Subject: Re: Legal entities who sign

From: "Jimi Thompson" <[email-masked]>
Date: Sat, 2 Nov 2002 00:44:21 -0800

<SNIP>
> According to "e-lawyers", legal entities cannot sign as even
> a delegated signer must be physical person.
</SNIP>

IMHO, secretaries and/or administrative assistants have been signing
documents for their CEO's for decades.  I know of several that are so good
that the signatures are virtually indistinguishable.  How is this any
different that having the CEO have more than one i-key (for example) so that
his assistant can sign documents in his absence?

Is the CEO really the ONLY person on the planet that has signing authority
for the company?  Most certainly not in the case of an ink signature.  All
sorts of people throughout any company have the ability to sign things.  In
legal-ese, authorized agents abound.  Procurement people sign things every
day, using their own pen-and-ink signature, but binding the company.
Shipping and receiving folks sign things every day, using their own
signature, also binding the company.  Most of these folks have a limit of
some kind on what they are allowed to sign.  Procurement folks, for example,
usually have a dollar limit.  I think that the real question is how to
include the limits and/or parameters into the certificate ( i.e. JoeBob's
certificate from Procurement at XYZ Corp is good but only up to $5000.00).
The XML folks might have some answers there.

In order to establish non-repudiation, I would say that you probably need to
have the CEO sign the authorized agents signature agreeing that they are
authorized under the parameters issued.  This should satisfy the
"non-repudiation" needs and still provide for statement about delegation of
authority.  I think that this solves your problem, as the only time a CEO's
key is needed would be to authorize a new agent.  The other, more accessible
people, would be available to handle day to day business.

You have a live human signing documents, which makes the "e-lawyers" happy.
It handles the "real world" delegation of authority that happens inside
companies.  I think that this solution satisfies all the criteria.  If I've
missed something, I'm sure that someone on the list will happily point it
out :)

Just my extremely humble 2 cents,

Jimi

---

From: J Adrian Pickering <[email-masked]>
Date: Sat, 02 Nov 2002 16:44:29 +0000

At 08:44 02/11/2002, Jimi Thompson wrote:

>signature, also binding the company.

They should not really be signing with their own signature but one 
identifying them in their delegated role. Most people have a repertoire of 
signatures which they use according to the role they are performing. The 
'forgery' you suggest above is, of course, OK because the person doing it 
acting in the role the CEO is allowing them to be: the CEO would not deny 
it is his/her own signature because of the relationship of trust that 
exists. It is a shame that this sort of signature use is necessary! Also, I 
hope most CFOs do not use the same signature on their personal cheques as 
printed on the corporate ones!

>   Most of these folks have a limit of

Again, in an earlier version of this thread, I was asking why Attribute 
Certificates do not seem to being treated as the solution to this. The 
individual signs in their role. The CEO and the company manage the 
delegation/authorisation matters internally and individuals qualify their 
signatures with them. In the example above JoeBob may sign as a US citizen 
(a certified, live human) and the XYZ-managed AC says he does so as 
Procurement at XYZ Corp with authority to $5k.

Note that this approach does add a benefit that the person signing is a 
'guaranteed real human' and there is a recognised authority attesting to 
this (such as the US government or their agents). This satisifies the 
lawyers. If you combine the individual and the role then you have an 
explosion of certificates for everyone to manage.

>missed something, I'm sure that someone on the list will happily point it

Echoed. I think solutions that map reasonably clearly onto current custom 
and practice have a much better chance of adoption. I know there may be 
better ways of doing this in the future, but we have to engineer solutions 
for the real world to get used to now.

>Just my extremely humble 2 cents,

...and my further 2 pence.

Regards,

Adrian Pickering/
University of Southampton UK

---

From: "Anders Rundgren" <[email-masked]>
Date: Sun, 3 Nov 2002 11:28:20 +0100

Thanx for your comments Jimi, Adrian, Lynn and Raffaello.

My [long-winding] response is probably a bit "orthogonal" as
the question from  _my_ point of view is really how to "map" the
de-facto standard since 20-30 years back, for sending common
e-business documents like purchase orders and invoices between
companies, into PKI.  The de-facto standard constitutes of leased
lines, shared secrets, VPNs, and EDI partner IDs.

BEFORE the advent of PKI, legal issues in _this_ context (with
respect to repudiation of sent documents), were not perceived as
a problem.  The same goes for authorization as the general feeling
is that business documents  that "look authentic", are also assumed
to be "authorized", regardless if the "signature" is an almost
unreadable figure on paper, or just a well-known e-mail address.

TRUST in the sense that you trust your business partners for
"executing" (paying, shipping, selling etc) is, and will _continue_
to be the major business issue.   PKI doesn't not change this.

The PROBLEM: To go from current "crude-but-working" solutions,
to not very well understood PKI-structures depending on a multitude
of CAs and layered external authorization-schemes requires a
_major_ rewrite of all business systems, including support for
entirely new and _extremely_awkward_ business (?)-processes like
add external CA-root, renew external CA-root, set-up certificate
mapping scheme, add external user, remove external user, etc.
My "gut-feeling" tells me this will never happen on a grand scale.

======================================================
- TTP-issued Legal-entity-only-certificates OTOH, simply extend current
  schemes while adding considerable technical strength and trust.

- Properly applied,  such certificates can also enable _globally_working_
  message-based "VPNs", costing FRACTIONS of current alternatives.

- Legal-entity-only signed messages allow adding arbitrarily sophisticated
  authorization data as message _payload_, when and if such data is needed
  and agreed upon, in effect offering a virtually unlimited path to the future.

- Legal-entity-only-certificates do not depend on X.500-directories, neither
  internally nor externally.  An organization may optionally "publish" such a
  certificate on their home-page.

- And then addressing much, much more, including Web Services, privacy,
  archiving, on-line authorization control, client-side PKI independence,
  interoperability, system protection, SAML, etc. etc...
======================================================

               So WHERE do we (the PKI community), go from here?

It's ALIVE!

Although I am moderately impressed with PKI-activities going on
in Sweden, I note with great satisfaction that the Swedish authorities
apparently plan to communicate through nodes equipped with the
authorities' "stamp-certificates".  Using https and XML BTW.

Due to the fact that globally operating CAs, including VeriSign, Identrus,
and GlobalSign, do not yet even seem to understand the "concept" of
legal-entity-only-certificates, the "stamp-certificates" will be
produced by the Swedish Post Office.

Best Regards
Anders Rundgren
Senior e-Commerce Architect

---

From: "Jimi Thompson" <[email-masked]>
Date: Sun, 3 Nov 2002 18:30:40 -0800

Anders and others,

I tend to agree with you.  There needs to be a legally and probably
governmentally recognized issuing body for the certificates, for a couple of
reasons.  First off, it will halt any squabbling over who the ultimate CA is
going to be.  I also think that this responsibility should move away from
commercial CA's since they have a financial incentive to issue as many certs
as possible and not that much incentive for verification.  In addition, I
find that the fees that they charge are quite high and might prohibit
participation from certain areas of the world.  I think that the Post Office
is probably fairly wise since they tend to be highly physically available in
most parts of the world.   I think that the only thing that's really missing
is a DNS-like standard which would allow verification of authenticity,
parameters of validity, or revocation.

Another 2 cents,

Jimi Thompson