Is GPG a kind of digital signature?

Question

So I've been using GPG since I've touched Linux&LibreOffice, but I only knew that's its a signature, for identifying the work is created by me. But soon I've been touching some law questions and they've told me to sign documents with cross-authenticated digital signature, which I'm not really sure what it is.

I've done research on cross-authenticated digital signature and digital signature on google, and they seem to show results that are paid service like DigiCert or other members in Adobe Approved Trust List (AATL). So I have a question, why use paid service while GPG is so popular plus it's free? Is that GPG isn't trusted on legal purpose? Or is there any difference between gpg and other digital signature? As GPG also seems to provides owner's email, name, sign date, etc. Then why paid digital signature still exists?

Answer 1

GPG is a tool to solve the technical challenges of authentication, signing, and encryption, and GPG is secure in the technical sense. However, security is not just a technical problem, there's also the issue of trust.

How do you define who to trust? This is not a question that can be answered by the tools, but rather something that the users of the system, in particular, the relying parties need to decid for themselves. So you need to ask the relying parties who they'll trust to attest to your claim.

The trust made on a system does not necessarily translate to trust in the person using the system. Also, the trust on the system to be usable to make a particular claim doesn't necessarily cover all possible claims.

For a more concrete example, a GPG signature by itself cannot be used to make claims about time as you could've made the signature at any time before or after the time you claimed you made the signature (the timestamp in a GPG signature is easily forged by the author). To prove time to a third party, you may need another system like a timestamping server, publishing hash, or some knowledge that could not have been acquired before a particular time to make certain claims on time and that you actually have a certain data before a certain time. An example of where this could be relevant is for making claims that you authored a certain material by publishing proof of timestamp, GPG alone isn't sufficient to do that, although GPG can be used as part of a system to prove that.

Also, legally speaking, a court may decide that certain evidence are inadmissible for certain scenario just because they don't understand how the proof works, even though technically it should be sufficient to prove your claim. You may be able to fight the long battle for a judicial review to convince the court that your proof works, but it could've been massively easier to supplant it with methods that have already well established legal precedents rather than doing something novel.

Answer 2

Anyone can make a pair of cryptographic keys that provide digital signing.

Anyone can claim that a private key they have is the private key of the pope. (They'd probably be lying, of course, which is my point.)

The value of cross-authenticated signatures is that you have a third party saying that your public key is indeed yours.

This provides an extra level of non-repudiation. If you want to take credit for something that has been signed, you probably don't need a cross-authenticated digital signature. Just prove that you have access to the same private key that matches the signature by signing something else.

However, if someone else wants you to sign something, then later prove that you did indeed use your own private key for that, they need a third party to demonstrate that the private key did belong to you at the time. Otherwise you could just say it wasn't you, and stop using that key pair.