INTRODUCTION
Information Technology has dramatically changed the way people do business. Business houses are increasingly using the information technology to create, transmit and store information in e-form instead of physical form. This way, it is cheaper, easier and speedier to store, retrieve and communicate information.
Exchanging documents over the Internet has become common in today’s world. Such documents often contain sensitive information for example, legal contracts, information concerning technological innovation, financial transactions etc. The concept of Digital Signature was conceptualized by Diffie and Hellman as an application of public key cryptography in 1976.
A digital signature functions for electronic documents like a handwritten signature does for printed documents. The signature is an unforgettable piece of data that asserts that a named person wrote or otherwise agreed to the document to which the signature is attached.
A digital signature actually provides a greater degree of security than a handwritten signature. The recipient of a digitally signed message can verify both that the message originated from the person whose signature is attached and that the message has not been altered either intentionally or accidentally since it was signed. Furthermore, secure digital signatures cannot be repudiated i.e. the signer of a document cannot later disown it by claiming the signature was forged.
In other words, digital signature enables "authentication" of digital messages, assuring the recipient of a digital message of both the identity of the sender and the integrity of the message.
KEY CONCEPTS
Technically speaking digital signature can be defined as the use of public key cryptography to authenticate a message. Public key cryptography gives a reliable method for digital signing and signature verification based on public/private key pairs. A person can sign a given digital message (file, document, e-mail, and so forth) with his private key. Before going in to the details of the digital signature let us understand the concept of private key, public key, message digest and public key trust models.
Private Key
Private Key is a cryptographic key, which is uniquely associated with an entity, and not made public. It is stored in encrypted text on the borrower's computer or a separate device such as a smartcard. This key is also protected with a password or PIN to avoid compromise or disclosure. The private key is used to encrypt information that can only be decrypted by the corresponding public key.
Public Key
Public key is a mathematical key that can be made publicly available and which is used to verify signatures created with its corresponding private key. Depending on the algorithm, public keys are also used to encrypt messages or files, which can then be decrypted with the corresponding private key.
A typical public key looks like this:
30 81 89 02 81 81 00 c7 f1 83 ae 34 37 7c 57 44 fc be 18 92 e7 41 cc ea b3 ff 5a f3 3e cf 36 61 2d c8 49 d9 e8 f6 6a 9d 5c d7 40 70 65 31 8c c1 01 fc 70 ce 99 6e 12 36 43 18 de 88 e2 bf aa 6f 2a bc 74 6c f3 90 6b ff 8b 2f 0e d5 02 ea 28 d1 c3 ca cc b0 77 07 30 58 03 be 7e b9 ee cd 81 af 80 5c fa b4 58 1c 6d b5 a5 c8 58 1a 9f 36 f2 26 14 40 8b 65 e9 e3 a6 cf 72 0a b7 5c 98 93 75 6e 21 fd d4 66 01 a7 99 02 03 01 00 01
Normally, a key expires after some period of time, such as one year, and a document signed with an expired key should not be accepted. However, there are many cases where it is necessary for signed documents to be regarded as legally valid for much longer than two years for example long-term leases and contracts. By registering the contract with a digital time-stamping service at the time it is signed, the signature can be validated even after the key expires.
If all parties to the contract keep a copy of the time-stamp, each can prove that the contract was signed with valid keys. In fact, the time-stamp can prove the validity of a contract even if one signer's key gets compromised at some point after the contract was signed. Any digitally signed document can be time-stamped assuring the validity of the signature even after the key expires.
To time stamp a document, a time-stamp authority (TSA) can be requested to provide time stamping. The TSA must be a trustworthy organization. TSAs can be a public time-stamp service provider, such as VeriSign, or an internal time-stamp server on the organisations’ intranet. When the time-stamp server receives the request, it time stamps the document with its private key and returns the document to sender. TSA's public key attached to the document can be used to verify the time stamping. Thus, the time-stamping and time-stamp verification process is similar to the digital signing and signature verification process.
Message Digest
Hash value or message digest of a message is the result of applying a hash function to a message. A hash algorithm converts the message or document into a series of meaningless alphanumeric characters also known as digest checksum. Message Digest Algorithms used in security applications are designed so that it is computationally infeasible to find another message, which produces the same checksum.
A secure message digest algorithm is also designed so that the original message cannot be deduced from the digest checksum. This type of message digest algorithm is sometimes referred to as a one-way function since its effect cannot be easily reversed other than by an exhaustive search of all possible input values. The most commonly used message hash algorithms are Message Digest 5 (MD5) and Secure Hash Algorithm 1 (SHA-1). MD5 can produce a 128-bit hash, and SHA-1 can produce a 160-bit hash. For example, the possibility that MD5 will output the same hash for two different documents is 1/2128.
Public key trust models
Exchanging documents over the Internet has become common in today’s world. Such documents often contain sensitive information for example, legal contracts, information concerning technological innovation, financial transactions etc. The concept of Digital Signature was conceptualized by Diffie and Hellman as an application of public key cryptography in 1976.
A digital signature functions for electronic documents like a handwritten signature does for printed documents. The signature is an unforgettable piece of data that asserts that a named person wrote or otherwise agreed to the document to which the signature is attached.
A digital signature actually provides a greater degree of security than a handwritten signature. The recipient of a digitally signed message can verify both that the message originated from the person whose signature is attached and that the message has not been altered either intentionally or accidentally since it was signed. Furthermore, secure digital signatures cannot be repudiated i.e. the signer of a document cannot later disown it by claiming the signature was forged.
In other words, digital signature enables "authentication" of digital messages, assuring the recipient of a digital message of both the identity of the sender and the integrity of the message.
KEY CONCEPTS
Technically speaking digital signature can be defined as the use of public key cryptography to authenticate a message. Public key cryptography gives a reliable method for digital signing and signature verification based on public/private key pairs. A person can sign a given digital message (file, document, e-mail, and so forth) with his private key. Before going in to the details of the digital signature let us understand the concept of private key, public key, message digest and public key trust models.
Private Key
Private Key is a cryptographic key, which is uniquely associated with an entity, and not made public. It is stored in encrypted text on the borrower's computer or a separate device such as a smartcard. This key is also protected with a password or PIN to avoid compromise or disclosure. The private key is used to encrypt information that can only be decrypted by the corresponding public key.
Public Key
Public key is a mathematical key that can be made publicly available and which is used to verify signatures created with its corresponding private key. Depending on the algorithm, public keys are also used to encrypt messages or files, which can then be decrypted with the corresponding private key.
A typical public key looks like this:
30 81 89 02 81 81 00 c7 f1 83 ae 34 37 7c 57 44 fc be 18 92 e7 41 cc ea b3 ff 5a f3 3e cf 36 61 2d c8 49 d9 e8 f6 6a 9d 5c d7 40 70 65 31 8c c1 01 fc 70 ce 99 6e 12 36 43 18 de 88 e2 bf aa 6f 2a bc 74 6c f3 90 6b ff 8b 2f 0e d5 02 ea 28 d1 c3 ca cc b0 77 07 30 58 03 be 7e b9 ee cd 81 af 80 5c fa b4 58 1c 6d b5 a5 c8 58 1a 9f 36 f2 26 14 40 8b 65 e9 e3 a6 cf 72 0a b7 5c 98 93 75 6e 21 fd d4 66 01 a7 99 02 03 01 00 01
Normally, a key expires after some period of time, such as one year, and a document signed with an expired key should not be accepted. However, there are many cases where it is necessary for signed documents to be regarded as legally valid for much longer than two years for example long-term leases and contracts. By registering the contract with a digital time-stamping service at the time it is signed, the signature can be validated even after the key expires.
If all parties to the contract keep a copy of the time-stamp, each can prove that the contract was signed with valid keys. In fact, the time-stamp can prove the validity of a contract even if one signer's key gets compromised at some point after the contract was signed. Any digitally signed document can be time-stamped assuring the validity of the signature even after the key expires.
To time stamp a document, a time-stamp authority (TSA) can be requested to provide time stamping. The TSA must be a trustworthy organization. TSAs can be a public time-stamp service provider, such as VeriSign, or an internal time-stamp server on the organisations’ intranet. When the time-stamp server receives the request, it time stamps the document with its private key and returns the document to sender. TSA's public key attached to the document can be used to verify the time stamping. Thus, the time-stamping and time-stamp verification process is similar to the digital signing and signature verification process.
Message Digest
Hash value or message digest of a message is the result of applying a hash function to a message. A hash algorithm converts the message or document into a series of meaningless alphanumeric characters also known as digest checksum. Message Digest Algorithms used in security applications are designed so that it is computationally infeasible to find another message, which produces the same checksum.
A secure message digest algorithm is also designed so that the original message cannot be deduced from the digest checksum. This type of message digest algorithm is sometimes referred to as a one-way function since its effect cannot be easily reversed other than by an exhaustive search of all possible input values. The most commonly used message hash algorithms are Message Digest 5 (MD5) and Secure Hash Algorithm 1 (SHA-1). MD5 can produce a 128-bit hash, and SHA-1 can produce a 160-bit hash. For example, the possibility that MD5 will output the same hash for two different documents is 1/2128.
Public key trust models
There are two public key trust models: direct trust and third-party trust. In the direct trust model, the sender and the receiver trust each other directly and exchange public keys personally and securely. In the third-party trust model, the sender and the receiver might not know each other directly, but both trust a third party or middleman to exchange their keys. The direct trust model works for small groups or companies in which people know and can contact one another directly. The third-party trust model is more suited to large companies and inter-company relationships in which people might not know one another or can't contact one another directly.
The third-party model introduces the Certifying Authority (CA). A CA is a trustworthy organization that certifies public keys. A CA can be an internal organization in the company, such as the information security department, or an external entity like a public CA, such as VeriSign. CAs certify public keys by issuing users a digital certificate that contains the user's identity, public key, and key expiration date etc. The CA uses its own private key to sign the digital certificates it issues, which is another digital signature application. Each CA makes available a certificate containing the CA's public key, which anyone can use to verify a certificate the CA issues.
DIGITAL CERTIFICATES
A digital certificate contains details such as version, serial number, signature algorithm, issuer, validity, public key, basic constraints, certificate policies, CRL distribution points, thumbprint, thumbprint algorithm etc.
An installed digital certificate can be seen by clicking at the certificates button in the content tab of the internet options of the Internet Explorer. The certificate of other people, intermediate certification authorities, trusted root certification authorities and trusted publishers can also be viewed there.
At present a Certifying Authority issues the following classes of Certificates:
Class 1 - This class of digital certificate is issued to an individual that binds the identity of that person with a particular e-mail id. These Certificates provide the lowest level of assurances and are used normally for non-commercial transactions, where proof of identity of a subscriber may not be required.
Class 2 – This class of certificate is issued to individuals belonging to or affiliated to a business or a government organization, which takes the responsibility of verifying the accuracy of the information submitted by an individual. Since these certificates are issued against a trusted database of an organization, the verification details coupled with a request for a Certificate for this class is done by the organization. Thus the organisation acts as a Registration Authority and saves the time and cost of verification at the end of the Certification Authority.
Class 3 – In order to acquire this certificate, the applicant must personally present himself before an authority approved by the CA who will identify the applicant. The identification will be based on, at a minimum, a well-recognized form of government-issued photo identitification and one other identification credential. The applicant must also provide documentation to prove the validity of the organisation he is employed with and his employment status with that organisation. It provides for stronger assurances of an applicant’s identity as compared to a Class 2 - Certificate.
SIGNING OF DOCUMENTS
The process of digitally signing a document or message is performed in two steps. Firstly the hashing algorithm is applied to the input message to get a hash value, the sender then applies his private key to obtain a digital signature.
VERIFICATION OF DIGITAL SIGNATURES
The digital signature technology also allows the recipient of a given signed message to verify its real origin and its integrity. From a technical point of view, the verification of a digital signature is performed in three steps.
In the first step, a hash-value of the signed message is calculated. For this calculation, the same hashing algorithm is used as was used during the signing process. The obtained hash-value is called the current hash-value because it is calculated from the current state of the message.
In the second step of the digital signature verification process, the digital signature is decrypted with the same encryption algorithm that was used during the signing process. The decryption is done by the public key that corresponds to the private key used during the signing of the message. As a result, the original hash-value that was calculated from the original message during the first step of the signing process is obtained.
In the third step, the current hash-value obtained in the first step is compared with the original hash-value obtained in the second step. If the two values are identical, the verification is successful and proves that the message has been signed with the private key that corresponds to the public key used in the verification process. If the two values differ from one another, it implies that the digital signature is invalid and the verification is unsuccessful.
It is possible that the digital signature is invalid. The possible reasons for getting an invalid digital signature are discussed as under:
If the digital signature is adulterated i.e. it is not real and when it is decrypted with the public key, the obtained original value will not be the original hash-value of the original message but some other value.
If the message was changed i.e. adulterated after its signing, the current hash-value calculated from this adulterated message will differ from the original hash-value because the two different messages correspond to different hash-values.
If the public key does not correspond to the private key used for signing, the original hash-value obtained by decrypting the signature with an incorrect key will not be the correct one.
If the verification fails, inspite of the cause, this proves only one thing i.e. the signature that is being verified was not obtained by signing the message that is being verified with the private key that corresponds to the public key used for the verification.
Unsuccessful verification does not always mean that an attempt for digital signature adulteration is detected. Sometimes, verification could fail because an invalid public key is used. Such a situation could be obtained when the message is not sent by the person who was expected to send it or when the signature verification system has an incorrect public key for this person. It is even possible for one person to own several different valid public keys along with valid certificates for each of them and the system attempted to verify a message received from this person with some of these public keys but not with the correct one i.e. the key corresponding to the private key used for signing the message.
In order for such problems to be avoided, most often when a signed document is sent, the certificate of the signatory is also sent along with the document and the corresponding digital signature. Thus, during the verification, the public key contained in the received certificate is used for signature verification i.e. if the verification is successful it is considered that the document is signed by the person who owns the certificate has signed the document.
SIGNING EMAILS
E-mail clients like Microsoft Outlook, Outlook Express etc. can be configured to send digitally signed and encrypted messages. Once the digital certificate has been configured in the e-mail the user can sign and encrypt the e-mail at the click of a mouse button. The image below displays how a user can digitally sign and encrypt an e-mail using the Outlook Express.
When the receiver gets a digitally signed message the following message is displayed in the e-mail body.
To read the message the receiver would be required to press ‘Continue’. However, in case the message is encrypted then the receiver will first need to use his private key to decrypt the message. It is advisable that the private key should be protected by password that should be known only to the owner of the key.
SIGNING DOCUMENTS
Digital signatures can be added to not only e-mails and other applications but also to word documents and .pdf files. However, it is advisable to maintain e-records in pdf format because of better in-built security features. To add a digital signature to a .pdf file click at the signature tab and use the option of ‘Sign Document’. An area on the document needs to be selected where the digital signature would appear.
INDIAN SCENARIO
Currently in India, there are a few organisations such as NIC, IDRBT, TCS, Safescrypt, which are authorized CAs to issue digital signatures. An individual can get a digital signature at prices starting from about Rs 750. The cost will go up on the basis of security features encrypted on the digital signature.
However, India has an edge over most countries in this domain. The Indian IT Act 2000 provides legal sanctity to digital signatures and transactions carried out by means of electronic data interchange and other means of electronic communication, commonly referred to as "electronic commerce", which involve the use of alternatives to paper-based methods of communication and storage of information, to facilitate electronic filing of documents with the Government agencies. Therefore, one can use them to digitally sign documents, thus eliminating paperwork, increasing efficiency and reducing costs. Some of the provisions of the IT Act 2000 relating to digital signatures are discussed as under:
As per Section 81 of the Act the provisions of this Act shall have effect notwithstanding anything inconsistent therewith contained in any other law for the time being in force.
Digital Signatures as per Section 2 (p) of the Act means authentication of any electronic record by a subscriber by means of an electronic method or procedure in accordance with the provisions of section 3.
As per Section 2 (d) of the Act "affixing digital signature" with its grammatical variations and cognate expressions means adoption of any methodology or procedure by a person for the purpose of authenticating an electronic record by means of digital signature.
Section 5 of the Act provides legal recognition to digital signatures. It reads:
Where any law provides that information or any other matter shall be authenticated by affixing the signature or any document shall be signed or bear the signature of any person then, notwithstanding anything contained in such law, such requirement shall be deemed to have been satisfied, if such information or matter is authenticated by means of digital signature affixed in such manner as may be prescribed by the Central Government.
Section 35 of the Act provides power to Certifying Authority to issue Digital Signature Certificate. It states that:
(1) Any person may make an application to the Certifying Authority for the issue of a Digital Signature Certificate in such form as may be prescribed by the Central Government
(2) Every such application shall be accompanied by such fee not exceeding twenty-five thousand rupees as may be prescribed by the Central Government, to be paid to the Certifying Authority:
Provided that while prescribing fees under sub-section (2) different fees may be prescribed for different classes of applicants'.
Provided that while prescribing fees under sub-section (2) different fees may be prescribed for different classes of applicants'.
(3) Every such application shall be accompanied by a certification practice statement or where there is no such statement, a statement containing such particulars, as may be specified by regulations.
(4) On receipt of an application under sub-section (1), the Certifying Authority may, after consideration of the certification practice statement or the other statement under sub-section (3) and after making such enquiries as it may deem fit, grant the Digital Signature Certificate or for reasons to be recorded in writing, reject the application:
Provided that no Digital Signature Certificate shall be granted unless the Certifying Authority is satisfied that—
(a) the applicant holds the private key corresponding to the public key to be listed in the Digital Signature Certificate;
(b) the applicant holds a private key, which is capable of creating a digital signature;
(c) the public key to be listed in the certificate can be used to verify a digital signature affixed by the private key held by the applicant:
Provided further that no application shall be rejected unless the applicant has been given a reasonable opportunity of showing cause against the proposed rejection.
CONCLUSION
Provided that no Digital Signature Certificate shall be granted unless the Certifying Authority is satisfied that—
(a) the applicant holds the private key corresponding to the public key to be listed in the Digital Signature Certificate;
(b) the applicant holds a private key, which is capable of creating a digital signature;
(c) the public key to be listed in the certificate can be used to verify a digital signature affixed by the private key held by the applicant:
Provided further that no application shall be rejected unless the applicant has been given a reasonable opportunity of showing cause against the proposed rejection.
CONCLUSION
When one journeys from the “physical” world to the “electronic” world, all the basic assumptions on security of the data and information fly out of the window. Email has today become a virtually ubiquitous means of communication. Users today assume that their critical data being sent both internally and externally via E-mail is safe from prying eyes. This may not be correct. Emails are mostly like an open postcard. It can easily be altered and anyone can easily “spoof” them. Thus, the four pillars of “trust” that are taken for granted in the physical world are questionable in the electronic world.
In the present global competitive environment the growing significance of digital signature is manifest by developments such as the Securities and Exchange Board of India permitting brokers to send online contract notes authenticated by digital signatures, the move to amend the Negotiable Instruments Act to approve electronic cheques, admissibility of e-transactions, Directorate General of Foreign Trade becoming digital signature-enabled, DCA21 project of DCA encouraging companies to file their records and returns digitally signed would give a fillip to the use of digital signatures in the country.
However, it is felt that the process of acquiring digital signatures would gain momentum only when digital signing is made mandatory for e-filing of forms and documents, online buying and selling, and online financial transactions.
