Subject: RE: Current signature formats insufficient

From: Michael Zolotarev <[email-masked]>
Date: Thu, 13 Jul 2000 10:49:08 +1000

<< Simon, in case you need somebody to say something nice to you :) - I'm
fully agree with you. If you read my previous mail, you'll see that our
opinions are identical.>>

Now, back to the subject:

The discussion is trying to address a lot of  different issues at the same
time, and it's becoming a mess. Let me filter it out a bit.

Issue 1:
Existing 'typical' signing environment (i.e. OS, communication h/w, etc) and
its vulnerability in case of a hacker attack.

Issue 2:
A concern that a user does not always see what he/she signs.

Issue 3:
Potential use of biometrics to make signing more convenient and secure for
the end user.

Issue 4:
Existing legal framework, and its ability to accept a notion of
'non-binding' signature.

Issue 5:
Existing signature-associated structure and protocols, with regards to the
ability to express different attributes of signing environment.

Now, if you look at it calmly, you'll see that:
Issue 1 has got nothing to do with PKIX. We can talk about how easy it is to
hack WinNT, and for how much - but why on this list?

Issue 2 Has nothing to do with PKIX. The user does not always see what he
signs? - fine, come up with a device that shows (do not forget to implement
'do not show' tick box, ticked by default).

Issue 3 has very little to do with PKIX. It is of common interest, I
believe, but it is rather technological, then anything else. We had a
discussion about biometrics already, in lengths, in the qualified certs
thread.

Issue 4.
It is more a legal problem, then PKIX. And I'd better shut up on this one.
Hey, any lawyers out there? Tell us what you think, and please restrain
yourself from using harsh language.

Issue 5. The formats of the signature, algorithms, and protocols must be
considered with NO RELATIONS at all to the environment. We MUST abstract
aspects of signing from the details of platforms, UI and whatever else. We
should assume that the environment is solid, and that the only thing that we
have to protect is the signature itself. 

So, what are we left with? Do I hear "Can we make a signature to communicate
extra attributes"?

Yes, we can.

M

> -----Original Message-----
> From: Paul Koning [mailto:[email-masked]]
> Sent: Thursday, July 13, 2000 12:38 AM
> To: [email-masked]
> Cc: [email-masked]; [email-masked]
> Subject: Re: Current signature formats insufficient
> 
> 
> >>>>> "Simon" == Simon McMahon <[email-masked]> writes:
> 
>  Simon> Hi all, My 2c worth.
> 
>  Simon> You should look to the analog-signature as an analogy. It's
>  Simon> the content of what you sign that includes the terms and
>  Simon> therefore the extent to which the signer is bound. Carelessly
>  Simon> given signatures should be legally binding, otherwise
>  Simon> ignorance will be used as a defense for repudiation, and only
>  Simon> fraudulently or forcefully obtained signatues should be able
>  Simon> to be sucessfully repudiated by recourse to the law and
>  Simon> courts.
> 
> I think that's a fine analogy, and it also serves to illustrate the
> issue that Denis is concerned about.
> 
> With classic signatures, the norm is that you see what you sign.  (One
> exception is the standard story about the overworked executive who's
> handed a stack of 50 memos to sign, with little yellow tabs marking
> "here's the spot" and someone slips in a ringer.  Don't know how
> common that is outside novels.)
> 
> With digital signatures, the norm is that you have no idea.  As Denis
> mentioned, current smartcards have no way of showing you what you're
> signing.  If you use an application that signs things (like a mailer)
> the binding is a little better.  There you still have to trust that
> the text you entered is in fact what's being signed -- in other words,
> that the program is trustworthy, correct, and unsubverted by trojan
> horses.  One good reason for using PGP, because you can check this,
> unlike closed source mailers.
> 
> The new (USA) digital signature law scares me, because it makes no
> sense so long as digital signature mechanisms continue to provide no
> meaningful way for the user to know what is being signed.  
> 
> 	   paul
>

---

From: "P.J. Ponder" <[email-masked]>
Date: Wed, 12 Jul 2000 21:48:13 -0400 (EDT)

On Thu, 13 Jul 2000, Michael Zolotarev wrote:
< . . . . > 
> Existing legal framework, and its ability to accept a notion of
< . . . . > 
> yourself from using harsh language.

If you don't want to be bound, don't sign.  

If you can't see what you're signing, you're a fool to sign it.

I've eaten many a pizza delivered to the door, and never signed for one.

Signing for a package acknowledges that you have received the package, not
that the contents are what you ordered, or the right size or color or pin
configuration - just that the delivery person gave it to you and you
received it - sort of like a 'chain of custody' thing.  And that is
binding - you have attested to the fact that you received the package.

The idea of a non-binding signature seems implausible to me - why sign,
except to attest to something?  If you don't want to be bound, just don't
sign.

---

From: Tony Bartoletti <[email-masked]>
Date: Wed, 12 Jul 2000 19:01:40 -0700

>except to attest to something?  If you don't want to be bound, just don't

When communicating over a channel, there may be cases where your "signature"
key is employed in serving to tamperproof, or authenticate the data 
transmitted.
Although, strictly speaking, you are "attesting" that "you indeed sent that
piece of data (authentication)" or at very least attesting "my key came into
contact with that data", you may well want it understood that you may not
agree with what the content might imply, when interpreted semantically.

You might write me, saying "What was that statement you disagreed with
so strongly", and so I send it to you, signed so that you know I was the
one who sent it.  Can you turn around and now claim I agree with that
statement?

How does one convey the "level of attestation" intended by a signature?

It would be one matter if signatures were restricted to whole-documents
formed of complete sentences.  One could qualify a submission with
"I don't agree with this part".  But in protocols, signatures are often
formed over oddly-constructed pieces of data that (some fear) might
easily be taken out of context.

The "key-usage" bits are/were intended to help manage this situation.
(Or so I thought.)

___tony___

Tony Bartoletti 925-422-3881 <[email-masked]>
Information Operations, Warfare and Assurance Center
Lawrence Livermore National Laboratory
Livermore, CA 94551-9900

---

From: "Simon McMahon" <[email-masked]>
Date: Thu, 13 Jul 2000 12:23:58 +1000

Tom wrote :
>      Actually, the assurance indicator is put on by the smart card under
> conditions which the home PC cannot hack.  The more severe limitation
would
> naturally be on NR signatures without the indicator.
>
But the RP could only rely on the assurance indicator if the CA says so
which implies (to me) that the CA checked that signing equipment is
reliable. Only a CA can tell a RP what to trust and it does this with a
certificate.

P.S. Sorry but my last post didn't go to the list but Tom quoted it in his
reply.

> opinions are identical.>>

Gee thanks ;)

> [snip]

But should we ? I think signatures are fine the way they are.

You know, this sounds alot like the TSA signing key debate where the TSA
private key was being overloaded to sign time stamps and self-signed certs.
Its all about to overload keys or not to overload them. I guess this might
make a nice precedent.

IMO to allow a key intended for NR signatures to make non-NR signatures
creates an ambiguity that undermines the NR-ness of the NR signatures. Thats
bad ! Use a differnent key for your non-NR signatures. Non repudiation is
critical to PKI and too easy to break, or at least undermine to the point
where its too hard to enforce legally.

Simon.