Slashdot Mirror
Seeking a Practical Guide to Digital Signatures?
ScuzzMonkey asks: "I work for a small company trying to streamline some business processes in Washington State. As a part of this initiative, we're considering implementing a 'paperless' contracts system. In order for this to work out, on our end, we need a legally acceptable method of electronically signing the contract documents that we receive via fax from our sub-contractors (at this time, they will still be signing manually; this may eventually move to e-mail and digital signatures on their end as well as they become more capable of dealing with us on that level). On the face of it, this seems pretty straightforward. I set up some sort of certificate or some such for our employees responsible for signing these documents, and they simply review the TIFF attachment that comes in from the fax software and 'sign' it with their digital signature via a selected program. With the passage of the E-Sign Act (PDF) in 2000, it seems like this should be every bit as solid in court as a written signature. But while I've been able to find quite a lot of information on the web about the theoretical ramifications of this law, there's not much on practical implementations. What sort of software should I use? Do I need a third-party issued certificate? If so, do I just need one for the company, or one for each signer? What certificate authorities would you recommend? Do some certificates work with some software but not other software? What about this program from the state? Has anyone done this successfully yet? Any other stumbling blocks I should be aware of here, either legal or technological?"
Are your customers willing to do this? While I'm sure there's a contingent out there that is willing to dive in and get rid of all the face to face visits and FedEx packages, I'm not so sure that they number past a few. Most companies that I have the pleasure of dealing with would much rather seal decisions with a pen than email.
:-(
A Google search on this topic pops up quite a bit of broken links.
I have been pwned because my
It signs messages and files just fine. What's wrong with using it?
Paperless office is what Notes all about.
Two points tho:
It's expensive, but very secure
The FAX solution is an add on product offered by many vendors.
Your best path, especially if you have no Notes experience, is to get a consultancy (IBM could recommend you one) who have done this before to give you proposal which you can then compare to alternate non-notes solutions.
Fnord! Any sufficiently undocumented code is indistinguishable from magic.
The problem is that you can't keep those keys in a secure server watched 24/24 by armed guards --- you must hand them out (or hand a key to a key to a key) to the actual humans who will have to use them, and there you have a weak link in your security chain: how can you prove that the key can't be stolen? Or are you willing to be liable for anything signed with a stolen key?
Things can be enhanced by having some kind of physical key (a credit card or better, one of those small round things that you put in an actual keyring) attached to every person, to unlock his keys; usable only with his personal password at a secure desk within the walls of the company. Usual protection against Tempest are useful, to prevent anyone from stealing your passwords, etc.
If you find a cost effective way to manage digital signatures, you might find that you can make an awful lot of money selling the process to other companies, as part of streamlining their internal IT processes.
Just my .002 mg of gold worth.
-- Faré @ TUNES.org
Reflection & Cybernet
He makes some good points here: Why Digital Signatures Are Not Signatures
I fully intend to have our lawyers go over this; however, I want to have a complete process to pitch at them so they can review the whole thing. If I talk to them before I have the technologies and processes lined up, they won't really be able to evaluate it properly--I could end up putting something into it later that might invalidate what they thought was kosher. So, you're right, I haven't talked to them yet--but that WILL be happening before the system goes live--just after I work out what the system is.
No relation to Happy Monkey
Sorry if I was unclear--the fax is coming the other direction. They sign (physically) and fax back to us, where we sign, digitally. We can provide that back to them on disk, via FTP, or e-mail, or a host of other ways--but we're NOT trying to fax a digital signature at any point of the process.
No relation to Happy Monkey
You have the right idea, but your technology is about a decade out of date.
You can get smart cards/crypto cards or dongles that keep the keys on the card. It's *never* revealed, and all crypto is done on the card or dongle. They aren't expensive - I bought a set of 5 cards for $100, and the Linux development kit including reader was under $100.
However this system use PKIX, not OpenPGP, and the infrastructure is different.
For every complex problem there is an answer that is clear, simple, and wrong. -- H L Mencken
The basis of a valid electronic signature is a combination of policy and code. As per Schneier's article and the E-Sig Act, deniability is the key factor. If you can provide the technology necessary to keep the means of signing secure, and can put in place a set of policies for which you have agreement on record, then you have a legally binding electronic signature.
The exact means you use to implement the technology, whether it be digital certificates or simple password authentication, is nearly irrelevant. Okay, you want to make it as secure as possible, and local regulations and/or your contracting partners may dictate your means. But aside from that, all you have to do is make sure that you have taken reasonable precautions to ensure that the signature corresponds to the person, and that intent to sign is implied in the signature. The first half is done through authentication of some sort. The second half is embodied in your company's documented policy.
For the policy, make sure that your company holds training sessions for all current and new employees who will use the system. Let them know that security of their job depends on the security of their passwords. If possible, get them to sign a form that spells out the policy, the usage, the consequences of misuse, and that they acknowledge that by using the system, the employee consents to be bound by the signature. We in healthcare call this informed consent . It maintains an audit trail that disallows deniability. The interesting point, on rereading the E-Sig Act, is that the employee may signal their intention not to be bound by the electronic signature -- but this must be written. In your policy, you may specify that the employees must agree to and comply with the electronic signature as a requirement for employment. At which point, you may remind them if they wish to withdraw their consent that they may be endangering their job in so doing.
As another poster mentioned, though, get a lawyer's (or insert other domain-specific expert here) advice on the topic. And, if you expect your electronic signature to be taken as valid by other companies, you must discuss the matter with them beforehand.
If you're going digital, go all the way and use an e-forms vendor like PureEdge which can be filled out, digitally signed, verified and archived without ever having a printed copy. Plus it's XML so you can map the data directly into a database. If you're going to digitally sign something, sign the actual document rather than a snapshot of it.
Bite the hand.