Re: [TLS] Please discuss: draft-housley-evidence-extns-00<

[<home_pw@xxxxxxx>]

I've lost track of the URL, but somewhere on an 
MSN/Microsoft site it once had a click-signature mechanism. 
"Click the Agree button" to be legally bound to something, 
over the SSL channel. That is not particularly remarkable, 
of course. However, there was specific and remarkable legal 
blurb justifying this as an "electronic signature". I recall 
reading it, wide-eyed.

One can gauge the trustworthiness of that "https signature" 
based on classical evaluation analysis (a) was the https 
implementation/ciphersuite/CA good enough (b) was the HTML 
rendered in Microsoft's IE product c) Is the browser and OS 
assured to ensure nothing else on the PC could interfere 
with the rendering of the server's-page ...and its dynamic 
button and event generation/communication. Absent an NCSC 
evaluation report thereto, the only party that can argue one 
way or the other is of course the vendor - which just 
happened to be Microsoft of course.

So, I think this was an edge case, that only an MSN site can 
make this claim for a click signature, because it has 
complete control over the trusted technology being applied 
(being an arm of Microsoft, the product maker of IE, https, 
MSN Servers, etc). However, to be an electronic signature, 
there has to be a recordation act. Presumably, the MSN audit 
logs have the details of the ciphersuite used, the browser 
headers, and perhaps even the SSL session pdus for replay.

----- Original Message -----
From: "Omirjan Batyrbaev" <batyr@xxxxxxxxxxxx>
To: <martin.rex@xxxxxxx>; "Stefan Santesson" 
<stefans@xxxxxxxxxxxxx>
Cc: <tls@xxxxxxxx>
Sent: Wednesday, January 10, 2007 12:54 PM
Subject: Re: [TLS] Please discuss: 
draft-housley-evidence-extns-00<


At
> least in US and at least one big b2b exchange said that 
> they have a simple
> non-repudiation practice: they make customers (buyers and 
> sellers) to sign
> the agreement that stipulates that whatever is the record 
> of a transaction
> in the exchange database that holds as the non-repudable 
> record. (the name
> witheld due to the NDA). So they have no need for even 
> application level
> non-repudiation. So as Stefan pointed out the b2b simply 
> uses http today.



_______________________________________________
TLS mailing list
TLS@xxxxxxxxxxxxxx
https://www1.ietf.org/mailman/listinfo/tls