Digital Signature - The Current State of Use — Legal and Practical

The Current State of Use — Legal and Practical

Digital signature schemes share basic prerequisites that— regardless of cryptographic theory or legal provision— they need to have, meaning:

1. Quality algorithms

   Some public-key algorithms are known to be insecure, practical attacks against them having been discovered.

2. Quality implementations

   An implementation of a good algorithm (or protocol) with mistake(s) will not work.

3. The private key must remain private

   if it becomes known to any other party, that party can produce perfect digital signatures of anything whatsoever.

4. The public key owner must be verifiable

   A public key associated with Bob actually came from Bob. This is commonly done using a public key infrastructure (PKI) and the public keyuser association is attested by the operator of the PKI (called a certificate authority). For 'open' PKIs in which anyone can request such an attestation (universally embodied in a cryptographically protected identity certificate), the possibility of mistaken attestation is nontrivial. Commercial PKI operators have suffered several publicly known problems. Such mistakes could lead to falsely signed, and thus wrongly attributed, documents. 'closed' PKI systems are more expensive, but less easily subverted in this way.

5. Users (and their software) must carry out the signature protocol properly.

Only if all of these conditions are met will a digital signature actually be any evidence of who sent the message, and therefore of their assent to its contents. Legal enactment cannot change this reality of the existing engineering possibilities, though some such have not reflected this actuality.

Legislatures, being importuned by businesses expecting to profit from operating a PKI, or by the technological avant-garde advocating new solutions to old problems, have enacted statutes and/or regulations in many jurisdictions authorizing, endorsing, encouraging, or permitting digital signatures and providing for (or limiting) their legal effect. The first appears to have been in Utah in the United States, followed closely by the states Massachusetts and California. Other countries have also passed statutes or issued regulations in this area as well and the UN has had an active model law project for some time. These enactments (or proposed enactments) vary from place to place, have typically embodied expectations at variance (optimistically or pessimistically) with the state of the underlying cryptographic engineering, and have had the net effect of confusing potential users and specifiers, nearly all of whom are not cryptographically knowledgeable. Adoption of technical standards for digital signatures have lagged behind much of the legislation, delaying a more or less unified engineering position on interoperability, algorithm choice, key lengths, and so on what the engineering is attempting to provide.

See also: ABA digital signature guidelines