Sylvia McDonald

My perspective

As a former member of GCHQ and HMT/CCTA, also chairman of a BSI committee and consultant to local government, I am concerned that the Information Society should evolve, without overkill or prescriptive legislation, to the long term advantage of users and beneficiaries of new enabling technology and E-Commerce opportunity. Mine is a user perspective.

General comment on the need for clear definitions

The consultation document concentrates on two security services to be provided : Signature Services and Confidentiality Services [ref para 38]. Yet the terms associated with description of these services are not unambiguously defined in the document narrative and glossary.

The consultation document also stresses the that proposed licensing regime is to promote the confidence of users of these services in both the technology and providers enabling the use of secure E-commerce. Yet the roles of the different types of trusted third parties are blurred , and the terms cryptography and encryption are not clearly defined in the document narrative and glossary.

If much of the legislative detail is to be left to statutory instruments, then the users and targeted beneficiaries of E-Commerce must be provided with clear understanding of definitions applicable to the primary legislation. If not, the sought-for user confidence will be lacking, and take-up by a critical mass will be too slow for government targets to be satisfactorily met with regard to the stated aim of conducting large percentages of public sector business electronically by 2001 and 2002. Definitions are important also because they must be in line with EU and international usage and meanings already published or understood at large.

Definitions of electronic and digital signatures

In particular the consultation document does not appear to explain the fact that, in the transition from a paper to an electronic world, it is by means of an algorithmic mechanism (digital signature) that the required function (electronic signature) can be achieved. This is a necessary distinction because an electronic signature by itself (ie the simple equivalent of a handwritten signature), even if made legally valid, cannot technically be used for authentication purposes by any licensed [or unlicensed] trusted third party. The unclear usage throughout the consultation document leaves the reader in ignorance of the very real implications. At Appendix, I list those paragraphs and boxes in my view needing review and clarification, and offer a short discussion.

Role of Signature and Confidentiality Services

It is assumed by the reader that authentication is the service to be provided by Signature Services and that delivery of unintercepted data to the lawful recipient is the guarantee to be provided by Confidentiality Services.

Definition of Authentication

Authentication is needed for three reasons: to verify (with revocation as necessary) the identity of a person or organisation in any communication; to ascertain that the communication comes from, or on behalf of, this identified source and is not unlawfully altered before delivery, and to be able to prove if necessary that that the person signing the communication endorses the data therein contained and cannot repudiate this.

The use of cryptography to create a public/private key infrastructure, together with appropriate management responsibilities under a licensing regime for the trusted third party delivering this service to E-Commerce users and beneficiaries, is the only practicable way to achieve the full measure of authentication required for successful take-up of E-Commerce. This scenario describes ‘digital signature’, not ‘electronic signature’ which occurs throughout this document in misleading and inconsistent context. Electronic signature is a relatively new term needing precise definition and harmonisation with international usage if it is to be used in contexts assigning it wider properties. It may be that confusion is arising due to use of the word ‘signature’.

Definition of Encryption

Following on from this, it is unclear what is meant by the government’s ‘clear policy differentiation between electronic signatures and encryption’ [ref para 35], particularly when the term ‘encryption’ is not found in the glossary. Cryptography is defined, albeit inadequately, in the glossary, but used without precision in the document narrative. Confidentiality is not necessarily about the need to keep data secret by means of encryption. It is about the need to protect against unlawful interception, which users of E-commerce should not be lulled into thinking can be prevented by data encryption itself. Confidentiality is also about protecting data stored or in transit from access with malicious intent to damage data integrity. In this case, predetermined use of the digital signature mechanism will enable detection of the unlawful action. Pages 14-18, paras 33-39 plus boxes and footnotes need substantial review to address this user perspective. Unfortunately the 1^st April deadline leaves me not enough time to comment in as much detail as I would like on these paragraphs.

Definition and role of TTPs, TSSPs and CAs

With regard to the definition of trusted third parties, TTPs should be the generic term and not TSPs, since trusted ‘intermediaries’ are not necessarily limited to being the human providers of the two Services (Signature and Confidentiality) referred to in this consultation document. Trusted intermediaries should perhaps be considered to include physical entities such as those occurring in log on processes or secure communication protocols or in systems used by Time Stamping Authorities.

TSSPs (expanding I would suggest to Trusted Specialist Service Providers) could be those TTPs specifically interested in providing, or qualified to provide, a specialist service or range of services, which they could offer either with or without accreditation from government licensing authorities. Such TSSPs could offer the Confidentiality Services referred to in this consultation document. TSSPs potentially would come from various branches of the computer and telecommunications industries, from banking, from crypto-specialist and other expert fields.

CAs would be the TTPs providing the Signature Services referred to in this consultation document. They should operate under the Licensing Criteria set out in this consultation document and would provide full authentication services for their clients. They should be able to call on government departmental co-operation wherever needed, for example, in support of registration activities should revocation be necessary on the death of a key holder. CAs could come from the legal profession, in particular the notaries whose traditional and expert skills in authentication in the paper world are unquestioned. They would perhaps also come from large consultancy firms.

Analogies with the paper world

With regard to Authentication and Confidentiality needs, in the paper world, we use headed paper with logos, sign an original copy in ink and either send through the post an open stamped postcard or paper put inside an envelope, sealed, stamped and perhaps registered for extra security. These are all certificates of a kind, which we are now, in an electronic world, looking for TTP intermediaries (ie CAs) to replace, using the digital signature mechanism to provide the level of assurance of the identity of correspondents that we need and already have. We need to have confidence either in the CA itself or in the legislation governing regulation of TTP/CA behaviour.

With regard to Confidentiality and Access needs, in the paper world, we look to the Royal Mail to deliver documents unopened and intact to correct destinations. In the electronic world, we must have both confidence in the enabling security technology provided by industry and a security policy in place to protect our own environments. We can then be sure that delivery to the correct destination will have been achieved. Next we also need to have confidence in the legislation governing the behaviour of both the CAs providing authentication and also those other TTPs [whatever their specialist nomenclature] with responsibility for key storage, management and recovery. We can then be sure that electronically transmitted mail, open or secret regardless, will have arrived intact.

With regard to the need for Secrecy at a level warranting data encryption, the TTP activities described above will still be required to ensure Authentication, Confidentiality and Access, but there may also be a need for further TSSP activity. It is also conceivable that the key escrow issues of concern to law enforcement departments of government could possibly be contained within the remit of yet a different type of TSSP.

For ordinary public sector business, however, cryptographic algorithms (digital signature), managed by TTPs (both CAs and TSSPs) under a licensing regime, are a sufficiently enabling technology to guarantee the levels of secrecy and/or security required, without the complexities of strong encryption and its management.

In conclusion

For the users and beneficiaries of E-Commerce to build up the confidence that this consultation document is seeking to promote, primary legislation should aim at laying foundations to allow replication in some measure of the familiar paper world in which we easily identify our correspondents by person or by organisation and to encourage the growth of the same confidence in electronic handling and delivery that we have in the Royal Mail paper system. To do this successfully, consistent definitions within the documentation are necessary and clear roles for trusted third party participants defined.

Appendix

Go back to the start of this document.

Go to the library of current responses.

Go to FIPR home page.

Last Revised: April 20 1999