Eric Norman wrote:
Since we're talking about court cases here, it's not obvious to me that the court would even care about whether certificates used for signing were valid at signing time. The only things a court might care about is whether the signer had the *intent* to sign, or the signature was under duress, or something like that. I have a suspicion, and hope, that these attempts to design "electronic justice" result in nothing more than discussions on mailing lists.
I don't know about hoping these discussions go nowhere ;-)But I agree with the implication that 'designing electronic justice' is problematic. In my view, too many of the PKI-in-court discussions seem to be devoid of context. Famously, Jane Winn years ago lampooned the idea of forming contracts on line using digital signatures -- but I think she was looking at the special case (the very special case) of stranger-to-stranger business.
Certificate subjects tend not to use their keys in a vacuum; when they sign things, there is plenty of context apart from their certificate. To imagine that a court case might turn on the certificate and private key alone I think is utterly academic.
It is better to realise that certificates are always used as part of some defined scheme (we should heed the practical experience that all most if not all successful individual certificate programs are "closed" or vertical). Certificates are not usually presented to Relying Parties by total strangers (and if they are, they should be ignored, just as we would tend to ignore an unexpected order sent to us by an unknown party on plain paper, even if it is signed by hand). Instead certificates are generally used to automate transactions between parties that either already know each other, or else recognise one another's credentials and capacity to act in the transaction at hand. There isn't a lot of "serious" use of certificates in vanilla e-mail applications. Rather, "serious" certificates are used in the context of special purpose software (e.g. medical software applications, e-conveyancing, government forms, trade documentation etc.) or are embedded in dedicated systems like smartcards, e-passports, set-top boxes, and Skype.
In these sorts of contexts, I think that when disputes get as far as a court, they are usually concerned with much more prosaic matters, like product failures, product liability, user interface design, and contracts.
Cheers, Stephen Wilson www.lockstep.com.au.