MIT and the National Notary Association released a white paper on how to use notaries and cryptographic digital signatures (a.k.a. digsigs). The press release is a curious throwback to a decade ago where organisations aspirated deeply and warned that unless something was done immediately, fire, flood and pestilance was sure to strike eommerce.
Many paper-based transactions, from real estate conveyances to international adoptions to last wills and testaments, are notarized in order to prevent, detect and prosecute fraud. As government agencies and industry move toward a complete paperless workflow, electronic documents will need to receive the same level of security as their paper counterparts. However, Greenwood warns that laws and regulations to guide Notaries in the performance of electronic notarizations are lacking and must be immediately addressed to ensure the protection of property rights in the 21st century."Those who regulate Notaries Public would be derelict in their duty if they failed to effect the rule-making necessary to transition to a reliable system of e-notarization," Greenwood writes. "Failing to exercise oversight and control in this area would be akin to failing to provide and enforce safety rules for hydrogen or hybrid cars because the new technology is different from the old."
Cryptographic digsigs can work fine as indicators of human intent without laws, without notaries, and without fuss, once you get into the core of the application. On the other hand, a law put in place can set us back a decade or more. One of the reasons why we do not see digsigs used more often is because of the early franchise-building Utah models that were popularised in the mid 90s.
To my knowledge, courts and lawyers have this all wrapped up as they know that a signature is an indicator of intent, and the intent rules, not the mark. Efforts to regulate this long-known legal principle are therefore likely no more than franchise building, and should be summarily rejected for what they are.
Luckily the PDF that Daniel Greenwood wrote is far more clear on what a digital signature can be. Here's one fascinating snippet:
The state of Colorado has pioneered a simple but effective solution to enable state regulation of electronic notarization.26 It is called the Document Authentication Number, or DAN, and works like this:In Colorado, this is an eleven-digit accounting number issued to each notary by the Secretary of State's accounting system. This number can be accessed and referenced by anybody. Like a white pages entry, it is unique but publicly accessible identification. The number will be searchable online to verify a notary's name, commission number, commission expiration date and other important information.
Second, each notary is issued multiple random numbers generated by the Secretary of State, who keeps a copy of each such number. Unlike the first number, these are kept confidential. They should be secured, just as is the notary's seal for paper-and-ink notarizations. One of these random, confidential numbers is used by the notary to ``brand'' every discrete eNotarization. The notary also has, associated with each confidential number, the relevant data that appears on the respective official seal, such as name, title, jurisdiction and commission expiration date. When used together, the Document Authentication Number and a randomly generated number assigned by the Secretary of State constitute the notary's electronic signature for a particular notarization.In order to execute an eNotarization, the Colorado notary would simply affix to the electronic document both the private and public numbers, along with the pertinent commission information. This could be done by manually ``copying and pasting'' the data from a document or spreadsheet or through easy-to-use software. Thereby, the notary has tied the document to the electronic notary signature. In effect, an electronic notarization has occurred.
Nice! Public / private digital signatures with just a bunch of big random numbers (BRNs). That shows extraordinary flair by Colorado, and one wonders how they managed to slip that one past all the franchise builders, cryptography guildsmen and other worryworts.
I was reminded the other night of an anecdote about digsig laws. Some years ago, I was asked to (informally) advise a small nation on digital signatures. I read the two page draft law, and said, that's fine, but you don't need that, and here's why... (Insert blah blah here as above.)
It was then explained to me that the purpose of the law was not to regulate digital signatures, but to fill the spot, as a certain other friendly but elderly country of masculine sibling nature was pushing to put in place a regime of another sort. This action was recognised as a complete agenda push by the helpful elder sibling, and therefore a defensive action was needed: "we already have a digsig law, thanks, we don't need yours."
At which point I then understood. Fine, put in place your digsig laws, but stick to the tiny model: a digital signature should not be rejected by courts solely on the basis that it is a digital signature. End of story. Meanwhile, let the private sector get on with working out how to do this.
Posted by iang at January 23, 2006 10:21 PM | TrackBackOh, my! Do legislators ever learn? There has been so much harmful legislation around digsigs that by now it should be clear that leaving us kids alone is the best thing governments can do. A national government can force everybody to trust a notary public within its borders, but why on Earth would I trust a US-notarized signature more than one that is not?
(BTW: The digital signature system in Estonia is surprisingly good. It's nice that they managed to hand key pairs to a large part of the population in a half-decent way. Some systems that build on these signaures, however, are horrible: the internet-voting they implemented is a typical Orwellian Nightmare Enabling Technology (tm).
In Estonia, national ID cards can make RSA signatures, with the private key never leaving the card. The government certifies the public key, but there are facilities in the card to request and store other certificates as well. The choice of RSA over other dig-sig schemes is commendable. The system is not perfect, but at least most Estonians have a key pair, which is reasonably secure and trustworthy.)
What is really needed for securing property in on-line transactions is title insurance. Before I buy something, I'd like to see an insurance policy by a trusted insurance company that says I will be compensated, if the seller didn't really own the thing he sold or failed to transfer the thing into my possession.
Without that, it's very difficult to conduct transactions in the value range between very cheap and very expensive, when risking the loss of value is already unacceptable, while litigation is still not worth it.
As for this DAN thing, it seems more expensive and less reliable than proper electronic signatures (not to mention the proliferation of TTPs it entails).
All that said, I would really love to see the notarization feature cleaned up and implemented in OpenPGP (will do it myself, if noone takes up the slack). There might be a market for private notarization and the feature might be helpful for title insurance as well.
Posted by: Daniel A. Nagy at January 25, 2006 05:39 PMHello,
I'm the guy who wrote the white paper. I also thought the Colorado system was inventive and a good use of technology tailored to the actual needs to the circumstances. To the underlying point that we don't need notaries or crypto to create a valid electronic signature, I totally agree. That was the reason I spent years pushing the model of statute which (unlike the Utah regulatory crypto law) allows any technology used with an intent to sign. The interesting rub here (which I didn't fully appreciate in the mid-90's when these battles were raging) is that notarization requirements frequently should require more. And more than technical security can currently provide. As you'll read if you digest the paper, there are some areas where it still makes sense to have an actual trusted person in the mix - a person who can screen the signer to see if they are under duress or are evidently a fraud, and (more to the point) a person who can take the stand and testify as to what actually heppened if there is a later problem. I don't think the overhead of notaries makes sense in the bast majority of eSignature situations, but I'm pursuaded that it is a good safeguard in some, and that having these people use electronic notarization on electronic signatures (e.g. where a person has electronically signed a will or a deed and has it electronically notarized) makes a lot of sense. Eventually we may have ways to be even more efficient without risking public protection against identity crime and fraud, but for now, I'm satisfied that the current safeguards are appropriate.
What do you people think?
Also - My last name is Greenwood. I think you spelled it wrong on your original post. Would that mess up an eNotarization??
Cheers,
- Dan Greenwood
Whichever version of enotarization and/or esignature is implemented, notaries are still needed as Dan said to validate the identity and willingness of the signer. Additionally, in the electronic age if someone were intoxicated, sits down at their computer and were able to initiate signing loan docs or the like without someone unbiased with them to see that they are under an influence imagine the mess. For sooo many reasons a notary cannot be taken out of the picture. Even with digital public and private information on an ID as bio-metrics, one cannot validate the person on the other end of that computer being who's information is on that ID. I believe if you were to take the unbiased notary out of the mix then is when you run possibly or probably a greater risk of fraudulent actions than there are on paper now. It will take a lot of specialized training on the part of the notaries. I am a notary and I am up for the challenge that lies ahead. I am even in anticipation of the implementation of e-notarization. I believe there will be a bit of 'Survival of the fittest'. I believe notaries will have to learn a lot more, go through more rigorous training and testing and be held to a higher standard than ever before. There should be, now I say 'should be', that's not meaning it will happen that way.......there should be a standard Notary Act across the nation.
As for the software many are saying it will never work because there will be too many softwares out there and they won't all work together. Well I'm not that technical of a person but we have .PDF and PCL and all of those converters to convert all these software languages to be compatible to all. I believe MISMO is creating a Standard by which the mortgage industry will have a standard to work by. I believe the softwares being developed will be designed to meet MISMO (Mortgage Industry Standards Maintenance Organization) standards of MXCompliance/XMLCompliance.
As for your name being misspelled and would it mess of an e-notarization........you bet your booties it would! :) but gee think......could one make a phone call or email right from the table with the signer and have the originator fix the error and re-upload the docs in a matter of minutes. Currently, the notary would go home and the docs would have to be re-initiated and a return trip made. Sounds like e-notarization is made in heaven to me.! :)