Article View: comp.security.misc
Article #1007Re: Can a single signature, without certificates, be enough?
From: John Elsbury
Date: Wed, 07 Jul 1999 00:00
Date: Wed, 07 Jul 1999 00:00
51 lines
3231 bytes
3231 bytes
On Wed, 07 Jul 1999 14:34:37 GMT, Fredrik Israelsson <fredrik_is@hotmail.com> wrote: >I am doing some research for a type of system that is characterized by >the following. > >- A reseller has a computer with a web application for online orders to >a distributor. >- A customer comes in to the reseller's store and wants to make an >order. >- The reseller fills out a form in the web application, and lets the >customer confirm the order by signing it electronically in some way. >- The customer does not need to have a certificate or anything else >that proves the authenticity of his signature. >- The customer does not need to load his signature into some database >before signing the order. Comparing of signatures only becomes relevant >if a dispute between the customer and the distributor takes place. > >Is such a system possible to implement? > >All kinds of solutions I have read about so far deals with certificate, >specialized smart cards and some kind of registration of customer data >before the actual signing takes place. None of these is needed when >signing with ink on paper. Why does it seem to be required in all >computer-related applications? > >Thank You all in advance! > >Fredrik Israelsson >Chalmers University of Technology, Sweden > Where is the risk if any of the parties fails to complete their part of the contract? The supplier may not supply at all, may supply the wrong item, or the goods may be defective. The buyer or an intermediary may fail to properly account for the value associated with the transaction. The purchaser may pay using a defective mechanism (e.g. stolen credit card, cheque with no backing funds) or may deny having requested the goods. If you follow the commercial risk, you will see who needs to trust whom, and to what extent. Signatures on paper can be verified against other credentials, and witnessed. A fingerprint or personal seal might also be used - again, a lot depends on the amount of trust required. Signatures on paper are susceptible to forensic analysis and to objective arbitration by independent third parties. The electronic transaction paradigm alters risk levels in some areas (forgery, impersonation) and therefore requires comparable methods to be implemented electronically . Food for thought? To e-mail me, please make the obvious change to my address
Technical Details
Message-ID:
<3783b9a4.2978064@news.clear.net.nz>Path:
arc1-ca.pugleaf.net!unknown!not-for-mailReferences:
<7lvoht$e62$1@nnrp1.deja.com>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: ff723,5df7da1ab816ffb X-Google-Attributes: gidff723,public X-Google-Thread: 10410e,5df7da1ab816ffb X-Google-Attributes: gid10410e,public X-Google-Thread: fdbb6,5df7da1ab816ffb X-Google-Attributes: gidfdbb6,public From: jelsbur@noprocessedmeat.clear.co.nz (John Elsbury) Subject: Re: Can a single signature, without certificates, be enough? Date: 1999/07/07 Message-ID: <3783b9a4.2978064@news.clear.net.nz> X-Deja-AN: 498286529 References: <7lvoht$e62$1@nnrp1.deja.com> X-Trace: news.clear.net.nz 931380169 172.18.102.11 (Thu, 08 Jul 1999 08:42:49 NZST) Organization: Clear Communications Reply-To: jelsbur@noprocessedmeat.clear.co.nz NNTP-Posting-Date: Thu, 08 Jul 1999 08:42:49 NZST Newsgroups: comp.security.misc,alt.internet.commerce,a.business.internet