[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: legal question about certs
Brian Thomas said:
>The major assumption which no one has challenged until now, and you,
>Carl, have done it somewhat obliquely, is that an identity cert binds a
>key to a person. This is absolutely not true, as the draft points
>out. The laws of mathematics bind a key to a person; the identity cert
>binds the key to a name which may or may not be the person you think it
>is. The matter in question is not whether the key belongs to the name,
>but whether the name belongs to the person. The issuer must show that
>the legal entity unambiguously named in the certificate possessed the
>key, not that the keyholder approved of the certificate issuance. My
>strong feeling about this is that presentation of a certificate, and
>use of the privileges thereby granted, constitutes acceptance of it.
Well, very nearly correct, at least as far as the ABA guidelines would
apply. The issuer must establish that the subscriber, either the subject OR
HIS LEGALLY AUTHORIZED AGENT, possesses effective control of the private
key, and should insist on the subscriber signing a piece of innocuous text
to establish that fact prior to being issued the certificate. But in the
case of corporations, etc., the authorized agent can substitute for the
subject "keyholder."
Explicit acceptance is highly desirable, but as you indicate beneficial
usage or self-publication constitutes implicit acceptance, so long as it can
be independently established that it is really the identified subject that
is using it. From the standpoint of the issuer's liability, they ought to
get an explicit acknowledgment of acceptance, and as I indicated earlier,
using the same digital signature that is being certified by the certificate
being issued raises some serious problems of circularity.
>
>Ed Gerck's example does not illustrate his point but the opposite. If
>I did not sign the certificate granting me access to the damaged site,
>there is no reason whatever to suppose that I had anything to do with
>the intrusion. My signature on the cert would give more reason to
>suspect me, but even so, someone would have to prove that I alone
>possessed the private key, which would require (at minimum) evidence
>that I had used it - which evidence could not be gathered without my
>cooperation at some point. This does nothing more than highlight the
>extreme responsibility of anyone issuing identity certs, and the
>extreme caution one must take in relying on them.
>
>To summarize, then, my signature on a certificate does not protect me;
>it only protects the issuer from liability for statements signed by my
>key, and then only in the presence of acceptable evidence that I (the
>legal, prosecutable, physical I) had exclusive possession of the
>associated private key. Rules of evidence must be carefully crafted
>for this, in light of technological realities; I don't envy those in
>this position.
Your are quite correct on this point, and that is why most (but
unfortunately not all) states that have adopted digital signature
legislation have carefully defined the duty of the subscriber to protect the
secrecy of his private keys, and to make it a rebutable presumption that a
digital signature is the result of a volitional, witting act of the
subscriber identified in the certificate.
In nearly all of the scenarios I can think of, the subscriber receives the
benefit of the digital signature, and loaning his key to someone else would
normally work to his detriment. However, there are perhaps some
circumstances (e.g., I get my secretary to sign my time card while I am off
playing golf) where this is not true, and for those applications the use of
some form of biometrics may be required.
The issue of how digital signatures will be accepted in criminal,
evidentiary proceedings has not yet been thoroughly examined, except perhaps
in the case of fraud. It's one thing to say that if someone is reckless or
negligent with his keys, or deliberately loans them out, he should be held
liable for any transactions so signed.
But it is quite something else to say that in addition to whatever civil
liability may obtain that person should be found guilty of a criminal
violation or law. The burden of proof -- "beyond reasonable doubt" -- is
going to be much higher.
Bob