EU Draft Digital Signature Directive

[Clare Wardle]

Richard Clayton wrote

>"Once again we see a pattern that the State is designing keys with >legal force which will be of use to the State (which cares about >having a 1-1 mapping of keys and people), and dressing it up as being >"good for business" whereas in fact commerce needs different things"

Digital signatures will be (and are being) used for a wide variety of purposes.  We only want helpful legislation where e.g. a change in the legal position would be required to allow them to be used, and not legislation spelling out every possibility.  In England it would be possible to use a digital signature in many transactions, although not for example the sale of land, or copyright.  This is not the case in most of Europe.

Under the draft directive it is true that there is no provision for a "company" signature. Currently companies, and other entities can only "sign" a document by getting one or more of their authorised officers (human beings) to sign on their behalf.  There have been representations that the availability of the new technology should allow this to change, but as some human(s) would have to authorise the signature in the first place it would seem better to deal with this by providing an attribute certificate to go with the signature than having a company signature without obvious human responsibility.  Rather more oddly the draft directive does require CAs to provide pseudonyms.

Several contributors have suggested that personal signatures are in some way attached to the person of the signer.  Since only a few people know what my signature or I look like, and as many conmen are quite capable of copying a signature (off a stolen card, for example) and as the number of people who check signatures is vanishingly small, and finally as signatures vary to the point that a useful scheme to check signatures electronically proved quite impracticable, I do not think that ordinary signatures are any more difficult to fake than digital ones - probably less.


Clare Wardle

My views are my own and not necessarily those of any company or person with which or whom I may be associated