Verification of digital signatures

A certification authority (CA) manages creation, verification and distribution of these signatures. In India, Reserve Bank of India and Securities and Exchange Board of India have been appointed as CA till date. These entities create the digital certificates that is the crux of the entire process. These certificates include the following details:

One of the reasons why more and more countries have shown a willingness to embrace digital signatures is to do away with the bureaucratic red tapism. Many a contract has been lost because the bidder was unable to get the signatures of all designated officials within the stipulated time. As against this, the creation and verification processes of digital signatures are capable of complete automation with human interaction required on an exception basis only. Alekhya Talapatra, National Business Manager, Compaq Computer India is confident that there will be certain ease in doing business. The transactional costs too will be cut down which will make doing business easy.

Compared to antiquated paper methods such as checking specimen signature cards, digital signatures yield a high degree of assurance without adding greatly to the resources required for processing. Pavan Sood, MD, ITNation.com likens the benefits of digital signatures over paper-based to the advantages of Internet communication over traditional modes of communication.

Agreeing with Alekhya, he adds, "Digital signatures will facilitate quicker authentication of documents, more efficient usage of corporate time, and carry forward the most critical benefit of the Internet medium - surpassing geographical distances."

Samsung's Vivek Prakash is happy that the problem of securing several encrypted messages has boiled down to securing just one private key. He is confident that digital signatures will enable secure and authentic transactions to be carried across open networks.

"These may involve authentication of electronic payments, official and legal communication, sites from which software is downloaded, and in smart cards," he says. "The good news is that it is very difficult to forge the digital signature. With digital signatures, no one can force you to sign on a 'blank paper'."

Now that digital signature has also been awarded a legal status, legally binding documents can be transferred electronically. This will allow business houses to conduct transactions and enter into binding contracts entirely by electronic means saving a lot of time.

Concedes B Prasanna Kumar, Chief Manager — IT, Karnataka Bank, one of the first financial institutions in the country, which will implement digitization, "Introduction of the new bill in the parliament has made digital signature legalized. This system will allow customers to transact their business from their office or home on the basis of their digital signatures."

Chief Technology Officer of Agmoz.com, Praveen Kumbnani is happy about the positive effect the new legislation will have on e-commerce. Says he, "The first advantage that I see is that it will boost e-commerce. Users may not comfortable with parting with their credit card numbers to a travel web site for bookings, as they are not confident about their security measures. However this may not be the case with the advent of digital signatures. This will come as a definite boost for online transactions."

Himanshu Goyal, Business Development Manager, Adobe Systems however is a bit cautious and says, "The Internet has become a new medium to do business through and the basic need here is authentication. That has to be solved. The advantages will then begin to roll in."

Firstly what is important is to find out just how many takers are there for this. To start with the price tag of Rs 25,000 for procuring a digital certificate has not won much favor. The second question that arises is whether the Indian public is ready to accept digitization of signatures? Alekhya feels that apart from MNCs and a few big Indian corporates the market as a whole is immature and adoption of this may not be smooth.

One of the biggest security hazards of the advent of digital signs is identity theft. The other problem is tracing of the document to the recipient leading to loss of privacy. Praveen Kumbnani Chief Technology Officer Agmoz.com agrees with the latter contention. Says he, "The major pitfall that I see is the issue of privacy. Here I do not mean the commercial use of personal information. We will have something similar to cookies and there is a potential that software will get written that will invade your computer and will then have access to all the information that is there in it. This is more of a misuse than commercial use of private information. This is an undesirable aspect that could accompany digital signatures." However the upside is that like the OS has evolved from DOS to Windows, there is bound to be evolution here too and this is what will move things forward which will safeguard user privacy.

Already Adobe has made provisions for privacy protection in its software. Adobe Acrobat uses the 1024 bit RSA algorithm to actually embed the signature in the file. The text may be replicated, but the signature cannot be.

But it must be remembered that since the private key is the essence of digitization, it loss could very well cause many problems to the user. It is very easy to lose the private key - by divulging it to someone else or by losing the media on which it may be stored. Hence most industry players advocate that the private key should be safeguarded properly and kept at a secure location on the network.

As in manual signatures, there are chances that new frauds will arise with the implementation of the digital signatures. However monitoring them will not be as easy Alekhya says. "The frauds will not be all that prominent, because there is always a provision of bad debts," he says. "And I foresee the magnitude of bad debts going down."

Though the onus of the security rests largely on the government, it is important for the corporates to be proactive too. Alekhya points out that the encouraging factor is the positive outlook adopted by the government as new portfolios are being created increasing the pace.

Talking about frauds, Praveen says, "The prime concern is monetary loss. A right mix of online and offline infrastructure to support the entire process will lead to minimizing the element of fraud. It can begin with a simple telephonic call to authenticate and verify. The offline support will help to build confidence in users faster. And there is no short cut to a learning curve."

Another aspect will be the introduction of e-currency. This will prevent fraud beyond a particular value. Praveen adds that increased B2B business is the insurance of e-transactions. "Insurance companies with due support from the government will have to work on this, as there is no defined method to assess and measure risk. We conduct business with a bank, because of its legacy, however there is no such legacy when we talk about digital signatures. And the most appropriate party to do this is the government."

So we have the technology and the right attitude towards it. But when will we see wide spread use of digitization. Says Alekhya of Compaq, " The time frame that I look at for major transactions to start happening is about a year, though smaller transactions will happen sooner."

Praveen says, "The issue here is not time frame, but implementation. With a lot of hype about the whole thing, smart ways to put everything in place have to be figured out."

Himanshu Goyal lauds the effort of the government and states, "With the government accepting digital signatures in principle, it is not before long that the whole thing is in place. Technology will adapt to needs that come with the digital signature and tools to enable the same will also soon be available."

Pavan Sood too is optimistic the way things are going. "Until recently, Indian courts did not recognize faxes and Internet documents as evidence in litigation procedures," he says. "But with the IT Act in place and legalization of digital signatures, we can expect a boost in trade and business being conducted on the electronic exchanges."

There is no doubt that adoption of the digital signatures might take some time. But this time will help security experts to untangle the security implications involved. Who in the end will be responsible for the security issues, will it be the CA or the user? Right now no answers seem to be forthcoming, but it won't be long before the CA makes it move.