The context is using digitally signed webservices (with XML-DSIG for example) for e-government interoperability between databases.

The idea is to give endorsement to both the data publisher and the data consumer: the data publisher receives signed requests, which ensure the consumer identity, the authenticity of the request, and forbid the repudiation. The same occurs with the response received by the data consumer.

The problem is: who is signing the webservice, and with which legal value? In my country, only "natural" persons are given legal value when digitally signing, and under the principle of being able to read the document before signing it. But obviously a "natural" person isn't able to process and sign every request, so this person has to delegate the signing to the server, with the risk of identity theft it implies.

In this context, do you think this digital signature may be allowed legal value? Do you think any government responsible will accept delegate his digital signature to a server? And the most important: which alternative scheme do you recommend?

  • 1
    This really is a question for a lawyer in your jurisdiction. – schroeder Apr 5 '16 at 14:23
  • I think you answered your own question: the legal framework of your country requires a human to digitally sign after having read a document. So a server cannot, on its own, take the decision to sign the document. Technically there are no particular problems with automating the process. – WoJ Apr 5 '16 at 14:26
  • Thanks, you're both right. Do you know if there is such a mechanism in other countries? Or any alternative mechanism that gives endorsement to both parts? – Sylvain Lesage Apr 5 '16 at 14:43

We are working in this domain for some time. As you've already mentioned - there's a difference between the technical signature (so the systems/databases can rely the data integrity is ensured) and legal value of data itself, where (according the legal framework) legally can sign only a 'natural' person.

Each state effectively 'validates' its own citizens and assures theirs identity (issuing their ID card, passport, authentication and signing certificates). There can be an application certificate issued, but they have no legal signing value. Most of the countries adopt this principle.

Often there's a mutual agreement between organizations to trust their signed data from the applications outside scope of the legal framework. I see many initiative to automate the signing (I'd support myself), but - as WoJ mentioned - the application cannot take own decisions and cannot assume any legal responsibility.

I've seen a system where the responsible person signs a batch (whole list of the document digests) without effectively having time to read all the documents. In this case a Hardware Security Module is used. Still - it is the person who legally takes responsibility so sign the documents.

  • Thanks, I think you're right: we should use "application certificates". Even if it does not provide legal value, I think it would give us strong elements of proof in case of any controversy. – Sylvain Lesage Apr 6 '16 at 3:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.