Subject: Re: [openpgp] [messaging] On Signed-Only Mails

From: Taylor R Campbell <[email-masked]>
Date: Tue, 29 Nov 2016 15:00:17 +0000

Date: Tue, 29 Nov 2016 09:25:45 +0000
   From: Peter Gutmann <[email-masked]>

   Vincent Breitmoser <[email-masked]> writes:

   >In some more detail:
   >https://k9mail.github.io/2016/11/24/OpenPGP-Considerations-Part-I.html
   >
   >[...] Signed-Only Mails are Useless [...]

   Yup, and it's for exactly the reasons given there that the S/MIME
   WG decided many years ago not to sign messages sent to the list.
   Courts, similarly, rule on the intent of the signer, not some
   attached bag of bits (see e.g. Steven Mason's excellent "Electronic
   Signatures in Law").  So while I wouldn't go so far as to call them
   harmful, I'd agree that they're mostly useless, unless you're using
   one to make some special point.  Even then, if it's for legal
   purposes, a court will look at almost everything but the signature
   when deciding on its effect.

Courts are not the only imaginable threat model for nonrepudiation of
a sender's message[1].

End-to-end authentication is important for preventing forgery of
conversations between two parties, but of the two ways to accomplish
that -- signatures, where anyone can verify, vs authenticators, where
only recipient can verify -- signatures work against the sender's
interest with no benefit over authenticators in the vast majority of
private messages.

Unfortunately, OpenPGP doesn't have public-key authenticators -- nor
authenticated encryption, and likewise S/MIME[2] -- so it's kludged up
by an ad hoc composition of signature and encryption that fails to
bind the sender and recipient, which has long been known to enable the
recipient of a private message to resend it for comic effect or
worse[5].

[1] Rob Graham, `Politifact: Yes we can fact check Kaine's email',
Errata Security blog, 2016-10-23.
http://blog.erratasec.com/2016/10/politifact-yes-we-can-fact-check-kaines.html

[2] Except perhaps for static-static DH mode described in RFC 2631[3],
but I've never seen evidence that anyone has ever used it in practice,
and have seen evidence of avoiding it[4].

[3] Eric Rescorla, `Diffie-Hellman Key Agreement Method', RFC 2631,
June 1999.
https://www.ietf.org/rfc/rfc2630.txt

[4] `The following features are lower in priority and are not likely
to be included in version 1.0 [of the Mozilla S/MIME toolkit]: CMS:
Static-static Diffie-Hellman Key Agreement Protocol (SSDH) (RFC2630
12.3.1.1)'
http://www-archive.mozilla.org/projects/security/pki/nss/smime/
[retrieved 2016-11-29]

[5] Don Davis, `Defective Sign & Encrypt in S/MIME, PKCS#7, MOSS, PEM,
PGP, and XML', 2001-05-05.
http://world.std.com/~dtd/sign_encrypt/sign_encrypt7.html

---

From: ianG <[email-masked]>
Date: Tue, 6 Dec 2016 13:36:29 -0500

On 29/11/2016 04:25, Peter Gutmann wrote:
> see e.g. Steven
> Mason's excellent "Electronic Signatures in Law").

Just as an aside, the 100 quid ++ excuse to not read Mason's book is now 
gone.  The 4th edition is out, it's free online, in a PDF form.

http://ials.sas.ac.uk/digital/humanities-digital-library/observing-law-ials-open-book-service-law/electronic-signatures
http://financialcryptography.com/mt/archives/001602.html

And you can still purchase the paper versions or Kindle or etc if you're 
a lawyer!

iang

---

From: ianG <[email-masked]>
Date: Tue, 6 Dec 2016 13:48:47 -0500

On 29/11/2016 04:25, Peter Gutmann wrote:
> Yup, and it's for exactly the reasons given there that the S/MIME WG decided
> many years ago not to sign messages sent to the list.  Courts, similarly, rule
> on the intent of the signer, not some attached bag of bits (see e.g. Steven
> Mason's excellent "Electronic Signatures in Law").  So while I wouldn't go so
> far as to call them harmful, I'd agree that they're mostly useless, unless
> you're using one to make some special point.

Which gets more to the point - the problem with digital signatures is 
that they mean different things to different people.  Just the crypto 
alone cannot solve that problem.  What is needed is a framework that 
states the meaning of the signature in human terms in a clear way.

This hasn't really been done to my knowledge.  CAs like CAcert have gone 
a long way towards establishing one meaning of a signature.  But the 
"one meaning" thing has also been insufficient;  we really need many 
meanings, and that needs more work.

Bringing it back to the topic, what we are really saying is that 
"signed-only mails will be useless without some context" and in the 
contrary where emails are signed and encrypted, we are actually 
providing some context by implication:  the signature is for 
authentication of the mail sender / key, which is a security statement 
not a legal statement, as is stressed by the inclusion of encryption;... 
  and therefore we can presume that the signature is not for legal 
purposes.  Note that it's still a presumption based on custom not statement.

To put that another way around - when we just do signed emails, are we 
doing an authentication (security) statement or are we intending a legal 
(signing) statement?  It's not clear.  We might be clearer by saying 
that plaintext sigs are more legal and binary ones are more 
authentication, but that's not backed up by any custom or anything.

> Even then, if it's for legal
> purposes, a court will look at almost everything but the signature when
> deciding on its effect.

Right, and now we have the problem that a digsig probably is a lousy 
legal signature anyway, if used without any context.  But does that make 
it not a legal signature?  No.

The closer statement might be:  "signatures don't make their purpose 
clear, and therefore they are often so confusing as to be useless."

iang

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 6 Dec 2016 20:40:59 -0500

There is actually an extensive literature on what digital signatures mean
from a legal point of view. The ABA has been working on that for decades.
Digital signatures are merely a form of electronic signature. And in the US
at least anything that is intended to have the effect of a signature is a
signature for legal purposes.

If you are going to raise legal issues as a reason to do something then go
study what the law actually is. It really isn't hard even in US common law.
It is even simpler in continental law systems.

The problem of digital signatures creating unintended contracts simply does
not exist. Lawyers thought through those issues in the 1990s.

The reason you need signatures in electronic mail is that there is no way I
am going to let encrypted mail through my spam filter without a signature
from someone I trust. Take out the authentication function and the
encryption function fails.

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Sat, 10 Dec 2016 23:08:29 -0500

On Tue, Dec 6, 2016 at 1:36 PM, ianG <[email-masked]> wrote:

> http://ials.sas.ac.uk/digital/humanities-digital-library/obs
> erving-law-ials-open-book-service-law/electronic-signatures
> ​​
> And you can still purchase the paper versions or Kindle or etc if you're a
> lawyer!
>

​Which would appear to remove the argument that we should avoid digital
signatures because they are too difficult. It really isn't that difficult
to see that the digital signature does not make the legal position any
worse than it is with regular email and could if correctly applied make
things a lot better.

What we are really talking about here is not merely the creation of an
autography but the performance of an intentional act of signing.

I don't think that a regular email application or for that matter any
general purpose communication mechanism should be used for that purpose.
Rather, intent to sign should be expressed through a separate application
and a key that is specific for that purpose.

---

From: [email-masked]
Date: Mon, 19 Dec 2016 14:08:49 -0500

On 12/10/2016 at 11:08 PM, "Phillip Hallam-Baker"  wrote:
​Which would appear to remove the argument that we should avoid
digital signatures because they are too difficult. It really isn't
that difficult to see that the digital signature does not make the
legal position any worse than it is with regular email and could if
correctly applied make things a lot better.
What we are really talking about here is not merely the creation of an
autography but the performance of an intentional act of signing.
I don't think that a regular email application or for that matter any
general purpose communication mechanism should be used for that
purpose. Rather, intent to sign should be expressed through a separate
application and a key that is specific for that purpose.

=====

There is a commercial product called Docusign 
https://www.docusign.com/

I'm not familiar with the specifics, but it seems not to have done
away with the central issue, of trusting that the signer is the real
person whose name is being signed, just as an open-pgp signature is
not trusted unless one trusts that the signing key belongs to the
person of that name.

Just as anyone can create a pgp signing key with any name,  anyone
(with the proper personal information) can create a Docusign
key/certificate.
vedaal