Digital Signatures

Digital Signatures A Brief Overview by Tim Sigmon August, 2000

Digital Signatures • Legal concept of “signature” is very broad • any mark made with the intention of authenticating the marked document • Digital signatures are one of many types of electronicsignatures • Example electronic signatures • loginid/password, PIN, card/PIN • digitized images of paper signatures • digitally captured signatures (UPS, Sears, etc.) • typed notations, e.g., “/s/ John Smith” • email headers

Digital Signatures (cont’d) • “digital signature” means the result of using specific cryptographic processes • Digital signatures operate within a framework of hardware, software, policies, people, and processes called a Public Key Infrastructure (PKI) • Note: PKI also supports other security requirements; in particular, confidentiality, both during transmission (e.g., SSL) and for storage

Public Key Cryptography • First, “secret key” or symmetric cryptography • same key used for encryption and decryption • orders of magnitude faster than public key cryptography • Public key technology solves the key exchange problem (no shared secrets!) • Public key and private key that are mathematically linked • Private key not deducible from public key • Confidentiality: one key encrypts, other decrypts • Digital signature: one key signs, other validates

Digital Signature example

Signed Email example • (show example of sending/receiving digitally signed email using Netscape Messenger) • (uses S/MIME)

Problem: relying party needs to verify a digital signature • To do this, must have an assured copy of the signer’s public key • signer’s identity must be assured • integrity of public key must be assured • Potential options for obtaining public keys • signer personally gives their public key to relying party • relying party obtains the desired public key by other “out of band” means that they trust, e.g., transitive relationships, signing parties, etc. • But, what about strangers? what about integrity of the public key?

Public Key (or Digital) Certificates • Purpose: validate both the integrity of a public key and the identity of the owner • How: bind identifying attributes to a public key (and therefore to the keyholder of the corresponding private key) • Binding is done (i.e., digitally signed) by a trusted third party (Certification Authority) • It is this third party's credibility that provides "trust"

X.509 v3 Certificates • Subject’s/owner’s identifying info (e.g., name) • Subject’s/owner’s public key • Validity dates (not before, not after) • Serial number • Level of assurance • Certification Authority’s name and signature • Extensions

Example Certs • (this is where I show and describe the contents of the actual certificates that were used to verify a digitally signed email message)

Distribution of Certificates • since certs carry public info and are integrity-protected, they can be distributed and shared by any and all means, e.g., • distribute via floppies or other removable media • publish on web sites • distribute via email (e.g., S/MIME) • directory lookups (e.g., LDAP, X.500) • distribution via directories is the ultimate solution • however, many important applications and uses of digital signatures can be implemented without the implementation or use of sophisticated directories

Trust and Certification Paths • Relying party needs an assured copy of the issuing CA’s PK in order to validate a certificate containing the signer’s PK • In general, a chain of multiple certificates that ends at a trusted root may be needed • How to organize the CA’s? • single top-down hierarchy (yikes!) • multiple hierarchies (Netscape/Microsoft disservice) • cross certifications (e.g., Federal BCA, Virginia’s BCA) • Revocation and CRLs (certificate revocation lists)

Where are we now? • Technologies are still evolving but are very usable • Policies and legal standing exist but still developing (need case law) • Code of Virginia, Federal law • Uniform Electronic Transctions Act • Browsers/email already contain a lot of capability • Particular uses widely taking place, e.g., SSL • Some universities making more use, e.g., MIT • Federal government taking a leadership role • ITC/UVa project for deployment

DS efforts in Virginia • Digital Signature Initiative (COTS workgroup) formed to pursue pilot deployments • UVa led development of a bridge certification architecture (modeled after federal bridge) • Pilot project sponsors • VIPNet, DIT, DGIF • DMV, DOT, DGS • Counties of Chesterfield, Fairfax, Wise • Cities of Norfolk, Charlottesville • http://www.sotech.state.va.us/cots • Virginia’s Council on Technology Services

Portals at UVa A Status Report by Tim Sigmon August, 2000

Portal Definition • problem: every person/group has a different definition • working definition: deliver information and services in an integrated, customized, and personalized manner • elements that we include: • authenticated access • customization - system presents info that is peculiar to the specific user • personalization - user controls certain aspects • break down organizational views/barriers

Background and Players • discussions among ITC, Univ. Relations, Student Council, Student Affairs, .... • JA-SIG conference and uPortal evaluation • development of “e-volving University” proposal • Reynolds and Sweeney presentation to Senior Cabinet • team is led by Nancy Tramontin and Debbie Mills

First Phase • deliver first version of student portal by Jan., 2001 • will not use uPortal (nor any other portal framework) • desired functionality • authenticated access (using existing passwords) • brief email stats and web-based email access • calendar that includes student events (not personal, yet) • course links • personal links (i.e., bookmarks) • personal reminders (?) • news, announcements, weather • important “fixed” links

Digital Signatures