E-Signatures. Chris Reed. Professor of Electronic Commerce Law

Transcription

1 E-Signatures Chris Reed Professor of Electronic Commerce Law Centre for Commercial Law Studies, Queen Mary University of London Of counsel, Lawrence Graham Agenda Rethinking the concept of signature e-signature technologies The problem of identity Legal validity of e-signatures Cross-border validity Regulation of signature service providers

2 A word of warning! Signatures have less legal significance than most (even lawyers) think Rarely needed to validate private dealings Often required for quasi public documents (wills, real estate transfers) Main role is for communication with government Apparent disputes about signature validity are often really about proof of agreement/acceptance of document Rethinking the concept of signature What is a signature? Method of evidencing: Identity of signatory Authenticity of [document] Intention to be bound by document Technologies include pens, typewriting, rubber stamps Potential legal approaches Law validates only manuscript signatures All technologies which achieve specified evidential effects can be valid Only specified technologies can create valid signatures

3 e-signature technologies These work in one of two ways: Adding information to an electronic document Typed name Scanned image of manuscript signature Logically associating information with an electronic document Encryption-based Associated information can be: Asymmetric encryption key Biometric data Adding information Signature is a mere add-on to document E.g. scanned image of manuscript signature, signature line of Like signing a Post-It note Fails to provide evidence that: Signatory added the signature data Document is unchanged since signature Extrinsic evidence could be used to prove these matters, e.g. headers + records of servers + Evidence of workings of sender s corporate system

4 Logical association Every electronic signature uses a method which can prove the link between: Identity information, e.g. Secret encryption key Biometric data and the document content Logical association means the necessary evidence is all in the document+signature Digital signatures are a subset of electronic signatures Use third party certification of secret keys PKI, or Public Key Infrastructure Applying a digital signature Alice sends a message to Bob She signs it with her secret key Bob checks the signature with Alice s public key If the check matches the message: Alice sent the message Alice agreed to its contents The message has not subsequently been altered

5 Digital signature technology Document { NumberStream } 1 [Hash function] [Hash function] MessageDigest NumberStream 2 (MessageDigest Ks )mod N = DigitalSignature (DigitalSignature Kp )mod N = MessageDigest Evidential basis of digital signatures Public key encryption can be broken But it is computationally infeasible to do so Key is N + Ks and Kp N is product of two prime numbers Ks and Kp derived from those numbers Assumption: the prime numbers can only be discovered by brute force (i.e. try all possibilities) Threatened by quantum computing Time taken to break a key where N= attempts per second = longer than expected lifetime of universe Currently used key lengths exceed 512 bits Each extra bit doubles the time to search for potential keys

6 Biometric data (e.g. signature metrics, fingerprint) Biometric signatures Encryption function Biometric signature Signature checked against known biometric data Evidential quality depends on (undisclosed) encryption function MessageDigest The problem of identity Is Alice really Alice? Secret key Certification Authority Public key

7 Certification process Signatory provides evidence of identity Ranges from merely giving valid address to attendance with identity documents To whom? Note role of RA in current commercial model Signatory provides copy of public key Signatory provides evidence that possesses secret/private key CA checks that public key validates digital signature CA issues certificate Legal validity of e-signatures Two models Valid if produces required evidential effects UNCITRAL Model Law US E-Sign EU Directive electronic signature Valid if Certified by trusted third party (Certification Authority); and Certification meets minimum standards Examples: EU Directive advanced electronic signature Singapore secure electronic signature

8 UNCITRAL UNCITRAL Model Law on Electronic Signatures 2001 Electronic signature means data in electronic form in, affixed to or logically associated with, a data message, which may be used to identify the signatory in relation to the data message and to indicate the signatory s approval of the information contained in the data message (art. 2(a)) 6(1) Where the law requires a signature of a person, that requirement is met in relation to a data message if an electronic signature is used that is as reliable as was appropriate for the purpose for which the data message was generated or communicated, in the light of all the circumstances, including any relevant agreement. 6(3) An electronic signature is considered to be reliable for the purpose of satisfying the requirement referred to in paragraph 1 if: (a) The signature creation data are, within the context in which they are used, linked to the signatory and to no other person; (b) The signature creation data were, at the time of signing, under the control of the signatory and of no other person; (c) Any alteration to the electronic signature, made after the time of signing, is detectable; and (d) Where a purpose of the legal requirement for a signature is to provide assurance as to the integrity of the information to which it relates, any alteration made to that information after the time of signing is detectable. US E-sign Electronic Signatures in Global and National Commerce Act (a) IN GENERAL- Notwithstanding any statute, regulation, or other rule of law (other than this title and title II), with respect to any transaction in or affecting interstate or foreign commerce-- (1) a signature, contract, or other record relating to such transaction may not be denied legal effect, validity, or enforceability solely because it is in electronic form; and (2) a contract relating to such transaction may not be denied legal effect, validity, or enforceability solely because an electronic signature or electronic record was used in its formation. 106(5) ELECTRONIC SIGNATURE- The term electronic signature means an electronic sound, symbol, or process, attached to or logically associated with a contract or other record and executed or adopted by a person with the intent to sign the record.

9 EU E-Signatures Directive Art 2(1) electronic signature means data in electronic form which are attached to or logically associated with other electronic data and which serve as a method of authentication Not to be denied validity solely on grounds that in electronic form art. 5 Signature + certification EU Directive art. 2(2) advanced electronic signature means an electronic signature which meets the following requirements: (a) it is uniquely linked to the signatory; (b) it is capable of identifying the signatory; (c) it is created using means that the signatory can maintain under his sole control; and (d) it is linked to the data to which it relates in such a manner that any subsequent change of the data is detectable. Certificate must meet Annex I CA must meet Annex II Certificate creation must meet Annex III Singapore Electronic Transactions Act 1998 s. 20 has similar requirements But certificate must be issued by a licensed CA

10 Cross-border validity Validity is a question for applicable national law Mutual recognition of certificates from other countries Based on recognition of accreditation schemes, not individual CAs Singapore Act ss. 20(b)(ii), 43 EU Directive art. 7 Contents of certificate E-signatures Directive Annex I Qualified certificates must contain: (a) an indication that the certificate is issued as a qualified certificate; (b) the identification of the certification-service-provider and the State in which it is established; (c) the name of the signatory or a pseudonym, which shall be identified as such; (d) provision for a specific attribute of the signatory to be included if relevant, depending on the purpose for which the certificate is intended; (e) signature-verification data which correspond to signature-creation data under the control of the signatory; (f) an indication of the beginning and end of the period of validity of the certificate; (g) the identity code of the certificate; (h) the advanced electronic signature of the certification-serviceprovider issuing it; (i) limitations on the scope of use of the certificate, if applicable; and (j) limits on the value of transactions for which the certificate can be used, if applicable.

11 Regulation of signature service providers Authorisation/licensing Accreditation Quality of company and staff Quality of processes Identification of signatory Security of keys Security of certificate creation Recordkeeping CA Liability Liability schemes Statutory Usually negligence-based EU Directive art. 6(1) Utah Act s strict liability overtaken by E-Sign Contractual E-Sign, Singapore Role of CPS Other? Tort-based?

12 Conclusions Currently, e-signatures are little-used Few legal requirements for signatures in commercial and private dealings Main uses likely to be Closed groups (e.g. Origo) B2C dealings affecting rights, e.g. banking, DRM Main driver for adoption is dealings with government Estonian ID card Single, government-issued e-signature would be adopted widely for commercial and private dealings