Digital Signatures

[Charles Lindsey]

	On Fri, 28 Aug 1998 18:07:33 +0100 (BST)
	George Foot <georgefoot@oxted.demon.co.uk> said...

> 
> But when the judge says "Mr. Smith is that your digital signature"
> poor Mr. Snith may not even understand the question. In any 
> case is it his signature ?  It cannot even be said to be unique 
> to him as this so-called electronic signature is probably 
> known to many other employees of the firm and may be found at  
> many locations within the company.

I would hope not. There are two ways a Company may arrange to sign
documents "on behalf of the Company".

1. The Company's "corporate signature" is kept in a tamper-proof iron
box. The question then boils down to who may instruct the box. So the
box is programmed to accept digitally signed instructions from certain
employees (and probably each employee's certificate will state which
kinds of document he is empowered to sign). If sensible arrangements are
made for employees (or more likely their managers) to delegate their
rights (on a time-limited temporary basis) during their absence, then
there is never any need for any employee to disclose his secret to any
other employee (and doing so should be a dismissable offence).

2. The Company delegates the right to sign on its behalf to designated
employees (again limited to certain classes of document). An employee
signing on behalf of the Company should, at the same time, present a
certificate of his authority signed by the Company key. Everything else
is then as in case #1. This system is probably better than the first,
because it involves less usage of the Company's key, which is probably a
good thing. OTOH it is easier to revoke an employee's authority in case #1.

Charles H. Lindsey ---------At Home, doing my own thing------------------------
Email:     chl@clw.cs.man.ac.uk  Web:   http://www.cs.man.ac.uk/~chl
Voice/Fax: +44 161 437 4506      Snail: 5 Clerewood Ave, CHEADLE, SK8 3JU, U.K.
PGP: 2C15F1A9     Fingerprint: 73 6D C2 51 93 A0 01 E7  65 E8 64 7E 14 A4 AB A5