Digital Signatures: Addressing the Legal Issues.

Forecasts for global revenues for B2B e-commerce are huge. Jupiter Communications predicts that in the US marketplace alone, spending on B2B will reach $6.3 trillion USD by 2005, representing a twenty-fold increase from B2B US spending in 2000. Although the forecasts are high, both businesses and consumers identify security concerns as a key barrier to growth in online commerce. One way of addressing these security concerns when transmitting data over open networks such as the Internet, is to use encryption technologies. The use of digital signatures based on public Rev. infrastructure ("PKI") is the de facto standard or high-level security on the Internet.

There are challenges in relying on PKI and digital signatures. Not only are the IT systems on which they rely complex, but their use gives rise to a number of legal issues. The United Nations Commission on International Trade Law ("UNCITRAL"), the European Union and many individual jurisdictions are legislating to facilitate and control the use of digital signatures and PKI, so businesses that are considering using these security techniques need to understand both the technical and legal environment.

This article explains what digital signatures and PKI are and the legal and technical challenges they raise.

What is a digital signature?

Digital signatures are a form of electronic signature. The term electronic signature is used to describe the full range of electronic means to confirm the sender of the message. They range from a file including a graphical image of the sender's handwritten signature (simple but unreliable) to biometric techniques, such as iris scans (complex but reliable).

Digital signatures are based on public key technology, a special form of encryption invented in the 1970s, which uses two different keys (because two different keys are used, this form of encryption is also known as asymmetric cryptography). One key is kept secret (the private key), whereas the other key is made publicly available (the public key). The two keys are generated simultaneously and collectively are known as a "key pair." Once a message has been encrypted using one of the two keys, it can only be decrypted by the other key.

Ensuring confidentiality on open networks