Subject: [Cfrg] Is it possible to verify your own signature?

From: ngaga Gisse <[email-masked]>
Date: Tue, 24 Apr 2007 13:16:57 -0700 (PDT)

Hi,
  I am working on a security system for protecting electronic patient record (EPR). By EPR I mean the raw record, say record "M".
   
  In my system I propose both the doctor and the patient to sign the same EPR, i.e. the same medical record entry.
  The patient's signature is verified by himself while the doctor's signature is verified by a different entity, say the TTP for example. Doctors use a group signature scheme while patients user an ordinary forward signature scheme. This means the two signatures are on the same EPR, that is, they are tied together.  Any change of the EPR by either of the two can be detected.
   Finally, the patient encrypt the EPR using the key derived from the some secret signing parameters such that, later on,  the patient can derive the decryption key from the signature and the verification key. Note that, the signed and encrypted data is kept in the hospital.  In this way the verification key has  to be kept secret and known only to the patient.
  Notice that, the validity of the patient's signature depends on the validity of the doctors signature (the doctor does not have the decryption keys).
   
  Question: 1) Does this break the objective of signature schemes, that a signature of entity "A" should be verified by another entity "B"?
  2) Doesn't  the fact that doctors and patient's signatures are on the same document and that the doctor's  signature  is verified by a different entity hold the objective in 1)?
   
  I will appreciate if someone can give me some pointers to  papers on this problem.
   
  Thanks,
  Ngaga

---------------------------------
Ahhh...imagining that irresistible "new car" smell?
 Check outnew cars at Yahoo! Autos.

_______________________________________________
Cfrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/cfrg