Viewpoint: Signing Your 011001010

In recent years we have seen everything from sex to taxes go online. The Internet revolution may now be claiming a new victim, as the handwritten signature gives way to a powerful new digital way of signing.

A digital signature is a specific example of a signature transmitted in electronic form. Simple examples of electronic signatures are writing a name at the end of an email message or creating a digital image of a regular signature. However, since these are just electronic equivalents of regular signatures, they are equally prone to forgery and are in fact weaker since they are easier to reproduce. Clearly seeing someone’s name at the bottom of an email message is not a secure enough way to legally bind that person to the message. In today’s digital age, a more sophisticated notion of signature to enable us to make legally binding commitments in cyberspace is required. Digital signatures provide this by attaching a unique number to a document that proves a given person signed that document. As such, the digital signature reflects a fundamental shift in the whole concept of a signature, and provides many features that traditional signatures do not.

Digital signatures are based on techniques used in cryptology. In cryptology, mathematical techniques are used to enable two people to have a confidential conversation with one another. This involves scrambling or encrypting messages in such a way that only the legitimate parties are able to descramble the encrypted message and read the original message. The same techniques used in encryption are used to create digital signatures. Broadly speaking, anyone wanting to sign documents generates two "keys," a public key and a secret key. These keys are actually nothing more than very large numbers that are mathematically related to allow one to sign and verify signatures. The signer keeps the secret key secret, and then deposits the public key in a digital phone book containing the public keys of all users. Using the public key, everyone can verify that a signature validly corresponds to a particular signer and document. The relationship between the public and secret key is such that it is not possible to derive the secret key just from knowing the public key. This guarantees that while someone can use your public key to verify your signature, it prevents them from signing documents in your name.

The main advantage of digital signatures over written signatures is their security. The mathematics underlying digital signatures are supposed to guarantee that it is essentially impossible to forge a signature. This in turn means that one cannot later deny having signed a document. Also, unlike other signatures, a digital signature is specific to the document that is signed. This means that unlike written signatures, digital signatures cannot be transferred from one document to another.

So why have digital signatures been receiving only gradual and reluctant public and legal acceptance? For one, the concept of a written signature is deeply embedded in our culture, and even if a technology offers added value, it can often take years to be adopted by the public. Though much easier to forge, the old written signature is a system that everyone understands; we are all more-or-less equally qualified to check if a signature matches the one on the back of a credit card. A major disadvantage of digital signatures is that people are reluctant to place their trust in a system that requires a high level of mathematical knowledge to understand.

Another problem is that governments have been nervous to allow for the free use and export of products containing the encryption technology that forms the foundation of digital signatures. They are afraid that encryption will enable organized criminals and terrorists to communicate in such a way that law enforcement officials will not be able to listen in. Other concerns include encryption being used to send child pornography undetected over the Internet. This has pitted privacy advocates and e-commerce lobbyists against the U.S. government (which sets the de facto standard followed elsewhere in the world) in a battle over the control of encryption. In the long term, the U.S. government stands to lose this battle because encryption technology comes down to mathematical formulas, and in the Internet age it is not possible to control the flow of such information. Faced with this reality and pressure from lobbyists, the U.S. government announced in January a relaxation of the rules governing the use and export of encryption. However, controversial new regulations may require the secret keys used in digital signatures to be made available to the authorities upon request. This may further dampen the enthusiasm of a public already concerned about its loss of privacy.

There are also a number of technical and logistical problems to be overcome before digital signatures become a central part of our lives. The most acute practical problem preventing widespread use of digital signatures is that of keeping an electronic directory of the public keys used to verify digital signatures. This is an enormous logistical task open to both malicious and accidental failures. When we check someone’s signature on a document using his or her public key, we need some way to be certain that we have that person’s authentic public key. Though this might be easy if we know the person or if he or she lives in our city, it becomes much more complicated when we are dealing with someone over the Internet whom we have never met and who lives on another continent.

To provide a solution to this problem, numerous so-called Certification Authorities (CAs) are now offering full-fledged digital signature services. These bodies basically act as an electronic telephone book by certifying public keys. Since they must be trusted by their clients, CAs play an important role in creating a hierarchy of trust between different parts of our society. Unfortunately, the proliferation of CAs offering digital signature services has resulted in a disorganized and fragmented system that may hinder the widespread use of digital signatures in e-commerce and other areas.

For digital signatures to become an efficient part of our everyday lives, a reliable and universal way to authenticate and manage public keys needs to be developed. Such a system, known as a Public Key Infrastructure, would make signing and verifying digital signatures as simple as placing a phone call. Achieving a workable Public Key Infrastructure requires a consensus amongst different bodies in industry and amongst different governments that has not yet been reached. Creating such a system will be a major challenge, as an increasing part of our lives goes online in the coming years.

In the meantime, keeping a pen handy is probably still a good idea.

Back to Top