DOCSLIB.ORG

Enhancing the Reliability of Digital Signatures As Non-Repudiation Evidence Under a Holistic Threat Model

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Enhancing the Reliability of Digital Signatures As Non-Repudiation Evidence Under a Holistic Threat Model UNIVERSITY CARLOS III OF MADRID DOCTORAL THESIS Enhancing the reliability of digital signatures as non-repudiation evidence under a holistic threat model Author: Jorge L´opez Hern´andez-Ardieta Supervisor: Prof. Dr. Ana Isabel Gonz´alez-Tablas Ferreres COMPUTER SCIENCE AND ENGINEERING DEPARTMENT Legan´es,February 2011 TESIS DOCTORAL Enhancing the reliability of digital signatures as non-repudiation evidence under a holistic threat model Autor: Jorge L´opez Hern´andez-Ardieta Directora: Prof. Dra. Ana Isabel Gonz´alez-Tablas Ferreres Firma del Tribunal Calificador: Firma Presidente: Vocal: Vocal: Vocal: Secretario: Calificaci´on: Legan´es, de de ii Abstract Traditional sensitive operations, like banking transactions, purchase pro- cesses, contract agreements etc. need to tie down the involved parties respecting the commitments made, avoiding a further repudiation of the responsibilities taken. Depending on the context, the commitment is made in one way or another, being handwritten signatures possibly the most com- mon mechanism ever used. With the shift to digital communications, the same guarantees that exist in real world transactions are expected from electronic ones as well. Non-repudiation is thus a desired property of cur- rent electronic transactions, like those carried out in Internet banking, e- commerce or, in general, any electronic data interchange scenario. Digital evidence is generated, collected, maintained, made available and verified by non-repudiation services in order to resolve disputes about the occurrence of a certain event, protecting the parties involved in a trans- action against the other's false denial about such an event. In particular, a digital signature is considered as non-repudiation evidence which can be used subsequently, by disputing parties or by an adjudicator, to arbitrate in disputes. The reliability of a digital signature should determine its capability to be used as valid evidence. The reliability depends on the trustworthiness of the whole life cycle of the signature, including the generation, transfer, verifica- tion and storage phases. Any vulnerability in it would undermine the reli- ability of the digital signature, making its applicability as non-repudiation evidence difficult to achieve. Unfortunately, technology is subject to vulner- abilities, always with the risk of an occurrence of security threats. Despite that, no rigorous mechanism addressing the reliability of digital signatures technology has been proposed so far. The main goal of this doctoral thesis is to enhance the reliability of digital signatures in order to enforce their non-repudiation property when acting as evidence. In the first instance, we have determined that current technology does not provide an acceptable level of trustworthiness to produce reliable non- repudiation evidence that is based on digital signatures. The security threats suffered by current technology are suffice to prevent the applica- bility of digital signatures as non-repudiation evidence. This finding is also aggravated by the fact that digital signatures are granted legal effectiveness under current legislation, acting as evidence in legal proceedings regarding the commitment made by a signatory in the signed document. In our opinion, the security threats that subvert the reliability of digital signatures had to be formalized and categorized. For that purpose, a holis- tic taxonomy of potential attacks on digital signatures has been devised, allowing their systematic and rigorous classification. In addition, and assuming a realistic security risk, we have built a new approach more robust and trustworthy than the predecessors to enhance the reliability of digital signatures, enforcing their non-repudiation property. This new approach is supported by two novel mechanisms presented in this thesis: the signature environment division paradigm and the extended electronic signature policies. Finally, we have designed a new fair exchange protocol that makes use of our proposal, demonstrating the applicability in a concrete scenario. Resumen Las operaciones sensibles tradicionales, tales como transacciones bancarias, procesos de compra-venta, firma de contratos etc. necesitan que las partes implicadas queden sujetas a los compromisos realizados, evitando as´ıun repudio posterior de las responsabilidades adquiridas. Dependiendo del contexto, el compromiso se llevar´aa cabo de una manera u otra, siendo posiblemente la firma manuscrita el mecanismo m´ascom´unmente empleado hasta la actualidad. Con el paso a las comunicaciones digitales, se espera que las mismas garant´ıasque se encuentran en las transacciones tradicionales se proporcionen tambi´enen las electr´onicas.El no repudio es, por tanto, una propiedad deseada a las actuales transacciones electr´onicas,como aquellas que se llevan a cabo en la banca online, en el comercio electr´onicoo, en general, en cualquier intercambio de datos electr´onico. La evidencia digital se genera, recoge, mantiene, publica y verifica medi- ante los servicios de no repudio con el fin de resolver disputas acerca de la ocurrencia de un determinado evento, protegiendo a las partes implicadas en una transacci´onfrente al rechazo respecto a dicho evento que pudiera realizar cualquiera de las partes. En particular, una firma digital se consi- dera una evidencia de no repudio que puede emplearse posteriormente por las partes enfrentadas o un tercero durante el arbitrio de la disputa. La fiabilidad de una firma digital deber´ıadeterminar su capacidad para ser usada como evidencia v´alida.Dicha fiabilidad depende de la seguridad del ciclo de vida completo de la firma, incluyendo las fases de generaci´on,trans- ferencia, verificaci´on, almacenamiento y custodia. Cualquier vulnerabilidad en dicho proceso podr´ıasocavar la fiabilidad de la firma digital, haciendo dif´ıcilsu aplicaci´oncomo evidencia de no repudio. Desafortunadamente, la tecnolog´ıaest´asujeta a vulnerabilidades, existiendo siempre una probabil- idad no nula de ocurrencia de amenazas a su seguridad. A pesar de ello, hasta la fecha no se ha propuesto ning´unmecanismo que aborde de manera rigurosa el estudio de la fiabilidad real de la tecnolog´ıade firma digital. El principal objetivo de esta tesis doctoral es mejorar la fiabilidad de las firmas digitales para que ´estaspuedan actuar como evidencia de no repudio con garant´ıas suficientes. En primer lugar, hemos determinado que la tecnolog´ıaactual no proporciona un nivel aceptable de confianza para producir evidencias de no repudio fiables basadas en firmas digitales. Las amenazas de seguridad que se ciernen sobre la tecnolog´ıaactual son suficientes para evitar la aplicabilidad de las firmas digitales como evidencia de no repudio. Esta situaci´onse agrava por el hecho de que las firmas digitales disponen de eficacia jur´ıdicapara actuar como medio de prueba o evidencia en procedimientos legales respecto al compromiso adquirido por el firmante en el documento firmado. En nuestra opini´on,las amenazas de seguridad que socavan la fiabilidad de las firmas digitales ten´ıanque ser formalizadas y categorizadas. Con este objetivo, se ha dise~nadouna taxonom´ıaintegral de ataques potenciales a la firma digital que permite su clasificaci´onsistem´aticay rigurosa. As´ımismo, y asumiendo un riesgo de seguridad realista, hemos construido una nueva propuesta m´asrobusta y confiable que las predecesoras para mejorar la fiabilidad de las firmas digitales, reforzando as´ısu propiedad de no repudio. Esta nueva aproximaci´onse basa en dos mecanismos novedosos presentados en esta tesis: el paradigma de la divisi´ondel entorno de firma y las pol´ıticasextendidas de firma electr´onica.Finalmente, hemos dise~nado un nuevo protocolo de intercambio justo donde se integra esta propuesta, demostrando su aplicabilidad en un escenario concreto. A Nuria Agradecimientos Ante todo, quiero agradecer profundamente a mi directora de tesis, An- abel, el esfuerzo que ha dedicado a lo largo de estos cuatro largos a~nos,no exentos de imprevistos y dificultades. Anabel, no s´olohas realizado una magn´ıficalabor como directora, gui´andomeen momentos de incertidum- bre y vislumbrando aquellas lagunas en mi investigaci´on,sino que tambi´en me has aportado un valioso legado tras el largo viaje que supone una tesis doctoral: haber aprendido a realizar una investigaci´oncr´ıtica,s´oliday fun- damentada. Gracias por tu apoyo, pero tambi´enpor los momentos duros en los que tu exigencia ha hecho de esta tesis una realidad. Quiero tambi´enagradecer a Benjam´ın, con todo mi cari~no,su apoyo en otras lides. Te debo m´asde una, ya lo sabes. Pero sobre todo, te debo algo que es muy importante para m´ı: ser parte de este grupo de investigaci´on, y, en definitiva, de esta Universidad. Arturo, t´utambi´entienes gran parte de culpa, y muchas gracias por ello. Gracias tambi´ena Chema por la disposici´ontan estupenda que tienes siempre ante todo, y por el apoyo que me has brindado siempre que has tenido oportunidad. No puedo expresar en palabras la deuda eterna que tendr´econ mis padres. Gracias a vosotros, soy lo que soy. Sin vuestra sabidur´ıay amor, no habr´ıa sido capaz de enfrentarme a estos retos. Y a mi hermano, que le debo tantos a~nosde hermandad en el sentido m´asamplio de la palabra. Animo´ brother, que ya te queda menos para acabar la tuya. Esta tesis es fruto de un inmenso esfuerzo que he podido realizar gracias al sacrificio mi mujer, Nuria. S´eque sin ti no habr´ıapodido conseguirlo. Pienso recompensarte con creces durante todos los a~nosmaravillosos que nos quedan por delante. Contents List of Figures ix List of Tables xi I Introduction 1 1 Introduction 3 1.1 Context . 3 1.2 Statement of the Problem . 4 1.3 Objectives and Contributions . 10 1.4 Thesis Organization . 13 1.5 Syntax Notation . 16 Acronyms, Abbreviations and Definitions 17 II State of the Art 19 2 Fundamentals on Digital Signatures 21 2.1 Digital Signatures . 21 2.2 Public Key Infrastructure . 22 2.3 Electronic Signatures . 24 2.4 Electronic Signature Policies . 25 2.5 Electronic Signatures from a Legal Viewpoint . 28 3 Non-repudiation Services 33 3.1 General Model for Non-repudiation Services . 33 3.2 Non-repudiation Using Digital Signatures .
Load more

Recommended publications
  • Signature Validation Procedures and Policies
    ETSI TS 102 853 V1.1.2 (2012-10) Technical Specification Electronic Signatures and Infrastructures (ESI); Signature validation procedures and policies 2 ETSI TS 102 853 V1.1.2 (2012-10) Reference RTS/ESI-000074rev Keywords electronic signature, security, trust services ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N° 348 623 562 00017 - NAF 742 C Association à but non lucratif enregistrée à la Sous-Préfecture de Grasse (06) N° 7803/88 Important notice Individual copies of the present document can be downloaded from: http://www.etsi.org The present document may be made available in more than one electronic version or in print. In any case of existing or perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF). In case of dispute, the reference shall be the printing on ETSI printers of the PDF version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at http://portal.etsi.org/tb/status/status.asp If you find errors in the present document, please send your comment to one of the following services: http://portal.etsi.org/chaircor/ETSI_support.asp Copyright Notification No part may be reproduced except as authorized by written permission. The copyright and the foregoing restriction extend to reproduction in all media.
    [Show full text]
  • Etsi Ts 101 733 V2.2.1 (2013-04)
    ETSI TS 101 733 V2.2.1 (2013-04) Technical Specification Electronic Signatures and Infrastructures (ESI); CMS Advanced Electronic Signatures (CAdES) 2 ETSI TS 101 733 V2.2.1 (2013-04) Reference RTS/ESI-0001733version221 Keywords CAdES, e-commerce, electronic signature, security ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N° 348 623 562 00017 - NAF 742 C Association à but non lucratif enregistrée à la Sous-Préfecture de Grasse (06) N° 7803/88 Important notice Individual copies of the present document can be downloaded from: http://www.etsi.org The present document may be made available in more than one electronic version or in print. In any case of existing or perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF). In case of dispute, the reference shall be the printing on ETSI printers of the PDF version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at http://portal.etsi.org/tb/status/status.asp If you find errors in the present document, please send your comment to one of the following services: http://portal.etsi.org/chaircor/ETSI_support.asp Copyright Notification No part may be reproduced except as authorized by written permission. The copyright and the foregoing restriction extend to reproduction in all media.
    [Show full text]
  • A Guide on Eidas 910/2014 Namirial DTM Solution for Legally Compliant E-Signatures
    A guide on eIDAS 910/2014 Namirial DTM solution for legally compliant e-signatures NAMIRIAL GmbH Legal Office: Seilerstätte 16, 1010 Wien, Austria Main Office: Haider Straße 23, 4025 Ansfelden | Phone: +43-7229-88060 | www.xyzmo.com Fiscalnumber 09 258/9720 | VAT-ID: ATU70125036 Table of Contents 1 What is eIDAS? ............................................................................................................. 3 2 Electronic identification .................................................................................................. 3 3 Electronic signatures and seals ..................................................................................... 4 3.1 Advanced Electronic Signature ............................................................................... 4 3.2 Qualified Electronic Signature................................................................................. 5 4 Time stamping ............................................................................................................... 6 5 Electronic registered delivery service ............................................................................ 7 6 Qualified preservation service ....................................................................................... 7 7 Technologies to implement e-signatures ....................................................................... 7 7.1 PAdES Standard ..................................................................................................... 8 7.1.1 Basic Profile (based on ISO 32000-1)
    [Show full text]
  • Eidas and E-SIGNATURE a LEGAL PERSPECTIVE: ELECTRONIC SIGNATURES in the EUROPEAN UNION
    eIDAS AND E-SIGNATURE A LEGAL PERSPECTIVE: ELECTRONIC SIGNATURES IN THE EUROPEAN UNION WHITE PAPER TABLE OF CONTENTS Part 1: Introduction 3 Key Highlights of the eIDAS Regulation 4 Legal Effect of Different Types of Signatures 6 Regulation of Trust Services 7 Legal Best Practices 8 Part 2: Compliance With the Regulation 9 Advanced Electronic Signatures 9 Qualified Electronic Signatures 10 Format Standards 12 Additional Evidence 12 Conclusion 13 E-Signature Solution Checklist 14 About the Authors This paper is a collaboration between Lorna Brazell of Osborne Clarke LLP and OneSpan. In part one, Osborne Clarke provides a legal opinion on the legal validity of electronic signature in the European Union. Part two has been prepared by OneSpan, and summarizes best practices recommendations for legal compliance when implementing e-signatures. eIDAS & E-SIGNATURE: A LEGAL PERSPECTIVE FOLLOW US 2 PART 1 Introduction The 2014 Regulation on Electronic Identification and Trust Services for Electronic Transaction in the Internal Market1 (“eIDAS”) went into effect throughout the European Union (“EU”) on 1 July 2016, replacing the 1999 Directive on electronic signatures2 (“the Directive”). Although the Directive had not been the subject of any disputes in its 16-year history, neither had it been a success. Its objective, to enable the widespread use of electronic signatures to conduct business across borders within the EU, was not met. There Are Three Key Reasons for This: I. Most EU Member States’ laws do not specify any form of signature for commercial contracts other than guarantees or contracts assigning real property. II. Many people mistakenly believed that the Directive mandated the use of advanced electronic signatures supported by a qualified certificate3 in order for an electronic signature to be legally effective.
    [Show full text]
  • Xades-Vs-Pades-Signed.Pdf
    XAdES vs PAdES Johannes Döring CTO, INBATEK CO., LTD CTO, ADDIVO GmbH CEO, COM-STYLE An overview about the history of signing with XML and PDF © 2017, INBATEK© 2017, CO.,LTD,INBATEK ThailandCO.,LTD, Thailand Digital signatures An electronic signature is a paperless way to sign a document using a unique credential associated with a given person that is logically attached to or associated with the document Electronic signatures can be used to authenticate the signer as well as detect any changes made to the document after it was signed. Electronic signatures provide real benefits. For example, they promote the emergence of fully automated purchasing processes by enabling buyers and sellers to sign and approve transactions without the need for traditional “wet” (paper-based) signatures. 2 Johannes Döring: XAdES vs PAdES © 2017, INBATEK CO.,LTD, Thailand Legal overview Directive in force in every EU Member State about electronic signature: “data in electronic form which are attached to or logically associated with other electronic data and which serve as a method of authentication” Being deliberately neutral regarding technology and security requirements confers to all kinds of electronic signatures a potential legal validity provided their authenticity is not contested. Advanced electronic signature (AdES) Qualified electronic signature (QES) 3 Johannes Döring: XAdES vs PAdES © 2017, INBATEK CO.,LTD, Thailand Requirements for AdES It is uniquely linked to the signatory. It is capable of identifying the signatory It is created in a way that the signatory can maintain sole control. It is linked to the data to which it relates in such a manner that any subsequent change of the data is detectable.
    [Show full text]
  • OVERVIEW of STANDARDS Specifying Formats of Advanced Electronic Signatures and Seals
    OVERVIEW OF STANDARDS Specifying formats of advanced electronic signatures and seals DECEMBER 2019 OVERVIEW OF STANDARDS December 2019 ABOUT ENISA The mission of the European Union Agency for Cybersecurity (ENISA) is to achieve a high common level of cybersecurity across the Union, by actively supporting Member States, Union institutions, bodies, offices and agencies in improving cybersecurity. We contribute to policy development and implementation, support capacity building and preparedness, facilitate operational cooperation at Union level, enhance the trustworthiness of ICT products, services and processes by rolling out cybersecurity certification schemes, enable knowledge sharing, research, innovation and awareness building, whilst developing cross-border communities. Our goal is to strengthen trust in the connected economy, boost resilience of the Union’s infrastructure and services and keep our society cyber secure. More information about ENISA and its work can be found at www.enisa.europa.eu. CONTACT For contacting the authors please use [email protected] For media enquiries about this paper, please use [email protected] LEGAL NOTICE Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the Regulation (EU) No 2019/881. This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only.
    [Show full text]
  • Signature Appliance Secure Your Transactions with Electronic Signatures
    IDnomic Signature Appliance Secure your transactions with electronic signatures In environments that require a high level of trust, advanced or qualified electronic signatures are highly advised. They ensure a document’s integrity in paperless transactions and provide proof of acceptance by the signer. Quickly deploy your digital Remote signature: Ensure trust in your exchanges signature project with an appliance a solution for mobile users Electronic signatures can support The deployment of a digital signature project Signing documents should be as easy organizations in their compliance journey can be complex with various integration as a hand-written signature. A remote with eIDAS regulation. While securing constraints to handle. The Signature signature functionality enables the user to document and data exchanges, electronic Appliance facilitates the implementation electronically sign documents anywhere and signatures also contribute to reducing of digital signature within document from any device. processing costs, such as printing and workflows. Users can keep using their archiving, and to enhancing productivity with existing document workflow management Atos offers a server-based solution where dematerialized processes. application and add electronic signature signing is done remotely with strong processes without any discontinuity. private key management. After a secure Electronic signatures guarantee the integrity authentication (for instance, with a smart of documents and identify the signers. Once The Signature Appliance uses signature card), the user can apply a signature made in a signer has produced a signature and the certificates generated by the Atos PKI a tamper-proof environment. signature has been verified, the signature is solutions or other PKI products. The secure and may no longer be repudiated.
    [Show full text]
  • TR 102 923 V1.1.1 (2010-07) Technical Report
    ETSI TR 102 923 V1.1.1 (2010-07) Technical Report Electronic Signatures and Infrastructures (ESI); PDF Advanced Electronic Signatures (PAdES); Usage and implementation guidelines 2 ETSI TR 102 923 V1.1.1 (2010-07) Reference DTR/ESI-000086 Keywords e-commerce, electronic signatures, security, PAdES ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N° 348 623 562 00017 - NAF 742 C Association à but non lucratif enregistrée à la Sous-Préfecture de Grasse (06) N° 7803/88 Important notice Individual copies of the present document can be downloaded from: http://www.etsi.org The present document may be made available in more than one electronic version or in print. In any case of existing or perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF). In case of dispute, the reference shall be the printing on ETSI printers of the PDF version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at http://portal.etsi.org/tb/status/status.asp If you find errors in the present document, please send your comment to one of the following services: http://portal.etsi.org/chaircor/ETSI_support.asp Copyright Notification No part may be reproduced except as authorized by written permission. The copyright and the foregoing restriction extend to reproduction in all media.
    [Show full text]
  • Digital Signatures for Dummies®, Cryptomathic Special Edition
    These materials are © 2017 John Wiley & Sons, Ltd. Any dissemination, distribution, or unauthorized use is strictly prohibited. Digital Signatures Cryptomathic Special Edition by Chris Allen and Steve Marshall These materials are © 2017 John Wiley & Sons, Ltd. Any dissemination, distribution, or unauthorized use is strictly prohibited. Digital Signatures For Dummies®, Cryptomathic Special Edition Published by: John Wiley & Sons, Ltd., The Atrium, Southern Gate Chichester, West Sussex, www.wiley.com © 2017 by John Wiley & Sons, Ltd., Chichester, West Sussex Registered Office John Wiley & Sons, Ltd., The Atrium, Southern Gate, Chichester, West Sussex, PO19 8SQ, United Kingdom All rights reserved. No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted by the UK Copyright, Designs and Patents Act 1988, without the prior written permission of the Publisher. For information about how to apply for permission to use the copyright material in this book, please see our website at http://www. wiley.com/go/permissions. Trademarks: Wiley, For Dummies, the Dummies Man logo, Dummies.com, and related trade dress are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates in the United States and other countries, and may not be used without written permission. All other trademarks are the property of their respective owners. John Wiley & Sons, Ltd., is not associated with any product or vendor mentioned in this book. LIMIT OF LIABILITY/DISCLAIMER OF WARRANTY: WHILE THE PUBLISHER AND AUTHOR HAVE USED THEIR BEST EFFORTS IN PREPARING THIS BOOK, THEY MAKE NO REPRESENTATIONS OR WARRANTIES WITH RESPECT TO THE ACCURACY OR COMPLETENESS OF THE CONTENTS OF THIS BOOK AND SPECIFICALLY DISCLAIM ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
    [Show full text]
  • White Paper Digital Signatures from the Cloud – Basics and Applications
    White Paper Digital signatures from the cloud – Basics and Applications Contents Basics of digital signature .................................................3 Electronic documents and signature ........................................3 Electronic signature ........................................................3 Digital signature ...........................................................4 Standards for digital documents and signatures .............................4 Task and uses of the signature service from the cloud .....................6 What is the task of the service? .............................................6 Where is the service used? .................................................7 What are the advantages of a signature service? ............................9 Software for the use of the signature service from the cloud ..............10 Task of the signature client ................................................10 3‑Heights™ PDF Security ..................................................10 3‑Heights™ PDF to PDF/A Converter .......................................10 3‑Heights™ Document Converter .......................................... 11 Interfaces for application integration ...................................... 11 Glossary ..................................................................12 Terms .....................................................................12 Abbreviations ............................................................. 13 About PDF Tools AG ......................................................16
    [Show full text]
  • 5126 Bull SAS Obsoletes: 3126 N
    Network Working Group D. Pinkas Request for Comments: 5126 Bull SAS Obsoletes: 3126 N. Pope Category: Informational Thales eSecurity J. Ross Security and Standards February 2008 CMS Advanced Electronic Signatures (CAdES) Status of This Memo This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited. Abstract This document defines the format of an electronic signature that can remain valid over long periods. This includes evidence as to its validity even if the signer or verifying party later attempts to deny (i.e., repudiates) the validity of the signature. The format can be considered as an extension to RFC 3852 and RFC 2634, where, when appropriate, additional signed and unsigned attributes have been defined. The contents of this Informational RFC amount to a transposition of the ETSI Technical Specification (TS) 101 733 V.1.7.4 (CMS Advanced Electronic Signatures -- CAdES) and is technically equivalent to it. The technical contents of this specification are maintained by ETSI. The ETSI TS and further updates are available free of charge at: http://www.etsi.org/WebSite/Standards/StandardsDownload.aspx Pinkas, et al. Informational [Page 1] RFC 5126 CMS Advanced Electronic Signatures February 2008 Table of Contents 1. Introduction ....................................................6 2. Scope ...........................................................6 3. Definitions and Abbreviations ...................................8 3.1. Definitions ................................................8
    [Show full text]
  • Appliance Secure Your Transactions with Electronic Signatures
    Horus Signature Appliance Secure your transactions with electronic signatures In environments that require a high level of trust, advanced or qualified electronic signatures are highly advised. They ensure a document’s integrity in paperless transactions and provide proof of acceptance by the signer. Quickly deploy your digital signature project with Remote signature: Ensure trust in your exchanges Horus Appliance a solution for mobile users Electronic signatures can support The deployment of a digital signature project Signing documents should be as easy organizations in their compliance journey can be complex with various integration as a hand-written signature. A remote with eIDAS regulation. While securing constraints to handle. The Horus Signature signature functionality enables the user to document and data exchanges, electronic Appliance facilitates the implementation electronically sign documents anywhere and signatures also contribute to reducing of digital signature within document from any device. processing costs, such as printing and workflows. Users can keep using their archiving, and to enhancing productivity with existing document workflow management Atos offers a server-based solution where dematerialized processes. application and add electronic signature signing is done remotely with strong processes without any discontinuity. private key management. After a secure Electronic signatures guarantee the integrity authentication (for instance, with a smart of documents and identify the signers. Once The Horus Signature Appliance uses card), the user can apply a signature made in a signer has produced a signature and the signature certificates generated by the Atos a tamper-proof environment. signature has been verified, the signature is PKI solutions or other PKI products. The secure and may no longer be repudiated.
    [Show full text]