qualified e-signature long-term security

Question

I'm considering to obtain a QES (Qualified electronic signature). But I'm concerned about long term security.

The hypothetical scenario is lets say after 10-15 years the algorithms are cracked or computers become too fast or whatever which allows somebody to produce fake signatures or modify existing documents.

What if somebody produces a document that appears signed by my QES during the time of its validity that puts me under some obligations I didn't actually agree to?

Are there technical or legal protections in such a scenario?

Answer 1

I'm concerned about long term security.

It is understandable. There are many different aspects here.

How secure are the algorithms?

To some extent, it is a matter of trust, in the sense that it cannot be formally proved like a mathematical theorem. Digital signature is based on applying transformations that are easy to do in one direction, but practically impossible to do in the inverse direction. Such problems like factoring of big numbers (used in RSA) or finding a discrete logarithm (in ECC, which is more often used now days than RSA) have no analytical solution. The only way to solve them is brute-forcing. The parameters are chosen in such way that even if the whole computing power in the world is used, the brute-forcing would take millions of years to find out a single private key.

Advances in cryptography (see diagram) allowed brute-forcing of RSA 512 and RSA 768 bits (see details here). But there are no further essential advances. There are recommendations for key length from institutions like NIST (USA), BSI (Germany). For instance, BSI recommends for the year 2023 at least 120 bit strength. This corresponds approximately to RSA key length of 2800 bits and ECC key length of 240 bits.

Despite researches of many mathematicians and cryptologists there are no known weaknesses in the used algorithms and they are considered to be secure. Secure in the sense that there is no analytical approach that can reduce brute-forcing to the acceptable amount.

Theoretically, the currently used algorithms can be broken by quantum computers. Broken in the sense, that brute-forcing can require essentially less computing power and essentially less time. Practically, currently we are far from building and running them. See, for instance:

• Will IBM's Condor quantum processor run Shor's Algorithm to crack a 256-bit Elliptic Curve key?
• Quantum computer threats to modern cryptography

There are currently works to establish standards for algorithms that are resistant to quantum computers. See overview at Wikipedia and standardization process at NIST.

Key management

Even if we believe that the algorithms used are secure and cannot be currently brute-forced, there are some other important aspects:

• Certificate validity period: Usually certificates are issued for some relatively short period like one year. In particular, this limits potential problems if the private key was stolen. Digital signature contains in particular a timestamp provided by a reliable party with its own signature. That's why if the attacker has you private key, it is impossible to create signatures with past dates.
• Certificate authority: You should trust it. There were CAs that became non-trusted. For instance, DigiNotar has issued more than 500 fake certificates.
• Keeping private keys: Security depends also on how secure you keep your private key. If you believe it was compromised, you should revoke your certificate as soon as possible.

Legals aspects

Legals aspects are off-topic on this site. You can ask them at the Law SE.