Digital Signature

Digital signature is a term with confusing referents. It is generally taken to be a 'subset' of electronic signatures. But some people use the term to describe something equivalent to electronic signature. As does this legislation.

electronic signature means an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record. This is the definition given by the U.S. Electronic Signatures in Global and National Commerce Act of 2000.

Or it can be used as a broader term encompassing message authentication codes, file integrity hashes and digital pen pad devices.

In this article digital signature is used to mean a cryptographically based signature assurance scheme. Many have been proposed, some have been found to be flawed and are not used. Some are covered by patents, some were covered by patents which have expired, and some are free of patent license requirements, though there is more than a little disagreement on this point amongst those with commercial interests.

Digital signatures are often used in the context of Public Key Infrastructure (PKI) schemes in which the public key used in the signature scheme is tied to a user by a digital identity certificate issued by a certificate authority, usually run by a third party commercial firm. PKI systems use asymmetric key cryptography to unbreakably bind user information (name, address, phone number, ...) to a public key; the underlying idea is closely akin to that of a notary endorsement. There are several digital signature schemes; most establish two complementary algorithms, one for signing and the other for checking the signature at some later time. The output of the signature process (in principle, these are bit strings, though they can represented in many ways) is also called a digital signature.

The term electronic signature, although sometimes used for the digital signatures discussed here, has had a distinct meaning in common law: it refers to any of several, not necessarily cryptographic, mechanisms for identifying the originator of an electronic message. Electronic signatures found valid by courts in various jurisdictions have included cable and Telex addresses, as well as FAX transmission of handwritten signatures on a paper document. It is said that this is the reason both the UETA (US State law), and the US Federal Electronic Signatures in Global and National Commerce Act refer only to electronic signatures. As the security (and workability) of the digital signatures discussed in this article are quite different than all other kinds of electronic signatures, these legal usages present problems in practice.

Benefits of Digital Signatures

There are three common reasons for applying a digital signature to communications:

Authentication

Public-key cryptosystems allow encryption of a message with a user's private key. The message itself need not be sent in ciphertext. If a hash of the document is generated and then protected via encryption, the document cannot be altered in any way without changing the hash to match, which, if quality algorithms are properly used, will be quite difficult. By decrypting the hash using the sender's public key, and checking the result against a newly generated hash of the alleged plaintext, the recipient can confirm (with high confidence) that the encryption was done with the sender's private key (and so presumably by the user who should have been the only person able to use that key), and that the message hasn't been altered since it was signed. No recipient can ever be absolutely certain the purported sender is indeed the signer -- ie, the person who used the private key -- since the cryptosystem might have been broken, the key copied, or the whole scheme evaded using social engineering.

The importance of high confidence in both the message integrity and sender authenticity is especially obvious in a financial context. For example, suppose a bank's branch office sends instructions to the central office in the form (a,b) where a is the account number and b is the amount to be credited to the account. A devious customer may deposit £100, observe the resulting transmission and repeatedly retransmit (a,b), getting a deposit each time and getting rich in the process. This is an example of a replay attack.

Integrity

Both parties will always wish to be confident that a message has not been altered during transmission. Encryption of the message makes it difficult for a third party to read it, but that third party may still be able to alter it, perhaps maliciously, without actually reading it. An example is the homomorphism attack: consider a bank which sends instructions from branch offices to the central office in the form (a,b) where a is the account number and b is the amount to be credited to the account. A devious customer may deposit £100, intercept the resulting transmission and then transmit (a,b3) to become an instant millionaire.

Non-repudiation

In a cryptographic context, the word repudiation refers to the act of disclaiming responsibility for a message (ie, claiming it was sent by some third party, certainly not me; 'I repudiate this message and its contents!"). A message's recipient may insist the sender attach a signature in order to make later repudiation more difficult, since the recipient can show the signed message to a third party (eg, a court) to reinforce a claim as to its origin. However, loss of control over a user's private key will mean that all digitally signatures using that key, and so 'from' that user, are suspect. Noticing that such a loss of control has occurred is not a cryptographic problem, but a human space one, and is unsolved. Short of special purpose protocols to address this issue, digital signatures alone cannot provide inherent non-repudiation.

Implementation of Public-key digital signatures

Public-key digital signature schemes rely on public-key cryptography. In public-key cryptography, each user has a pair of keys: one public and one private. The public key is distributed freely, but the private key is kept secret by the user; another requirement is that it should be computationally infeasible to derive the private key from the public key.

Generally, digital signature schemes include three algorithms:

  • A key generation algorithm
  • A signing algorithm
  • A verification algorithm

For example, consider a situation in which Bob sends a message to Alice and she wants to be certain it came from him. Bob sends his message to Alice, attaching a digital signature. The digital signature was generated using Bob's private key, and takes the form of a string of bits (normally represented as a string of characters (ie, digits and letters)). On receipt, Alice can then check whether the message really came from Bob by running the verification algorithm on the message together with the signature, using Bob's public key. If they match, then Alice can be confident the message really was from Bob, because quality digital signature algorithms are so designed that it is very difficult to forge a signature to match a given message (unless one has knowledge of the private key, which Bob must keep secret).

Association of digital signatures and encryption

Digital signatures use encryption techniques but the algorithms are not typically suited for direct encryption of bulk plaintexts; more efficient methods are available. Of course a signed document may be sent encrypted over a public communication channel (eg, the Intenet) just as might be any other message.

More usually, Bob first applies a quality cryptographic hash function to the message, and then digitally signs the resulting hash (see diagram). An insecure hash can compromise the digital signature. For example, if it is possible to generate hash collisions, it might be feasible to forge digital signatures.

There are several reasons to sign such a hash (or message digest) instead of the whole document.

  • For efficiency: The signature will be much shorter and thus save time since hashing is generally much faster than signing in actual practice.
  • The document is intended to be read by others: E.g., diplomas, birth certificates, identity certificates, driver's licenses, a contract establishing ownership of something, etc... These documents will be in clear text, but an accompanying digital signature can be used to verify that they are neither forged nor altered.
  • For integrity: Without the hash function the text "to be signed" must be split (separated) in blocks with a size shorter than the length of the private key. Then each block has to be signed and sent to the receiver. However the receiver of the signed blocks is not able to recognize if one ore more blocks have been erased during the transmission.
Using separate key pairs for signing and encryption

In several countries, a digital signature has a status somewhat like that of a traditional pen and paper signature. Generally, these provisions mean that what is digitally signed legally binds the signer of the document to the terms therein. For that reason, it is often thought best to use separate key pairs for encrypting and signing. Using the encryption key pair a person can engage in an encrypted conversation (eg, about buying a house), but does not legally sign every message he sends. Only when both parties come to an agreement do they sign a contract with their signing keys, and only then are they legally bound by the terms of a specific document. After signing, the document can be sent over the encrypted link.

Association of digital signatures and trusted time stamping

Digital signature algorithms and protocols do not inherently do not provide certainty about the date and time at which the underlying document was signed. The signer might, or might not, have included a time stamp with the signature, or the document itself might have a date mentioned on it, but a later reader cannot be certain the signer did not, for instance, backdate the date or time of the signature. Such misuse can be made impracticable by using trusted time stamping in addition to digital signatures.

Additional security precautions

Putting the private key on a smart card

All public key / private key cryptosystems depend entirely on keeping the private key secret. A private key can be stored on a user's computer, and protected by, for instance, a local password, but this has two disadvantages:

  • the user can only sign documents on that particular computer and
  • the security of the private key completely depends on the security of the computer, which is notoriously unreliable for many PCs and operating systems.

A more secure alternative is to store the private key on a smart card. Many smart cards are deliberately designed to be tamper resistant. In a typical implementation, the hash calculated from the document is sent to the smart card, whose CPU encrypts the hash using the stored private key of the user and returns it. Typically, a user must activate his smart card by entering a personal identification number or PIN code (thus providing a two-factor authentication). Note that it can be sensibly arranged (but is not always done) that the private key never leaves the smart card. If the smart card is stolen, the thief still needs the PIN code to be able to generate a digital signature. This reduces the security of the scheme to that of the PIN system, but is nevertheless more secure than are many PCs.

Using smart card readers with a separate keyboard

Entering a PIN code to activate the smart card, commonly requires a numeric keypad. Some card readers have their own numeric keypad. This is safer than using a card reader integrated into a PC, and then entering the PIN using that computer's keyboard. The computer might be running a keystroke logger (by its owner/operators intention or otherwise -- due to a virus, for instance) so that the PIN code becomes compromised. Specialized card readers are less vulnerable, though not invulnerable, against tampering with their software or hardware. And, of course, eavesdropping attacks against all such equipment are possible.

Other smart card designs

Smart card design is an active field, and there are smart card schemes which are intended to avoid these particular problems, though so far with little security proofs.

Some digital signature algorithms

  • Full Domain Hash, RSA-PSS etc., based on RSA
  • DSA
  • ECDSA
  • ElGamal signature scheme
  • Undeniable signature
  • SHA (typically SHA-1) with RSA
  • Rabin signature algorithm
  • Pointcheval-Stern signature algorithm
  • Schnorr signature

 

The current state of use — legal and practical

Digital signature schemes all have several prior requirements without which no such signature can mean anything, whatever the cryptographic theory or legal provision.

  • First, quality algorithms. Some public-key algorithms are known to be insecure, practicable attacks against them having been discovered.
  • Second, quality implementations. An implementation of a good algorithm (or protocol) with mistake(s) will not work.
  • Third, the private key must remain actually secret; if it becomes known to any other party, that party can produce perfect digital signatures of anything whatsoever.
  • Fourth, distribution of public keys must be done in such a way that the public key claimed to belong to, say, Bob actually belongs to Bob, and vice versa. This is commonly done using a public key infrastructure and the public key\leftrightarrowuser association is attested by the operator of the PKI (called a certificate authority). For 'open' PKIs in which anyone can request such an attestation (universally embodied in a cryptographically protected identity certificate), the possibility of mistaken attestation is non trivial. Commercial PKI operators have suffered several publicly known problems. Such mistakes could lead to falsely signed, and thus wrongly attributed, documents. 'closed' PKI systems are more expensive, but less easily subverted in this way.
  • Fifth, users (and their software) must carry out the signature protocol properly.

Only if all of these conditions are met will a digital signature actually be any evidence of who sent the message, and therefore of their assent to its contents. Legal enactment cannot change this reality of the existing engineering possibilities, though some such have not reflected this actuality.

Legislatures, being importuned by businesses expecting to profit from operating a PKI, or by the technological avant-garde advocating new solutions to old problems, have enacted statutes and/or regulations in many jurisdictions authorizing, endorsing, encouraging, or permitting digital signatures and providing for (or limiting) their legal effect. The first appears to have been in Utah in the United States, followed closely by the states Massachusetts and California. Other countries have also passed statutes or issued regulations in this area as well and the UN has had an active model law project for some time. These enactments (or proposed enactments) vary from place to place, have typically embodied expectations at variance (optimistically or pessimistically) with the state of the underlying cryptographic engineering, and have had the net effect of confusing potential users and specifiers, nearly all of whom are not cryptographically knowledgeable. Adoption of technical standards for digital signatures have lagged behind much of the legislation, delaying a more or less unified engineering position on interoperability, algorithm choice, key lengths, and so on what the engineering is attempting to provide.

Legal aspects

Legislation concerning the effect and validity of digital signatures includes:

China

  • Electronic Signature Law of the People's Republic of China (Chinese) - The stated purposes include standardizing the conduct of electronic signatures, confirming the legal validity of electronic signatures and safeguarding the legal interests of parties involved in such matters.

Brazil

  • Medida provisória 2.200-2 (Portuguese) - Brazilian law states that any digital document is valid for the law if it is certified by ICP-Brasil (the official Brazilian PKI) or if it is certified by other PKI and the concerns parties agree with the validity of the document.

European Union and the European Economic Area

  • European Union Directive establishing the framework for electronic signatures:
    • Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic signatures.
    • Commission Decision 2003/511/EC adopting three CEN Workshop Agreements as technical standards presumed to be in accordance with the Directive
  • Implementing laws: Several countries have already implemented the Directive 1999/93/EC.
    • Austria
      • Signature Law, 2000
    • Belgium
      • Signature Law, 2001
    • Czech Republic
      • Act on Electronic Signatures, 227/2000
    • England, Scotland and Wales
      • Electronic Communications Act, 2000
    • Germany
      • Signature Law, 2001
    • Lithuania
      • Law on electronic signature, 2002
    • Norway
      • Electronic Signature Act, 2001 (in Norwegian).
    • Slovenia
      • Electronic Business and Electronic Signature Act (in Slovene) .
    • Spain
      • Ley 59/2003 , de 19 de diciembre, de firma electrónica (in Spanish).
    • Sweden
      • Qualified Electronic Signatures Act (SFS 2000:832) (in Swedish).
      • SFS 2000:832 in English translation

India

  • Information Technology Act, 2000
  • (PDF) India's Information Technology Act, 2000

New Zealand

  • Electronic Transactions Act, 2003 sections 22-24

United Nations Commission on International Trade Law

  • UNCITRAL Model Law on Electronic Signatures (2001), a strong influence in the field.

United States

  • Uniform Electronic Transactions Act (UETA)
  • Electronic Signatures in Global and National Commerce Act (E-SIGN), at 15 U.S.C. 7001 et seq.

Russian Federation

Federal Law of Russian Federation about Electronic Digital Signature (10.01.2002)

The Law regulates the activity of Certificate Authorities and conditions for practical application of Digital Signature. However, the Law does not correspond to the recommendations of WTO, UNCITRAL and other influential organizations. Digital Signature Systems described in this Law are not compatible with international standards. This is the main reason, why the Law will be overwritten. Amendments should simplify the procedure of Digital Signature use.

Switzerland

  • Federal Law on Certification Services Concerning the Electronic Signature, 2003

Uruguay

Uruguay laws include both, electronic and digital signatures:

  • Concerning passwords or adequate information technology gestures
  • Concerning electronic and digital signature and PKI

Legal cases

Court decisions discussing the effect and validity of digital signatures or digital signature-related legislation:

  • In re Piranha, Inc., 2003 WL 21468504 (N.D. Tex) (UETA does not preclude a person from contesting that he executed, adopted, or authorized an electronic signature that is purportedly his).
  • Cloud Corp. v. Hasbro, 314 F.3d 289 (7th Cir., 2002) (E-SIGN does not apply retroactively to contracts formed before it took effect in 2000. Nevertheless, the statute of frauds was satisfied by the text of E-mail plus an (apparently) written notation.)
  • Sea-Land Service, Inc. v. Lozen International, 285 F.3d 808 (9th Cir., 2002) (Internal corporate E-mail with signature block, forwarded to a third party by another employee, was admissible over hearsay objection as a party-admission, where the statement was apparently within the scope of the author's and forwarder's employment.)