Slashdot Mirror
German Government Introduces Digital Signatures
bertvl writes: "From this
article on CNN: Germany's federal government is introducing electronic signatures for its employees, a step it hopes will help make the security procedure generally accepted in the country. More than 200,000 employees of ministries and agencies will be able to sign electronic documents using a chip card with an encrypted key, giving them the same legal weight as paper documents with a handwritten signature, the federal Cabinet said in a statement Thursday."
This is definately more secure than any paper signature. Of course, both can be duplicated perfectly, the digital sig being a lot harder (depending on the key strength).
Cthulhu Saves.
Will keeping track of 200,000 signatures be a logistical nightmare. Plus I am sure it will be easily cracked by someone, and then there will be fake documents flying around, but now they will have legal status.
Cruise TT
Oh, that's nice. Now, instead of having to pay the government to make laws I like, I can just pay someone to crack their digital signature.
"Anonymous cowards are just K-whores afraid of their accounts being modded down." - Bob the O (me)
Ok, so what's the betting that these 'chip card signers' get used as coffee mats by 95% of of the people who they've been given to? :)
Just last week I set up my life insurance,
and they used the chip in my bank card as a digital signature (together with the code).
The nice lady all explained me on how the Belgian State now accepts these digital signatures and how great that was.
Mind you, that I reside in a farmer community, I wonder how the farmers react ?
Greetings.
My other sig is Funny.
That some people (such as the BiKom group mentioned towards the end), grasp any technological advancement as an opportunity to deprive "citizens" (see also: plebs) of their privacy (National ID cards, "citizen card", GPS in rented cars).
The German government just get it. First they send 52-page colour booklets promoting open source to all businesses in the country, then they give a large sum of money to add more security and encryption in mutt and KMail, and now this!
... is people. How many people are going to go for a dump, leaving their keycard on their desk? Practically everyone where I work wanders off at some point leaving their PC logged with their (Notes) mail running. This could lead to hours of fun. Similarly, passwords/phrases get shared, borrowed etc.
Unless you use biometrics (I don't generally leave my fingers on my desk when I go to lunch), the stupid-factor will always play a part. The legal status of digital signatures will only really be clarified when the first case comes to court with the defense: "someone else must have used my key".
(OT) Oh, and would people please learn to spell "definite". It's like "finite" with a "de" on the front (quickly checks for typos).
"Under the iron bridge, we fist" - The Smiths, Still Ill
CNN incorrectly reported the prices as yen. The should be Euro
Not ¥ but €
I bet lots of Japanese wish that ¥60 was close to $53....
(This is just like the use of duel instead of dual, when they asked Nicole Kidman about her dual citizenship. CNN has really gone downhill.)
The power of accurate observation is commonly called cynicism by those who have not got it. - G.B. Shaw
You know Germany seems to be one of the technological world leaders. They just decided to phase out all nuclear power in favor of wind power by the year's end and it looks like they'll do it. The acceptance of digital signitures is a huge step in helping the internet reach its full potential for changing the way we live our lives. Germany is taking this first step. What I want to know is: who are the politicians making all of these progressive decisions and what affect are they having in the EU Parliament? Are other European countries following Germany's lead in these type of issues? I know that German business law strongly favors big business, are there any other laws or policy that a liberal would take issue with in Germany? What is the state of Linux use in Germany? I ask all this because I'm looking at an offer for a research position at the Max Planck Institute in Munich (I'm sorry _Munchen_:).
"A witty saying proves nothing." - Voltaire
The only way to be sure is to raise the hashed message to the proper power modulo p*q in your head.
Here in the U.S., for me anyway, the most common reason for me to have to sign something is when I pay with a credit card, yet when I purchase something online, no signature is required. This could be great if used by e-commerce companies to verify the person making the purchase is indeed who they say they are.
Slightly off topic, but why are the currencies given in Japanese yen in the article if it is hosted on an American site and about Germany?
The future isn't what it used to be.
Paper easily collects fingerprints and body fluids. You may not be able to perfectly verify that signature, but you should be able to verify whether or not someone actually held the paper.
Keycards are great, but only if used in conjunction with biometrics.
The power of accurate observation is commonly called cynicism by those who have not got it. - G.B. Shaw
Can be found here.
--Metrollica
Surely the 'legal weight' will be determined by the courts: It's only a matter of time before somebody signs something (or appears to), and then denies any involvment. Excuses (true or not) of "My card was stolen", "They made me tell them the key", "I don't know what you're talking about" will presumably be uttered (in german). Cryptogram has covered the problem that "the key isnt the person" in the past.
If the first 10 cases all end up with courts deicing that there isn't enough evidence that the person did actually "sign" the document, there surely won't be much legal weight? A paper signature means little if there is sufficient doubt about it's authenticity, I dont see how that's going to change here.
As an aside, I like the last line of the CNN piece:
Bitkom called instead for a "citizens' card," with chip and electronic signature, for all Germans.
Yeah Baby! I can't see anything bad happening down that road!
Tales from behind the Lagom Curtain
Its nice to see this happen as a large scale experiment. We'll have to watch to see how the non-geek workers handle it. But, for cost reasons alone, I don't see the US government implementing anything like this on a wide basis for at least 10 years.
Brian
It's all fun and games until someone steals your digital identity. Just ask all the posters who rate an imposter here. Or ask Signal 11 (7608).
signal ll (150330)
Signal 69 (159601)
Signal 11 (160141)
Signal Eleven 11 (196051)
Signal 12 (196465)
Signal seven 11 (196530)
Signal 1| (196903)
Signal%2011%20 (198994)
Signal 13 (199065)
Signal 10 (199067)
Signal 14 (199492)
Signal%2011 (199508)
Signal l1 (199916)
Signal 11 on. . (200800)
nbsp;Signal 11 (200811
Sìgnal 11 (200815)
Signal 11_bork2 (202783)
Sìgnal ll (203092)
Signal (203244)
Signal 11_bork1 (203709)
Signal II (221055)
Signal 111 (248325)
Signal 1I (255479)
Signal Eleven (261043)
Signal Nine (442438)
by Signal 11 (200808)
If voting were effective, it would be illegal by now.
Project Ägypten (Free Software Sphinx-Clients):
The Sphinx project launched by German authorities aims to improve secure email exchange. The projects technological base is the protocol 'TeleTrust e.V. MailTrusT Version 2'. This includes the standards S/MIME, X.509v3 and others.
Proprietary products are already on the way, but with the project Ägypten there is now also a Free Software solution going to be realized for popular mail user agents (sphinx-enabling KMail and mutt are essential goals).
The Free Software companies Intevation, g10 Code and Klarälvdalens Datakonsult AB are contracted by the German 'Bundesamt für Sicherheit in der Informationstechnik (BSI)' to incorporate the Sphinx protocols into Free Software MUAs. Background is to ensure availability of alternatives to proprietary desktops.
hany
According to the article's illustration, the Germans will digitally sign their names by writing a long, free-floating string of binary in the air with an ordinary pencil. Evidently the technology being used is both more advanced and more bizarre than anything I've ever seen.
G'damn, but this is a tough issue (I'm speaking generally here) How do you:
(1) Insure that no one can fake your identity
(2) Insure that no one can conglomerate data from your identity
It seems to me that both (1) and (2) are desireable, yet mutually exlusive. How do you insure anonimity with a definite ID? These two issues have never been smashed together with such power before. Digital technology gives us the possibility for either (1) or (2), but can it ever give us both? Are they mutually exclusive? Is it either anarchy or buttonhole ID facism?
.. Personaly I would opt for Anarchy for myself, and button-hole facism for everybody else.. (for safety's sake of course).. How 'bout you?
Starsucks
What happens if someone steals your card? It is like forging a signature, although harder to deny.
Wouldn't thumb or retinal scans be more secure (maybe more expensive though?)
Good security should consists of three parts:
Now it seems the German government has two out of the three (know+have), which is one (or two!) better than most of the world. Now all they need are retinal scanners, and they're set!
Like I said, it may not be a Good Thing® they end up with, but whatever it is... it's a lot closer to "secure" than anything else.
If the encryption is not strong enough to deter the majority of fraudsters, then I'd steer clear.
I'd hope they use some kind of pin code in addition to the "chip card". I also hope you can cancel a "chip card" if it gets stolen...
If someone fraudulently uses your digital signature that better not be binding!
...after all?
I know you americans don't have ID cards, but we have them in Portugal and allways had, so we don't tend to consider them as forms of major control, even though they are.
The point here is that if you loose your wallet and someone gets ahold of your ID card, you can be in a lot of trouble if it gets misused.
I have heard of stories from people I know that lost their ID and found themselves being chased by stores that claimed people had bought stuff there, paid the first entrance fee and never paid the rest. And that is the least that you can expect, even if you report your ID being missed 5 minutes after you loose it.
We, at least, don't have that many legal mechanisms to prevent situations like those, but I would bet it's a matter of time until there is a case of stolen digital ID.
The German government, by giving incentive to open source applications like encription and security are aware of these problems. So if they actualy exist? They existed well before things went digital, so you can expect a few cases of stolen ID before things get smooth.
Nice move here in Europe, btw. First GEANT, now this, really love the way things are popping up after a lot of foundation work.
Lay
Weakly typed languages will bring us armageddon
Lay
Weakly typed languages will bring us armageddon
I don't think a German Teenager needs a fake id to buy porn or beer, nobody asks for it in the first place unlike in the "land of the free" where you get id'd even if your 35.
It is not really a innovative step by the German government alone. All EU member states have to transform the EU directive on e-commerce into national law. According to the directive the member states have to make sure that most contracts (very few exceptions) can be closed online. The German government just tries to extend this rule to public law.
Line 9: Argument of type SIGNATURE expected.
So, like all you are aware of, citizens from European countries have phisical and economic mobility troughout the member states. And we have a common currency now too. So, since Belgium already has a system like this too, the next logical step would be to implement this troughout the whole Europe, which I bet has already been tought.
Any other European country that has a system like this? What are the chances of all these systems being interchangeable?
It's nice that a government from another member state can digitaly ID you... isn't it? :-)
Lay
Weakly typed languages will bring us armageddon
Lay
Weakly typed languages will bring us armageddon
Hong Kong's Government has implemented PKI infrastructure for digital signature for their citizens. However, there has a fundamental fault in the system - not being thoughtful in distributing the root CA. First the root CA is not embedded in the browsers we commonly use, or have a upper root CA, which is included in browser, signed their root CA. They even allow citizen use floppy to transfer the CA issued to computer...hmm....
Anyway, the technology is mature, the things yet to be done are policy-making and legalese. Nothing is 100% secure, the CA issuer must bare the legal responsibility and liability. I wish they'd one day realize what is the legal implication of such a faulty CA system.
WRONG! Digitial signatures were equal to written ones in Germany long before the EU directive. IIRC germany was actually the first state in the world to pass such laws.
Who do you think was the strongest supporter of the EU-directive? The german security requirements were actually much harder than those now demanded by the EU. Many big companies, who had already invested in the needed infrastructure (setting up an CA in a secure building, etc.) were pretty much pissed after the laws got relaxed with the EU-directive.
The new thing now is, that the german government is trying to push the use of digital signatures, because the adoption has been really low.
I just hope they don't consider it more credible than paper signatures, because it isn't.
Sure, the math is safe, but the use isn't. When I digitally sign a document, I don't actually do it myself - I ask a device to do that - a device of which, regardless of common beliefs, I have very little control (About as much control as one might have on their employee - you can ask them to do something, and it will usually look as if they did it, but that doesn't imply anything).
According to CNN.com, the EU seems to be using the Japanese Yen as currency....
Cheers,
me
p.s. Uh, I think they ment Euro...i.e.
All your base are belong to us!
To believe that you're signing the document on screen, you have to trust every element of hardware and software between the screen and the card (at least). All an attacker needs to do is to introduce a suitable trojan/virus on the computer holding the document - probably a PC, probably running windows - and when you try to sign something, replace your doc with one of their choosing. For a system that doesn't demand password entry for each crypto operation - and that can drive users nuts - the attacker can get both the real and other document(s) signed, making it hard to notice.
...
You can have the most tamperproof card and break-proof algorithm you please, but if you plug it into a standard PC, you are open to all the attacks we hear about every day
I love anonymous coward posts. Their tendency towards being both insightful and constructive...it just brightens my day to know that I can be insulted by someone with bad grammar and not be allowed to know who it is.
"Anonymous cowards are just K-whores afraid of their accounts being modded down." - Bob the O (me)
As far as I know the signatures are intened to be used for so called e-government with public authorities. That means to register via email at the record section etc. What do you think about this aspect?
The chip card thing is just to make it harder to find private keys on hard disks...
That remainds a lot the old and still on use seal of authentication. You stamp a seal on a document an it will be legal. The problem with seals and cards is the fact they can be forged, stolen, misused by rugue employees, etc.
The use of digital signatures will be a good breakthrought to the German Gov on the digital era but only the first step, or they will have to dela with a lot more problems.
------I can please only one person per day. Today is not your day. Tomorrow isn't looking good either.------
in this cnn poll. wither or knot the megaslothians consume the starving fedorites, is nearly irrelevant (except to the hatters).
getting their (aol's) 30+ million users onto a penguinized desktop would be (we think) quite relevant. no FUDging now.
God save the queen. fud is nearly dead? on to the desktop. perception is 9/10 of permission.
The german government's encryption has been continually broken for 60 years, do you really think this is a good idea?
see http://www.gchq.gov.uk and ask yourself if you trust these people when they can sign official documents of the german government.
- Kaos games and encryption systems developer
The german government is well aware of the fact that a computer is a hackable device. There are laws for the public key infrastructure PKI to be government accepted and it just goes far beyond trust in the certification issuer. The computer that creates the keys has to be sealed off and what not all, i do not know all of this stuff, since this was all decided a few years ago.
About the chipcard in itself not being safe but only in conjunction with a safe computer, there were plans to build chipcard readers with to not reveal the private key to the PC but only tell the PC whats needed for the encryption job. And this is also done after the user entered a PIN code on the keyboard of the chip card reader (and not on the keyboard of the PC). But I do not know, to what level the protection of the home PC is enforced to get the digital signature legally accepted.
This decision is the result of an EU directive on e-commerce, and not a german initiative. The European Union is a confederation of 15 european states that has federal-like institutions : a government (the commission), a president (currently Mr. Aznar), a central bank and common currency, a common foreign, defense and economic policy, a parliament, etc. But as it is not officialy federal yet, i.e. it is not declared as a state (national pride, y'know), the parliament cannot make laws. In theory. In fact, the EU is a stealth federation, a non-official yet sovereign state, as all member states have the duty to turn EU directives into laws (France was recently condamned for being reluctant to apply a european directive). And there are many discussions today in the EU institutions about open source, Linux, e-commerce and so. I would expect a directive soon encouraging the use of open source software for administrations in the EU. Stay tuned!
Everyone who's praising the German government on being all tech-savvy and forward-thinking and blah-blah-blah should first read Bruce Schneier's thoughts on the subject: Why Digital Signatures Are Not Signatures.
In a nutshell, he says this: Cryptography can do quite a bit to guarantee that a given signature came from a given computer. It can do absolutely nothing to guarantee that that signature represents the person it purports to represent. To quote Schneier: "The mathematics of cryptography, no matter how strong, cannot bridge the gap between me and my computer."
It's all good and well for governments to embrace new technology, but only if they don't cause major fuckups in the process.
Do domain names matter?
Banks don't often check small amounts. With me they've only checked signatures in checks above 200 Euros. Anything lower than that they'd just paid.
Thing here is that, in order for a system of digital identification to get widespread adoption, the public has to have trust . Who's going to be in favour of a system that people will initially perceive as being insecure (because it's not them that are signing, "it's a computer") , especialy with all the news about trojans and security breaches in networked systems?
The point is that people are on the other side of digital ID, they're not thinking "Oh, good, I can have documents digitaly signed and save me a whole lot of trouble", they're thinking more in the lines of "Hey, and if someone..."
They will have to check and double check and triple check to guarantee that the system is secure, otherwise they will have a very hard time trying to implement it a second time after they loose public trust.
Why are ATM machines and credit cards widely accepted by the public? On top of the convenience, they offer a (limited) liability for the damages that can come from its misusage, otherwise people would carry plain good old-fashioned cash anywhere they went.
Lay
Weakly typed languages will bring us armageddon
I have been thinking of writting about this and today one slashdotters question has prompted me to finally take it up.
I am doing M.Sc.Information Technology at the Uni of Stuttgart. Its a very good program as it includes technical subjects like IP Networks, Telecomm Networks,Distributed Systems, Mobile Communictions, DSP, Embedded Systems, etc etc as well as non-technical courses such as Law, Business Management, Innovation and Technology Management, etc.
The whole program is in English!!!! Infact there are many universities here which are offering such programs. for more info this website . Check out the "free Education" link. Yes, the education is totally free here.
In our course on Law, there was a very strong emphasis on "Digital Signatures". You can say that it has been taken up consciously on all levels and its not an overnight decision. A long well thought out process.
Thoughts on One-Way Authentication : As far as i know the E-Card + PIN code combination is the only secure solution, otherwise all one-way authentication schemes can be hacked. I dont about other banks but atleast Deustsche Bank is using a combination of same technique for their internet banking. You have log-in/password to login onto your account, but to make the actual transaction one has to enter a unique id which is sent by DB through regular mail( you get 50 transaction ids ). This is again a hybrid solution.
Of all the countries, i think, Germany has made the most secure and wise use of technology.
Voltaire: God is dead.
God: Voltaire is dead!
But I feel that often the risks and costs of the old system are not given as much weight.
Let's take an example. Some years back, an argument raged in my community about a proposed tunnel under a fjord. The tunnel would allow people to get to the other side in 6 minutes instead of following the outline of the fjord for 45 minutes on a narrow, winding, often steep road.
The risks of the the new system, the tunnel, got a lot of press. We were treated to many horrifying predictions, each fit for a disaster movie. The proponents of the tunnel pointed out that while the road does not make a good disaster movie, people regularly die in car crashes on it.
My observasion is that this argument got considerably less recognition than it should have if people had viewed the issue rationally.
In light of this, can we perhaps enrich the discussion on this particular new system (digital signatures) by identifying the risks and costs of the old system (handwritten signatures on paper).
I can see a few.
1) Signatures can be forged. It takes talent, skill and effort to do it well, but only rarely do you need to do it well, because the signature is rarely verified by anyone who actually knows how to do it. (It's not always verified at all. I saw a bogus check hanging in a store once, signed Donald Duck or something like that. The clerk had actually accepted this check as payment.)
2) The piece of paper needs to be in the same place as the signer. This can't always be arranged easily and sometimes people accept the dangerous alternative of doing business with no signature at all (or a weaker version of the digital signature, the pin code).
3) Handwriting recognition can't be automated (or has the software gotten good enough?), with the same results as in point 2 (think ATMs).
I'm thinking of things like online shopping and tax returns at the same time here, but to get a clear picture the applications of signatures should probably be categorized. Also note that I haven't decided in favour of digital signatures. I just want to promote this idea of mine that we should give equal weight to the risks and costs of the system already in place as to the risks and costs of the system being proposed.
Fuck the system? Nah, you might catch something.
Unfortunately, the article misses the main point: Germany has been trying to build a PKI for governmental use since 1997 or so (when legislation was passed to make documents carrying some types of digital signatures equivalent to paper documents).
However, the 1997 law features very high requirements for CAs and the actual implementations of digital signing. Partly because of the high security standards (which look good on paper, but fails in practice--a certified solution was successfully attacked by compromising the hosting general purpose computer), and partly because of incompatibilities, acceptance of this type of signatures was extremely low.
The new digital signature law introduces a new kind of digital signature with lower security standards, and which does not necessarily require additional hardware. Although this is less secure (key theft might be possible), this approach seems to be practical.
At the same time, the compatibility problems are addressed in the Sphinx framework, where KMail and GnuPG are enhanced so that they can exchange messages with other Sphinx-compatible clients.
If I'm not mistaken, the German federal government announced recently that it would promote the use of the low security digital signature in non-critical areas of the federal government. I think this is a good idea; even a digital signature based entirely on software (and not on some smart card which fully implements an assymmetric crypto algorithm) provides more authentication than a simple phone call, and certainly much more non-repudiation (even more than an oral consultation). And this time, the rollout might actually succeed, if the clients get ready soon.
Im working on a project in Sweden that is a collaboration between some of the largest banks in the country. At the end of 2002 all customers will be offered a digitial certificate they can use to sign contracts etc. with on the internet. In the first release the certificates will be "soft" but there are long term plans to incorporate them into cards once home card terminals become common.
There is a fundamental difference between a "real" signature and a digital signature. Anyone can copy a "real" signature, with practice anyone can do it fairly well. In 99.9% of cases an expert can still say it is fake. Thus it is really difficult to do it well.
With digital signatures... well... all it is is just a number. The security is only as good as the security of your card (microchip, whatever). If someone has that, their "fake" signature is IDENTICAL to your own.
In one case the security is based on something that took years in all of us to develop. It's based on one of our characteristics that we are hard pressed to CHANGE. In another it's simply a number.
I am a law student and I recently took a class on e-commerce. In that class, we discussed electronic signatures, and the subset of electronic signatures known as digital signatures. I admit at the beginning that I know very little about the technology here, so please be gentle if I get the tech wrong. This is more of a post about how the law views this type of signature. In the U.S., with the exception of the states of Utah, Minnesota, and Washington, the state law Uniform Electronic Transactions Act (UETA) and the Federal E-Sign Act both define what an electronic signature is. Federal law normally supercedes state law, but in this case, it was written so that it parallels UETA and only takes effect if a state has no legislation in the area. Both UETA and E-Sign define an electronic signature as a sound, symbol, or process logically associated with the record executed by a person (this is the identity issue) with the intent to adopt (identity + intent) and authenticate (sign) the record (electronic substitute for a writing). This law is designed to make it so that electronic contracts can pass the statute of frauds, which require that a contract be in writing and signed by the party against which enforcement of the contract is sought. German law is different, as I understand it (If there are any Germans out there, please reply and correct any misstatements I make here). In Germany, a contract is not valid until it is notarized, giving it the backing of the state. The notary serves the purpose of actually seeing the person sign the written contract. In the U.S., very few types of contracts are required to be notarized (deeds transferring real estate, for example), but a notarized document is presumed to be valid. A digital signature, such as the Public Key Infrastruction (PKI) is similar to the notary function, because it brings in a third party (I tend to think of Verisign here, because the professor who taught this portion of the class was at one point an attorney for Verisign) to verify the identity of the person authenticating the document. PKI works like this (I apologize to those who know the technological details... this is an incredibly simplistic explanation, but for non-techies like me, it should suffice): Third party provides a private key to A. A creates a record and then authenticates it by using the private key to encrypt the message. The private key encrypts the message, and adds one line of non-encrypted text directing the receiver (B) to contact the third party. The third party provides B with the public key to decrypt the message sent by A. The decrypted message will only be readable if the message sent by A has not been tampered with. It's not surprising, then, given the German preference to have a contract verified by a notary, that the German government (and the EU, I might add) would prefer using PKI. Your third party acts as a notary verifying that it really was person A who sent the message. Earlier I mentioned that in the U.S., the law was UETA or E-sign, except in Minnesota, Utah, and Washington. The reason is is that those states enacted laws favoring PKI. Internationally, the United Nations Commission on International Trade Law (UNCITRAL) passed a model law that favors PKI. Under the model law, an electronic signature (under UETA, for example) is still usable, but if you use PKI, there is a presumption that the document is valid (which means that you had better have damn good evidence that it's not if you hope to prove it invalid). Since security is more of a technological issue, I'll leave that to wiser heads to discuss, although I will leave with a quotation from a good friend: "Locks are for honest people. If someone wants your stuff bad enough, they'll find a way in."
There's a huge difference once you introduce smart cards.
A desktop computer is often left unattended, and it's not unreasonable to believe that somebody could gain illicit access to the data and software.
In contrast, a smart card is designed to be carried on the subject's person, in wallet or purse. With better cards, you can't pull the private key off the card - all crypto is done on the card itself. And even if you steal the card and attempt to disassemble it, they're designed to make such attacks futile.
If you want to make it even stronger, since there will always be idiots who write their PIN number on the card itself, you can try the experimental systems that mix biometrics and smart cards. The smart card contains the shrouded private key, the biometrics are used to unlock it.
For every complex problem there is an answer that is clear, simple, and wrong. -- H L Mencken
Yeah, I know it's not as easy as all that. The world is being ram-rodded into a currency system which practically requires that you carry a corporate credit card. But that's only because people keep believing in the bullshit being fed to them. They keep eating it up! One of the most frustrating things in the world is to have your life shaped into pain by morons when you know better, and when they keep insisting that you're the foolish one.
Biometrics = Evil. (If you don't understand why, then sit the fuck down and figure it out!)
(-Most of the preceding was not directed at the poster. Just venting ire. Sorry.)
-Fantastic Lad
Digital Signature != Electronic Signature
The former is secure (depending on algorithm and key size), the latter is not.
The first one is something like PGP.
The latter is like the "I Accept" button on software EULAs.
So I don't know why people are talking about these being more secure than handwritten signatures. At least you can have handwriting analysis done on written ones and most of the time there is at least one witness and also a notary for the handwritten kind.
We discussed all this before when Clinton passed a law to make electronic signatures binding in the US. Remember?
Finally I can revoke all those stupid German trademark laws without getting involved in politics.
What about forged signatures?
xxxxxxxxxx O xxxxxxxxxx H xxxxxxxxxx xxxxxxxxxx W xxxxxxxxxx E xxxxxxxxxx L xxxxxxxxxx L xxxxxxxxxx.
Actually, I'm not done yet. I just wanted to say that we're moving towards a moneyless, paperless society. One day, and it might not be so far off in the distant future, there will be no money, and all documents will be electronic and signed with digital signatures. All your personal information will be stored on a so-called "chip card." This will be a sort of global identification card, which will simultaneously serve as:
With tiny storage medium such as microdrives reaching capacities of a gigabyte or more, such a card is not far off. It could even come from the government already in a nice waterproof protective wallet. After a few years go by, they'll start implanting this technology in peoples' bodies, and sell you on the added conveniences, such as monitoring of your life functions, the impossibility of getting kidnapped, huge reduction in crimes, etc. That way, Big Brother can really be in control of your life.
Ok, now I'm done.
xxxxxxxxxx O xxxxxxxxxx H xxxxxxxxxx xxxxxxxxxx W xxxxxxxxxx E xxxxxxxxxx L xxxxxxxxxx L xxxxxxxxxx.
There is a discussion on authentication (digital signatures, biometric smart cards, etc) at
http://www.see.govt.nz/pki/authentication.html.
The ideal solution is a biometric fingerprint reader on the smartcard, which unlocks your digital signature for the transaction. Cost is still prohibitive, US$500.
I am required by my employer to wear my ID badge so it is visible at all times. I have to scan it to gain entrance to my building, and it is occasionally visually inspected on top of that. To make this process simple, almost all of us wear our IDs on retractor clips on our belts.
My ID badge also has a smart-card chip in it. I put in the reader on my desk, enter my PIN, and log into the computer/network. I am required to lock my workstation when I leave my desk even momentarily, and auto-lock behavior is enforced if I forget. I can be fired if I am caught cheating on these security practices. Turst me, that's motivation to do things right.
People can learn anything if it's in their best interests to do so.
--Jaborandy
What I want to know is: who are the politicians making all of these progressive decisions
The German Government is a coalition between the Social Democratic Party and the Green Alliance.
On the Bundesministerium Wirtschaft und Technologie's (Federal Ministry of Economics and Technology's) site you can see more about who makes up the ministry. The BMWi's site also carries more information about this story.
Heise is a leading German news source. You'll find more information about similar technology news there.
The German CIA fact file has some more background about Germany.
Most of these sites have English versions, but there's not always the same level of detail. If you can stand its translations, it might be worthwhile firing up Babelfish or a similar translation service.
Anything in silicon can be duplicated.
What is the chip in the card? maker, fips rating etc.
There are sites that explain how to probe the chip, after removing it from the card after a bit of fuming nitric acid, and how careless makers do not destroy test areas, and how they can be re-enabled, and how hac- er crackers can monitor the bus, lithium nicobate and more.
Very good cards are expensive. whats the bet a common cheapish commercial chip was used? not based on 0.13 micron?
It's about time someone realised I know what I'm talking about on encryption.
If anyone wants to use digital signatures, I recommend Blowfish as the algorithm. http://counterpane.com
Avoid all versions of DES and AES, there is a good reason NSA approved those algorithms as standards.
- Kaos games and encryption systems developer
This is how I figure it works.
. ht m
:)
* It's an assymetrical encryption system. You give out your public key to whomever wants it and you guard your private key, that's on your chipcard, with your life. The private key must never fall in the hands of someone else.
http://www.howstuffworks.com/encryption1.htm
* On your normal PC your private key is protected by a password/passphrase. This ensures that even if others get that file, it is made unreadable by the passphrase encryption.
However, if someone breaks into your computer, via internet or physically, they can install a keylogger/trojan to find out what you are typing and what your passphrase is. Now they can read your "unreadable" private key, it's stolen BAD!
* The only way to properly protect your private key is to disconnect your PC from the internet and physically protect it from break-in.
* The chipcard is not connected to the internet and it's very difficult to physically get to the info (you need big microscopes and micro wires etc.)
It will only give out information if it receives a certain PIN number (instead of a password). Much better protected info than on a magnetic strip.
* If the card-reader is connected to the PC/internet and you enter your PIN number through your PC keyboard then your PIN can, again, be intercepted/logged and your Private Key can be used if someone has your card, BAD!
So the card reader ABSOLUTELY HAS TO HAVE IT'S OWN KEYPAD TO ENTER THE PIN. Also if there is ANY display used, it has to be on the card reader ITSELF and not on your PC. The PIN must not be sent to your PC to check your input.
In addition the card reader has to belong to you so you know for sure that some strange/cracked card-reader doesn't log your PIN number.
Now what I don't understand, and I wish someone could explain to me, is.
What exactly comes out of the card? I've read this already:
http://www.zdnet.com/pcmag/issues/1507/pcmg0090
? The private key comes out of the card/reader into your PC to encrypt your hash. It can be intercepted and stolen. BAD!
? Your PC Hashes the message. The hash goes into your chipcard and it's encrypted there with your private key. The encrypted hash comes out of the chipcard and is attached to the message as your signature. This seems to work except, the unencrypted hash can be intercepted before it's sent to the chipcard and after it leaves. I'm no cryptographer but can't you calculate the private key from the encrypted message somehow if you have the original message? Probably not, because then Puplic Key Cryptography couldn't work
? Ok so above text block, I think, is the answer, but what about using your chipcard in untrusted card readers belonging to other people.
The only way I can see that this can be safe is if you really, REALLY keep your chipcard safe. In practice, this does not happen ofcourse. So you have to report it stolen and invalidate all future signatures coming from that card?
In other words, the safety of chipcards is that the person that steals your PIN cannot steal/copy your card/information on the card??? (unlike magnetic cards).
This does not seem the BEST way to do it, although much better than with magnetic cards.
Can someone please tell me if one of the above methods is used in the German/European system? Or if not, what other method is used?
Am I right in the assumption that the ULTIMATE method of signing stuff is a chipcard with BUILT IN KEYPAD/DISPLAY TO ENTER YOUR PIN. Then after you input your PIN, the card will encrypt a hash within the next 20 seconds. I think some company has already made a display on a credit card with Light Emitting Polymer.
OR
You use a very portable card reader with built in keypad and display, that has a robust physical communication port to connect to someone else's computer and sign something that way. Wireless seems a bad move because of additional security concerns.
I'm just guessing here, anybody have the real answer? Thanks.
WRONG! Digitial signatures were equal to written ones in Germany long before the EU directive. IIRC germany was actually the first state in the world to pass such laws.
Sorry, but you are partly mistaken: Germany was among the first nations to introduce a Digital Signatures Act (Signaturgesetz in German) in 1997 but it only set a standard for digital signatures. So they existed but could not be used where public and civil law required a "signature". This changed on the 1st of August 2001 with another law. Now you can use digital signatures where a handwritten signature was required before - with a few exceptions (see article 126 paragraph
3 of the German Civil Code [BGB]).
Line 9: Argument of type SIGNATURE expected.