> For the complete documentation index, see [llms.txt](https://docs.emudhradigital.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.emudhradigital.com/documentation/what-is-esign.md).

# What is eSign

**eSign** is an online electronic signature service notified under the Second Schedule of the Information Technology Act, 2000 and the *Electronic Signature or Electronic Authentication Technique and Procedure Rules, 2015*. It lets an application request a legally valid digital signature for a user without the user holding a USB token or a pre-issued Digital Signature Certificate (DSC).

## The problem eSign solves

A conventional DSC requires the subscriber to apply to a licensed CA, complete identity verification and keep the private key on a cryptographic token. That is reliable but does not scale to millions of citizens and customers who need to sign one form, once.

eSign replaces that with:

1. **Online identity verification** — the user is authenticated against an eKYC source (Aadhaar online eKYC, or an eKYC account held with the CA).
2. **On-the-fly key and certificate** — the ESP generates a fresh key pair in an HSM and the CA issues a short-lived DSC carrying the eKYC identity.
3. **Hash signing** — only the document hash leaves the application; the document itself is never sent to the ESP.
4. **Key destruction** — for one-time eSign, the private key is destroyed immediately after use.

## Key characteristics

| Characteristic           | Description                                                                              |
| ------------------------ | ---------------------------------------------------------------------------------------- |
| Legally recognised       | Equivalent to a handwritten signature for permitted transactions under the IT Act.       |
| Privacy-preserving       | The ESP sees only the SHA-256 hash and a short document description (max 50 characters). |
| Consent-driven           | The user explicitly consents to identity verification, DSC issuance and signing.         |
| Short-lived certificates | One-time eKYC class DSCs are valid for not more than 30 minutes.                         |
| Auditable                | Every transaction is logged by the ESP and CA and retained for 7 years.                  |
| API based                | Applications integrate through standard XML APIs over HTTPS published by CCA.            |

## Variants

| Variant            | Identity source                                              | Authentication                                | Key lifetime                |
| ------------------ | ------------------------------------------------------------ | --------------------------------------------- | --------------------------- |
| eSign v2           | Online Aadhaar eKYC (UIDAI)                                  | OTP, fingerprint, iris, face                  | One-time                    |
| eSign v3           | CA eKYC account (offline Aadhaar, PAN, bank, organisational) | PIN + second factor                           | One-time                    |
| Remote Key Storage | CA eKYC account                                              | AuthPIN (in HSM) + application authentication | Long-term (default 2 years) |

**Remote Signing (Document Signer)** is a related service for organisational, unattended signing and is not an "eSign" in the CCA sense — it uses a conventional organisational Document Signer certificate hosted in an eMudhra HSM.

## Typical use cases

* Account opening, loan and credit card applications, mandates and KYC forms
* Insurance proposals and policy documents
* Employee onboarding, offer letters and HR declarations
* Government applications, tax filings and certificates
* Purchase orders, invoices, vendor and customer agreements
* Intra-office approvals and note sheets