Subject: Musings on Notary signatures

From: [email-masked]
Date: Fri, 26 Apr 2002 10:12:57 -0500

From: John Dlugosz

The normal interpretation of signing something is to agree with or assert
its content.  If that's the only kind we have, we can do this:

I sign my document.  Then to prove I did so at a specific time, send the
signature (which may include the data or be detached, it matters not) to
the notary.

The notary produces a =new= document, which states "I afferm that the blob
sent to me (length nn, SHA1=xxxxxxx) was done so at whatever time." and
signs (afferms to) that.

A notary sig packet would do the same thing, but could be added to the file
containing the signature being signed.  I beleive that is what the current
discussion has agreed on.

However, the above allows for another feature.  The document produced by
the notary can contain other information too, to implement things from
section 4.1 of Applied Cryptography.  For example, it can contain a serial
number, so someone who doesn't trust Trent's clock can find other documents
and know what order they were signed in (hmm, why would you trust Trent's
counter but not his clock?), lists of other "before" and "after" customers,
or other verification information that can be used to validate the
timestamp in other ways, without the need for a trusted notary to have
produced the timestamp signature.

---

From: "vedaal" <[email-masked]>
Date: Fri, 26 Apr 2002 12:00:57 -0400

----- Original Message -----
From: <[email-masked]>
To: <[email-masked]>
Cc: <[email-masked]>; <[email-masked]>
Sent: Friday, April 26, 2002 11:12 AM
Subject: Musings on Notary signatures

> produced the timestamp signature.

There is still a problem with all this, in that it can verify only that the
signature was notarized at a certain time.
Nothing prevents the original signers from altering their computer clocks to
later or earlier as would suit them,
and then delay sending the signed message for notarization.
A possible practical solution at the user end, might be something as
follows:

Alice sends Bob a document for review, with instructions that when Bob is re
ady to sign it, Bob should send it
signed to Alice, and cc at the same time to an agreed-upon notary, for time
stamping, who would then cc it back,
already notarized/timestamped  to Alice and Bob.

vedaal

---

From: David Shaw <[email-masked]>
Date: Fri, 26 Apr 2002 12:18:30 -0400

> produced the timestamp signature.

This is essentially what the notary service at
http://www.itconsult.co.uk/stamper.htm does with serial numbers.  One
can use a signature notation to do the same thing with the proposed
notary signature as well.

As a receipient of such a message, I think I would prefer the proposed
notary signature.  It is in a well specified and understood machine
readable format, so anyone can verify any notary signature with a
minimum of fuss and/or new code.

David

-- 
   David Shaw  |  [email-masked]  |  WWW http://www.jabberwocky.com/
+---------------------------------------------------------------------------+
   "There are two major products that come out of Berkeley: LSD and UNIX.
      We don't believe this to be a coincidence." - Jeremy S. Anderson

---

From: Jon Callas <[email-masked]>
Date: Fri, 26 Apr 2002 12:48:26 -0700

> and then delay sending the signed message for notarization.

I don't see why this is a problem. Let's suppose I'm the notary and Alice
hands me a signature that she produced in 1972. I notarize it. Big deal.
It's 12:40pm on Friday, 26 April 2002. If you want to believe Alice's date,
why do you need mine?

A savvy receiver of both signatures will decide that the correct timestamp
for the document is within epsilon of my time, not Alice's. (And if you
think my clock is wrong, then just get another notarized signature, or
notarize the darn thing yourself, and use *that* timestamp.)

All you have to do is assign reasonable semantics and procedures to
something. The semantic meaning of a notary signature is merely, "I saw it
at time T." It is a certification of sorts. It certifies not a name, but a
timestamp. Apply whatever trust model you like best to that signature.

    Jon

---

From: "vedaal" <[email-masked]>
Date: Fri, 26 Apr 2002 16:34:51 -0400

----- Original Message -----
From: "Jon Callas" <[email-masked]>
To: "vedaal" <[email-masked]>; "OpenPGP" <[email-masked]>
Sent: Friday, April 26, 2002 3:48 PM
Subject: Re: Musings on Notary signatures
...
> for the document is within epsilon of my time, not Alice's.
...
It's not really a problem, but consider:

Alice is a stockbroker, Bob is a day-trader,
Bob needs a stock bought or sold at a certain time, which changes quickly in
value throughout the day.

With the notary as a simultaneous cc recipient and sender, it can add a time
verification to the transaction.

just a suggestion for a practical application at the user end.

-vedaal