ietf-openpgp
[Top] [All Lists]

Re: Signature types

2005-09-22 07:00:17

Daniel A. Nagy wrote:
It's actually RFC1991 that got me wondering:

     <40> - time stamping ("I saw this document") (*)
  ...                                          Type <40> is intended to
  be a signature of a signature, as a notary seal on a signed document.

Now, this is contradictory. If a signature does not have any cryptograpic
binding (except the indirect one through the other signature) to the
document, it cannot be used to assert the integrity thereof.

Someone with the public key of the notary cannot verify this claim. Also, it
makes a lot of sense to certify documents that have not been signed.

[snip]

       This signature is a signature over some other OpenPGP
        signature packet(s). It is analogous to a notary seal on the
        signed data.


Except that if it's a signature on the signature, then it cannot be
analogous to a notary seal on the signed data (see above).


One of the difficulties that may be occuring here
is that the word 'notary' has different meanings
in civil and common law contexts.  In the former,
a notary is likely to be interested in the content
of the signed data;  whereas in the latter, the
notary is normally only interested in the quality
of the signature, and not the data.

We had a long threat on this about a year ago, and
I believe some changes were made disambiguate ..

I think the context that the Draft uses the word
notary is more towards the common law case of just
the signature and not the data that is signed.


iang

<Prev in Thread] Current Thread [Next in Thread>
  • Re: Signature types, Ian G <=