Subject: RE: Signing what you don't understand

From: Peter Williams <[email-masked]>
Date: Thu, 20 Jul 2000 19:51:31 -0700

http://www.verisign.com/press/2000/roaming.html

"VeriSign's revolutionary technology allows an end-user to securely 
store digital certificates and/or any other type of data, such as 
financial information or an online patient record, on distributed 
network servers operated by multiple trusted service providers. This 
technology enables portability of digital certificates, providing 
convenience for users to access and download their certificates and 
private keys for online authentication. It also enables the generation 
of binding digital signatures for conducting high-value e-commerce 
transactions, regardless of whether users are accessing the Internet 
from work, home, or another location such as an Internet kiosk. Digital 
certificates are electronic credentials that identify parties online, 
enabling encrypted communications and legally binding, valid digital 
signatures. 
"
 
-----Original Message-----
From: Richard Levitte [mailto:[email-masked]]
Sent: Thursday, July 20, 2000 11:24 AM
To: Anders Rundgren
Cc: Peter Lipp; [email-masked]; [email-masked]
Subject: Re: Signing what you don't understand

Anders Rundgren wrote:

> Peter,
>
> >> Several leading PKI vendors have implemented systems where the private
key
> >> is held on a central Web server and then downloaded at run time to a
web
> >> browser.  Are you saying that signatures created using these keys are
> >> invalid?
> >Are you sure? Could you provide a reference? I doubt that strongly...
> >
> >Peter
>
> I think this is one...
>
> http://www.arcot.com/products/webfort.html

I think not, at least from reading the papers "Protecting Digital
Identities" and
"Protecting Your Private Key".  All they say is that they've invented some
kind
of key database ("key wallet" to use their term) that is more secure than
what
comes with for example MSIE and Netscape Communicator...

Personally, if I was confronted with a CA that wanted to create my private
key
for me, and store it centrally to boot, I'd go somewhere else.  Very fast.
It
contradicts anything even remotely close to being called "secure".

--
Richard Levitte   !!! New cell phone number !!!
[email-masked]

/* You might enjoy viewing the complete vCard */

---

From: "Peter Lipp" <[email-masked]>
Date: Fri, 21 Jul 2000 08:52:32 +0200

> enabling encrypted communications and legally binding, valid digital

Admittedly you don't explicitly claim that technology to be able to generate
legally binding digital signatures, even if the last sentence seems to imply
that... at least you wouldn't be able to in Europe.

Peter