🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.security.misc
Article #1007

Re: Can a single signature, without certificates, be enough?

#1007
From: John Elsbury
Date: Wed, 07 Jul 1999 00:00
51 lines
3231 bytes
On Wed, 07 Jul 1999 14:34:37 GMT, Fredrik Israelsson
<fredrik_is@hotmail.com> wrote:

>I am doing some research for a type of system that is characterized by
>the following.
>
>- A reseller has a computer with a web application for online orders to
>a distributor.
>- A customer comes in to the reseller's store and wants to make an
>order.
>- The reseller fills out a form in the web application, and lets the
>customer confirm the order by signing it electronically in some way.
>- The customer does not need to have a certificate or anything else
>that proves the authenticity of his signature.
>- The customer does not need to load his signature into some database
>before signing the order. Comparing of signatures only becomes relevant
>if a dispute between the customer and the distributor takes place.
>
>Is such a system possible to implement?
>
>All kinds of solutions I have read about so far deals with certificate,
>specialized smart cards and some kind of registration of customer data
>before the actual signing takes place. None of these is needed when
>signing with ink on paper. Why does it seem to be required in all
>computer-related applications?
>
>Thank You all in advance!
>
>Fredrik Israelsson
>Chalmers University of Technology, Sweden
>
Where is the risk if any of the parties fails to complete their part
of the contract?  The supplier may not supply at all, may supply the
wrong item, or the goods may be defective.  The buyer or an
intermediary may fail to properly account for the value associated
with the transaction.  The purchaser may pay using a defective
mechanism (e.g. stolen credit card, cheque with no backing funds) or
may deny having requested the goods.  If you follow the commercial
risk,  you will see who needs to trust whom, and to what extent.

Signatures on paper can be verified against other credentials, and
witnessed.  A fingerprint or personal seal might also be used - again,
a lot depends on the amount of trust required.  Signatures on paper
are susceptible to forensic analysis and to objective arbitration by
independent third parties.  The electronic transaction paradigm alters
risk levels in some areas (forgery, impersonation) and therefore
requires comparable methods to be implemented electronically .

Food for thought?

To e-mail me, please make the obvious change to my address
Technical Details
Message-ID: <3783b9a4.2978064@news.clear.net.nz>
Path: arc1-ca.pugleaf.net!unknown!not-for-mail
References: <7lvoht$e62$1@nnrp1.deja.com>

Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: ff723,5df7da1ab816ffb
X-Google-Attributes: gidff723,public
X-Google-Thread: 10410e,5df7da1ab816ffb
X-Google-Attributes: gid10410e,public
X-Google-Thread: fdbb6,5df7da1ab816ffb
X-Google-Attributes: gidfdbb6,public
From: jelsbur@noprocessedmeat.clear.co.nz (John Elsbury)
Subject: Re: Can a single signature, without certificates, be enough?
Date: 1999/07/07
Message-ID: <3783b9a4.2978064@news.clear.net.nz>
X-Deja-AN: 498286529
References: <7lvoht$e62$1@nnrp1.deja.com>
X-Trace: news.clear.net.nz 931380169 172.18.102.11 (Thu, 08 Jul 1999 08:42:49 NZST)
Organization: Clear Communications
Reply-To: jelsbur@noprocessedmeat.clear.co.nz
NNTP-Posting-Date: Thu, 08 Jul 1999 08:42:49 NZST
Newsgroups: comp.security.misc,alt.internet.commerce,a.business.internet