Subject: RE: Current signature formats insufficient

From: Michael Zolotarev <[email-masked]>
Date: Thu, 13 Jul 2000 13:33:45 +1000

Tony,

A signature on the message serves two purposes:

A. to ensure the origin and integrity of the message - that the message came
from me, and it was not modified en-route.
B. to indicate that a signer was AWARE (!) of the content of the message.

The critical point is that my AWARENESS(!) of the content does NOT imply
that I agree or disagree with the message. This is a common mistake people
do.

If I wanted to stress out that I agree with what the message says, I'd need
to do the following:

Put a claim into the message, like "I, Michael Zolotarev, strongly agree
with that statement". That'd be enough, provided that the origin and
integrity of the message is ensured by MY signature.

Using a special key usage bit to specify your agreement is not very
practical. Why? You'd have to define the following set:

1. Strongly agree
2. Agree
3. Agree with reservations
4. Agree with a certain doubt

And so on. It is less a joke that you might think, really.

regards
M

---

From: "Simon McMahon" <[email-masked]>
Date: Thu, 13 Jul 2000 14:09:11 +1000

> 4. Agree with a certain doubt

Thats right - the content contains all the details about what and how much
committment is being made. The signature format is irrelevant accept that it
has to be validatable.

Simon.