Subject: Re: Legal entities who sign

From: [email-masked]
Date: Sat, 2 Nov 2002 14:15:54 -0700

there may be two separate issues. there is contract with human
demonstrating that they intended to sign what was signed. Some of this is
analogous to some of the click-thru stuff ... where it is demonstrated that
there is a high probability that a human actually had to look at the T&Cs
as part of doing the click (placing the click at the bottom of long page
where the person had to scroll down thru the page to get to the click
button).  legal signature can carry with it the concept that the person
read, understood, agrees, and intended to sign what was signed.

as referenced in the past .... there is a computerized process that
involves secure hash and asymmetric cryptography that has a label "digital
signature". At the basic level ... the use of the term "signature" in
"digital signature" and the term "signature" in "legal signature" .... may
only have purely superficial relationship to each other. it is possible to
have secure hash and asymmetric cryptography that meets all the technical
specifications of a digital signature and carries with it none of the
characteristics of a legal signature.

once parties have a binding contract ... the contract can specify all sorts
of processes that can be binding for the parties ... aka a particular
automated mechanism doing something that is deemed acceptable by both
parties. the signing of something by an automated agent can be accepted on
good faith if the contract stipulates that it is to be accepted (i.e. say
in the case of a PO).

jimit@prodigy net at 11/2/2002 1:44 am wrote:

In order to establish non-repudiation, I would say that you probably need
to have the CEO sign the authorized agents signature agreeing that they are
authorized under the parameters issued.  This should satisfy the
"non-repudiation" needs and still provide for statement about delegation of
authority.  I think that this solves your problem, as the only time a CEO's
key is needed would be to authorize a new agent.  The other, more
accessible people, would be available to handle day to day business.

---

From: [email-masked]
Date: Mon, 4 Nov 2002 11:28:33 +0100

Jimi,

There is a profile for certification authorities issuing public key certificates and qualified certificates. Such profiles are based on RFC 2459 and are compliant with the european directive on electronic signature. I has also to be noted that country's internal laws on electroic signatures shall also comply with the requirements of the european directive.

So IMHO, i think that whether it has to be a commercial or governmental authority is of no worth if the corresponding authority doesn't comply with the country law and directives governing the issuiance of PK certificates and electronic signatures.

Anders,

I find very elegant the idea of using X509 certificates to express and implement "Legally signing certifificates" but where are we hence from the terms "signature policy", "committment textes", that where suggnested as a mean to define particular legal and contractual contexts? Does this mean that the certificate policy under which you issue "legally signing certificates" will stand for and replace the "signature policy"?

IMHO, i still think that the most important issue that still need to be resolved is an elegant, easy and standard mean to implement the "delegated signing capabilities".

Best regards,

malek.

-----Original Message-----
From: Jimi Thompson [mailto:[email-masked]]
Sent: 04 November 2002 03:31
To: Anders Rundgren; [email-masked]; J Adrian Pickering; Ing.
Raffaello Galli
Subject: Re: Legal entities who sign

Anders and others,

I tend to agree with you.  There needs to be a legally and probably
governmentally recognized issuing body for the certificates, for a couple of
reasons.  First off, it will halt any squabbling over who the ultimate CA is
going to be.  I also think that this responsibility should move away from
commercial CA's since they have a financial incentive to issue as many certs
as possible and not that much incentive for verification.  In addition, I
find that the fees that they charge are quite high and might prohibit
participation from certain areas of the world.  I think that the Post Office
is probably fairly wise since they tend to be highly physically available in
most parts of the world.   I think that the only thing that's really missing
is a DNS-like standard which would allow verification of authenticity,
parameters of validity, or revocation.

Another 2 cents,

Jimi Thompson

**** DISCLAIMER **** 
"This e-mail and any attachments thereto may contain information 
which is confidential and/or protected by intellectual property 
rights and are intended for the sole use of the recipient(s) named above. 
Any use of the information contained herein (including, but not limited to, 
total or partial reproduction, communication or distribution in any form) 
by persons other than the designated recipient(s) is prohibited. 
If you have received this e-mail in error, please notify the sender either 
by telephone or by e-mail and delete the material from any computer. 
Thank you for your cooperation."