© Julia Wilk (FHÖV NRW) 1 Digital Signatures

© Julia Wilk (FHÖV NRW)2 Structure 1. Introduction 2. Basics 3. Elements of digital signatures 4. Realisation in public authorities 5. Conclusion

Digital Signatures © Julia Wilk (FHÖV NRW)3 1. Introduction What is a Digital Signature? - A Digital Signature is a type of asymmetric cryptography used to simulate the security properties of a handwritten signature on paper. - Sometimes also used: Electronic Signature (here synonymic)

Digital Signatures © Julia Wilk (FHÖV NRW)4 Why is it important for e-Government? Handwritten signature often required in public law Digital signature can replace it More possibilities of electronic services: - Cost savings - Saving Time  For both citizens and authorities

Digital Signatures © Julia Wilk (FHÖV NRW)5 2. Basics 2.1. Law 2.2. Security Properties of handwritten and digital signatures

Digital Signatures © Julia Wilk (FHÖV NRW)6 2.1.Law Germany: “Signaturgesetz” in Precondition for safe and legally binding electronic signatures - Regulates specifications for using digital signatures Europe: EU Signature Directive - Unification of different signature laws in the EU (especially different security levels) - Basis for changes of the German law in 2001, 2005 and Changes made the law conform to the European directive

Digital Signatures © Julia Wilk (FHÖV NRW)7 Law: Different Signatures 1. Electronic signature - Data in electronic form which are attached with other electronic data and which serve as a method of authentication  E.g. a scanned signature 2. Advanced electronic signature - Means an electronic signature that is also - uniquely linked to the signatory, - capable of identifying the signatory, - linked to the data to which it relates that any change of the data is detectable.  Guarantees not only the authentication, but also the integrity of the text

Digital Signatures © Julia Wilk (FHÖV NRW)8 Law: Different Signatures 3. Qualified digital signature based on a qualified certificate of a Certification Authority (CA) Germany: sole signature that is equal to a handwritten signature (§ 126a BGB) guarantees authentication, integrity and also confidentiality 4. Qualified digital signature with accreditation Like a qualified signature, but furthermore - CA was accredited voluntarily - Proof for comprehensive technical and administrative security

Digital Signatures © Julia Wilk (FHÖV NRW) Security Properties

Digital Signatures © Julia Wilk (FHÖV NRW)10 Security Properties of handwritten messages Authenticity - Nobody should impersonate someone he doesn’t is  Handwritten signatures are unique Integrity - A message can not be falsified unnoticed  No obvious changes in the document (like sth. was erased) Obligation - The signature has to assure legal certainty  If Cologne decides to choose Mr. Klüngel as the builder, his signature is a guarantee that he really builds the town hall for 20 million Euro Confidentiality - No person except the receiver should be able to read the message  Document sent in an undamaged envelope

Digital Signatures © Julia Wilk (FHÖV NRW)11 Security Properties transferred to digital signatures Authenticity - Nobody should impersonate someone he doesn’t is  So.'s identity can be proved e.g. with a chip card that can only be used with the right PIN Integrity - A message can not be falsified unnoticed  One is sure the text received is the same that was sent, and that no hacker had changed it Obligation - The signature has to assure legal certainty  If Cologne decides to choose Mr. Klüngel as the builder, his signature is a guarantee that he really builds the town hall for 20 million Euro (see § 126a BGB) Confidentiality - No person except the receiver should be able to read the message  Not guaranteed by digital signature itself, but because of asymmetric encryption

Digital Signatures © Julia Wilk (FHÖV NRW)12 3. Elements of digital signatures 3.1. Basic functionality 3.2. Hash functions and hash results 3.3. Asymmetric encryption 3.4. Certification 3.5. User’s realisation

Digital Signatures © Julia Wilk (FHÖV NRW) Basic functionality Example: Bob wants to send a message to Alice and sign it digitally 1. Bob creates a digest of the message – a sort of digital fingerprint (also: hash result). If the messages changes, so does the digest. 2. Bob then encrypts the digest with his private key. The encrypted digest is the digital signature.

Digital Signatures © Julia Wilk (FHÖV NRW)14

Digital Signatures © Julia Wilk (FHÖV NRW) Basic functionality 3. The encrypted digest is sent to Alice along the message. 4. When Alice receives the message, she decrypts the digest using Bob’s public key. 5. Alice then creates a digest of the message using the same function that Bob used. 6. Alice compares the digest that she created with the one Bob encrypted. If the digests match, then Alice can be confident that the signed message is indeed from Bob.

Digital Signatures © Julia Wilk (FHÖV NRW)16

Digital Signatures © Julia Wilk (FHÖV NRW) Hash functions and hash results Asymmetric encryption guarantees confidentiality Encryption can take too much time and would be too much to calculate if there are bigger documents Solution: Not the document itself, but its hash result gets signed

Digital Signatures © Julia Wilk (FHÖV NRW) Hash functions and hash result Hash function:= algorithm which creates a digital representation in the form of a hash result of a standard length which is usually much smaller than the message but substantially unique to it Hash function also known as “digital fingerprint”

Digital Signatures © Julia Wilk (FHÖV NRW) Premises for hash functions It has to be impossible to generate the same hash result for two different documents (like a fingerprint is unique, too) Hash function has to have the “one-way- property”: The hash result can be calculated from the document, but it mustn’t be possible to calculate the document from the hash result

Digital Signatures © Julia Wilk (FHÖV NRW) Asymmetric encryption Basic: a pair of keys, namely a private key and a public key Premises: - Private key has to be saved, e.g. using a chip card with a PIN - Public key can be accessible for everyone, but its owner’s identity has to be identifiable without problems to guarantee authentication (certificate) - Not possible to generate the Private key by knowing someone’s Public key

Digital Signatures © Julia Wilk (FHÖV NRW) Encryption: Proceeding Generating message’s digest (hash result) Using Public Key to encrypt hash result Result of the encryption: digital signature Sender sends - message, - digital signature and - certificate to receiver Receiver wants to check - Integrity  Generating hash result, compare it to the sender’s hash result and decrypting the message with the sender’s public key - Authenticity  Can be checked by means of the certificate

Digital Signatures © Julia Wilk (FHÖV NRW) Encryption: Proceeding

Digital Signatures © Julia Wilk (FHÖV NRW) Certification Important for authenticity: - Receiver of a message has to be sure that the public key he uses really belongs to the sender Solution: Certification Authority (CA) - Independent, confidential - Law causes premises for a CA:  Professional competence  Qualified equipment of hardware and software  Unimpeachable employees

Digital Signatures © Julia Wilk (FHÖV NRW) Certification Certificate: comparable with a digital identity card Document that shows someone’s identity doubtless Three-stepped infrastructure guarantees authenticity: - Sender - CA - Authority that controls CA  In Germany “Bundesnetzagentur”

Digital Signatures © Julia Wilk (FHÖV NRW) Realisation by user Important for security: private key has to be absolutely saved and only available for his user Technical premises: - Chip card and PIN  High security level because of “possession and knowledge”  Cards available through bank branches, but they are only mediators of accredited CAs  Encryption of the hash result is realised in a matter of seconds - Card reader - Computer and corresponding software

Digital Signatures © Julia Wilk (FHÖV NRW) User acceptance Citizen’s interests: - Doing as much administrative aspects as possible by using the internet - Survey: 88 % of German citizens would like to do everything concerning public administration online to avoid waiting times and save time

Digital Signatures © Julia Wilk (FHÖV NRW) User acceptance Today: Nearly every authority has got a homepage where you can download forms or search for information Problem: Forms often need to be signed handwritten We learned: Only the qualified digital signature can replace a handwritten signature Using qualified signatures premises special equipment (remember chip card, card reader…)

Digital Signatures © Julia Wilk (FHÖV NRW) User acceptance Special equipment costs money Question: Are the citizens really willing to pay for their wish to do as much as possible online? - Equipment costs are estimated about 50 € in Germany - Expensive if someone only needs his authority for 2 or 3 times a year - Solution: Equipment has to be all-purposed, it has to be possible to use the equipment in other fields, like home banking e.g. - Digital signatures are not established plentiful, a distribution in Germany would also reduce costs

Digital Signatures © Julia Wilk (FHÖV NRW) User acceptance Other problems: - Administrative procedures often need original documents (like a family register or a birth certificate) - If you do everything in a electronic way, the expert advice of the official is missing which maybe causes mistakes

Digital Signatures © Julia Wilk (FHÖV NRW) User acceptance Summing up: - The more possibilities of using digital signature equipment exist, the more will be established the digital signature and also the citizen’s acceptance - Electronic government offer is rising year by year, so maybe also the success will rise with it

Digital Signatures © Julia Wilk (FHÖV NRW)31 4. Realisation in public authorities 2001: only 4,8 % of German local authorities use digital signatures 2006: 30 % use respectively qualified signatures and qualified signatures with accreditation

Digital Signatures © Julia Wilk (FHÖV NRW)32 Use of digital signatures in German cities (Survey by KGSt, 2006)

Digital Signatures © Julia Wilk (FHÖV NRW)33 5. Conclusion Offering and diffusion of digital signatures had grown in the last years Reasons: - Unification of law in the EU - Further development - Increasing disposition of public authorities to engage in digital signatures

Digital Signatures © Julia Wilk (FHÖV NRW)34 5. Conclusion Citizen’s vantages: - Many transactions can be done from the computer at home - Citizen is not bound to opening times and reachability of public authorities Public authorities: - Saving costs in traditional sectors - New technologies cause other costs and other resources like qualified employees - Long-term: digital signatures can redound to more efficiency

Digital Signatures © Julia Wilk (FHÖV NRW)35 5. Conclusion Security - Today things like the one-way hash function, asymmetric encryption and sophisticated chip card system cause secure proceedings - The security standard has to be conformed to the computer systems that get increasingly powerful Costs - High costs are indispensable to guarantee a high security level

Digital Signatures © Julia Wilk (FHÖV NRW)36 5. Conclusion User’s/Citizen’s Acceptance - Chip card systems are easy to use - High costs could reduce the success of digital signatures - Necessary to coordinate standards to use a chip card system for many different applications  The more people use it, the more can costs be reduced and digital signatures can be used area- wide

Digital Signatures © Julia Wilk (FHÖV NRW)37 5. Conclusion Summing-up: - Today digital signatures are under way and can only be seen as an amendment to traditional procedures - In the future digital signatures will get more and more important to guarantee an efficient action of public authorities

Digital Signatures © Julia Wilk (FHÖV NRW)38 Questions???

Digital Signatures © Julia Wilk (FHÖV NRW)39 -The End-