Subject: Re: RE: RE: MD5, SHA-0

From: Arshad Noor <[email-masked]>
Date: Wed, 25 Aug 2004 11:17:59 -0400

Richard,

Thank you for shedding more light on the subject.  Can you point me to
information on the electronic notarization pilots?  I am most interested
in the one in CA, but am also keen on knowing how the remaining three
states are implementing it.

Thank you.

Arshad Noor
StrongAuth, Inc.

----- Original Message -----
From: Richard Hansberger <[email-masked]>
Date: Wednesday, August 25, 2004 12:13 pm
Subject: RE: RE: MD5, SHA-0

> I hope some of this information is useful; I can provide specific
> documentation if necessary.
> 
> Many state laws mandate that Notaries may NOT notarize documents 
> with "blank
> or incomplete" spaces. Notaries are expected to review documents 
> carefully,though not to interpret them for signers. In every case 
> and in every state,
> the signer MUST appear before the Notary. Physical presence of the 
> signerbefore the Notary is almost the entire premise of notarization.
> 
> Acknowledgments and jurats are only two types of notarial acts. 
> There are at
> least 7 others (off the top of my head). What is common to them 
> all is a
> notarial certificate that contains wording indicating the act 
> performed. By
> far, however, acknowledgments and jurats comprise the bulk of what 
> Notariesdo on a daily basis.
> 
> California actually does have provisions for electronic 
> notarization (we are
> running pilots right now), and three other states do as well: CO, 
> AZ, PA.
> 
> Richard J. Hansberger
> Director of eNotarization
> National Notary Association
> 818-739-4027
> 
> -----Original Message-----
> From: Arshad Noor [mailto:[email-masked]] 
> Sent: Wednesday, August 25, 2004 5:17 AM
> To: Santosh Chokhani
> Cc: 'IETF LTANS'
> Subject: Re: RE: MD5, SHA-0
> 
> 
> 
> I cannot speak for the French (or for that matter, for the 
> remaining 49
> states 
> of the US), but the State of California requires that Notaries 
> must review
> the 
> document BEFORE the document signer signs it (I would presume that 
> this 
> may be a uniform requirement in the US).
> 
> Notaries sign two types of documents - Acknowledgements and 
> Jurats.  An
> Acknowledgement witnesses the actual act of the document signer 
> signing 
> the document, while in the Jurat, the document signer must swear 
> to veracity
> 
> of the contents of the document before signing it.  In both cases, the
> Notary 
> MUST review the unsigned paper document, and witness the signer 
> signing the
> document before he/she notarizes it.  
> 
> There are no laws around electronic notarization in CA, and it 
> might be
> prudent to not use the word "Notary" or "Notarization" with such 
> servicesuntil there is a law that defines it - we may risk 
> diluting the meaning of
> the word in the paper world.
> 
> Arshad Noor
> StrongAuth, Inc.
> 
> 
> ----- Original Message -----
> From: Santosh Chokhani <[email-masked]>
> Date: Wednesday, August 25, 2004 7:50 am
> Subject: RE: MD5, SHA-0
> 
> > 
> > Denis:
> > 
> > If we assume that notary notarizes the original document, we do
> > not have a
> > problem.
> > 
> > Larry:
> > 
> > Should the notary requirement make this clear?
> > 
> > -----Original Message-----
> > From: Denis Pinkas [mailto:[email-masked]]
> > Sent: Wednesday, August 25, 2004 7:35 AM
> > To: Santosh Chokhani
> > Cc: 'IETF LTANS'
> > Subject: Re: MD5, SHA-0
> > 
> > 
> > Santosh,
> > 
> > > Carl, Denis:
> > > 
> > > My response was terse.  I assumed that the question was prompted
> > with
> > > when the Notary is given only the hash in the first place for
> > the
> > > reasons of confidentiality.
> > 
> > Hum, hum !!!
> > 
> > My undersnding of the primary role of a notary (at least under the
> > French 
> > legislation) is to look at the content of the document (already 
> > signed) 
> > before applying his own signature. Therefor I have some 
> > difficulties with 
> > schemes where the Notary would not have access to the semantics 
> of 
> > the 
> > document. Otherwise the word "Notary" should not be used for 
> that 
> > case.
> > Denis
> > 
> > 
> > 
> > > Thus, I was proposing that to preserve the confidentiality
> > desired b
> > > the submitter, we look into ERS encryption approach.
> > > 
> > > -----Original Message-----
> > > From: Denis Pinkas [mailto:[email-masked]]
> > > Sent: Wednesday, August 25, 2004 4:13 AM
> > > To: Santosh Chokhani
> > > Cc: 'IETF LTANS'
> > > Subject: Re: MD5, SHA-0
> > > 
> > > 
> > > Santosh,
> > > 
> > > 
> > >>Larry:
> > >>
> > >>The initial reading is that SHA-1 is relatively safe, but 
> people 
> > >>should move to SHA 256 within next 5 years.
> > >>
> > >>That said, LTANS does need to worry about what happens if the 
> notary 
> > >>has the hash of the document.  If the hash gets broken, it
> > dilutes the
> > >>document existence claim.
> > > 
> > > 
> > > No. Apply a new time-stamp token with a new hash function.
> > > 
> > > 
> > >>I think one alternative is to use the encrypt scheme as ERS
> > folks have
> > >>proposed for trusted archive.  Of course, the caveats in the ERS
> > >>encryption paper will apply.
> > > 
> > > 
> > > Avoid any kind of encryption for that purpose.
> > > 
> > > Denis
> > > 
> > > 
> > >>-----Original Message-----
> > >>From: [email-masked] 
> > >>[mailto:[email-masked]]
> > >>On Behalf Of Larry Masinter
> > >>Sent: Wednesday, August 18, 2004 2:26 AM
> > >>To: 'IETF LTANS'
> > >>Subject: MD5, SHA-0
> > >>
> > >>
> > >>
> > >>It's sometimes hard to discern technical details in news 
> articles. 
> > >>Anyone have a more reliable source on what happened at Crypto 
> 2004?> >>
> > >>http://news.com.com/Crypto+researchers+abuzz+over+flaws/2100-
> > 1002_3-53
> > >>13655.
> > >>html
> > >>
> > >>I still haven't understood, for notary services, if
> > >>the notary service doesn't have the original document
> > >>but just the hash, what happens when the hash algorithm
> > >>is compromised?
> > >>
> > >>Larry
> > > 
> > > 
> > > 
> > > 
> > 
> > 
> > 
This email message and any files transmitted with it contain confidential information intended only for the person(s) to whom this email message is addressed.  If you have received this email message in error, please notify the sender immediately.