RE: Manually Signed Digest as an XML signature type

All,

	I would slightly modify Barb's statement but to my knowledge
the restatement would not have any effect whatsoever on any
Electronic Signature scheme I have seen to date.

	The problem I have with electronic signatures is that a
biometric
alone cannot provide a cryptographically strong (i.e. immune to attack)
binding of the signature to the specific document.

	I have seen many, many biometric schemes that claim to construct
such a binding but on examination every single one that I have seen to
date either relies for comms security on the cryptographic key alone or
is
subject to relatively unsophisticated attack once the algorithm is
known.

	The only technique I have seen thus far that is promissing in
this
area is to use a biometric technique to gate access to the public key

	My very strong predjudice is that should sufficient motivation
exist that a proof may be constructed to this effect.

If we define

1) a cryptographic system to be one in which there is an
asymetry in the complexity of computing a function and its inverse.

2) a biometric system appropriately

My guess is that it is possible to construct a proof that any system
in which there is an asymetric work function associated with the
creation and verification of a signature validating the document
falls into this category.

	That is just my opinion, I could be wrong.

			Phill



-----Original Message-----
From: tgindin@us.ibm.com [mailto:tgindin@us.ibm.com]
Sent: Monday, June 05, 2000 8:33 PM
To: Barb Fox
Cc: Joseph M. Reagle Jr.; w3c-ietf-xmldsig@w3.org
Subject: RE: Manually Signed Digest as an XML signature type


     Does your last statement mean that you believe that a separate
standard should later be produced for non-digital electronic signatures
of
XML documents, or that you believe that the existence of such signatures
should not be encouraged?  If a separate standard is produced, it should
borrow a very large fraction of the syntax from this standard.
     I would not object to wording like "no signature object is in
compliance with this version of the standard unless it contains a
SignatureValue which may be verified by purely cryptographic means", as
long as "this version" is present.

          Tom Gindin


"Barb Fox" <bfox@Exchange.Microsoft.com> on 06/05/2000 08:13:29 PM

To:   "Joseph M. Reagle Jr." <reagle@w3.org>
cc:   Tom Gindin/Watson/IBM@IBMUS, <w3c-ietf-xmldsig@w3.org>
Subject:  RE: Manually Signed Digest as an XML signature type





Joseph:

Your definition of KeyInfo is information related to the generation of
the
signature.
Mine is that KeyInfo is information required by the verifier of a
signature.  There are several forms, like KeyName, that illustrate that
it's not intended to be used in the generation of a signature.

Also, in your choice between:

"A. Non cryptographic electronic signatures should place their
"validating"
information in SignatureProperties, or
B. Non cryptographic electronic signatures can not use XML Signature
syntax
what-so-ever. (Specifying this would be difficult as we would then have
to
enumerate all the algorithms that may be used, or all those that may
not,
and it's difficult to enforce.)"

I believe we should clearly state that compliance with this standard
requires that a cryptographic signature MUST be generated (or verified.)
If
the producer of a cryptographically signed XML document wishes to add an
electronic signature, it should be included as a SignatureProperty.

--Barb