Andrew po-jung Ho wrote:
>
> One of the unresolved issues is how to keep the digital signature secure.
> Should the "trusted" digital notary or the "untrusted" medical information
> system keep the signature?
>
The digital notary should not keep the signature, that is not it's purpose.
The digital notary knows nothing and should know nothing about the content
of the documents it's notarizing. That's why a good notary implementation makes
what it does know public (or at least accessable to those needing to rely on
the document). Anyone can verify the integrity of a document via
the public information the Notary provides.
After you have been assured that the document is indeed the document that the
person/organization who presented it to you claimed it is, i.e. it was created
on such and such date by organization X. You then need to delve into it's content,
and using other assurances decide on how trustworthy that content is. For example,
the document could have been digitally signed. Now you can use another technology
to verify that signature. Now you know with some kind of assurance (read the
CA policy statement to see just what kind of assurance you get!) the identity of
the entity which performed the digital signature. From there you can make another
judgement as to how trustworty that entity is and how much you can rely on that
content.
In security parlance this is called your trust model. The point of all this
fancy technology is to build a trust model in a distributed world. What I call
assurances are the amount of trust your model has at each step, is it
100% or 99.9% or 90% or 50%?
>
> and related to this, What is the protection
> against the destruction of the signature?
>
These issues are not really unresolved, they fall into what I have been calling
good policies and procedures, i.e. good data center practices. Which is why
I have been slightly schizophrenic about this topic. If in the end, you come
back to how good a system you run ( meaning you can provide some kind of
assurance that the process used to establish identities is sound, that the
application programs themselves are sound and that the entire supporting infrastructure
hosting these applications are sound ) then you carefully need to weigh the
value add of any complex, poorly understood by users and untested in deployment,
technology. For example, just how much does this new suite of PKI technologies really
add
to the assurance levels in your trust model?
This is why I believe that digital notary, employing a fairly limited range of the
capabilities of modern cryptography, and not really requiring end user deployment
of private keys,
is a good place to start understanding how this will effect practice.
