2

I have noticed that most digital signature providers do not try to certify anything but an e-mail address, while it is quite easy to create an email address without disclosing any personal information.

Thus, I may know the e-mail address of a signatory and nothing else.

If a legal dispute occurs, how do I know who really holds the e-mail address ? How to avoid repudiation ?

Why is it that apparently nobody cares ?

Actually some people do care, especially in Italy (I let you figure out why). In particular, infocert.it proposes web recognition.

(https://www.firma.infocert.it/prodotti/firma-digitale.php?_ga=1.152428668.492019680.1448886434)

See also

http://www.agendadigitale.eu/identita-digitale/700_come-funzionera-il-sistema-di-identita-digitale-italiano.htm

in summary, you would get a digital ID after showing you real ID to somebody, possibly an official.

In Belgium, they (propose to) put a certificate into the ID card.

An intermediary way (safer than email, lighter than de visu recognition or making all ID cards smart) could be based on mobile GSM phone, as it is not normally possible (?) to buy a SIM card without showing one's ID and the buyer is responsible for its use and can revoke it in case of loss.

Do you know about digital signature based on SIM card ? Google gives some answers but I found nothing practical.

I am interested in practical solutions but also theoretical advice please.

closed as unclear what you're asking by Rory Alsop Dec 31 '15 at 12:25

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Please be more concise with your questions. You start by asking one question('If a legal dispute occurs, how do I know who really holds the e-mail address ?'), then ask an opinion based question ('Why is it that apparently nobody cares ? '), then continue with inconsequential supporting information, and finally finish by asking a question designed to provoke discussion('Do you know about digital signature based on SIM card ?'). If you can pick one question that does not require a discussion to answer and leave out unnecessary info, it would be much easier to understand/answer. – cremefraiche Dec 1 '15 at 2:42
0

This is essentially the same issue with Domain Validated SSL certificate. A domain validated certificate or email identity certificate asserts that you're talking to a system/someone authorized to use the domain/email address but doesn't tie the address with any real world identity.

A DV or email address only certificate cannot be used to verify whether the owner of the address is a decent person to do whatever business you want to do with them or that the person/entity behind the certificate is who you think they are. You're still left to yourself to determine whether the email address you've got is the correct email address of the person you want to communicate with.

The worth of email certificate is that it simplifies verification of the certificate because part of the checking process had already been done by the certificate authority. The certificate authority has checked that the certificate belongs to the authorized owner of the email address. So all you need to do is to check that the certificate belongs to the person in front of you.

If you meet someone you trust in person and he tells you his email address and where to get his certificate, you can verify that the certificate can be used to send email to the owner of that address without them having to read out the certificate fingerprint in person (as would be necessary with GPG if you don't already have a connection through web of trust).

There are several problems here. If you don't trust the person, then you don't have any reason to trust their assertion that the email address really belongs to them. However you can still be sure that if the person doesn't actual own the email address, he won't be able to receive any emails sent to that address or send any signed email from that address, as he presumably don't have the private key corresponding to that email address, and the certificate authority wouldn't have issued it to him.

If you don't trust the person's assertion of his email address, you can simply send an email to the address with a secret word and if he can read the secret word to you in person, you can be sure that the person standing in front of you had the private key corresponding to the certificate.

Not the answer you're looking for? Browse other questions tagged or ask your own question.