🚀 go-pugleaf

On Wed, 07 Jul 1999 14:34:37 GMT, Fredrik Israelsson
<fredrik_is@hotmail.com> wrote:

>I am doing some research for a type of system that is characterized by
>the following.
>
>- A reseller has a computer with a web application for online orders to
>a distributor.
>- A customer comes in to the reseller's store and wants to make an
>order.
>- The reseller fills out a form in the web application, and lets the
>customer confirm the order by signing it electronically in some way.
>- The customer does not need to have a certificate or anything else
>that proves the authenticity of his signature.
>- The customer does not need to load his signature into some database
>before signing the order. Comparing of signatures only becomes relevant
>if a dispute between the customer and the distributor takes place.
>
>Is such a system possible to implement?
>
>All kinds of solutions I have read about so far deals with certificate,
>specialized smart cards and some kind of registration of customer data
>before the actual signing takes place. None of these is needed when
>signing with ink on paper. Why does it seem to be required in all
>computer-related applications?
>
>Thank You all in advance!
>
>Fredrik Israelsson
>Chalmers University of Technology, Sweden
>
Where is the risk if any of the parties fails to complete their part
of the contract?  The supplier may not supply at all, may supply the
wrong item, or the goods may be defective.  The buyer or an
intermediary may fail to properly account for the value associated
with the transaction.  The purchaser may pay using a defective
mechanism (e.g. stolen credit card, cheque with no backing funds) or
may deny having requested the goods.  If you follow the commercial
risk,  you will see who needs to trust whom, and to what extent.

Signatures on paper can be verified against other credentials, and
witnessed.  A fingerprint or personal seal might also be used - again,
a lot depends on the amount of trust required.  Signatures on paper
are susceptible to forensic analysis and to objective arbitration by
independent third parties.  The electronic transaction paradigm alters
risk levels in some areas (forgery, impersonation) and therefore
requires comparable methods to be implemented electronically .

Food for thought?

To e-mail me, please make the obvious change to my address

This general situation is no differnte to paper signatures.
In general, the recipint of a handwritten sigature does not know if it is a
forgery, unless the person can supply other details at the time (e.g. not
possible with orders by fax, letters etc)

In general:
Provide a public key which the buyer uses to encrypt a hash of the
order/details.
If a dispute, use the private key to decrypt the hash, and use the hash to
prove the existence of the order, and all details in it.
This does nothing for the situation where false details were initially
supplied by the buyer.
None of this is built anywhere I know of.

Otherwise:
Spend several million dollars and a year or 2 getting an accredited CA
service in place and issuing certificates to people in person, with proof of
their claimed ID.
Or, forget the idea.

Lyal
Fredrik Israelsson wrote in message <7lvoht$e62$1@nnrp1.deja.com>...
>I am doing some research for a type of system that is characterized by
>the following.
>
>- A reseller has a computer with a web application for online orders to
>a distributor.
>- A customer comes in to the reseller's store and wants to make an
>order.
>- The reseller fills out a form in the web application, and lets the
>customer confirm the order by signing it electronically in some way.
>- The customer does not need to have a certificate or anything else
>that proves the authenticity of his signature.
>- The customer does not need to load his signature into some database
>before signing the order. Comparing of signatures only becomes relevant
>if a dispute between the customer and the distributor takes place.
>
>Is such a system possible to implement?
>
>All kinds of solutions I have read about so far deals with certificate,
>specialized smart cards and some kind of registration of customer data
>before the actual signing takes place. None of these is needed when
>signing with ink on paper. Why does it seem to be required in all
>computer-related applications?
>
>Thank You all in advance!
>
>Fredrik Israelsson
>Chalmers University of Technology, Sweden
>
>
>Sent via Deja.com http://www.deja.com/
>Share what you know. Learn what you don't.

How about letting the retailer have a digital certificate,
which he/she uses to assure the customer's identity to the
distributor after checking the cusomter's identitfication card?
Could that eliminate the need for loading signatures in advance
in, for example, PenOp's products for signature capturing?
How about legal issues? Wouldn't the retailer function as a witness
in this case?

Fredrik Israelsson
Chalmers University of Technology, Sweden


In article <7lvoht$e62$1@nnrp1.deja.com>,
  Fredrik Israelsson <fredrik_is@hotmail.com> wrote:
> I am doing some research for a type of system that is characterized by
> the following.
>
> - A reseller has a computer with a web application for online orders
to
> a distributor.
> - A customer comes in to the reseller's store and wants to make an
> order.
> - The reseller fills out a form in the web application, and lets the
> customer confirm the order by signing it electronically in some way.
> - The customer does not need to have a certificate or anything else
> that proves the authenticity of his signature.
> - The customer does not need to load his signature into some database
> before signing the order. Comparing of signatures only becomes
relevant
> if a dispute between the customer and the distributor takes place.
>
> Is such a system possible to implement?
>
> All kinds of solutions I have read about so far deals with
certificate,
> specialized smart cards and some kind of registration of customer data
> before the actual signing takes place. None of these is needed when
> signing with ink on paper. Why does it seem to be required in all
> computer-related applications?
>
> Thank You all in advance!
>
> Fredrik Israelsson
> Chalmers University of Technology, Sweden
>
> Sent via Deja.com http://www.deja.com/
> Share what you know. Learn what you don't.
>


Sent via Deja.com http://www.deja.com/
Share what you know. Learn what you don't.