Subject: Re: Signature targets and where they should be used

From: Jon Callas <[email-masked]>
Date: Tue, 27 May 2003 19:57:35 -0700

On 4/16/03 2:38 PM, "David Shaw" <[email-masked]> wrote:

Is there a consensus on this?

Personally, I think that the SHOULD is good enough. If you want to do a
blind notary, you have the perfect reason not to put the target packet
there.

However, I included this text: "Note that we really do mean SHOULD. There
are plausible uses for this (such a a blind notary that only sees the
signature, not the key nor source document) that cannot include a target
subpacket."

    Jon

> 
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> On Wed, Apr 16, 2003 at 03:40:24PM -0400, Michael Young wrote:
>> 
>> From: "David Shaw" <[email-masked]>
> 
>>> In the case of notary signatures, there is no "C" to specify.  It is
>>> merely signature A (the 0x50 signature), on data B (the signature to
>>> be notarized).  There is no benefit in specifying B twice as the data
>>> to be signed and then again as an additional subpacket.
>> 
>> I'd agree that the benefit is slight at best.  I suppose if
>> you had "B" and the material it covered (so that you could generate
>> B's hash), and you had a disorganized bunch of notary signatures,
>> then you could pick out the matching ones faster if they had
>> target subpackets.  This doesn't seem like a compelling scenario. :-)
> 
> There is actually another reason why using targets for notary
> signatures is not really good: one of the nice features of notary
> signatures is that the notarizer doesn't need the original signer's
> public key or the material the original signature covered.  All the
> notarizer needs is the signature packet.  Unfortunately, to use a
> signature target in the notary signature, the notarizer needs the
> original signer's public key to extract the hash from the original
> signature packet...
> 
> I suppose we could solve that problem by defining a signature target
> to be the canonical hash of the signature being targeted, but even
> then there is still no good reason why using a target for notary
> signatures needs to be a SHOULD.
> 
> David
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.2rc2 (GNU/Linux)
> Comment: http://www.jabberwocky.com/david/keys.asc
> 
> iD8DBQE+nc1c4mZch0nhy8kRAjTQAJ42SnhAoD42MFWJjin3KJXBxZrMDACeNDqK
> hGj20/LjG6I8lBPGqigWOlA=
> =a8B8
> -----END PGP SIGNATURE-----
>

---

From: David Shaw <[email-masked]>
Date: Wed, 28 May 2003 23:23:18 -0400

> signature, not the key nor source document) that cannot include a target

The gist of my original comment was that a signature target is
actually needed when issuing a certification revocation signature
(i.e. 0x30).  This is a signature (the 0x30 sig) on the hash of an
object (the pk+user ID) that actually refers to another signature (the
signature being revoked).  A signature target there is necessary to
know which signature is being revoked.

With notary signatures, on the other hand, it is clear which signature
is being signed.  The notary signature itself won't even verify if we
check it against the wrong signature.  Including a signature target
there is like making a signature (the 0x50) on the hash of an object
(the signature being notarized), that contains a second copy of the
signature being notarized in the signature target subpacket.  Why
SHOULD someone include it twice?

Saying nothing at all on the subject of signature targets and notary
signatures, or even making it a "MAY" just seems simpler.

All that said, I'm okay with the added clarification above. :)

David

---

From: Ian Grigg <[email-masked]>
Date: Thu, 29 May 2003 13:25:14 -0400

When the word "notarised signature" is used, is this
a term that has been tested against the legal meaning
of the words?

Specifically, the term has quite different significances
under civil code and common law.  In the civil code, a
notary is a very important person, perhaps more significant
than an attorney.  He or she has to study for 6 years to
obtain their qualification, and it is a tightly constrained
field (at least in the country I'm mildly familiar with).

When a notary notarises a document in a civil law country,
he is inherently taking some view on the document.  In
some cases, a notary refuses to participate on some
arbitrary grounds such as an unfamiliar document or a
person not within jurisdiction.  Signatures also may be
meaningless unless notarised.

This seems to be in complete contrast to the common law
view, where only the signature is notarised and the signer
is identified.

My question then would be, has anyone tested this notion
of implying a notary function with a civil law expert?

If not, as a minimum, it might be a good idea to add
a statement that the use of the term is not meant to
draw from the legal definition(s) of same.

Or, describe the feature as potentially providing a
feature useful for notaries, rather than calling it
"notarised signatures."

The main issue here is that if someone does use OpenPGP's
new notarised signature form, will that imply an
unexpected legal meaning in the wrong country?  I know
some countries are very jumpity about the misuse of
terms, and at least one big/rich country in particular
puts people in jail for misrepresenting their status.

(Apologies for jumping in late and briefly on this one.)

-- 
iang

---

From: David Shaw <[email-masked]>
Date: Thu, 29 May 2003 14:55:26 -0400

> field (at least in the country I'm mildly familiar with).

The term "notary signature" should not imply any legal meaning
whatsoever.  As you point out, it means different things to different
people in different places.

I can't imagine the terminology is a problem.  After all, the terms
"signature", and "certification" mean different things in different
legal juristictions as well, and PGP has been using those terms for
over a decade.

> draw from the legal definition(s) of same.

I'm okay with this if the WG thinks it is necessary, though if we're
going to go down that route, it would probably be simpler to put a
single sentence in the introduction disclaiming any legal standing for
terminology used in the whole document than it would be to add
specific notes to the notary section.

David

---

From: Derek Atkins <[email-masked]>
Date: 29 May 2003 19:33:26 -0400

Ian,

Feel free to bring a lawyer to the table to provide input, but we're
here to create Internet Standards, not Legal Standards.  So long as we
define our own terminology (or use references to definitions) I see no
problem with using the same term as another field in a way different
than that other field uses it.

This is orthogonal to the issue of whether the OpenPGP Notarized
Signature is useful to a "Notary" (in the legal sense).  Making
something that is useful is a Good Thing (TM).  I'd rather make
something useful than make something non-useful.  But not being
a lawyer (or a Notary) I don't know what would be useful.

I would think that having the ability to reference just the signature
or also sig + document in a notary signature would be sufficient to be
useful to any definition of notary....

-derek

-- 
       Derek Atkins
       Computer and Internet Security Consultant
       [email-masked]             www.ihtfp.com

---

From: Ian Grigg <[email-masked]>
Date: Thu, 29 May 2003 19:33:02 -0400

> legal juristictions as well, and PGP has been using those terms for

Right.  That precisely is the issue, in that it
has been observed that the misuse of the word
'signature' by the cryptographic communiity has
contributed to the mess that is CAs and PKIs...

People have understood that digital signatures
imply legal signatures in some hand waving sense.
People have therefore tried to build systems to
use digital signatures to replace other forms,
generally with little success.

So, I guess what I'm saying is this:  If one
subscribes to the view that a bug in "digital
signatures" is the word "signature", then
perhaps we should not compound that bug by
expanding the term to "notarised signature".

If so, then what in cryptographic terms is
that new form of signature?  As far as I can
see it is a 3rd party signature over a sig:

   0x50: Notary signature.
       This signature is a signature over some other OpenPGP signature
       packet. It is a notary seal on the signed data. ...

I'd suggest something like:

   0x50: 3rd party confirmatory signature.
       This signature is a signature over some other OpenPGP signature
       packet. It provides a mechanism for a 3rd party to confirm the
       first signature over the signed data, and is analogous to a
       notary seal. ...

Except that is a little clumsy.

(also 5.2.3.25.)

> specific notes to the notary section.

Sure.  I'm not wedded to the change myself,
I'm just much more sensitive to the legal
system having been recently squeezed through
the mill (and, PGP signatures played a small
part in that ;-)

My perspective comes down to:  "how can we
reduce costs in future disputes?"

The issue with the current text would be
that some poor muggins might have to go
through a court case explaining why the
phrase

    "It is a notary seal on the signed data."

does not imply that it is a notary seal on
the signed data, and the person who signed
it is not fraudulently purporting to be a
notary.

As the text is quite explicit as to what
it is (normally a laudable objective!),
and as the program (optimistically)
conforms to the RFC, then he has a bit
of a battle making the alternate case...

-- 
iang

---

From: David Shaw <[email-masked]>
Date: Thu, 29 May 2003 21:39:50 -0400

> a lawyer (or a Notary) I don't know what would be useful.

I did some research on this a while back.  One of the services that a
(U.S.) notary provides is "acknowledgment", which to my non-notary eye
looked reasonably close to what we're talking about here.  This is the
notary taking note that a document was signed, and documenting the
fact that notice was taken.  The contents of the document are
generally irrelevant here: just that it was signed and the signer
requested a notary to note that fact (and presumably witness the
making of the signature).  The main difference between an
acknowledgment and this is that generally an acknowledgment contains
the statement that the original signer signed the document by his/her
own free will.

When I asked a lawyer and notary friend about it, she said that the
match I had imagined wasn't so good.  In general, real life notary
functions are far more concerned with identification of the signer
than they are about the immutability of the signed document or
signature itself.  Could the building blocks (signature, notary
signature) we have in OpenPGP be usable to a real notary?  Maybe - but
a number of underlying laws and/or assumptions and/or infrastructure
would have to change first.

David

---

From: Jon Callas <[email-masked]>
Date: Thu, 29 May 2003 18:55:43 -0700

>  0x50: 3rd party confirmatory signature.

I used "Third-Party Confirmation Signature."

    Jon