you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 3 months ago* (3 children)

What? No it's not. This whole comment is wrong, sorry.

When a website has you type a name as a signature it's a legal representation of that signature. There's nothing cryptographic at all about it. In the US this is regulated by the ESIGN Act (https://uscode.house.gov/view.xhtml?path=%2Fprelim%40title15%2Fchapter96&edition=prelim). Also, where would you even store the key? I've made ways to use Webauthn keys to do this, but no signatory uses these methods.

And that's not how ZKPs in government IDs work, either. You never sign with them, you only verify.

Ref: My job is cryptographic signature protocols, and I have a draft at IETF for one of them.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 0 points 3 months ago* (last edited 3 months ago) (2 children)

    When a website has you type a name as a signature it's a legal representation of that signature. There's nothing cryptographic at all about it. Wjere would you even store the key? I've made ways to use Webauthn keys to do this, but no signatory uses these methods.

    I claimed no such thing. That is not a digital signature.

    I'm fairly certain we are not discussing the same thing.

    I can digitally sign documents the way I have described, NOT IN A WEB BROWSER, using entirely local or even open source software, using my government issued ID card.

    The solution provided for electronic signatures by the Digital and Population Data Services Agency is a signature certificate. The certificate is located in the card chip.

    As described by the relevant finnish agency, this is enabled by a "signature certificate" stored on peoples ID cards. The functionality uses a separate PIN from that which you use to verify your identity in the context of a website you are visiting.

    I am not aware of any other way for me to sign a document in such a way. All the other signatures, which do also work, are something else. And potentially insecure in all the ways OP thinks. (Someone else can type the same name).

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 3 months ago (1 child)

    I claimed no such thing. That is not a digital signature

    But that's what OP is describing with the ""'s, so I assumed you were responding to the question, which they may have as well.

    The functionality uses a separate PIN from that which you use to verify your identity in the context of a website you are visiting.

    Interesting, I hadn't realized Finland added a separate cert from the ZKP ( https://www.suomi.fi/services/citizen-certificate-digital-and-population-data-services-agency/dc540ff4-0030-46b2-add0-9f7ceb2a41c8), new info gleaned.

    Though this may still be "slightly" off. Seems the finish ID is a standard Zero Knowledge Proof (ZKP) plus a pin activated signature (Citizen) certificate.

    This should mean you can identify yourself, or that you are over 18 without revealing your full identity) without the PIN, as that operates separately from the signing certificate which can be activated independently. The PIN would be used for signatures or encrypting things. Very cool.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 0 points 3 months ago* (last edited 3 months ago)

    There are two PINs, PIN1 for ZKP and PIN2 for digital signing. The card does nothing without one.

    Most EU countries provide some way for citizens to sign documents using a private key tied to their legal personage.

    Putting it on the ID card they are given anyway just makes sense.

    My final paragraph is there to explain that a lot of "digital signatures" aren't really signatures in any meaningful way. What goes into the actual file doesn't matter at all, UNLESS it's the aforementioned cryptographic signature.

  • source
  • parent