Subject: RE: Digital Signatures - Legal Advice Wanted

From: "Heimberg, Jim" <[email-masked]>
Date: Mon, 07 Aug 2000 14:43:26 -0400

Just to add to the confusion, is there no allowance for designating the
personality as the role that person fills?  For instance, if you wanted as a
CA to grant a signature and encryption key and the requisite authority to
the Chief Financial Officer of a small company (e.g., Acme Electrical
Supply) for purchasing as required, why can you not issue a certificate to
[email-masked] (and if you need to personalize it, you could add the
person's name or initials after the CFO designation)?

-----Original Message-----
From: Tony Bartoletti [mailto:[email-masked]]
Sent: Monday, August 07, 2000 2:21 PM
To: Adrian McCullagh; 'Anders Rundgren'; PKIX-List
Subject: RE: Digital Signatures - Legal Advice Wanted

At 07:00 AM 8/7/00 +1000, Adrian McCullagh wrote:

>In Common law countries like the USA, Australia, UK and Canada, there
>is a doctrine known as ostensible authority.  This provides that if a
>person signs a document on behalf of another legal entity (the
>principal) and the signer has some external reasonably perceived
>authority such that a reasonable person looking at the transaction
>objectively would believe that such person through his/her position
>had such authority to bind the principal then the principal is bound
>by the signers action.
>
>So as I see it, a director could digitally sign the digital document
>using the directors own personal private key and as part of the text
>of the document state the following word "signed for and on behalf of
>Company XXXX".  This would indicate to the world that the signer is
>NOT signing the digital document so as to be personally bound but is
>signing as an agent and as such is attempting to bind the principal
>(company).

(Please correct me, Anders, if I am mistaken, but) I believe the
issue is a little different than Adrian supposes.

Rather than have a (company) individual sign on behalf of
"the company", I believe that the issue is whether a company
(ok, an individual acting on behalf of the company if you must)
can hold "customer's keys" and apply "customer's signatures",
given some trail of evidence that the customer, on a case-by-
case basis, has authorized that their signature be affixed to
a given transaction.

The primary goal being to keep the customer's "secret keys"
in an environment more secure than the customer may be expected
to maintain.

(The legal precedent for this might be "power of attorney"?)

If I'm wrong ... nevermind :)

___tony___

>The recipient would on receipt verify the digital signature using the
>signer's personal certificate that has the public key embodied in it.
>If the recipient is concerned about the authority then the recipient
>can check the company records to determine if the signer has the
>necessary implied/ostensible authority.   To accelerate the process of
>verification of authority there may be some solution in the use of
>role based certificates or attribute certificates but I have not
>really give this issue sufficient thought.
>
>If there is still some doubt then the recipient can always check with
>the Company secretary or the Managing director as to such authority.
>
>The Uniform Electronic Transactions Act that is forming part of the
>Uniform Commercial Code of various US States does anticipate software
>agents and thus server based organisation digital signatures.
>
>But there are no cases that specifically deal with your issue.
>
>The simple solution is for a company officer to digitally sign the
>digital document and affix the words noted above in the text prior to
>digitally signing.
>
>I hope this is helpful.
>
>
>Adrian McCullagh
>Director of Electronic CommerceTel: 617 3231 1522
>Gadens Lawyers                      Fax: 617 3229 5850
>level 39
>Central Plaza 1
>345 Queen Street
>Brisbane Australia 4000
>
>Ph. D. Candidate
>Thesis "The Incorporation of Trust Strategies in Digital Signature
>Regimes for Elec. Comm."
>Information Security Research Centre
>Queensland University of Technology
>
>
>
>- -----Original Message-----
>From: Anders Rundgren [ mailto:[email-masked]]
>Sent: Monday, August 07, 2000 6:58 AM
>To: PKIX-List
>Subject: Digital Signatures - Legal Advice Wanted
>
>
>Hi,
>I am working with an e-commerce standard that features server-based,
>organization-signed orders.
>
>However, server-based, organization-oriented digital signatures do
>currently not, to the my knowledge,
>have explicit support in any legal system.  How to solve this?  One
>way (the current one) is to state
>in separate agreements between the trading partners, that you will
>stand by these signatures in court.
>
>I wonder if there could be a more general solution like: A company
>officer digitally signs (using a personal
>certificate), a document where he/she states that signatures
>associated with a certain trading partner
>certificate are to be considered as legally binding from the company's
>point of view.
>Such a document is preferably published on the company's home-page for
>easy reference.
>
>How does this sound in the ears of lawyers?
>
>regards
>Anders Rundgren
>
>
>
>-----BEGIN PGP SIGNATURE-----
>Version: PGP Personal Edition 6.0.2
>
>iQA/AwUBOY1FTJWt1NGjt4vzEQLdmACeJiR1FMKZ//6Mtfq+v5DfAGGo/q4AoJoM
>bWjrz+F/Xll2zwotTzuligVm
>=sEx7
>-----END PGP SIGNATURE-----

Tony Bartoletti 925-422-3881 <[email-masked]>
Information Operations, Warfare and Assurance Center
Lawrence Livermore National Laboratory
Livermore, CA 94551-9900

---

From: "Jeff Davis" <[email-masked]>
Date: Wed, 9 Aug 2000 11:52:44 +0100

Jim,

I agree with your point here.  If a person is given a certificate and
set of keys which can then be used to sign for  and on behalf of the
company then that should be binding against the company and not the
individual.  The DN should reflect the position of authority within the
company, including the individuals name for accountability etc.

When the person leaves the company the certificate gets revoked,
probably better than chopping off the hands of the person leaving!
 some people continue to recognise hand written signatures long after
their authority has expired ).

Cheers

Jeff Davis

----- Original Message -----
From: Heimberg, Jim <[email-masked]>
To: 'Tony Bartoletti' <[email-masked]>; Adrian McCullagh
<[email-masked]>; 'Anders Rundgren'
<[email-masked]>; PKIX-List <[email-masked]>
Sent: Monday, August 07, 2000 7:43 PM
Subject: RE: Digital Signatures - Legal Advice Wanted