0

We are looking for a solution to meet the needs of a UK incorporated charity (CIO) that has three to seven trustees from at least three continents.

Obligations as trustees of a board include signing (by a quorum of the trustees):

  • minutes of trustee meetings and AGMs
  • annual accounts
  • decisions and press releases
  • deeds (eg of retirement and appointment)
  • contracts (eg bank accounts and employment contracts)
  • and registers (what happened / didn't happen, etc).

While there's been lots said about eIDAS, our experience (with other charities) has been rather less exciting: our experience has been that, despite eIDAS, every solicitor we've had to deal with has expected QES (or insisted upon a paper-based identity process) despite many saying things like "there are no documents that require use of Qualified Electronic Signatures in the UK". Even more so, we are aware that the Land Registry really doesn't accept electronic/digital signatures at all (unless you are a registered conveyancer).

If we had no prior experience, we wouldn't be aware of the issues at all, but having been embroiled in an investigation as to who was present at a meeting of another charity; who signed the minutes, and who did not - it became clear that we definitely need to establish both identity and corresponding signatures tied to that identity.

Here's the kicker: I'm looking for a non-commercial approach in order to spend as little money as possible.

We cannot feasibly use snail mail to garner signatures (though we could do that with establishing identities).

If we manage to gather proof of identity (using all the normal hard-copy tricks of having a notary sign that the copy is a genuine copy, etc), then use some method to provide a secure chain (via some form of certificate) of those identities, and then we use that to generate a set of related certificates, could we not therefore have something which says "this person has signed this document, given that they have (1) a private key that is directly dependant upon (2) the certificate against these documents which have been uniquely identified as being who they say they are?

... I guess I'm asking, is it possible to hand-roll an identity/digital signature service, bearing in mind that the purpose of this is only to be able to prove identity internally, or if required by legal?

... Otherwise, is there a methodology or approach which isn't so commercially out of reach that we can afford it?

I’m really looking for guidance - like a guide, and mechanism(s) for this. I’m not so interested in COTS - but wouldn’t reject it out of hand. For the sake of the question - I’m looking for ideas and approaches rather than adverts or commercial service recommendations.

0

1 Answer 1

0

Disclaimer: IANAL

Technically, there is little to no difference between a free certificate (like letsencrypt ones), a certificate that you produce yourself, and an eIDAS level 3 one.

The only difference is who guarantees that the certificate is authentic, whether it is guaranteed that at any moment only the legitim owner could have and use the certificate, and how it can be proven. At that point, it becomes an organizational question and starts with secure generation procedures and ends with a personal delivery between an identified trusted actor and the final recipient. And all that is costly...

But most laws (I know it is true for UE, and think it is still true for UK) require a guaranteed personal delivery on a hardware device for a x509 certificate to legaly replace a hand written signature. Because if is the condition for non-repudation, meaning that the owner of a certificate is liable for any usage of the certificate.

Said differently, I think that you could try to ask about it on Law, because the problem cannot be solved by technical ways.

1
  • thanks for this. Can I ask you to expand somewhat - for instance, if we were to store a legally verified digital copy of all our identities, and then digitally sign it (via a non-repudiable source) could we then derive a CA based on that, (or use it as the basis of an intermediate certificate, such that we can derive trustee certificates, or am I being crazy?
    – Konchog
    Jan 17 at 17:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.