Version classiqueVersion mobile
OpenEdition Books

Cyberidentities

 | 
Leen D’Haenens

Part Two: Cyberlaw

The Legal Aspects of Digital Signatures

Patrick van Eecke

Résumé

In its recently adopted Communication, A European Initiative in Electronic Commerce (European Commission, Communication to the European Parliament, the Council, the Economic and Social Committee and the Committee of the regions, 15.04.97, COM(97) 157: 13), the European Commission announced its intention to come forward with a specific initiative on Digital Signatures. This initiative will aim at ensuring a common legal framework encompassing the legal recognition of Digital Signatures in the Single Market, the setting up of minimum criteria for Certification Authorities, as well as pursuing worldwide agreements. Also, the European Parliament has invited the Commission to prepare as soon as possible legal provisions concerning information security and digital identifications (European Parliament Resolution A4-244-96 of 10.09.96, OJ320:164 of 28.10.96). The paper first wants to describe the need for secure authentication in cyberspace. Second it wants to analyze the legal situation in the different EU member states regarding the use, the implementation, and the legal acceptance of Digital Signatures and Certification Authorities. Finally, the keynote wants to compare the European vision with the Canadian legal and technical state of the art. The Canadian government is, indeed, currently developing guidelines for the introduction of digital signatures in Canada

Texte intégral

I INTRODUCTION

1In its recently adopted Communication “A European Initiative in Electronic Commerce” the European Commission announced its intention to come forward with a specific initiative on digital signatures (EC, 1997). This initiative will aim at ensuring a common legal framework encompassing the legal recognition of digital signatures in the Single Market, the setting up of minimum criteria for Certification Authorities, as well as pursuing worldwide agreements. In its communication the European Commission expresses the need for a sound and flexible regulatory framework which would generate confidence for both business and consumers and ensure full and unlimited access to the Single Market. Such a regulatory framework would be an essential key to Europe’s success and a major competitive advantage in itself (EC, 1997: 13).

2In this respect the following study seeks to describe and analyze the legal situation in the different EU member states and the main contracting countries regarding the use, the implementation and the legal acceptance of digital signatures and Certification Authorities. Furthermore, the study seeks to define the legal obstacles to the Internal Market, and advocates the need for a European legal initiative.

II THE EC COMMUNICATION ON ELECTRONIC COMMERCE

  • 1 The complete text of the communication is available at [http://www.cordis.lu/esprit/src/ecomcomx.h (...)

3This chapter briefly describes the Communication from the European Commission announcing a Community initiative in the field of digital signatures:1 “A European Initiative in Electronic Commerce.”

2.1 Electronic commerce – A need for trust

2.1.1 What is electronic commerce?

4Electronic commerce is about doing business electronically. It is based on the electronic processing and transmission of data, including text, sound and video. It encompasses many diverse activities including electronic trading of goods and services, on-line delivery of digital content, electronic fund transfers, electronic share trading, electronic bills of lading, commercial auctions, collaborative design and engineering, on-line sourcing, public procurement, direct consumer marketing and after-sales service. It involves both products (e.g., consumer goods, specialized medical equipment) and services (e.g., information services, financial and legal services); traditional activities (e.g., healthcare, education) and new activities (e.g., virtual malls) (EC, 1997). Electronic commerce is not a new phenomenon. For many years companies have exchanged business data over a variety of communication networks. But there is now accelerated expansion and radical changes, driven by the exponential growth of the Internet.

5Until recently no more than a business-to-business activity on closed proprietary networks, electronic commerce is now rapidly expanding into a complex web of commercial activities transacted on a global scale between an ever-increasing number of participants, corporate and individual, known and unknown, on global open networks such as the Internet (EC, 1997, {par. 6}).

6The pace and the extent to which Europe will benefit from electronic commerce greatly depends on having up-to-date legislation that fully meets the needs of business and consumers. The objective of the Commission is to implement the appropriate regulatory framework by the year 2000. The existing Single Market regulatory framework has proved its worth for traditional forms of business. It must now be made to work for electronic commerce by achieving two complementary objectives: building trust and confidence and ensuring full access to the Single Market.

2.1.2 Electronic commerce: Need for trust and confidence

7Every form of trade needs trust and confidence between the participants. The ability to be sure who is your contracting partner, what is exactly agreed upon (what is the exact content of the transaction), when the transaction takes place, creates trust between the partners. As we move towards the use of electronic forms of communication and documentation, this ability to trust must be maintained. Building such trust and confidence is indeed the prerequisite to win over businesses and consumers to electronic commerce.

8Building trust and confidence among businesses and consumers implies the deployment of secure technologies (such as Digital signatures, digital certificates and secure electronic payment mechanisms) and of a predictable legal and institutional framework to support these technologies. In order to allow electronic commerce operators to reap the full benefits of the Single Market, it is essential to avoid regulatory inconsistencies and to ensure a coherent legal and regulatory framework for electronic commerce at EU level. This should be based on the application of key Internal Market principles (EC, 1997: 5).

2.1.3 Electronic commerce: Ensuring full access to the single market

  • 2 Proposal for a European Parliament and Council Directive, third amendment, Directive 83/189/EEC la (...)

9Given its size, the Single Market potentially offers businesses a “critical mass” of customers before addressing further global markets. However, faced with the new challenges posed by electronic commerce, member states are responding in different ways. The development of divergent legislative approaches is not only ineffective given the transfrontier nature of electronic commerce, but it also may result in fragmenting the Single Market and thus inhibiting the development of electronic commerce in Europe. The proposed Transparency Mechanism Directive2 is precisely targeted at reducing the danger that new measures, by being different from one member state to another, may restrict the free movement of Information Society services (EC, 1997).

  • 3 Directive 95/46/EC of the European Parliament and the Council on the protection of individuals wit (...)
  • 4 Directive 96/9/EC of the European Parliament and of the Council on the legal protection of databas (...)
  • 5 Directive 97/7 of the European Parliament and the Council of 17.2.1997 on the protection of consum (...)
  • 6 Proposal for a European Parliament and Council Directive amending Council Directive 89/552/EEC on (...)
  • 7 Commission Green Paper “Legal Protection of Encrypted Services in the Internal Market”, COM (96) 7 (...)
  • 8 Communication from the Commission “Follow-Up to the Green Paper on Copyright and Related Rights in (...)
  • 9 Questionnaire on “Industrial Property Rights in the Information Society”. Version 5.0. September 1 (...)
  • 10 Green Paper on “Commercial Communications in the Internal Market”, COM (96) 192 final. 08.05.1996.
  • 11 Green Paper on “Public Procurement in the EU: Exploring the Way Forward”, COM(96) 583 final. 27.11 (...)
  • 12 Green Paper on the “Protection of Minors and Human Dignity in Audiovisual and Information Services (...)

10However important it is to avoid regulatory inconsistency by discouraging divergent actions at national level, the Union must also ensure that a coherent regulatory framework for electronic commerce is created at European level. Such a regulatory framework will inevitably be built on existing Single Market legislation which already largely creates the right conditions for on-line businesses. As part of that framework, specific measures have already been taken to respond to new developments. They include the recently adopted directives on data protection,3 on the legal protection of data bases4 and on contracts negotiated at a distance;5 and the proposed revision of the “Television without Frontiers” Directive.6 In addition, a number of consultation or policy documents have been issued to stimulate debate on various policy areas including the legal protection of encrypted services,7 copyright and related rights,8 industrial property,9 commercial communications,10 public procurement11 and the protection of children and human dignity in audio-visual and information services12 (EC, 1997).

2.2 Digital signatures as a tool to ensure trust and confidence

11Secure technologies – such as Digital signatures and digital certificates – go some way to meeting these challenges. Digital signatures enable the unambiguous confirmation of the identity of the sender and the authenticity and integrity of electronic documents. Unique to the sender and unique to the message sent, Digital signatures are verifiable and non-repudiable. Similarly, the exchange of digital certificates (“Internet ID cards”) through an automatic “digital handshake” between computers provides assurance that the parties are who they say they are, and helps to assess whether the service provided and the goods or services delivered are genuine (EC, 1997).

12Copyright protection mechanisms, also based on secure technologies such as cryptography and smart cards, ensure the protection of digital material and are a crucial factor in the emergence of a mass-market in electronic content. Also based on cryptographic methods, secure electronic payment mechanisms provide the final element of trust: the ability to pay and to be paid. Such secure technologies are for the most part fully operational and commercially available.

13Digital signatures will be the driving force behind the development of many new services, which vary from certification (i.e., linking identity with a public key) to fullyfledged digital notary services, like adding a time stamp to a electronic document, electronic archiving, etc. These service will play a dominant role in the Information Society, particularly in electronic commerce.

14However, the necessary regulatory and institutional framework supporting such technologies is not yet complete, particularly in areas such as interoperability and mutual recognition across borders.

III CURRENT INITIATIVES WITH RESPECT TO DIGITAL SIGNATURES

15This chapter shortly describes some practical and legal initiatives which are taken on national, international and Community level regarding the introduction of digital signatures and CA services.

3.1 Practical initiatives

16Especially in the banking sector, the tax administration and the social security field, electronic communication authenticated by digital signatures is or is being put in use. Electronic shopping malls, introducing electronic commerce in the real sense, have been appearing on the Internet.

  • 13 [http://www.isabel.be/].
  • 14 [http://www.belsign.be/].
  • 15 [http://www.teletrust.de].
  • 16 [http://www.ncr.es].
  • 17 [http//www.banesto.es].
  • 18 [http://sest.mkn.co.uk].

17The Belgian Isabel network allows the customer to communicate in a secure way with most of the Belgian financial institutions and some private enterprises by making use of digital signatures and smart-card technology.13 The Chambers of Commerce initiative “BelSign” operates as a Certification Authority (CA) and offers on-line certificate management services to issue and manage digital certificates.14 In Scandinavia the Nordic Post Security Service (NPSS), a joint venture of the Finnish, Danish, Swedish and Norwegian postal authorities, is testing its first service using digital certificates and cryptography keys – a secure electronic mail system that will soon be launched. Sweden already has various digital signature initiatives, in the private as well as in the public sector. In France the Banque Nationale de Paris (BNP) and Société Générale, together with Visa International, France Télécom and Gemplus, are working together to develop a secure way of buying goods and services over the Internet, using chip card technology. In Germany, within the scope of their Banking Communication Standards, banks offer their clients the use of a digital signature for secure electronic banking. The Teletrust Deutschland e.V.15 projects create public-domain application solutions for secure electronic communication. The two biggest Irish banks have set up Internet “shopping malls” making use of digital signatures. The Dutch I-pay project implements a trustworthy and secure electronic payment system, including the use of digital signatures and a Certification Authority function. Also the PTT Post-a private company in the Netherlands-is planning to offer secure e-mail services, using digital signatures and cryptography. PTT Post will act as a Certification Authority/Trusted Third Party. In Spain “Telefonica” is planning to create, in co-operation with the most important banking associations in Spain a certifying authority regarding electronic banking transactions using credit cards and being carried out through Internet.16 Another application concerns the Banesto bank. This bank has created a CA which is presently operating through Internet.17 In the United Kingdom the Certification Authority Eurosign is offering its services to the Internet public.18 Also in the public sector an infrastructure is being developed for the transmission of intergovernmental secure electronic mail to be used by the British Government (Communications Electronic Security Group, 1996). In France an electronic professional health card will be introduced before 1999 enabling professional users and health insurance organizations to send, sign, receive and process electronic care documents. Also Spain and Belgium are implementing electronic social security cards based on smart cards and digital signatures. In Luxembourg “Healthnet” is an already partly operational value added network which offers all kinds of telematic services to all the professionals working in Healthcare and Social Security. To provide security, digital signatures will soon be utilized.

  • 19 See also Green Paper on Public Procurement in the European Union: Exploring the Way Forward, Commu (...)
  • 20 See also Office For Harmonization In The Internal Market (Trade Marks And Designs), [http://europa (...)
  • 21 SEMPER is part of the European Commission’s ACTS program, [http:/www.semper.org].
  • 22 ICE-TEL is funded by the Telematics for Research Initiative within the Euopean Telematics Applicat (...)

18Also on a European Community level, diverse applications of electronic communication are in a project phase, or already implemented. Most of them are tending to introduce digital signatures for authenticating the electronic messages. The electronic tendering procedure in the public procurement field (SIMAP)19 and the electronic request procedure for a Community trademark (OHIM-RESMA)20 are only two examples. Diverse pilot projects and studies are currently being carried out for encouraging electronic commerce, such as SEMPER (Secure Electronic Marketplace for Europe)21 and ICE-TEL (Interworking Public Key Infrastructure for Europe).22

19Especially in the United States, but also in Canada and Japan the development of electronic commerce in both the private and public sector is booming. Internet shopping malls, and electronic communication between the government and citizens are in full operation. The use of digital signatures in these countries is recognized as one of the most important tools to produce technically and legally secure electronic documents. Well-established certification authorities provide for identification and issuance of digital certificates. Legislation has been or will soon be enacted to provide for a legal framework eliminating existing legal obstructions and regulating the new services.

3.2 Legal initiatives

  • 23 Council Resolution Nr. 96/C 376/01 of 21.11.1996 on new policy-priorities regarding the informatio (...)
  • 24 European Parliament Resolution A4-244/96 of 19.09.96, OJ320, p.164 of 28.10.96.

20The Council has requested the member states and the Commission “to prepare consistent measures to ensure the integrity and authenticity of electronically transmitted documents.”23 Also the European Parliament has invited the Commission to prepare as soon as possible legal provisions concerning information security and digital identification.24

  • 25 Recommendation of the OECD Council concerning Guidelines for Cryptography Policy, 27.03.1997; http (...)

21At the end of March, the OECD has adopted Guidelines for Cryptography Policy,25 setting out principles to guide countries in formulating their own policies and legislation relating to the use of cryptography. These Guidelines make recommendations on several aspects of cryptography, including Digital signatures and international service provision.

  • 26 ETSI Technical Committee Reference Report, Requirements for Trusted Third Parties, Vs. 0.0.7 of 26 (...)
  • 27 Public-Key Infrastructure (X.509) (pkix) Charter: [http://www.ietf.cnri.reston.va.us/html.charters (...)
  • 28 X500 and IS09594 series; ftp://ftp.bull.com/pub/OSIdirectory/ITU
  • 29 W3C Digital Signature Initiative: [http://www.w3.org/puh/WWW/Security/DSig/DSigProj.html].

22The European standardization body (ETSI) is in the process of drafting a report26 on the requirements for so-called Trusted Third Parties (TTPs). This report, once finalized, will serve as the basis for the European standardization process concerning TTP services, including those related to Digital signatures. The draft report explicitly recognizes the impact of the commercial and legal environment on the technical standardization process. At the global level, the IETF (Internet Engineering Task Force),27 ISO/ITU28 and the W3C (World Wide Web Consortium)29 are working on standardization relevant for Digital signatures.

23In its recently adopted Communication “A European Initiative in Electronic Commerce” the Commission responded by announcing its intention to come forward with a specific initiative on Digital signatures (EC, 1997, {par. 51}). This initiative will aim at ensuring a common legal framework encompassing the legal recognition of Digital signatures in the Single Market, the setting up of minimum criteria for Certification Authorities, as well as pursuing worldwide agreements.

  • 30 Loi N° 96-659 du 26.07.1996 de réglementation des télécommunications.
  • 31 Informations- und Kommunikationsdienste-Gesetz - IuKDG, Article 3.
  • 32 Licensing of Trusted Third Parties for the provision of cryptography services - Public Consultatio (...)
  • 33 Staatscourant nr. 54, 18.03.1997.
  • 34 Press release, Council of Ministers, 30.05.1997.
  • 35 Law of 15 March 1997, n° 59, Article 15, § 2 Supplemento Ordinario alla Gazzetta Ufficiale della R (...)

24EU member states are preparing their national regulatory framework. France has already adopted a new Telecommunications Act,30 implementation legislation has been announced. In Germany a law on digital signatures was approved by the German Bundestag on June 13, 1997.31 The UK Government has launched a Public Consultation on the regulation of TTPs.32 The Dutch Government has created an interdepartmental task force.33 Also Denmark is developing a draft law on digital signatures. Sweden organized a public hearing in June. Belgium announced a legal initiative with respect to Digital signatures and electronic documents.34 Italy has recently approved the legal equivalence of electronic documents, and TTPs is expected as an application of the general principle stated by the new law.35

  • 36 South Korean Act on Promotion of Trade Business Automation.
  • 37 Digital Signature Bill 1997 [http://www.geocities.com/Tokyo/3399/digisign.html].
  • 38 Certification Authority Guidelines (Alpha version), April 1997, Electronic Commerce Promotion Coun (...)

25Other countries are also implementing national legislation allowing the use of electronic documents and setting the rules for the delivery of relevant services. In some of the United States, digital signatures are already accepted as legally valid mechanisms. Of 33 state laws that have been enacted, proposed, or drafted, 23 of them are technology neutral, and 10 call for the use of digital signatures (Droite, 1997; Horning, 1997). South Korea recognizes the legal validity of digital signatures.36 Also Malaysia has drafted a bill seeking to make provision for, and to regulate the use of, digital signatures and to provide for matters connected therewith.37 In Japan the Electronic Commerce Promotion Council has published Certification Authority guidelines.38 Also the Canadian government is currently developing guidelines for the operation for all CAs in Canada. The Australian government is considering issues associated with establishing a public key authentication framework as well.

  • 39 Working Group on Electronic Commerce: [http://www.un.or.at/uncitral/sessions/wg_ec/index.htm#TOP]

26International regulatory co-operation relating to digital signatures is still in its infancy, but will mature rapidly in the coming months. Initial bilateral (EU/US, EU/Japan) and multilateral (UNCITRAL)39 discussions have started. National security and law enforcement issues are dealt with in other fora (G7-P8).

IV BRIEF OVERVIEW OF CONCEPTS AND TERMINOLOGY

27This section briefly describes the most important concepts and terminology which are used in the report.

4.1 What is a digital signature?

28Several different methods exists to electronically sign documents. These electronic signatures vary from very simple methods (for example, inserting a scanned image of a hand-written signature in a word processing document) to very advanced methods (using cryptography). The subset of electronic signatures based on public key cryptography, is often called digital signatures. The basic nature of digital signatures is that the author of an electronic document can sign his electronic document by using a secret cryptography key. This key must be kept private at all times by the user. The signature can only be verified with the associated public key of the author. This public key is widely known.

29The idea behind this authentication is the confirmation of identity by proving the possession of a secret key. The author encrypts the message or a part of it with his secret key. The recipient of the message can check the identity of the author by decrypting the information with the public key of the presumed author. If the decryption is not successful the recipient will not validate the message. This process of authentication relies on the public keys of the users that are accessible to all the communication partners and on a trusted relationship between the identity of the users and their public key.

30In this sense, a digital signature can be described as a piece of data that has been extracted from the electronic message itself, made unforgeable by the use of public key cryptography and consequently attached to the message.

31Like the signature you use on written documents today, digital signatures are now being used to identify authors/co-signers of e-mail or other information objects electronic data. Digital signatures can provide three important functions:

  • Authentication: To authenticate the identity of the person who signed the data – so you know who participated in a transaction.
  • Integrity: To protect the integrity of the data – so you know that the message you read has not been changed, either accidentally or maliciously.
  • Non-repudiation: To allow you to prove later who participated in the transaction – so someone may not successfully deny having sent or received the data.

32It is important to know that in order to create a signed message, it is not necessary to send the message itself in encrypted form. The digital signature will be appended to the message and can be verified irrespective of the form (clear/encrypted) of the message itself.

  • 40 There must be only a negligible possibility that another data unit could result in the same hash v (...)
  • 41 See also, LegSec WP3 Report Security Issues, ENS Legal and Security Issues, E2307, Deliverable 3, (...)

Digital signatures: step by step
A digital signature is created as follows:
The first step is to create the data unit that is to be signed, e.g., a precisely delimited information object in digital form. This can be a text document, software, or any other digital information.
The second step will be to create a hash value, often called a “message digest” or a “fingerprint” of the message. That is the result of a mathematical process based on the data unit and an algorithm which creates a compressed digital representation. If the data unit is changed the hash value will no longer correspond to this data and this will generate an error message.40 This technique will enable the signature software to operate on small and predictable amounts of data.
As a third step the signer will encrypt the hash value with his private key. The checksum — the digital signature — will be unique to both the data unit and the private key used to create it, and it has to be attached or appended to the data unit.
As a final step the digital signature will be verified by regenerating the hash value on the basis of the same data unit and the same algorithm. This hash value will be computed with the public key to once again produce a checksum, which should be compared with the checksum/signature attached to the data unit. If the result is identical it will verify that the signer’s private key was used to sign and that the data unit has not been altered.41

4.2 What is cryptography?

33Cryptography is a highly important instrument for achieving secure electronic commerce. By encoding or scrambling the data of an electronic message, it is possible to protect the information from being disclosed or modified. The encoding and decoding of the message is performed by using a key which is only known to the communicating partners. The main advantage of encoding the message is that the partners can be sure nobody can read the message. Furthermore, since only the contracting partners know the secret key, every encrypted message which can be decoded by that secret key can only originate from the other party, and thus authenticates the message. This system of sharing one secret key is called symmetric or secret key cryptography. Before the partners start to communicate they, of course, have to exchange the secret key. This creates both practical and security problems: the communicating parties have to contact each other before they start the encrypted communication, and the secret key can be intercepted during its transmission. Furthermore, since the receiver is also in the possession of the secret key, he is able to sign as well The main problem, however, is that you cannot communicate with partners you have never contacted before. This creates difficulties in an open electronic environment, such as the Internet, in which electronic commerce will mostly take place between partners who do not know one another.

34Symmetric cryptography, however, is not the only type of cryptography. The encoding and decoding of the message can also be performed by using two keys: one public key which is publicly known, and one secret key, which is only known by the entity. This cryptography technique is called asymmetric or public key cryptography. The public key can be used by anyone to encrypt a message. Only the owner of the secret key can decrypt it. Thus, if two entities want to send information to each other, they exchange their public keys. The public keys could also be retrieved from a database which is open to the public. When A sends to B a message, A encrypts the message using the public key of B. Only B can encrypt the message using his secret key.

35The primary advantage of public-key cryptography is increased security. The secret keys do not have to be transmitted or revealed to anyone. Another advantage of this system is that the public key and the secret key can both be used for encoding as well as for decoding. Their functions are interchangeable. This means that A can encode a message with his own secret key, which B can decode by using A’s public key. On the face of it, this seems a silly method, because everybody has access to A’s public key and can thus decrypt and read the message. This is, indeed, true. On the other hand, B can be sure that the message can only originate from A, since he is the only one who knows the secret key. Without having contacted A before, B can trust on the authenticity of the message. It is on this technology of sharing a public key that digital signatures are based.

4.3 Where does the user get his keys from?

36The key pair can be generated by the user himself by running specific cryptography software. Even the recent versions of the most popular Internet communication software, such as Microsoft Internet Explorer and Netscape Communicator, allow the user to create its own key pair. The key pair can also be generated by a third party. This is, for example, the case in the electronic banking sector. For security reasons, the secret key can immediately be destroyed by the third party.

4.4 How does the user store his private key?

37Temporarily, secret keys are being stored on the hard disk of the user’s computer. The user gains access to the secret key by entering a password or pass phrase. This type of storage, however, has the disadvantage of non-mobility. The user always needs his own computer in order to put his digital signature on an electronic file. Therefore, the storage of the secret key on a removable carrier, such as a smart card is getting more popular. The user simply inserts his smart card into a reader by which he can sign digitally.

4.5 Can the private key not be stolen?

38Once a person has generated or received his public and private key, it is extremely important to keep the secret key free from access by others. If somebody gains access to the secret key, that person will be able to counterfeit the key and, thus, to create digital signatures. Protection of the secret key is, however, for the user a local matter under his control or the control of a responsible site security officer. Every person bears responsibility for his own signature and should protect it from lost, theft or illegal use. Neither should the user forward his secret key to other people such as a secretary or colleague.

4.6 How does the user obtain the partner’s public key?

39The user needs the public key of his partner in order to check the authenticity of his digital signature. This public key can be delivered by the partner himself but can also be retrieved from a database which is publicly accessible. Normally, the communication software of the user will automatically check the digital signature by retrieving previously stored public keys or accessing the relevant public database.

4.7 How can the user be sure this public key really belongs to his partner?

  • 42 ISO 9594-8-The Directory-Authentication Framework defines a certification authority as follows: “A (...)

40The authentication procedure is based on the presumption that the public key really belongs to the signer. This presumption is, however, not self-evident. The risk exists that somebody creates a key-pair, places the public key in a public directory under somebody else’s name and thus signs electronic messages in the name of somebody else. Furthermore, a public/private key pair has no inherent association with any identity, it is simply a pair of numbers. Therefore, the assurance should exist that the public key really belongs to the claimed identity. The answer is to rely on third parties to certify public keys. A third party will guarantee the relationship between the identity and the public key. This association is achieved in a digital certificate that binds the public key to an identity. These third parties are known as Certification Authorities and must be accepted by all users as impartial and trustworthy, Trusted Third Party (or TTP).42 In addition, the process of key certification must be foolproof and should be afforded the highest level of security. A Certification Authority will, by issuing a digital certificate, certify the identity of the user and guarantee that the public key really belongs to the claimed user. The act of using a registered digital signature to sign an electronic message becomes thus very similar to appearing in front of a notary public to manually sign a paper.

4.8 How does the certification authority check the identity of the user?

41Some certificates are passed out after a simple E-mail address check. The assurance provided is minimal, and only good for establishing a consistent presence, not for guaranteeing that someone is a real person. Other certificates are issued after receiving third party proofing of name, address and other personal information provided in the on-line registration. Usually this will be a check of some consumer databases.

42The best identification check is, of course, personal appearance. Some certification authorities require someone to personally take their application to a notary, who will check identification before endorsing it. This adds an additional layer of credibility to the certificate (e.g., Verisign). It could also be possible to meet personally with a representative of the certification authority (e.g., Thawte). Most of the CAs offer a range of certificates, graded according to the level of investigation used to confirm the identity of the subject of the certificate.

4.9 What is the content of a digital certificate?

43Digital certificates may contain every type of information necessary to identify the creator of the digital signature. Usually they contain the owner’s public key, the owner’s name, the expiration date of the certificate, the name of the Certification Authority that issued the digital certificate, a serial number, and perhaps some other information. The CA signs information and thereby adds credibility to the certificate. People who receive the certificate check the signature and will believe the attribute information / public key binding if they trust that certifying authority.

44In order to allow an automated checking of the certificates it is important that certificates are built up in the same form. It is therefore necessary that standards be followed, describing the elements a certificate should contain. The emerging certificate standard is the X.509 certificate format, which has been around since 1988 and is part of the ITU-OSI group of standards. X.509 certificates are very clearly defined using a notation called ASN.1 (Abstract Syntax Notation 1) which specifies the precise kinds of binary data that make up the certificate. The X.509 certificate, version 3, is approved in 1997 and is currently being implemented in most applications. This version allows to insert additional information such as alternate naming, restricting the use of the key, identification data (E-mail address,...), and information about a so called (cf. below) Certificate Revocation List (International Telecommunications Union, 1997).

4.10 What if the certificate is not valid any longer?

  • 43 Furthermore, certificates based on the X.509 standard come with an expiry date to ensure that old, (...)

45Many cases exist where an individual’s certificate should not be used or trusted anymore, for instance when an employee leaves a company, or when someone’s computer or smart card containing the secret key is stolen. When a certificate becomes compromised, there must be a way to call up the CA and request that the certificate be disavowed.43 The most common way of making the revocation public is to put it in a database, called a Certificate Revocation List or CRL. The CRL can be accessed by the public to check if the certificate of a user is still valid. A Certification Authority thus must maintain two databases, a complete list of certificates and a list of revoked certificates.

4.11 Why should the user trust the certification authority of the other party?

  • 44 The X.509 structure did not allow the cross-certification structure until in its last version (v.3 (...)

46When one user, whose public key is certified by a CA, wants to communicate securely with his partner, certified by another CA, both users should trust each other’s CA. One way to achieve this confidence is by cross-certification, this means that both CAs certify each other’s public key.44 Another solution could be that the two CAs are certified by a third CA, functioning as a top-level CA. In this hierarchical CA structure each CA only needs to be certified once in order to gain trust. At the moment, however, most CAs are certifying themselves by simply signing their own public key and posting this certificate on their own websites. This self-certification is possible because the CAs rely on trust gained from other activities, such as postal services or banking activities. In order to assess the level of trust that may be put into a CA, the CA should also provide a combination of technology (such as security protocols and standards, secure messaging, and cryptography), infrastructure (including secure facilities, customer support, and redundant systems), and practices – a defined model of trust and legally binding framework for subscriber activities and disputes. In short, a CA should be a trusted on-line service operating 24 hours a day, 7 days a week on a global basis.

47Hierarchies are, however, not the only solution. There are cryptography solutions which are making use of a so-called web of trust. Your key might be signed by people who are trusting you, such as friends, family or colleagues. People who will want to verify the signature might know someone from this group and have a copy of his public key. It is self-evident, though, that existing webs of trust are too small to offer a practical solution for electronic commerce.

4.12 What is the difference between traditional and digital signatures?

48The “signature” concept has a long tradition and is normally easy to describe. It gives basic mechanisms for secure traditional information management. A hand-written signature is physically tied to a carrier (the sheet of paper), which gives shape and structure to the information in an immediately readable format. This “lock” for the information, provided by the carrier and the signature representing the issuers unique patterns of handwriting, gives the reader reasons to believe that the object originates from the individual who is seen to be the originator and the identity attribute is inherent, not given to the signatory.

49Digital signatures are not immediately readable and the “signature,” the carrier and the signed object are not physically related to each other in the same “locked” and durable form. A manipulation of the data normally leaves no such traces as a manipulation in the traditional environment and portions of a signed information object may be stored on different locations, such as a hard disk. Visual inspection of a traditional example is replaced by technical verification of a signed information object, stored in a computer readable format and logically tied to the signature. As the digital attribute making the signature unique for the individual is assigned, not an inherent characteristic of the signatory, the signature process may be performed by anyone who has access to the secret and the procedures.

50The hand-written signature furnishes the information with a physically unique sign of authenticity – it is an original example. Such signed objects may be in a person’s possession, and can thus be the carrier of authority (e.g., power of attorney) or a certain right (e.g., bills of lading and other negotiable documents). However, the unique aspect of a digitally signed object has to be related to a pattern of data, which may easily be copied, and the duplicate will have exactly the same qualities as the “template.” Consequently, the unique existence of IT material is built upon the storing and transmittal of original contents and certain IT applications such as shipping documents demands some form of registration; cf. the risk of double-spending of electronic money.

4.13 Can traditional signatures be replaced by digital substitutes?

51The management of traditionally signed objects may in the main be replaced by digital equivalents. By making use of security techniques, such as digital signatures, the authenticity of the information can be maintained. The need for protection of such objects is already carefully considered in the traditional environment. An examination of electronic commerce, electronic handling of cases by administrative agencies and similar routines shows the same need for protection in the IT environment. However, the changes related to the transition from original examples to original contents have to be noticed where appropriate.

52Consequently, current issues are in principle traditional matters of legal protection and security, which give basic mechanisms for the information management. Instead of creating a completely new legal framework, existing achievements should be utilized, as far as they are compatible with IT.

V GENERAL OVERVIEW OF LEGAL ISSUES

53This chapter shortly describes the different legal issues requiring further investigation if digital signatures and services are being introduced in the European Community and its main trading partners. The issues are subdivided into problems concerning products, services and signatures.

54Currently, member states and trading partners are looking into the need to adjust or are already amending national law and regulation in order to provide for legal validity and enable businesses and citizens to use digital signatures without technical nor legal risk. The Commission Communication states that a wide range of regulations at national level could, however, inhibit the establishment of service providers across frontiers. These include differing professional requirements, differing prudential and supervisory systems, and notification or licensing requirements (for example for regulated professions or financial services) (EC, 1997). In order to ensure the proper functioning of the Internal Market the divergences between national regulatory frameworks for digital signatures and any resulting potential regulatory barriers should be analyzed.

5.1 Legal issues regarding the use of digital signatures

5.1.1 “Taper-Based” legislation in some member states may hinder a free flow of digitally signed electronic documents

55Most member states have not adapted their national legislation to the new techniques of document management. Laws of evidence, as well as sectoral legislation, impose, explicitly or implicitly, the need for penned signatures on paper documents. Consequently, the uncertainty concerning the legal status of digitally signed electronic documents is slowing down the development of electronic commerce in Europe.

5.1.2 New “electronic-based” legislation in some member states may hinder a free flow of digitally signed electronic documents

56This legal uncertainty concerning the acceptance of electronic documents and digital signatures has urged some member states to implement specific legislation explicitly accepting electronic documents and digital signatures. Germany, for example, recently approved new legislation, whilst Italy has adopted digital signature legislation in March 1997. The United Kingdom has launched a public consultation paper and France and Belgium are drafting legislation about digital signature services. Since there is no collaboration between the member states in drafting this new legislative rules, there is no Europe-wide consistency with respect to specific requirements regarding the legal acceptance of electronic documents. New national legislation would surely hinder the development of electronic commerce on the internal market: consumers having a national valid digital signature would not be able to use it in other member states, merchants would not be able to contract with consumers from other member states and digital signature services would not be able to deliver services in other member states. Moreover, the acceptance of national technical requirements could easily lead to national protectionism.

5.2 Legal issues regarding the introduction of digital signature services

57The provision of trusted services is a completely new service sector. This sector is still in its infancy, but interested market players are positioning and preparing themselves. The sector is currently dominated by commercial undertakings based outside Europe, such as Verisign in US, Thawte CA in South Africa or the Canadian Keywitness. Some EU-based commercial companies have emerged, quite a lot of them are subsidized from EU R&D programs. It is expected that in the next years a significant number of new entrants will appear on the market. These new entrants seem to focus on their national market and do not, at least not initially, target markets in other EU member states. Legal uncertainties are certainly due to this hesitation.

58From the legal point of view it is important to distinguish clearly between on the one hand, the procedures and conditions governing the establishment of a Certification Authority, and, on the other hand, the conditions imposed on the different services provided by a Certification Authority. Different Treaty Articles (52, 59) apply to each of these situations.

5.2.1 National procedures and conditions on establishment may hinder the freedom of establishment of digital signature services

59The establishment of a provider of certification services is subject to the law of the member state concerned. Some member states intend to impose specific establishment requirements and authorization procedures on Certification Authorities; others only require compliance with the general provisions in the law concerning the establishment of a company. Some member states may have voluntary authorization schemes, others may impose mandatory licensing. For example, the UK Public Consultation Paper envisages mandatory licensing, while the German law provides an optional legal framework for CA licensing. Restrictive practices with regard to the establishment of a Certification Authority should not undermine the freedom of establishment, for example by discriminating without justification on the basis of nationality or by restricting, again without justification, the number of service providers. Requirements for professional qualifications of Certification Authority staff and ownership requirements are also typical examples of establishment restrictions.

60Some regulation may also impose that CA-activities can only be performed by the government. Exactly like this is the case for the issuance of identity cards in some countries (like in Sweden), the government would be solely responsible for the emission of digital certificates. This monopoly, together with an immunity for government CAs would certainly undermine the confidence in trusted services.

5.2.2 National conditions on providing services may hinder a free flow of CA services

61Some member states intend to introduce regulation concerning the provision of cryptography related services. The definition of these services as well as the conditions imposed on each of them may be different from one member state to the other and therefore create Internal Market obstacles.

62It is current practice that Certification Authorities define the rights and obligations of the parties involved in the certification services they provide in a so-called Certification Practice Statement. The provisions in such Statements should be compliant with the law of the country where the Certification has been legally established.

National rules on consumer protection

63Member states may feel it necessary to include in their national law and/or in the license itself (if applicable), conditions with regard to the protection of the consumer, covering issues like transparent, non-discriminatory certificate delivery, pricing of services, an obligation to inform the consumers of best practice behaviour and certified products, limits on financial commitments, and liability and damage compensation. Especially the liability of CAs should be clarified and regulated on a European level.

National divergent scope of application

64Non-harmonized delimitation of the scope of application may invoke refragmentation of the single market. For example, the British Public Consultation Paper envisages the mandatory licensing of all organizations offering or providing “encryption services.” Encryption services encompass any service which involves any or all cryptographic functionalities like key management, key recovery, key certification, key storage, message integrity (through the use of digital signatures), key generation, time-stamping or key revocation services. Thus, a license will be required not only for certification services/Certification Authorities, but for all TTP Services. France will organize a TTP licensing regime, as well. However, a clear distinction is made in the new French Telecommunications Law between cryptography products or services, which, on the one hand, cannot have other objectives than authentication of a communication or the assurance of the integrity of the message and on the other hand, cryptography products or services which can also serve for confidentiality purposes. Only the provision of the latter services will be licensed. The use of cryptography for authentication/integrity functions only, as when using a digital signature, will not be regulated. Certification Authorities providing certification services only (identification, certificate issuance, certificate directory services) will not need a license to provide these services in France. On the contrary, the German digital signature Law precisely envisages the licensing and regulation of certification services.

National rules on certifícate issuance

65A Certificate links a name with a public key. Before issuing a certificate, the Certification Authority has to establish the identify of its client, assign a name, and verify the possession of the private key. The procedures followed by the Certification Authority determine the “strength” of a certificate. National legislation may determine how the Certification Authority has to proceed.

66Some member states allow certificates related to digital signatures to be issued to physical persons only. For example, in the legal initiative announced by the Belgian Council of Ministers, natural persons only should have a digital signature. According to §2, 2 of the German Law, only natural persons can get a certificate. In the Danish proposal, Article 15 stipulates that authorized Certification Authorities may only certify key pairs for the purpose of digital signatures for natural persons. Certification of key pairs for legal persons is allowed for identification purposes only. Different authorities exercised by a physical person may be implemented by so-called attribute certificates. Digital signatures committing moral persons are either implemented via attribute certificates or by issuing a certificate to the moral person itself. In this second situation it is left to the internal procedures of the moral person to ensure that only duly authorized personnel can commit the moral person. The impact of these two different approaches requires further legal analysis.

67Upon request a certificate could be issued to a person using a pseudonym. For privacy reasons such behaviour could be perfectly legitimate. Law enforcement or national security requirements could be met by setting out in the law the conditions under which the Certification Authority is obliged to provide the real identity. A complication may arise if the certificate has been issued abroad.

68Rules concerning the identification of the applicant can vary from member state to member state and from CA to CA. This divergence in identification guarantees may cause different confidence capacities of the certificates. The lack of a common European approach may inhibit a free choice of certificates.

69Many different certificates exist. For regulatory purposes it is important to identify clearly which types of certificates, and, implicitly, which kind of digital signatures are the subject of regulation.

National rules on the recognition of foreign certificates

70Since certificates are the deliverables of certification service providers, which may operate across borders, provisions have to be made to recognize certificates issued by Certification Authorities established in either another EU/EEA member state or a third Country. Certificates issued in another jurisdiction could be recognized either directly (by recognizing certificates only) or indirectly (by recognizing digital signatures based on such certificates). Indirect recognition has the advantage that all elements constituting a digital signature (i.e., keys, certificate, signature product) have to be taken into account. Direct recognition of certificates only is easier.

71The Danish proposal (art. 19) stipulates that certificates issued by foreign certification authorities will have the same legal status, provided that a Danish certification authority guarantees that the foreign certification authority will comply with the Danish obligations. The German law (§15) only accepts foreign certificates if an equivalent level of security can be demonstrated.

72The role and impact of cross certification practices, whereby a Certification Authority recognizes certain certificates issued by another Certification Authority, need to be studied further.

National licenses for CAs

73Member states may charge a special body, or bodies, with the issuance and elaboration of, and the supervision of compliance with, authorizations concerning digital signature services. The UK Public Consultation Paper suggests a mandatory licensing system operated by the Department of Trade and Industry, whereas the German digital signature bill only stipulates a voluntary licensing system.

74National licensing procedures and conditions could however, restrain the provision of services by foreign CAs. Therefore, some form of pan-European co-operation between national supervisory authorities might be useful, and could be facilitated by a Community instrument, if put in place.

National rules on the generation of the keys

75Some member states may forbid the user to generate his keys himself. The CA or another organization may be imposed to produce the keys and even to keep them in escrow. Other member states may allow the user to generate his own key-pair. It is questionable whether a user of one member state could apply then for a certificate in another member state with different rulings.

5.3 Legal issues regarding digital signature products

76In order to ensure reliable use and legal validity, and to combat fraud and misuse, digital signatures require adequate products for key generation, key storage, certificate storage and retrieval, signature generation and verification. National, as well as European Community rulings may however hinder a free circulation of these products.

5.3.1 National technical and operational requirements may inhibit a free circulation of digital signature products

77Member states may establish at national level technical and operational requirements to be met by certain categories of digital signature products. Such requirements may differ from member state to member state and will continuously change due to the rapid technological developments. Different national technical requirements and unsynchronized adaptation to technological progress are well-known causes of Internal Market obstacles. Germany, for example, requires the fulfillment of certain technical and operational specifications in order to provide digital certificates and digital signatures with legal validity, if a foreign certificate meets its national technical requirements, it will only be valid if the same level of security can be guaranteed (§14 of the digital signature Law).

  • 45 Council Directive 83/189/EEC of 28.03.1993 laying down a procedure for the provision of informatio (...)

78Member states have to communicate to the Commission, and through it, the other member states their intended technical rules, the observance of which is compulsory, de jure or de facto, in case of marketing, use, manufacturing or importation of a product, digital signature products including.45 This procedure enables the Commission, and the member states, to identify those rules which, once adopted, will create Internal Market obstacles, and to take appropriate action, either issuing comments, a detailed opinion or by proposing Community measures. Community technical harmonization measures do not contain, in principle, detailed technical requirements, but limit themselves to establishing the essential safety requirements and leave technical details to international standardization.

5.3.2 National certification of products may inhibit a free circulation of goods

79A plethora of digital signature products will become available. Some of them will be tested via well established certification procedures by recognized certification bodies against agreed evaluation criteria. Others may not be tested or fail to pass testing. Some manufacturers may even not want their products to be tested. The use of noncertified products may result in the legal validity of the related digital signature being uncertain and not recognized by the Courts.

80The widespread use of digital signatures will inevitably lead to legal conflicts needing to be settled in court or by arbitration. Third party expert inspection of the products used and procedures applied would facilitate parties in providing proof that adequate products have been used and the necessary procedures have been executed. Adequate measures need to be identified in order to ensure that digital signature products are sufficiently open for such public inspection.

81In order to enable citizens, business and government to decide what kind of product provides the necessary level of security, it is necessary that adequate security criteria are defined and an independent assessment of these products and services takes place, of which the results are made publicly available. Common evaluation criteria and procedures play a fundamental role in providing a basis for the international mutual recognition of digital signatures. Different schemes can be envisaged to implement the evaluation of digital signature products, and the related accreditation of recognized certification bodies.

  • 46 Council Recommendation N° 95/133/EC of 7.4.1995 on common information technology security evaluati (...)

82The Council has recommended46 the implementation of the Information Technology Security Evaluation Criteria (ITSEC). A number of member states have already established (or have indicated their intention to establish) ITSEC schemes. Some of these schemes could be used for digital signature purposes.

83The need for harmonized certification criteria and procedures related to digital signatures has to be confirmed. If required, the EU could pursue the mandatory adoption of ITSEC for digital signature products until the Common Criteria are complete.

5.3.3 Current community legislation may hinder the free flow of digital signature products

  • 47 Council Regulation (EC) No. 3381/94 of 19.12.94 setting up a Community regime for the control of e (...)

84The Dual Use Regulation47 obliges member states to impose prior authorization procedures on cryptography products dispatched from one member state to another. Sometimes member states also impose authorization procedures before products can be distributed.

85Since a digital signature does not, in principle, encrypt the contents of the underlying message/file, well-engineered “digital signature only products” should not impinge upon law enforcement or national security. Under these circumstances it is difficult to justify the restrictions on the free circulation and the use of this category of products for reasons of national security or law enforcement.

  • 48 For a similar solution see US regulation ITAR, Section 123.25: http:/www.epic.org/crypto/export_co (...)

86Maintaining intra-Community controls on digital signature products will also have a detrimental effect on the development of a European industrial capability in the field of digital signatures by denying industry the benefits of the size of the full Single Market. Intra-Community controls on digital signature products also have other negative circulation effects. Law abiding citizens will be required to remove digital signature tools, legitimate in their home country, from their lap-top computer, if they travel to another EU member state. This problem might be solved by establishing an exemption for the temporary, personal use of digital signatures products if the product remains in the possession of the citizen while traveling throughout the Union.48

5.3.4 National cryptography regulations may cause an internal market obstacle

  • 49 OECD Cryptography Guidelines, recital clause 15, and principle VI on lawful access.
  • 50 Although good security practice requires the use of different security mechanism for different pur (...)

87In the case of digital signatures cryptography is not used to conceal information. It is widely recognised49 that the use of cryptography for digital signature purposes is distinct from its use to ensure confidentiality and that each of these uses presents different issues. Therefore, digital signatures are of no concern to national security of EU members. However, since it is technically possible to use the same key pair (public and private key) for digital signatures as well as for confidentiality purposes,50 this implies that regulatory provisions aimed at only one of these application areas could apply to the other as well, which may lead to unsatisfactory situations. National rules forbidding or limiting the use of cryptography could, indeed, inhibit the free use of digital signature products. In some countries the production, export (Dual Use Regulation, see above) as well as use of encryption techniques is restricted. Therefore, it might be worthwhile to consider the use of separate key sets for digital signature purposes and for confidentiality purposes. In the United States, for example, the NIST digital signature Standard (DSS) respects the distinction between cryptography for confidentiality purposes and for authentication purposes by providing a tool which only creates digital signatures.

VI CONCLUSION

6.1 Digitally signed electronic documents

88The legal value of digitally signed electronic documents is currently nonexistent, or at least doubtful throughout the European Union and beyond. A common European position in the form of a legal instrument could clarify the legal acceptance of electronic documents. Instead of creating a completely new legal framework, existing law should be utilized and adapted to new patterns of action in the IT environment. Consequently, there is a need for a definition of digital signatures and electronic documents. From a legal viewpoint technical descriptions should be avoided, since new security methods in accord with technical advances might arise. In the establishment of unified legal and technical concepts, more abstract formulations could be used where the conceptual functions are contained, while clarifying the demand for verification both for the originator and the contents.

6.2 Digital signature services

89Governments have started to reflect on the need to regulate the new economic activity of delivering digital signature services, such as the issuance of digital certificates by Certification Authorities. Due to the inherently cross-border nature of these services, different national regulatory approaches and the lack of mutual recognition of each other’s regulatory requirements may easily lead to a fragmentation of the Internal Market for electronic commerce and on-line services throughout the Union. (Potential) Internal Market obstacles, once identified, should be analyzed and the national regulations causing them should be scrutinized in the light of the free circulation provisions of the Treaty. Enforcement of the law of and control by the country of origin, complemented by the mutual recognition of each other’s provisions, should be the preferred approach. Serious, but justified restrictions may require Community harmonization of conditions and requirements. Although it may be licensed, the provision of certification services is, in principle, a commercial activity in a competitive environment. Individuals and businesses should be able to chose from the offerings of several Certification Authorities, established either in their home country or abroad. Digital signatures regulation, at national as well as at Community level, should not only pre-empt and avoid any distortion of competition but also actively facilitate cross-border competition in trusted services to the benefit of citizens and business.

90Since different national conditions and procedures create obstacles to the proper functioning of the Internal Market, a harmonization of conditions and procedures must be envisaged. Country of origin control over Certification Authorities combined with mutual recognition should be the principle governing the establishment of Certification Authorities within the EU/EEA. A lot of thought should be devoted to the possibility and conditions of cross-certification by the diverse Certification Authorities, as well as the implementation of a hierarchical structure at the European level. Indeed, some commercial Certification Authorities are offering the provision of top-level Certification Authority as a special, highly priced service. The most prominent provider of this services is based outside Europe. National supervisory authorities do function as top-level Certification Authority on a country by country basis for licensed certification authorities. These national structures could be complemented by the EU authority which issues and publishes the certificates of the national level Certification Authorities. The concept of an EU top-level Certification Authority holds many promises and may encourage the development of certification services in Europe. Its implementation, operating conditions and potential impact still require further work.

6.3 Digital signature products

91Further work has to be done in order to identify the need for pre-defined classes of digital signature products and the requirements applicable to each of them. If mutual recognition of each other’s provisions concerning digital signature products does not result in a satisfactory functioning of the Internal Market, then common technical requirements for digital signature products will have to be established via a Community-wide legal instrument, supported by standardization.

92Some form of consultation and co-operation at EU/EEA level on the scientific and technical evolution of the cryptographic technologies underlying digital signatures may be necessary. Regulation must keep pace with technology and stay abreast of the products available on the market. Common technical requirements and evaluation procedures and criteria play a fundamental role in providing a basis for the international mutual recognition of digital signatures.

93Regarding the present regulated state of the use and export of encryption products, the Commission should not seek the immediate and unconditional abolition of the current controls. It should pursue, together with the member states, a policy allowing for the identification of the conditions (administrative co-operation, mutual assistance, other) which must be met in order to gradually abolish controls on intra-Community shipments of digital signature products.

Notes

1 The complete text of the communication is available at [http://www.cordis.lu/esprit/src/ecomcomx.htm].

2 Proposal for a European Parliament and Council Directive, third amendment, Directive 83/189/EEC laying down a procedure for the provision of information in the field of technical standards and regulations, COM (96) 392 final, 30.08.1996.

3 Directive 95/46/EC of the European Parliament and the Council on the protection of individuals with regards to the processing of personal data and the free movement of such data. OJ L281 23.11.1995, p.31.

4 Directive 96/9/EC of the European Parliament and of the Council on the legal protection of databases OJ L77 27.03.1996, p.20.

5 Directive 97/7 of the European Parliament and the Council of 17.2.1997 on the protection of consumers in respect of distance contracts.

6 Proposal for a European Parliament and Council Directive amending Council Directive 89/552/EEC on the coordination of certain provisions laid down by law, regulation or administrative action in member states concerning the pursuit of television broadcasting activities, COM(95) 86 Final of 31.05.1995, OJ C 185 of 19.07.95, p. 4.

7 Commission Green Paper “Legal Protection of Encrypted Services in the Internal Market”, COM (96) 76 final. 06.03.96.

8 Communication from the Commission “Follow-Up to the Green Paper on Copyright and Related Rights in the Information Society”, COM(96)568 final, 20.11.1996.

9 Questionnaire on “Industrial Property Rights in the Information Society”. Version 5.0. September 1996. DG XV/E/3.

10 Green Paper on “Commercial Communications in the Internal Market”, COM (96) 192 final. 08.05.1996.

11 Green Paper on “Public Procurement in the EU: Exploring the Way Forward”, COM(96) 583 final. 27.11.1996.

12 Green Paper on the “Protection of Minors and Human Dignity in Audiovisual and Information Services”. COM (96) 483 final. 16.10.1996.

13 [http://www.isabel.be/].

14 [http://www.belsign.be/].

15 [http://www.teletrust.de].

16 [http://www.ncr.es].

17 [http//www.banesto.es].

18 [http://sest.mkn.co.uk].

19 See also Green Paper on Public Procurement in the European Union: Exploring the Way Forward, Communication adopted by the Commission on 27th November 1996 on the proposal of Mr. MONTI, [http://europa.eu.int/enycomm/dgl5/gpentoc.htm].

20 See also Office For Harmonization In The Internal Market (Trade Marks And Designs), [http://europa.eu.int/agencies/ohim/ohim.htm].

21 SEMPER is part of the European Commission’s ACTS program, [http:/www.semper.org].

22 ICE-TEL is funded by the Telematics for Research Initiative within the Euopean Telematics Applications Program, [http://www.darmstadt.gmd.de/ice-tel/].

23 Council Resolution Nr. 96/C 376/01 of 21.11.1996 on new policy-priorities regarding the information society, OJ C376 of 12.12.1996.

24 European Parliament Resolution A4-244/96 of 19.09.96, OJ320, p.164 of 28.10.96.

25 Recommendation of the OECD Council concerning Guidelines for Cryptography Policy, 27.03.1997; http://www.oecd.org/dsti/iccp/crypto_e.html

26 ETSI Technical Committee Reference Report, Requirements for Trusted Third Parties, Vs. 0.0.7 of 26.03.97.

27 Public-Key Infrastructure (X.509) (pkix) Charter: [http://www.ietf.cnri.reston.va.us/html.charters/pkix-charter.html]

28 X500 and IS09594 series; ftp://ftp.bull.com/pub/OSIdirectory/ITU

29 W3C Digital Signature Initiative: [http://www.w3.org/puh/WWW/Security/DSig/DSigProj.html].

30 Loi N° 96-659 du 26.07.1996 de réglementation des télécommunications.

31 Informations- und Kommunikationsdienste-Gesetz - IuKDG, Article 3.

32 Licensing of Trusted Third Parties for the provision of cryptography services - Public Consultation Paper on detailed proposals for legislation, March 1997.

33 Staatscourant nr. 54, 18.03.1997.

34 Press release, Council of Ministers, 30.05.1997.

35 Law of 15 March 1997, n° 59, Article 15, § 2 Supplemento Ordinario alla Gazzetta Ufficiale della Republica Italiana n.63 del 17.03.1997.

36 South Korean Act on Promotion of Trade Business Automation.

37 Digital Signature Bill 1997 [http://www.geocities.com/Tokyo/3399/digisign.html].

38 Certification Authority Guidelines (Alpha version), April 1997, Electronic Commerce Promotion Council of Japan (ECOM), Certification Authority Working Group, Certification Authority Guidelines Special Working Group, [http://www.ecom.or.jp/eng/output/ca/ca-eng-guideline.htm].

39 Working Group on Electronic Commerce: [http://www.un.or.at/uncitral/sessions/wg_ec/index.htm#TOP]

40 There must be only a negligible possibility that another data unit could result in the same hash value, and these routines must also be secure against any attempt to try to achieve this.

41 See also, LegSec WP3 Report Security Issues, ENS Legal and Security Issues, E2307, Deliverable 3, p.30.

42 ISO 9594-8-The Directory-Authentication Framework defines a certification authority as follows: “An Authority trusted by one or more users to create and assign certificates. Optionally the CA may create the users’ keys.”; For more details about the use of TTP and the legal issues involved, see the various reports on this topic: TEDIS, Trusted Third Parties and similar services, Final report, November 1991; The various lNFOSEC studies (see INFOSEC 1994 Security Investigations, May 1994), LEGSEC, Inca case study, Final report, February 1995; TEDIS, EDITT Trusted Third Parties Workshop, February 1995; TEDIS II, Report on Security in Open Environments, Ver.7, February 1995; LEGSEC, EBR Casestudy, Final report, February 1995; LEGSEC, ENS Legal and Security Issues, Deliverable 2, May 1995.

43 Furthermore, certificates based on the X.509 standard come with an expiry date to ensure that old, retired certificates can be removed from the network.

44 The X.509 structure did not allow the cross-certification structure until in its last version (v.3). The two first versions only acknowledged a strictly hierarchical model.

45 Council Directive 83/189/EEC of 28.03.1993 laying down a procedure for the provision of information in the field of technical standards and regulations; OJ L109 of 26.04.83.

46 Council Recommendation N° 95/133/EC of 7.4.1995 on common information technology security evaluation criteria; OJ L93 of 26.04.97, p. 27.

47 Council Regulation (EC) No. 3381/94 of 19.12.94 setting up a Community regime for the control of exports of dual-use goods, Article 19; OJ L367 of 31.12.94

48 For a similar solution see US regulation ITAR, Section 123.25: http:/www.epic.org/crypto/export_controls/personal.htm

49 OECD Cryptography Guidelines, recital clause 15, and principle VI on lawful access.

50 Although good security practice requires the use of different security mechanism for different purposes. A single key pair for all kinds of purposes is certainly not good practice.

Auteur

Lecturer at the Interdisciplinary Centre for Law and IT, University of Leuven, Belgium. E-mail: patrick.vaneecke@law.kuleuven.ac.be

© Les Presses de l’Université d’Ottawa | University of Ottawa Press, 1999

Conditions d’utilisation : http://www.openedition.org/6540

Acheter

Volume papier

Chargement

Unavailable