1

If I as layman don't err, there are in banking controls, from both internal and national oversights, of the work done by the employees. These are apparently effective, since the details of transactions can be audited and verified from recordings. Are there essentially comparable controls of the work of the employees involved in digital signatures, taking consideration also of the fact that in many cases more than one CAs are involved in a transaction?

I just found an interesting article on digital signatures: D. Adamski et al.: Why Digital Signatures Fail - Legal Concepts for Long Term Validity in Austria, Germany and Poland, in A. U. Schmidt et al., Long-Term and Dynamical Aspects of Information, pp. 113-124, Nova Sci. Publ., 2007.

  • If you look at most CA's Certification Practice Statements (CPS's), then you will find they don't warrant anything and they shed all (or nearly all) liability. For example, see Apple Inc. Certification Authority Certification Practice Statement, Sections 2.1, 2.4 and 2.5. Essentially, their own lawyers tells us they are not trustworthy. I'd be delighted if someone would point me to a mainstream CA's CPS that offers proof by contradiction. It also depends on a reasonable definition of trust (its very hard to define). – jww Jun 20 '14 at 15:44
1

See Webtrust for an introduction on what is usually done with CA.

A core point is that in many countries, banks must comply to existing regulations enforced by dedicated administrations. Such regulations and systems are still nascent in the case of certificate authorities and digital signatures; so the situation is not clarified yet. One can expect that common controls will emerge at some point (come back in 40 years or so...).

In the mean time, each actor in the business of signatures will have its own requirements and contractual engagements. For instance, Microsoft, in their Root Certificate Program, list a number of requirements, including:

The CA must complete an audit and submit audit results to Microsoft every twelve (12) months. The Audit must cover the full PKI hierarchy that will be enabled by Microsoft through the assignment of Extended Key Usages (EKUs). All certificate usages that we enable must be audited periodically. The audit report must document the full scope of the PKI hierarchy including any sub-CA that issues a specific type of certificate covered by an audit. Eligible audits include:

Anyway, the ultimate goal for a digital signature system is to revert the burden of proof: if there is a dispute between two parties A and B, A claiming that a given signature (purportedly by B) binds B, while B pretends that the signature is fake (or could have been forged, hence cannot be considered binding), then the digital signature system is "strong" if the judge estimates that it is up to B to prove the potential fakeness of the signature, while A can just sit and watch. All the controls and regulations and audits and InfoSec frameworks are means by which this goal may be achieved, within a legal framework which:

  1. depends on the jurisdiction, and
  2. does not exist yet (or not fully) in many jurisdictions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.