Subject: Re: Signature types

From: Ian G <[email-masked]>
Date: Sat, 27 Aug 2005 17:24:00 +0100

Daniel A. Nagy wrote:
> It's actually RFC1991 that got me wondering:
> 
>      <40> - time stamping ("I saw this document") (*)
>   ...                                          Type <40> is intended to
>   be a signature of a signature, as a notary seal on a signed document.
> 
> Now, this is contradictory. If a signature does not have any cryptograpic
> binding (except the indirect one through the other signature) to the
> document, it cannot be used to assert the integrity thereof.
> 
> Someone with the public key of the notary cannot verify this claim. Also, it
> makes a lot of sense to certify documents that have not been signed.

[snip]

>>        This signature is a signature over some other OpenPGP
>>	signature packet(s). It is analogous to a notary seal on the
>>	signed data.
> 
> 
> Except that if it's a signature on the signature, then it cannot be
> analogous to a notary seal on the signed data (see above).

One of the difficulties that may be occuring here
is that the word 'notary' has different meanings
in civil and common law contexts.  In the former,
a notary is likely to be interested in the content
of the signed data;  whereas in the latter, the
notary is normally only interested in the quality
of the signature, and not the data.

We had a long threat on this about a year ago, and
I believe some changes were made disambiguate ..

I think the context that the Draft uses the word
notary is more towards the common law case of just
the signature and not the data that is signed.

iang