🚀 go-pugleaf

mazz@faceng.newcastle.edu.au (Richard Mazzaferri) wrote:

>dallet@ozemail.com.au (Michael Wines) wrote:

>> >6. Perpertrators can fake their mail addresses making it next to
>> >impossible to prove that a person sent the offending transmission.
>> 
>> Oddly enough this is the reason the Senate Committee into
>> Internet Censorship suggested mandating strong encryption -
>> to make it mandatory to create encrypted digital signatures
>> on all messages, so that people couldn't hide their
>> identities.

>Won't "they" just start using fake digital signatures?  What's to stop
>someone creating a new public/private key pair and using that to provide a
>"signature", or faking the signature data itself?  Is *every* e-mail
>message going to have its signature verified against some sort of massive
>database containing everyone's registered public keys (rather like the
>Australia Card for those who use e-mail)?  This will either become a
>further burden on ISPs

This thread has drifted a bit from the topic of the proposed
NSW legislation here - my fault. However the Senate
Committee report shows that there are reasonable-sounding
answers to many of the issues being raised.

Refer:
http://senate.aph.gov.au/committee/csrssuet_rep/report.html

------------------------
Senate Select Committee on Community Standards Relevant to
the Supply of Services Utilising Electronic Technologies -
Report on Regulation of Computer On-Line Services Part 2
November 1995

Recommendation 2: 
That the Government give consideration to making the use of
strong cryptography by service providers obligatory as a
means of overcoming perceived enforcement problems with
section 85ZE of the Crimes Act 1914.

Recommendation 4 :
That Access and Service Providers be required to verify the
identity of all clients and that all clients are over the
age of 18 years.
------------------------

It is fairly clear from these two recommendations that the
committee's intentions are to impose the enforcement burden
on the providers. Providers would be expected to identify
all clients, and mandate the use of digital signatures on
all messages. It would be technically quite simple to
prevent the use of fake signatures. A massive database of
signatures will not be necessary. Instead, signatures could
be recorded at the time the identity check is made.

Michael Wines.