Text of (original) draft EU DIGITAL SIGNATURE DIRECTIVE

[Nicholas Bohm]

At 04:14 3/04/1998 +0100, Caspar Bowden wrote:
>European Commission Working Draft of Directive on a Framework for Electronic 
>Certification Services
>
>DIRECTIVE .... . OF THE EUROPEAN PARLIAMENT AND
>OF THE COUNCIL of .... .
>
>on a common framework for electronic certification services

[snip]

>HAVE ADOPTED THIS DIRECTIVE
>
>I. Scope and definitions

[snip]

>Article 2 - Definition
>
>For the purpose of this Directive:
>
>
>1. "electronic signature" means a process which indicates the signatory's 
>electronic approval of the content of data and which meets the following 
>requirements:
>
>(a) uniquely linked to the signatory;

This condition can never be satisfied because of the possibility of
accidental or deliberate compromise of the signature.

>(b) capable of identifying the signatory;
>
>(c) created in a manner or using a means under the sole control of the 
>signatory; and
>
>(d) linked to the data to which it relates in such a manner that if the
data is 
>altered the electronic signature is invalidated.
>
>
>2. "digital signature" means an electronic signature which uses an
asymmetric 
>cryptographic technique such that a person having the signatory's public key 
>can determine whether:

The nomenclature seems absurd:  all electronic signatures are digital.  And
is it right that although RSA keys are asymmetric, DH keys are symmetric?
If so, this definition inappropriately favours a particular technical
solution.

>(a) the transformation was created using the signatory's private key that 
>corresponds to the signatory's public key; and
>(b) the transformed data record data record has been altered,
>
>
>3. "signatory" means a natural or legal person who creates an electronic 
>signature.
>4. "private key" means the key of a key pair used to create a digital 
>signature.
>
>5. "public key" means the key of a key pair used to verify a digital
signature. 
>
>6. "qualified certificate" means a digital attestation which attributes a 
>public key or a similar device to an individual person and verifies the 
>identity of the person, by requiring its physical appearance before an 
>(accredited) certification service provider, or through appropriate other 
>measures; and contains, at least:
>
>
>(a) the name of the certification service provider issuing it;
>(b) the name of its holder or an unmistakable pseudonym which shall be 
>identified as such;
>
>(c) a public key which corresponds to a private key under the control of the 
>holder or a similar device fulfilling the same function;
>
>(d) beginning and end of the operational period of the certificate;
>
>(e) existing limitations on the scope of use of the certificate;
>
>(f) existing restrictions of the certification service provider's liability;
>
>(g) the algorithms with which the public key or a similar device can be used;
>
>(h) the number of the qualified certificate; and
>
>(i) the electronic signature of the certification service provider issuing
it.
>
>
>7. "certification service provider" means a (accredited) person who or
entity 
>which:
>
>(a) issues publicly available certificates attributing a public key or a 
>similar device to a person and verifying the identity of that person;
>(b) provides other services related to electronic signatures.
>
>
>8. "general accreditation scheme" means a procedure setting out rights and 
>obligations specific to the certification service sector and allowing
persons 
>or entities to provide certification services, regardless whether it is 
>regulated in a form of either a set of specific conditions defined in
advance 
>in a general manner, such as a "class license" or under general law and
whether 
>such regulation requires registration. which (is voluntary and) does not 
>require an explicit decision by a national accreditation body before
exercising 
>the rights stemming from the accreditation.
>9. "individual accreditation scheme" mean a procedure setting out rights and 
>obligations specific to the certification service sector which does not
entitle 
>persons or entities to provide certification services until they have
received 
>an explicit decision by the national accreditation body.
>
>10. "national accreditation body" means an institution, legally distinct and 
>functionally independent of a certification service provider, charged by a 
>Member State with the elaboration of, and supervision of compliance with, 
>accreditations.
>
>II. Electronic signatures
>
>Article 3 -- Legal effects
>
>1. Member States shall ensure that with respect to data authenticated by
means 
>of an electronic signature provided by an accredited certification service 
>provider it is presumed that:

It is inconsistent with definition 1(c) above for the signature to be
provided by the service provider, not the signatory.  And this provision is
objectionable as tending to promote the validity of certified signatures
without giving proper support to uncertified signatures which have
nevertheless been accepted by the parties to a transaction.  This tends to
entrench the need (otherwise much exaggerated) for certification services.
This in turn provides a ready-made infrastructure for the imposition of
"key escrow" requirements.

>(a) the data has not been altered since the time the electronic signature
was 
>affixed to it;
>(b) the electronic signature is the signature of the person to whom it
relates; 
>and
>
>(c) the electronic signature was affixed by that person with the intention
of 
>signing the data.
>
>2. Member States shall ensure that data on which an electronic signature is 
>affixed and which is based on a valid qualified certificate provided by an 
>accredited certification service provider complies with legal form
requirements 
>and can be used as proof of evidence at court in the same manner as if the
data 
>had existed in a manually signed form.

Same general objection as above.

>3. Member States shall ensure that the presumptions under paragraph 1, may
be 
>refuted by:
>
>(a) evidence indicating that the security procedure used to verify the 
>electronic signature is not to be technically recognised as secure; or
>
>(b) evidence relating to facts of which the relying party was or should have 
>been aware which would suggest that the relying party acted in malicious
faith. 
>
>(c) evidence indicating that the electronic signature was affixed under
duress, 
>compulsion or deceive.

Heart in the right place, drafting very strange.

>III. Certification service providers

[snip]

>Article 6 - Liability
>1. Member States shall ensure that by issuing a qualified certificate, a 
>certification service provider is liable to any person who reasonably
relies on 
>the certificate for:
>
>
>(a) all information in the qualified certificate being accurate as of the
date 
>it was issued, unless the certification service provider has stated
oppositely 
>in the certificate;
>(b) complying with all requirements of this Directive in issuing the
qualified 
>certificate;
>
>(c) the holder identified in the qualified certificate holds the private
key or 
>a similar signature device corresponding to the public key or similar device 
>listed in the certificate;
>
>(d) the holder's public key and private key constituting a functioning key
pair 
>or a similar device fulfilling the same function; and
>
>(e) to the certification service provider's knowledge, the qualified 
>certificate not having any material facts affecting the certificate's 
>reliability.
>
>2. Member States shall ensure that certification service provider are only 
>liable for direct economic damage shall not include any anticipated profits.
>
>3. Member States shall ensure that notwithstanding paragraph 1, a
certification 
>service provider is not liable if it can demonstrate that it has taken all 
>reasonably practicable measures to avoid errors in the qualified certificate.
>
>4. Member States shall ensure that notwithstanding paragraph 1, a
certification 
>service provider may, in the qualified certificate limit the use of the 
>certificate. The certification service provider shall not be held liable for 
>damages arising from a contrary use of the certificate.
>
>5. Member States shall ensure that notwithstanding paragraph 1, a
certification 
>service provider may, in the qualified certificate, limit the value of 
>transactions for which the certificate is valid. The certification service 
>provider shall not be held liable for damages in excess of that value limit.
>
>6. Member States shall ensure that notwithstanding paragraph 1, a
certification 
>service provider may, in the qualified certificate, restrict his liability
to a 
>specific amount.

The overall effect will almost certainly be the issue of certificates of
very little value in terms of recourse by relying parties: all shadow,
little substance.

[snip]

>Article 8 - Data Protection
>1. Member States shall ensure that certification service providers operate
in a 
>manner fulfilling the requirements laid down in Community law for data 
>protection and privacy.
>
>2. Member States shall ensure that a certification service provider may
collect 
>personal data only directly from the data subject and only insofar as
necessary 
>for the purposes of issuing a certificate.
>
>3. Member States shall ensure that in the case of persons using
pseudonyms, the 
>certification service provider shall transmit the data concerning the
identity 
>of these persons to public authorities upon their request.

Access to this information should be limited by requirements for judicial
warrant based on specified criteria.

[snip]

Overall:  much too much emphasis on certification services; needs to
provide proper support for validity of electronic documents and signatures
without dependence on (essentially feeble) certification infrastructure.

	Regards,

		Nicholas Bohm

Salkyns, Great Canfield,
Takeley, Bishop's Stortford CM22 6SX, UK

Phone		01279 870285	(+44 1279 870285)
Fax		01279 870215	(+44 1279 870215)
Mobile   	0860 636749  	(+44 860 636749)

PGP RSA 1024 bit public key ID: 0x08340015.  Fingerprint:
9E 15 FB 2A 54 96 24 37  98 A2 E0 D1 34 13 48 07
PGP DSS/DH 1024/3072 public key ID: 0x899DD7FF.  Fingerprint:
5248 1320 B42E 84FC 1E8B  A9E6 0912 AE66 899D D7FF