House Nixes Digital Signature Bill 32
Seth Scali writes "The Electronic Signature in Global and National Commerce Act was nixed by the House of Representatives on Monday. According to the article over at ZD Net, the vote was 234 to 122-- or about 1/2 of what would be needed to pass." It needed a 2/3 majority. Most Congressmen seem to agree that we need some sort of legally binding digital signature capability, but say they don't think the current proposal offered enough security or consumer protection. Oh, well. Maybe next time.
Re:I hope so... (Score:1)
Little Consumer Protection (Score:1)
Good Thing (Score:2)
Just like Microsoft, the government can't be wrong *all* the time.
I hope so... (Score:3)
Re:Good Thing (Score:1)
Re:I hope so... (Score:2)
--
Interested in XFMail? New XFMail home page [slappy.org]
Re:It's a good thing (for now) (Score:1)
Bingo. This is exactly what I was talking about when I asked Bruce earlier this week what he thought of digital signatures. Physical copies of your signature are there to be evaluated. They've been a legally viable method of verification for a /long/ time.. and the cost of forging a signature generally exceeds the benefits of the forgery. Is it perfect? No. But binding us to weak-crypto to please some wrinkled prunes in congress would only result in fradulent activity on an unimaginable scale if such a scheme was cracked. And the government, being what it is, would not admit to it until many many lives had been destroyed or a few large businesses sunk over fradulent signatures.
--
Re:I hope so... (Score:2)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Easy to duplicate? I think not.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v0.9.8 (GNU/Linux)
Comment: For info see http://www.gnupg.org
iD8DBQE4IEh8KV5kReY9sP8RAn8JAKCZKGZ23q5U8NBxFrV
pqUx8DUPME1AjzB1bqdDD08=
=rvgZ
-----END PGP SIGNATURE-----
--
Interested in XFMail? New XFMail home page [slappy.org]
Re:President Nixes Digital Signature Bill (Score:1)
the blurb said the bill only got half the votes needed to pass, but by my math, it was only 4 votes away from passing. That's pretty close.
Re:I hope so... (Score:2)
A regular signature is static-- you put it on one document the same way you put it on another (well, with minor variations, but the overall whole of the thing stays the same). It is difficult for somebody else to imitate it, due to those idiosynchrasies.
However, a digital signature is *not* static. If you digitally sign a document, I cannot create another document and simply "cut and paste" the signature of the other document onto mine-- it would be immediately recognizable as bogus. The reason is that a digital signature *changes* with the contents of the document being signed and with the person signing it. If you and I sign the same document, the signatures are different and unique to each of us. If you sign two different documents, the signatures are different-- and unique to *you*.
If you want to learn more, I'd recommend the original RSA paper, at http://theory.lcs.mit.edu/~rivest/rsapaper.ps , as well as a copy of the DSS (Digital Signature Standard), available from NIST at http://csrc.nist.gov/fips/fips1861.pdf , as well as Bruce Schneier's "Applied Cryptography".
What kind of security are we talking about? (Score:1)
So it makes me wonder if what they did was protect our privacy and security, or if they just reacted aversely to a new technology they don't understand.
I mean, gosh, there are still people out there who are afraid of using the ATM to make withdrawals! There's surely plenty enough technophobia amongst politicians to fear digital signature, what they probably consider to be, 'your name at the bottom of an email' or something.
So, it's not a good thing. If they had shot down the Bill for reasonable security concerns over expert advice on cryptanalysis, it would be great. But now, it just smacks of technophobia, and so the breakthrough of a nation-wide digital signature standard won't make its way into the US just yet.
Maybe we should ask Al to do something about it...
"Knowledge = Power = Energy = Mass"
Re:Good Thing (Score:1)
As far as I was concerned, this bill was a good thing. Arguments will follow if no-one else leaps in...
Re:Little Consumer Protection (Score:1)
Re:I hope so... (Score:1)
Regarding signatures, personally, I couldn't tell you if a signature was made by me or not, because my signature never really looks the same twice. I suspect I'm not alone on this one.
At least digital signatures give you some assurance that the person that signed something really was the person you think it was. Tell me how I'm supposed to know that the little ink scribble at the bottom of a document was made by the proper person?
On my interpretation of fractions and such... (Score:1)
So, based on my (mis) understanding of the article, I came to a mathematically correct conclusion based upon a faulty assumption-- I don't need more math, I need more common sense!
President Nixes Digital Signature Bill (Score:3)
The House passed the bill in question (It only takes 218 votes for a majority in the House, and this bill got 234). It won't become law because the President will veto it, thus the need for a 2/3rds majority to override. It's misleading to say that the House killed the bill.
BTW, I really hate it when articles quote blatant spin as if it were actually newsworthy.
Re:Even laymen can understand the concept of secur (Score:2)
A GPG digital signature is currently nearly 100% authenticatable.
A digital signature used to sign a document is both specific to that document and specific to that sender. If it was sent by the wrong person, the signature will be invalid. If the data changes between the time of signing and the time of verifying, the signature becomes invalid.
Try playing with GPG [http://www.gnupg.org [gnupg.org]] for yourself. It's an extremely neat app.
Re:I think so... (Score:1)
Re:Waiting until society is ready(not just us)is G (Score:1)
Re:President Nixes Digital Signature Bill (Score:1)
>The managers of the bill brought it to the floor
>under suspension of the (House) rules, meaning
>it didn't go through the rules committee, which
>is a normal course of action. Bills that are
>brought up under suspension of the rules require
>2/3rds majority to pass.
I bow to your superior knowledge. The Washington Post article on the subject confirms this.
Online Contracts Fail in House [washingtonpost.com]
The Post also has an article from a few days ago on concerns that the new law would weaken consumer protection: Acti vists Call 'Digital Signature' Bills Flawed [washingtonpost.com]
A digital signature bill is still alive in the Senate, and hopefully this will all be worked out soon.
It's a good thing (for now) (Score:3)
Any legislation has to be written realizing that protocol or key length requirements need to change with time. A given protocol and keylength may be fine for early November 1999 but may be cryptographically weak in early November 2009. This brings up another point. The protocol and key length requirements need to be strict enough that the chances of them being compromised before the signature on the document no longer protects anything is vanishingly small. In other words the strength behind the signature is directly proportional to the lifetime of the document.
Consider an earnings report for a company for a given quarter. It only requires a years worth of strength in its digital signature. If a third party were to release an October 1998 earnings report in an attempt to manipulate the stock price it would be quickly caught and discredited.
Consider an individual taking out a 30 year mortgage on their home. If the digital signature can be forged in under 30 years this puts the consumer who took out the mortgage at risk. A malignant mortgage company could change interest rates or terms of the agreement to profit at the expense of the consumer. Things like this happen now with pen and paper signatures.
The security requirements for taking out a second thirty year mortgage after the first could be different than those for the first. Technology has increased, computers are faster and maybe new hiccups like quantum computation are a reality.
Digital signatures have the capability of being many orders of magnitude safer than pen and ink signatures if and only if people aren't legistated into weak signatures.
Even laymen can understand the concept of security (Score:3)
Technophobia isn't rampant there, but skeptisism towards large companies who try to worm their way out of accountability is.
How does this affect digital signatures? Well, unless there is a -close- to 100% foolproof way of authenticating a digital signature, we're just going to run into the same old hastles we're having now, where signatures are forged or copied, or transactions deliberately tampered with or fabricated.
IMHO, digital signatures =must= be coupled with user input which is simply too complex to forge. Using a random sampling of the retina as a one-time pad would work for this. Then use the pad to encrypt the signature, and any other data.
But that only gives you a measure of security against outsiders. What about dodgy bank employees? There, encryption is useless, as the bank has to have the decryption key to be able to make use of the data. At -some- point, in the bank, the information has to be in the clear, and all someone has to do is inject false data there.
Actually, there's a way to solve that, too. If the bank's software is "incomplete", and your signature includes self-decrypting executable code, which is necessary to complete the transaction, it would be necessary to obtain that code before false transactions could be made in your name. However, if this code requires a "ping" or "traceroute" to your card, before it will work, it would be beyond most employees to fake a response. It doesn't make it impossible, but that's not the point. At present, any bank clerk with an IQ of -5, who can tell the difference between a keyboard and a ham sandwich has 99% of the tools they need to do a phantom withdrawl. Make it hard enough, and the people left who still could would probably be earning so much that they wouldn't bother with such petty cash.
This bill is coming back . . . (Score:2)
House Republicans intend on bringing this bill back up for a vote before the end of the current congressional session. When you consider it was rushed to the floor and missed being approved by only 4 votes (where did that "about 1/2 of what would be needed to pass" come from?) you can understand their optimism in trying again. This time, instead of bringing it up on the suspension calendar (with the required a 2/3rds vote) they will try to run it through the rules committee and get a "closed rule" on the bill, meaning no amendments to it on the floor. That way they only need a simple majority to pass it.
If the House is going to go down this route, look for it to happen by Friday. But with Lott saying the target adjournment date is Nov. 10, you can be fairly certain this bill will expire with the session (unless they manage to get it appended to a year-ending omnibus appropriation bill, then anything goes . . . ).
Re:What kind of security are we talking about? (Score:1)
Okay, so maybe the Bill wasn't shot down for reasonable security concerns, but I still would like to say that I can't imagine it would be very hard to 'steal' somebodies identity. Assuming they use a private/public key algorythm it wouldn't probably be too hard to get the private key. With America's current computer ignorance, anybody with a little balls and good social engineering skills could steal somebody's identity.
Without informing the public a million times over I just see this leading to disasterous problems.
Re:I hope so... (Score:1)
Re:President Nixes Digital Signature Bill (Score:2)
um, not quite cowboy. The managers of the bill brought it to the floor under suspension of the (House) rules, meaning it didn't go through the rules committee, which is a normal course of action. Bills that are brought up under suspension of the rules require 2/3rds majority to pass. Because of this, it will never make it to Clinton for him to veto. The fact that Clinton said he would veto it is irrelevant and shouldn't be taken as a given (he said he'd veto the welfare reform act a few years ago and then signed it). Clinton's lackeys in the Commerce department were close to saying okay to this bill, and most likely could have gotten what they wanted in a conference committee, leading to a presidential signature.
Re:It's a good thing (for now) (Score:1)
I think there is a need for legally binding digital signatures, but its something I wouldn't want to see rushed through the legislature to make some withered old republicans look digitally saavy. This could have disastorous effects.
Not to be confused by some worthless, bought-and-paid-for Democrats, eh?
But seriously, folks, legally binding digital signatures may need to be more than encrypting, with the user's private key, the hash of the document. In no particular order:
1. third party escrow, that verifies the signature soon after the document is signed. That way, even if the crypto method is cracked later on, or the private key is compromised, there still exists a known good copy of the document.
2. signing key expiration (already exists in pgp)
3. some watermarking technology, similar to some corporate checks today (which show "void" when a check is copied)
These methods aren't foolproof, of course
Waiting until society is ready(not just us)is GOOD (Score:2)
In the news I read, the reasons given for nixing Digital Signatures had to do with creating a second class of enforceable, legally binding contracts. I wholeheartedly agree with this. There is no sense in rushing into a new use of technology and forcing it down the throats of consumers who will not understand the message they are receiving. Contract law is one area that is clear enough for a great many people to understand. It is well thought out and well documented in the Uniform Commercial Code and a great many state laws.
This applies to a whole huge list of transaction types and contract law situations.
As much as I love technology and all the cool benefits of it in terms of information flow, I think that for something as important as this, it's imperative that the plan be well thought out and understood by even those who do not understand the underlying technology. It was prudent to wait.
So, who cares about key length? Really. If the consumer will not even understand they are entering a legally binding agreement or receiving information which legally binds them, then we are not ready as a society to take the step. It's really as simple as that, and all the different arguments about the technological merits of one solution vs another can just sit by the wayside until these larger issues are worked out and understood.
If that doesn't take place first, then passing a digital signature act will be something the goverment does to us, not for us.
Re:It's a good thing (for now) (Score:2)
- Michael T. Babcock <homepage [linuxsupportline.com]>
Re:Good Thing (Score:1)
The key weakness in this scheme is protecting the signer's private key. This key is protected well barring physical access to the machine it resides on. Chances are you'll realize your machine has been comprimised and be able to revoke the keypair (certificate) before anything can happen.
This risk can also be reduced with a certificate stored on a smart card.
While not impossible, forging a digital signature is not a trivial exercise. Forging a pen and paper signature is by far easier. There were some issues with this legislation that show that it may have been rushed to the floor, but there does need to be legislation providing a minimum of legal strength to digital signatures on a national level. Many states already recognize them as legally binding, but without all the states having this is keeping the technology from being used on a national basis. The Clinton administration is not opposed to digital signatures as far as I know, the Department of Health and Human Services and the Department of Commerce are moving forward with their proposed electronic signature standard (142.310 I think) that would bring legal weight to digital signatures.
IMHO this is all a good thing. The legistlation however needs to be watched as this is a potential window for something of a "national id" to be instituted in the form of digital certificates.
Re:I hope so... (Score:2)
Both the good and the bad thing about realworld signatures is that you can't revoke them. It also takes a HUGE amount of skill to replicate them infront of someone else. It's one thing to sit at home and try over and over until you get a reasonable facsimile, it's entirely another to be able to do it on the fly.
I can't really see how we could as a country or world create a sufficiently secure system of key management. It's got to be a lot better than the current notary system, but that would tend to leave the handling of it in the hands of the government, which would probably be the NSA, FBI, or Secret Service...
Re:Waiting until society is ready(not just us)is G (Score:1)
And what if I think that it's just more junk mail from Honda or Dell and I throw it away today? They only have to make a reasonable effort. I don't have to (they ask for it, but I never do it) sign and return anything today. They don't know that I got it.
Data Integrity Issues: What happens when a consumer's data is lost and it contained contracts in electronic form? Can he get a copy from the other party?
It would be helpful to the other party to just do so, since a subpoenae is all that is required. Same thing applies if the office burns to the ground today. You should keep your copy, but the agreement is just that... the paper is only a physical means for remembering it later.
What happens when the corporation loses their copy? If it's a contract that I have the only copy left, may I say I don't have a copy either and stop taking actions for which the agreement applies if the terms are later found to be unfavorable?
But what about the fact that they've been doing the same things for several years? That's the legal precedent anyway (at least partially, in terms of establishing how the contract was actually implemented). And yes, you could say you lost it. But if they subpoenae your copy and you lie... well, you've committed a number of felonies. Again, same issues as the non-digital world.
We would be forcing the courts to decide the question... Would you trust that the outcome in determining such basic facts to be favorable?
Yes. Our current Supreme Court is very pro-individual.
For the past few years, I and several other people I know, have been using Microsoft Word documents with a scan of my signature in the appropriate place. I've never had a problem with this, and though it's never been taken to court, I've issued invoices to state agencies via e-mail and been paid. It doesn't seem dramatically different than using a fax machine to finish the contract.
Have a little more faith. Our society, believe it or not, still operates on the premise of individuals not really screwing other individuals. The exceptions are always a bit interesting and sleazy. (Like forged signatures or ambigous contract language.)
-Derek