Digital signature

Encyclopedia : D : DI : DIG : Digital signature

Digital signature is a term with confusing referents. It is generally taken to be a 'subset' of electronic signatures.[The University of Virginia][State of WI][National Archives of Australia][CIO] But some people use the term to describe something equivlent to electronic signature. As does this legislation.

`electronic signature' means an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record.[US ESIGN Act of 2000] This is the definition given by the U.S. Electronic Signatures in Global and National Commerce Act of 2000.

Or it can be used as a broader term encompassing message authentication codes, file integrity hashes and digital pen pad devices.

in this article digital signature is used to mean a cryptographically based signature assurance scheme. Many have been proposed, some have been found to be flawed and are not used. Some are covered by patents, some were covered by patents which have expired, and some are free of patent license requirements, though there is some disagreement on this point amongst those with commercial interests.

Digital signatures are often used in the context of PKI) schemes in which the public key used in the signature scheme is tied to a user by a digital identity certificate issued by a certificate authority, usually run by a commercial firm. PKI systems use asymmetric key cryptography to record the binding of user information to a public key. There are several digital signature schemes; most establish two complementary algorithms, one for signing and the other for checking after signing. The output of the signature process is also called a digital signature.

The term electronic signature, although sometimes used for the digital signatures discussed here, has had a distinct meaning in common law: it refers to any of several, not necessarily cryptographic, mechanisms for identifying the originator of an electronic message. Electronic signatures found valid by courts have included cable and Telex addresses, as well as FAX transmission of handwritten signatures on a paper document. It is said that this is the reason both the UETA (US State law), and the US Federal Electronic Signatures in Global and National Commerce Act refer only to electronic signatures. As the security (and workability) of the digital signatures discussed here are quite different than other kinds of electronic signatures, these legal usages present problems in practice.

Contents

Benefits of Digital Signatures

There are three common reasons for applying a digital signature to communications:

Authenticity

Public-key cryptosystems allow encryption of a message with a user's private key. The message need not be sent in ciphertext. If a hash of the document is generated and and then encrypted, the document cannot be altered in any way without changing the hash, which, if quality algorithms are properly used, will be quite difficult. By decrypting the hash using the sender's public key, and checking the result against a newly generated hash of the plaintext, the recipient can confirm (with high confidence) that the encryption was done with the sender's private key (and so presumably by the user who should be the only person able to use that key), and that the message hasn't been altered since it was signed. The recipient cannot be absolutely certain the sender is indeed the signer -- ie the person who used the private key -- since the cryptosystem may have been broken, the key copied, or obtained using social engineering.

The importance of high confidence in both the message integrity and sender authenticity is especially obvious in a financial context. For example, suppose a bank's branch office sends instructions to the central office in the form (a,b) where a is the account number and b is the amount to be credited to the account. A devious customer may deposit £100, observe the resulting transmission and repeatedly retransmit (a,b), getting a deposit each time. This is a replay attack.

Integrity

Both parties will always wish to be confident that a message has not been altered during transmission. Encryption of the message makes it difficult for a third party to read it, but that third party may still be able to alter it, perhaps maliciously. An example is the homomorphism attack: consider a bank which sends instructions from branch offices to the central office in the form (a,b) where a is the account number and b is the amount to be credited to the account. A devious customer may deposit £100, intercept the resulting transmission and then transmit (a,b³) to become an instant millionaire.

Non-repudiation

In a cryptographic context, the word repudiation refers to the act of disclaiming responsibility for a message (ie, claiming it was sent by a third party). A message's recipient may insist the sender attach a signature in order to prevent later repudiation, since the recipient may show the message to a third party to reinforce a claim as to its origin. Loss of control of a user's private key will mean that all digitally signatures using that key become suspect. Short of special purpose protocols, digital signatures alone cannot provide inherent non-repudiation.

Implementation of Public-key digital signatures

Public-key digital signature schemes rely on public-key cryptography. In public-key cryptography, each user has a pair of keys: one public and one private. The public key is distributed freely, but the private key is kept secret and confidential; another requirement is that it should be computational infeasible to derive the private key from the public key.

Generally, digital signature schemes include three algorithms:

A key generation algorithm
A signing algorithm
A verification algorithm

For example, consider a situation in which Bob sends a message to Alice and she wants to be able to prove it came from him. Bob sends his message to Alice, attaching a digital signature. The digital signature is generated using Bob's private key, and takes the form of a numerical value (normally represented as a string of binary digits). On receipt, Alice can then check whether the message really came from Bob by running the verification algorithm on the message together with the signature, using Bob's public key. If they match, then Alice can be confident that the message really was from Bob, because quality digital signature algorithms are so designed that it is very difficult to forge a signature to match a given message (unless one has knowledge of the private key, which Bob has kept secret).

Association of digital signatures and encryption

Digital signatures use encryption techniques but typically are not used to encrypt; more efficient methods are available. Of course a signed document may be sent via an encrypted communication channel just as any other message.

More usually, Bob first applies a quality cryptographic hash function to the message and then signs the resulting hash (see diagram). An insecure hash can compromise the digital signature. For example, if it is possible to generate hash collisions, then it might be feasible to forge digital signatures.

There are several reasons to sign such a hash (or message digest) instead of the whole document.

For efficiency: It makes the signature much shorter and thus saves time since hashing is generally much faster than signing in implementations.
The document is intended to be read by others: E.g., diplomas, birth certificates, identity certificates, driver's licenses, a contract establishing ownership of something, etc... These documents will be in plain text but a digital signature can be used to verify that they are neither forged nor altered.

Using separate key pairs for signing and encryption

In several countries, a digital signature has something like the legal status of a normal signature. This means that what is digitally signed legally binds the signer of the document to the terms therein. For that reason, it is often thought best to use separate key pairs for encrypting and signing. Using the encryption key pair a person can engage in an encrypted conversation (e.g. about buying a house) but does not legally sign every message he sends. Only when both parties come to an agreement they sign a contract with their keys for signing and only then they are legally bound to that specific document. After signing, the document can be sent over the encrypted link.

Association of digital signatures and trusted time stamping

The fact that something is digitally signed does not provide certainty about the date and time at which it was signed. The signer might, or might not, have included a time stamp with the signature, or the document itself might have a date mentioned on it, but the reader cannot be sure that the signer did not, for instance, backdate the date of the signature. Such misuse can be accomplished using trusted time stamping which can be implemented in addition to digital signatures, but is not automatically included with basic digital signatures schemes.

Additional security precautions

Putting the private key on a smart card

All public key / private key cryptosystems depend entirely on keeping the private key secret. The private key can be stored on a user's computer, and protected by, for instance, a local password but this has two disadvantages:

the user can only sign documents on that particular PC and
the security of the private key completely depends on the security of the PC, which is notoriously unreliable for many PCs and operating systems.

A more secure alternative is to store the private key on a smart card. Many smart cards are deliberately designed to be tamper resistant. In a typical implementation, the hash calculated from the document is sent to the smart card, whose CPU encrypts the hash using the stored private key of the user and returns it. Usually a user must activate his smart card by entering a personal identification number or PIN code (thus providing a two-factor authentication). Note that the private key never leaves the smart card. If the smart card is stolen, one still needs the PIN code to be able to generate a digital signature. This reduces the security of the scheme to that of the PIN system, but is nevertheless more secure than many PCs against attack.

Using smart card readers with a separate keyboard

To enter the PIN code to activate the smart card, a numeric keypad is needed. Some card readers have their own numeric keypad. This is safer than using a card reader integrated in a PC and entering the PIN using the computer's keyboard. A computer might do some form of keystroke logging (be it intended or unintended (due to a virus, for instance) by its owner) so that the PIN code is compromised. Specialized card readers are more protected against tampering with their software or hardware. Eavesdropping attacks against such equipment is of course possible.

Other smart card designs

Smart card design is an active field, and their smart card schemes avoid these particular problems, though sometimes introducing others.

Some digital signature algorithms

Full Domain Hash, RSA-PSS etc., based on RSA
DSA
ECDSA
ElGamal signature scheme
Undeniable signature
SHA (typically SHA-1) with RSA
Rabin signature algorithm
Pointcheval-Stern signature algorithm
Schnorr signature

The current state of use — legal and practical

Digital signature schemes all have several prior requirements without which no such signature can mean anything, whatever the cryptographic theory or legal provision.

First, quality algorithms. Some public-key algorithms are known to be insecure; practicable attacks against them having been identified.
Second, quality implementations. An implementation of a good algorithm (or protocol) with mistake(s) will not work.
Third, the private key must remain actually secret; if it becomes known to some other party, that party can produce perfect digital signatures of anything whatsoever.
Fourth, distribution of public keys must be done in such a way that the public key claimed to belong to Bob actually belongs to Bob, and vice versa. This is commonly done using a public key infrastructure and the public key[\leftrightarrow]user association is attested by the operator of the PKI (called a certificate authority). For 'open' PKIs in which anyone can request such an attestation (universally embodied in an identity certificate), the possibility of mistake is non trivial. Commercial PKI operators have suffered several publicly known problems. Such mistakes could lead to falsely signed, and thus wrongly attributed, documents.
Fifth, users (and their software) must carry out the signature protocol properly.

Only if all of these conditions are met will a digital signature actually be evidence of who sent the message.

Legislatures, being importuned by businesses expecting to profit from operating a PKI, or by the technological avant-garde advocating new solutions to old problems, have enacted statutes and/or regulations in many jurisdictions authorizing, endorsing, encouraging, or permitting digital signatures and providing for (or limiting) their legal effect. The first appears to have been in Utah in the United States, followed closely by the states Massachusetts and California. Other countries have also passed statutes or issued regulations in this area as well and the UN has had an active model law project for some time. These enactments (or proposed enactments) vary from place to place, have typically embodied expectations at variance (optimistically or pessimistically) with the state of the underlying cryptographic engineering, and have had the net effect of confusing potential users and specifiers, nearly all of whom are not cryptographically knowledgeable. Adoption of technical standards for digital signatures have lagged behind much of the legislation, delaying a more or less unified engineering position on interoperability, algorithm choice, key lengths, etc and so on what the engineering is attempting to provide.

Legal aspects

Legislation concerning the effect and validity of digital signatures includes:

China

[Electronic Signature Law of the People's Republic of China (Chinese)] - The stated purposes include standardizing the conduct of electronic signatures, confirming the legal validity of electronic signatures and safeguarding the legal interests of parties involved in such matters.

Brazil

[Medida provisória 2.200-2 (Portuguese)] - Brazilian law states that any digital document is valid for the law if it is certified by ICP-Brasil (the official Brazilian PKI) or if it is certified by other PKI and the concerns parties agree with the validity of the document.

Uruguay

Uruguay laws include both, electronic and digital signatures:

Legal cases

Court decisions discussing the effect and validity of digital signatures or digital signature-related legislation:

In re Piranha, Inc., 2003 WL 21468504 (N.D. Tex) (UETA does not preclude a person from contesting that he executed, adopted, or authorized an electronic signature that is purportedly his).
Cloud Corp. v. Hasbro, 314 F.3d 289 (7th Cir., 2002)[link] (E-SIGN does not apply retroactively to contracts formed before it took effect in 2000. Nevertheless, the statute of frauds was satisfied by the text of E-mail plus an (apparently) written notation.)
Sea-Land Service, Inc. v. Lozen International, 285 F.3d 808 (9th Cir., 2002) [link] (Internal corporate E-mail with signature block, forwarded to a third party by another employee, was admissible over hearsay objection as a party-admission, where the statement was apparently within the scope of the author's and forwarder's employment.)

References

External links

Public-key cryptography [edit]

Algorithms: Cramer-Shoup | DH | DSA | ECDH | ECDSA | EKE | ElGamal | GMR | MQV | NTRUEncrypt | NTRUSign | Paillier | Rabin | Rabin-Williams | RSA | Schnorr | SPEKE | SRP | XTR

Theory: Discrete logarithm | Elliptic curve cryptography | RSA problem

From Wikipedia, the Free Encyclopedia. Original article here. Support Wikipedia by contributing or donating.
All text is available under the terms of the GNU Free Documentation License See Wikipedia Copyrights for details.