Knowing who signs: levels of assurance.
Proofing, credential and authentication: three distinct moments, and a level that risk should decide.
Before asking how something gets signed, it is worth asking who is being asked to sign it. A signature that is technically flawless is of little use if the person who produced it is not who they claimed to be. That is why identity is the quiet foundation of any signing process, and also the point where the most improvisation happens.
Three moments that are often confused
Talking about "verifying identity" lumps together three different things, which happen at different moments and fail in different ways.
- Initial proofing. Someone demonstrates who they are: they present a document, it is compared with their face, an official registry is consulted. This happens once, when the person is enrolled or when a certificate is issued.
- The credential. As a result, the person receives something that represents them: a certificate, an account, an app tied to their phone, a chip based identity document.
- Authentication at signing. At the moment of signing, the person shows that they are the one who controls that credential: a password, a code, a fingerprint, a second factor.
A process can be very demanding at one moment and very weak at another. A certificate issued after rigorous in person verification loses much of its value if it is then protected by a password anyone could guess.
The idea of levels
The most widely used reference frameworks agree on organizing trust into levels. The ISO/IEC 29115 standard of 2013 proposes four levels of assurance for authentication. The European eIDAS Regulation, through its Implementing Regulation 2015/1502, defines three: low, substantial and high. The digital identity guidelines published by the US National Institute of Standards and Technology, NIST SP 800 63, have separated the level of identity proofing from the level of authentication since their third revision in 2017, precisely so that the two are not confused.
Names and details vary from one framework to another, but the logic is the same: the higher the level, the harder it is for someone to impersonate another person, and the more it costs, in time and friction, to reach it.
Proportionality: risk decides the level
The most common mistake is choosing a single level for everything. If the maximum is required for every transaction, users drop out and shortcuts appear. If the minimum is used across the board, decisions that deserved far more get signed with nothing but an email address. The useful question is what would happen if the person signing were not who they claim to be.
| Situation | Potential harm | Reasonable identity |
|---|---|---|
| Accepting terms of use | Low | Control of an account or an email address. |
| Employment or services contract | Medium | A verified document and a second factor at signing. |
| Loan, power of attorney or sale | High | Identity proofed in person or by an equivalent method, and a high assurance credential. |
The ways to establish who someone is
- In person. The person appears before an agent with their identity document. This remains the benchmark against which every other method is measured.
- Remote, with document and face. The document is photographed, an image or video of the person is captured, and the two are compared. Its strength depends on detecting forgeries and impersonation attempts, an area where fraud evolves quickly.
- Chip reading. Many identity cards and passports carry a chip with data signed by the issuer, following the ICAO Doc 9303 specification. Reading it with a phone makes it possible to confirm that the document is authentic, something a photo cannot guarantee.
- Previously established identity. This relies on a verification someone else already performed: a national digital identity, a bank, a trust service provider.
- Assisted video. An operator guides the verification in real time. It adds human judgment, at a higher cost.
What the evidence must include
Whatever the level, the signing record must state which method was used to verify identity, when, with what result, and which credential was used to sign. A record that only says "identity verified" gives no one, years later, a way to judge how much that verification was worth.
- What level of identity does each type of document require, and who decided it?
- Is authentication at signing as strong as the initial proofing?
- Does the record capture the method used, not just the result?
- What happens when a method fails: does the process stop, or does it silently drop to a lower level?
Identity involves three moments: initial proofing, the credential, and authentication at signing. Reference frameworks organize them into levels of assurance, and the right level is determined by the harm an impersonation would cause. Whatever is done must be described in the evidence, including the method and not just the result.