Digital Signatures - Basic vs Medium Assurance

[Envelope3]

For those of you who use verifiable 3rd party Digital Signatures, are you opting for Basic Assurance or Medium Assurance? Basic Assurance uses 3rd party networks to verify that the document has not been tampered with. Medium Assurance also has the 3rd party show that the person who applied the certificate is who they say they are.

Obviously Medium Assurance is more expensive per year and it requires a few hurdles on the front end. Want to know if its actually required to do this extra work.

 

[Lomarandil]

Want to know if its actually required to do this extra work.

Depends (heavily) on your state/province/AHJ.

We've managed without using Medium Assurance so far except for I think British Columbia (and no active projects there, thank goodness).

 

[TLHS]

I'm confused by the distinction levels you've got there. The 'document hasn't been tampered with' is inherent to any digital signing. It wouldn't need a third party to validate that. If the signature is still there and there isn't any versioning tagged by the file format then it hasn't been modified. I can do that with a key I generate myself if I don't need to be able to prove that it's me specifically. The only value a third party has is assigning keys to individuals and being able to say that a person is connected to their key?

 

[Envelope3]

The difference between the two isn't the tampering thing, it's that the medium assurance lets the document receiver know that the name on the certificate is who he/she actually states. This is because medium assurance requires more documentation during the initial application process to obtain the certificate (ID's, notary, etc).