Subject: The EU Signature Directive - A 15+15 Year Perspective

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 18 Nov 2008 11:37:39 +0100

Some 15 years ago the EU launched a signature directive.  This posting tries to describe the consequences of this directive with respect to usage of PKI.

Primary Motivation

There are a number of processes needing a human-written signature in order to fulfill legal requirements.

Some of these processes could without doubt be possible to carry out electronically and thus also remote over a network, if there was some kind of technology available that could serve as a replacement for a hand-written signature.

The Solution

Right or wrong, digital signatures using PKI were considered as a viable alternative.  To make PKI a credible solution, the EU signature directive added a number of requirements including characteristics of the signature creation device and policies for CAs.

Current Deployment

Apart from Qualified Certificates which (for reasons too diverse for describing in an email) have not become truly mainstream, the EU signature directive have indeed in local legislations made it possible to perform fairly qualified tasks remotely over the Internet.  I.e. the directive has functioned as an ENABLER.

Then Something Went Wrong...

Unfortunately, a few (but influential) people got a bit carried away and interpreted the signature directive in way that has severely hampered the use of PKI.  Essentially they began claiming that all messages in order to be trustworthy should be signed by a qualified signature or at least by a digital signature created under the direct control a human being.

>From a 50000 ft perspective this may sound like a great idea, but the fact is that decades before the signature directive was conceived; yes, even before PKI was invented, the concept of secure messaging actually existed.  Back in those days secure messaging was facilitated through the use of leased lines which allowed banks (and some early b2b networks), to securely exchange transaction messages in a completely automated fashion.

An example:  If you want to wire-transfer money from your bank to another bank, the way the transfer is initiated (phone, paper, on-line, etc) has no impact on the transaction messaging because it is performed in a transaction network that neither the customers, nor most of the staff have direct access to. 

That such networks have proved to be secure, reliable, cost-efficient, and sometimes even globally scalable, apparently did not impress the bunch of hard-core signature experts who for example in Germany managed to make PKI a DISABLER by outlawing non-human digital signatures on invoices.  That German paper-invoices do not even require signatures makes this position a true mystery.

One had hoped that this would be an exception to the rule but it is not; If you scan sites like NIST.GOV, CIO.GOV, and GSA.GOV you'll find literally thousands of security-related documents, indeed in a few places mentioning PKI, but mostly full of government regulation abbreviations like FISMA, giving little if any guidance on how to create secure messaging between agencies, not to mention between agencies and the private sector.

I'm happy to see that the Nordic countries plus Estonia have realized that all signatures that can be securely bound to an entity (in practice) are legally binding, in the extremely rare case somebody would actually repudiate a signed invoice.   These governments have all (and independently of each other) created local variants of a scheme that I have described in:
http://webpki.org/papers/web/gateway.pdf
which could be characterized as a 21st century version of leased lines for multi-party automated secure messaging.

It will probably take another 15 years for this concept to achieve general acceptance although it is really (if you look closely) very similar to the US e-Authentication scheme, they have just not connected the dots yet: A SAML assertion and an server-signed invoice from a specific entity are essentially only different in content, not in trustworthiness.

Anders Rundgren
http://WebPKI.org

---

From: Juergen Brauckmann <[email-masked]>
Date: Tue, 18 Nov 2008 12:56:01 +0100

Anders Rundgren wrote:
> hard-core signature experts who for example in Germany managed 
> to make PKI a *DISABLER* by outlawing non-human digital signatures on 
> invoices.  That German paper-invoices do not even require 
> signatures makes this position a true mystery.

It is my understanding that requiring qualified digital signature on 
invoices is targeted against VAT refund fraud.

Actually there are several products and services that you can buy to 
automate qualified signature creation; google shows you some of them if 
you ask for "signature server".

Jürgen

---

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 18 Nov 2008 14:35:24 +0100

Hi Juergen,

Should I interpret your response like following?  In Germany you can buy special equipment or services in which a company official (CFO?) puts another instance of his/her smart card, and then this card is used to automatically sign outgoing invoices that this card-owner typically has neither seen nor have direct control of, including when he or she is at home sleeping?

This is sometimes referred to as the "hostage" PKI solution and must be one of the most flagrant examples of "pushing the envelope" ever heard of, since this scheme obviously was not the intent with the EU signature directive.

Anders Rundgren

----- Original Message ----- 
From: "Juergen Brauckmann" <[email-masked]>
To: "Anders Rundgren" <[email-masked]>
Cc: <[email-masked]>
Sent: Tuesday, November 18, 2008 12:56
Subject: Re: The EU Signature Directive - A 15+15 Year Perspective

Jürgen

---

From: Patrick Patterson <[email-masked]>
Date: Tue, 18 Nov 2008 09:27:22 -0500

Hi Anders:

On November 18, 2008 08:35:24 am Anders Rundgren wrote:
> Hi Juergen,
>
> Should I interpret your response like following?  In Germany you can buy
> special equipment or services in which a company official (CFO?) puts
> another instance of his/her smart card, and then this card is used to
> automatically sign outgoing invoices that this card-owner typically has
> neither seen nor have direct control of, including when he or she is at
> home sleeping?
>
Just how is this different from the signature printers that are used on all 
cheques issued by larger companies? Or the signature stamp that has been in 
use by accounting departments for at least a century?

> This is sometimes referred to as the "hostage" PKI solution and must be one
> of the most flagrant examples of "pushing the envelope" ever heard of,
> since this scheme obviously was not the intent with the EU signature
> directive.
>
No, this is business reality - one needs an "officer of the company" to sign 
documents (be they cheques, invoices, purchase orders, etc.), and no company 
over a couple of hundred employees is going to make their CFO and COO sit 
down and spend their days signing documents. They will use either the printed 
(or stamped) equivalent of their handwritten signature, or the PKI 
alternative.

As long as the use of these signatures is controlled by policy, and is 
accountable, then just because it isn't a "pure" implementation, doesn't mean 
that it isn't valid.

As an aside, this is one of the reasons that in the Aerospace industry, we're 
working on the concept of "Organisational" certificates (PKI analog to the 
corporate seal). It neatly side-steps the mental block that some people have 
regarding "one person, one key", and allows anyone who is authorised to "sign 
on behalf of the company" to use the PKI based corporate seal.

-- 
Patrick Patterson
President and Chief PKI Architect,
Carillon Information Security Inc.
http://www.carillon.ca

---

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 18 Nov 2008 18:55:57 +0100

Hi Patrick,

<snip>

>corporate seal).

That's interesting and VERY GOOD news!  I thought the Aerospace industry spent their PKI money on [IMO] rather awkward Bridge CA stuff like http://certipath.com which I consider the opposite to Organizational certificates since Bridge CAs is typically rather about extending the reach of (existing) employee certificates.

>It neatly side-steps the mental block that some people have regarding  
>"one person, one key", and allows anyone who is authorized to "sign 

Apart from possible mental blocks, there are other quite down-to-earth hurdles as well:
  a.. Employees come and go => Your "digital handles" to other companies easily get invalid
  b.. How do you automatically and securely correlate a company identity as expressed in business messages with a PKI-based employee identity, and preferably make that scale a few blocks from of your own backyard?
  c.. That VeriSign's SSL PKI reaches out over the entire globe, while employee PKIs (be it PIV or just your local stuff) typically is unknown at 99.99% of all places, indicates that the employee PKI model suffers from pretty serious trust establishment issues
  d.. Privacy concerns.  Who (in the organization) actually orders goods is not necessarily something the seller needs to know.  In fact, employment is not public information
Regarding who is authorized "to sign on behalf of the company", I believe that such certificates should only to be used for secure messaging which means that they are installed in gateway servers and/or information systems.  The purpose of such signatures is supporting authenticity and message integrity, while "consent" and "authorization" are things that typically stay inside of the company.  This is at least how bank transaction networks operate.

In addition, company certificates open the road for even more sophisticated security schemes which I have briefly covered on the last page of:
http://webpki.org/papers/web/gateway.pdf

Regards
Anders Rundgren
http://WebPKI.org

---

From: Patrick Patterson <[email-masked]>
Date: Tue, 18 Nov 2008 16:49:27 -0500

On November 18, 2008 12:55:57 pm Anders Rundgren wrote:
> Hi Patrick,
>
> <snip>
>
> >As an aside, this is one of the reasons that in the Aerospace industry,
> > we're working on the concept of "Organisational" certificates (PKI analog
> > to the corporate seal).
>
> That's interesting and VERY GOOD news!  I thought the Aerospace industry
> spent their PKI money on [IMO] rather awkward Bridge CA stuff like
> http://certipath.com which I consider the opposite to Organizational
> certificates since Bridge CAs is typically rather about extending the reach
> of (existing) employee certificates.
>
Well, I'll let Santosh ring in on this if he wants, but the I can say that 
most of the companies with which I am familiar have had to implement or beef 
up their "existing" PKI infrastructures to comply with the much more rigorous 
and standardised requirements of joining the Bridge, thus facilitating, 
within the community at least, the establishment of Trust "more than a few 
blocks away from your own backyard" :)

> other companies easily get invalid 

That is why the Corporate Seal (you know - the one that is a physical piece of 
hardware, is kept in a safe, and is only let out by the corporate lawyers for 
defined and logged purposes) is a usefull concept to translate into the 
Digital Credential (read PKI) realm. Since the Certificate is issued to the 
corporate legal body, and not any particular physical person, it doesn't 
suffer from the same problems as "personal" certificates.

> b.. How do you automatically and 
> securely correlate a company identity as expressed in business messages
> with a PKI-based employee identity, and preferably make that scale a few
> blocks from of your own backyard? 

Is this is somewhat dependant on both the messaging format, and the trust and 
policy infrastructure that you place on the Organisational issuing practices? 

Not to get into any dogmatic debates, but by leveraging the Bridge within the 
community, we believe that this can allow the trust in the Org certs to be 
validated to quite a rigorous level.

> c.. That VeriSign's SSL PKI reaches out 
> over the entire globe, while employee PKIs (be it PIV or just your local
> stuff) typically is unknown at 99.99% of all places, indicates that the
> employee PKI model suffers from pretty serious trust establishment issues

Ok - now you're tickling one of my favourite points of discussion. The entire 
idea behind the PKI framework being worked on within the Aerospace industry 
is that it is meant to be only for within the industry. As I tell my clients, 
if you want a certificate for a web portal that is B2C focused (i.e.: for 
John Q. Public to access and interact with) then buy a Verisign (or 
equivalent) SSL certificate. If you want a certificate for 
inter-industry "closed community" collaboration (B2B within the closed 
community that is an aerospace program or project), then use a certificate 
from a CA that is cross-certified with CertiPath. Within the industry, we 
have worked out solutions for trust anchor establishment (although if more 
people did PDVAL correctly, it would make it even easier:), so we're not 
interested in propagating each individual companies CA Trust Anchor to 
millions of non-affiliated entities. In the ideal case (where the platforms 
that we work on do PDVAL correctly), each company would only propagate it's 
own trust anchor to its internal systems (trivial with such mechanisms as AD 
group policies), and let the pdval tools do their jobs when presented with 
a "external" certificate. If that external cert can "cross the bridge", then 
we're fine. If it can't, then don't trust it.

> d.. Privacy concerns.  Who (in the organization) actually orders goods is
> not necessarily something the seller needs to know.  In fact, employment is
> not public information Regarding who is authorized "to sign on behalf of
> the company", I believe that such certificates should only to be used for
> secure messaging which means that they are installed in gateway servers
> and/or information systems.  The purpose of such signatures is supporting
> authenticity and message integrity, while "consent" and "authorization" are
> things that typically stay inside of the company.  This is at least how
> bank transaction networks operate.
>

Ok - we've got a slightly different view on this point - the precise point of 
Org certs is to act as the digital equivalent of the corporate seal, which is 
the legacy mechanism for engaging the corporation in some sort of contract, 
liability, or promise - eg.: Signature.

The way that I see it, the EV SSL certs that are currently being espoused 
today are probably sufficient to convey the identity assurance that would be 
required for gateway messaging servers - for us to develop an industry 
specific solution that would compete with this would subject us to precisely 
the concerns that you had in b) and c).

> In addition, company certificates open the road for even more sophisticated
> security schemes which I have briefly covered on the last page of:
I've not read your paper yet, but I'll add it to my list :)

---

From: Stefan Santesson <[email-masked]>
Date: Tue, 18 Nov 2008 22:41:47 +0000

Anders,

On the factual side, the EU signature directive was adopted 1999, which is 9 years ago and not 15.
Further, the primary function of the EU directive was to establish that no signature should be denied legal value solely because it was not based on a certain technology or met certain standards. The article 5 signature (often referred to as qualified signatures) are just a level of security that all member countries MUST accept as equivalent to hand-written signatures. I certainly agree that the content and intention of this directive has been highly misunderstood.

The requirements on electronic invoicing comes from a totally separate directive.

However, I lack any specific technical proposal for this working group to consider in your e-mail.
In absence of such proposal, your mail appears to me more as a political manifesto.

Stefan Santesson
Senior Program Manager
Windows Security, Standards

From: [email-masked] [mailto:[email-masked]] On Behalf Of Anders Rundgren
Sent: den 18 november 2008 04:38
To: [email-masked]
Subject: The EU Signature Directive - A 15+15 Year Perspective

Primary Motivation

The Solution

Current Deployment

Anders Rundgren
http://WebPKI.org

---

From: Stephen Wilson <[email-masked]>
Date: Wed, 19 Nov 2008 11:23:47 +1100

Anders Rundgren wrote:
> 	... VeriSign's SSL PKI reaches out over the entire globe, while
>       employee PKIs (be it PIV or just your local stuff) typically is
>       unknown at 99.99% of all places, indicates that the employee PKI
>       model suffers from pretty serious trust establishment issues

This is another red herring.  It tells us nothing true or deep about the 
effectiveness of individual certificates.  The fact that employee PKIs 
don't have global reach is hardly surprising.  To begin with, global 
recognition of *employees* outside the enterprise is not usually 
important!  Look at the J&J corporate PKI; seems to be working great 
with 100,000+ individuals.

But more importantly, successful PKIs are always application specific. 
[BTW the application-specificity of SSL server certificates is really 
one of their most salient features, but almost always overlooked when 
people try to draw lessons form SSL's success!]  The reach problem that 
so concerns Anders is really only a matter of root key distribution. 
With application specific PKI, where 9 times out of 10 the transacting 
parties run special software (healthcare apps, conveyancing, trade 
documentation management, Skype etc etc), root key distribution is 
trivial.

Cheers,

Steve Wilson.

Managing Director
Lockstep Technologies

Phone +61 (0)414 488 851

www.lockstep.com.au/technologies
-------------------
  * ABC TV 'The New Inventors' Nov 2008
  * Global Security Challenge Asia Top Five 2008
  * Australian Technology Showcase 2008
  * AusIndustry COMET Grant 2007
  * ICT Secrets of Innovation Finalist (Security) 2007
  * Anthill / PwC Cool Company Finalist (Innovation) 2007
-------------------
Lockstep Technologies develops unique new smart ID solutions to
safeguard identity and privacy. Lockstep Consulting provides
independent specialist advice and analysis on authentication, PKI
and smartcards.

---

From: Patrick Patterson <[email-masked]>
Date: Tue, 18 Nov 2008 16:49:27 -0500

---

From: "Anders Rundgren" <[email-masked]>
Date: Wed, 19 Nov 2008 23:09:48 +0100

Hi Stefan,
You're right, I screw up the adoption year.

Regarding the motives behind this and that for e-invoices I'm not able to tell because it is simply not decodable based on for example the German "solution" depicted a few postings ago.

Is this political manifesto? Well, that depends on what you mean with political :-)

What does S/MIME bring me using Windows Mail except for a black screen telling that there is a security problem with this message, compared to unsigned messages encouraging me to download coolpicture.exe which is treated as secure mail?  Of course Microsoft can add yet-another-impossible-to-understand-by-ordinary-humans-security-setting, but I don't think it will help much because S/MIME is based on an inferior security architecture (which in fact is the indirect reason to why I got the coolpicture.exe message as well).

Isn't somewhat funny that the scheme I described some 10 years ago (server-signed assertions), which roughly 100% of the PKIX list slammed as a bad idea, actually is one of the corner-stones of Microsoft's brilliant CardSpace technology?

Both of these things are in turn is highly related to the undisputed fact that the US government doesn't have a documented architecture for secure messaging between agencies of the kind that is slowly but surely becoming standard in the EU.

Is there something for PKIX to cater for here?  It seems that most PKIX folks prefer dealing with rather esoteric stuff
http://www.ietf.org/proceedings/08nov/agenda/pkix.txt
than for example digging into the realities of large-scale consumer/citizen PKIs of the kind used in Europe.  I'm currently implementing the PKI for Web 2.0 framework in Google's Android because I think the route Microsoft selected for CardSpace (first code + preliminary specs, then standards) is a better mousetrap.

Regards
Anders Rundgren

  ----- Original Message ----- 
  From: Stefan Santesson 
  To: Anders Rundgren ; [email-masked] 
  Sent: Tuesday, November 18, 2008 23:41
  Subject: RE: The EU Signature Directive - A 15+15 Year Perspective

  Anders,

   

  Stefan Santesson

  Senior Program Manager

  Primary Motivation

  The Solution

  Current Deployment

  Anders Rundgren

  http://WebPKI.org

---

From: "Anders Rundgren" <[email-masked]>
Date: Fri, 21 Nov 2008 09:51:58 +0100

Stephen,
I completely agree with your view regarding the value and use of community
or app-specific PKIs.

However, one of the applications that caught my interest, secure messaging
over the Internet doesn't fit very well into the categories you are mentioning,
with S/MIME as the primary example.  That a bunch of people insist signing
their mails to this list using PKIs that hardly any of the recipients recognize,
is an indication that the concepts "community-scale security solution" versus
"Internet-scale security solution" still are largely unknown.

That this knowledge deficit has limited impact on "nerdy" mailing lists like
IETF-PKIX is for sure.   However, for governments it is not equally easy.

Anders

----- Original Message ----- 
From: "Stephen Wilson" <[email-masked]>
To: "Anders Rundgren" <[email-masked]>
Cc: <[email-masked]>; <[email-masked]>
Sent: Wednesday, November 19, 2008 01:23
Subject: Re: The EU Signature Directive - A 15+15 Year Perspective

Cheers,

Steve Wilson.

Managing Director
Lockstep Technologies

Phone +61 (0)414 488 851

---

From: Stephen Wilson <[email-masked]>
Date: Fri, 21 Nov 2008 20:13:14 +1100

In my view, S/MIME e-mail is a very generic application.  It does fit 
well my analysis of application-specific versus generic, and I think it 
is actually predictable that S/MIME on its own would be difficult and 
not very beneficial.

In an open community, one stranger sending a signed e-mail to another is 
very closely analogous to sending a plain paper fax with a handwritten 
signature on the bottom.  If you weren't expecting it, and you didn't 
recognise the sender, you would probably throw such a fax into the 
trash.  The idea that a receiver would be interested enough to examine 
the certificate and even read the sender's CA's CP was always fanciful.

So, S/MIME on its own is not terribly useful in business.  [Whether 
someone signs their e-mail to this list is really immaterial; most of us 
recognise one another, and in any case the communications are not 
critical, so authentication is moot.  Frankly I don't know why anyone 
would bother signing their e-mails, I assume it's habit, and/or a default.]

And so S/MIME it was never pushed hard.  The infrastructure and 
interoperability challenges, while significant, would not have been 
insurmountable, provided there was sufficient demand to solve them. 
There wasn't, so they weren't.

There are all sorts of ways to realise "electronic messaging" and S/MINE 
is just one.  I presume that most defence forces have good electornic 
messaging systems.  Some messaging solutions would sensibly use digital 
signatures and certificates; others might not need to.

Meanwhile, there are inumerable other e-business applications separate 
over and above 'messaging;, where PKI is delivering great benefits.

So I still don't think that anyone should fixate on messaging as a 
keystone application of PKI.  The experience of messaging is not an 
accurate baromoter of the fortunes of PKI.

Cheers,

Stephen Wilson.

---

From: "Anders Rundgren" <[email-masked]>
Date: Fri, 21 Nov 2008 13:19:56 +0100

Stephen,

>There wasn't, so they weren't.

I don't really see that there actually could be an economically, politically,
and technically realistic way making a user-based authentication, signing or
encryption solution work outside of a limited community.

Anyway, since S/MIME is pretty much a relic, when I talk about secure
messaging I refer to web services.

I may indeed be "obsessed" with secure messaging, and I do see some
progress in Europe where "PKI-lite" schemes are getting some traction.
The US seems to forever be stuck in the architecture once raised by the
federal government which is a very expensive and slow path to secure
messaging.  To get an Org (legal entity)-cert in the EU is a $300 thing,
while the cost of getting cross-certified with the FBCA ( http://www.cio.gov/fpkipa )
is prohibitive for all but pretty large organizations.

Germany (of course...) tries hard to get the EU countries lining up for
an EU BCA ( http://www.bridge-ca.de ), but I think they begin to see
that this will not be as easy as planned, since the alternative is cheaper,
faster, and integrates nicely with just about any "business" process you
can think of.

I don't know what they are doing "Down Under" but if you have a link
or two, I would appreciate it.

Anders

---

From: Timothy J Miller <[email-masked]>
Date: Fri, 21 Nov 2008 08:17:02 -0600

On Nov 21, 2008, at 3:13 AM, Stephen Wilson wrote:

> In an open community, one stranger sending a signed e-mail to  
> another is very closely analogous to sending a plain paper fax with  
> a handwritten signature on the bottom.  If you weren't expecting it,  
> and you didn't recognise the sender, you would probably throw such a  
> fax into the trash.  The idea that a receiver would be interested  
> enough to examine the certificate and even read the sender's CA's CP  
> was always fanciful.
>
> someone signs their e-mail to this list is really immaterial; most  
> of us recognise one another, and in any case the communications are  
> not critical, so authentication is moot.  Frankly I don't know why  
> anyone would bother signing their e-mails, I assume it's habit, and/ 
> or a default.]

Since it's my ears burning, I'll say it's both habit and default.  :)   
Apple Mail is my main MUA; it handles S/MIME settings on a "last set  
is next default" basis.  So if I sign an internal mail--and typically  
have reasons to do so--the next mail will default to signed.  TB is  
the other MUA I use relatively frequently, and it makes it unintuitive  
enough to change S/MIME options on any single email that I've set  
signed as the default.

On the other hand I neither expect nor assume that people will accept  
or install trust in the MITRE PKI just because I'm signing mail to a  
list.  But the integrity functions of S/MIME are unimpaired and IMHO  
as important as the authentication and confidentiality functions.

> accurate baromoter of the fortunes of PKI.

However, it's been my experience that S/MIME is the flagship PKI  
application *from a typical user's perspective.* In the environment I  
support users see and use it every day, even more than PKI authN to  
web services or even Kerberos PKINIT.  When I say "PKI" to a group of  
users, the response I get is "email"--and that's after years of  
training (though the high turnover rate of some of my user population  
doesn't help here).

And it's the application that causes the most pain and suffering.

-- Tim

---

From: "Timothy J Miller" <[email-masked]>
Date: Fri, 21 Nov 2008 17:21:09 +0100

>as important as the authentication and confidentiality functions.

I could if I had spent some 20 extra minutes, created a certificate that
would be "visually" indistinguishable from your MITRE PKI certificate.
With that I would like to say that integrity without authentication doesn't
buy that much.

[email-masked] impersonating [email-masked] which was
piece of cake since secure Internet mail is a joke.  Although I personally
do not laugh...

Naturally my ISP should have authenticated me and only let me use one
of the e-mail addresses I have registered, but it didn't since there is no
point in doing that because the rest of the security architecture is broken.

Anders-as-Tim

---

From: Peter Sylvester <[email-masked]>
Date: Fri, 21 Nov 2008 18:04:24 +0100

There are some firewalls that doesn' like things like:

X-Authentication-Warning: balder-227.proper.com: majordom set sender to [email-masked] using -f

I don't know whether it is intended that majordom is not a trustworthy
entity to the local mail daemon.

---

From: [email-masked] (Peter Gutmann)
Date: Sat, 22 Nov 2008 22:07:52 +1300

Juergen Brauckmann <[email-masked]> writes:

>Actually there are several products and services that you can buy to automate
>qualified signature creation; google shows you some of them if you ask for
>"signature server".

>From talking to someone who's endured this in Germany, the only reason the
services exist is that you're paying them to bypass Anders' PKI-disabler for
you (either that or you exploit loopholes in the requirements, I can't
remember the precise details because they were pretty obscure but there are
tricks around using PDFs as electronic documents to meet the filing
requirements but having them in printed form to meet the archiving
requirements, and other odds and ends).

The system (without using the loopholes) required that not only do you need to
carry out a complex signing ritual but you have to verify cert chains and
CRLs, and then the certs expire so you need timestamping and secure archiving
of the fact that you've verified everything (when he described this to me I
had to keep stopping him to verify things because it sounded like a
description of a pathological torture test that someone had invented as sort
of obstacle course for businesses, but he claimed this wasn't a worst-case
scenario but something that everyone was expected to do).

So it's created a great business model in that you can outsource the pain to
companies that have sprung up to service the market, but first hobbling
businesses and then saying you have all these great new services that take the
hobbles away seems pretty counterproductive unless you happen to be in the
signature services racket.

Peter.

---

From: [email-masked] (Peter Gutmann)
Date: Sat, 22 Nov 2008 22:11:32 +1300

"Anders Rundgren" <[email-masked]> writes:

>This is sometimes referred to as the "hostage" PKI solution 

Ahh, I knew there must be some name for it :-).

>and must be one of the most flagrant examples of "pushing the envelope" ever
>heard of, 

>From talking to the person who'd had experience with this, and in particular
the totally unnatural business model it was creating, it certainly sounded
exactly like a hostage PKI.

Peter.

---

From: "Jorge López" <[email-masked]>
Date: Sat, 29 Nov 2008 16:44:43 +0100

Hi all,
In Spain, we are (un)fortunatelly one of the few countries that have moved
the EU Directive on Electronic Signatures to a National Law. Now, users own
insecure tools to create non-repudiable and legally-binding e-signatures.
What is going on with current business model? Do the users have to cope with
the legal consequences of a signature created on their behalf, just because
a cryptographic validation of a set of bits says that?

The purposes derived from a handwritten signature have been directly
translated to the digital realm by means of PKI and cryptography. However,
the conditions and threats under which a signature is generated in the
digital realm are obviously far away from those of the physical realm. IMHO,
the main reason that make current business model fail is precisely the
uncertainty that end users have respecting the actual security of
PKI-enabled applications and the founded "legal support".

Regards,

Jorge L. Hernandez-Ardieta

2008/11/18 Anders Rundgren <[email-masked]>

>  Some 15 years ago the EU launched a signature directive.  This posting
> tries to describe the consequences of this directive with respect to usage
> of PKI.
>
> *Primary Motivation*
>
> Some of these processes could without doubt be possible to carry out
> electronically and thus also remote over a network, if there was some kind
> of technology available that could serve as a replacement for a hand-written
> signature.
>
> *The Solution*
>
> Right or wrong, digital signatures using PKI were considered as a
> viable alternative.  To make PKI a credible solution, the EU signature
> directive added a number of requirements including characteristics of the
> signature creation device and policies for CAs.
>
> *Current Deployment*
>
> Apart from Qualified Certificates which (for reasons too diverse for
> describing in an email) have not become truly mainstream, the EU signature
> directive have indeed in local legislations made it possible to perform
> fairly qualified tasks remotely over the Internet.  I.e. the directive has
> functioned as an *ENABLER*.
>
> *Then Something Went Wrong...*
>
> Unfortunately, a few (but influential) people got a bit carried away and
> interpreted the signature directive in way that has severely hampered the
> use of PKI.  Essentially they began claiming that all messages in order to
> be trustworthy should be signed by a qualified signature or at least by a
> digital signature created under the direct control a human being.
>
> From a 50000 ft perspective this may sound like a great idea, but the fact
> is that decades before the signature directive was conceived; yes, even
> before PKI was invented, the concept of secure messaging actually
> existed.  Back in those days secure messaging was facilitated through the
> use of leased lines which allowed banks (and some early b2b networks), to
> securely exchange transaction messages *in a completely automated fashion*
> .
>
> An example:  If you want to wire-transfer money from your bank to another
> bank, the way the transfer is initiated (phone, paper, on-line, etc) has no
> impact on the transaction messaging because it is performed in a transaction
> network that neither the customers, nor most of the staff have direct access
> to.
>
> That such networks have proved to be secure, reliable, cost-efficient, and
> sometimes even globally scalable, apparently did not impress the bunch of
> hard-core signature experts who for example in Germany managed to make PKI a
> *DISABLER* by outlawing non-human digital signatures on invoices.  That
> German paper-invoices do not even require signatures makes this position a
> true mystery.
>
> One had hoped that this would be an exception to the rule but it is not; If
> you scan sites like NIST.GOV, CIO.GOV, and GSA.GOV you'll find literally
> thousands of security-related documents, indeed in a few places mentioning
> PKI, but mostly full of government regulation abbreviations like FISMA,
> giving little if any guidance on how to create secure messaging between
> agencies, not to mention between agencies and the private sector.
>
> I'm happy to see that the Nordic countries plus Estonia have realized that
> all signatures that can be securely bound to an entity (in practice) are
> legally binding, in the extremely rare case somebody would actually
> repudiate a signed invoice.   These governments have all (and independently
> of each other) created local variants of a scheme that I have described in:
> It will probably take another 15 years for this concept to achieve general
> acceptance although it is really (if you look closely) very similar to the
> US e-Authentication scheme, they have just not connected the dots yet: A
> SAML assertion and an server-signed invoice from a specific entity are
> essentially only different in content, not in trustworthiness.
>
> Anders Rundgren
> http://WebPKI.org
>
>
>