Digital Signature Validity and Acceptance

Keep in touch with digital signature validity and acceptance worldwide and some tips how you can make sure you are prepared to discuss it with your higher management including your CIO and legal counsel

My Photo
Name:Manoj K. Srivastava
Location:Ellicott City, Maryland, United States

Monday, June 27, 2005

Sending and Receiving College Transcripts Electronically

Organizations: Dartmouth College[1] & University of Wisconsin[2]
Funded by: National Institute of Health,[3] Federal Government of Education[4]
Developed by: Identrus,[5] with Scott Rea of Dartmouth College

Problem

For secondary and primary institutions, the process of sending and receiving transcript information involves a lot of paperwork. An institution or student who requests an official copy of a transcript must send a signed letter or a signed fax to the registrar’s office. This request is processed in the order that it is received, printed on special paper, and sent to the requester by mail. [6] The process can take up to a week or more, depending on how fast the registrar’s office can print out the transcript and mail it out. These institutions also use costly paper to print the transcripts on. When receiving transcripts, institutions like Dartmouth College and University of Wisconsin require the paper format of a transcript to be sent to their respective schools. This process can take weeks to receive the information, verify its authenticity, and manually input the data into their registrar systems.

Solution

Purpose of Application: to electronically and securely send transcript information to/from institutions, secondary institutions (test concept to be used for Dartmouth College and University of Wisconsin)

The National Institute of Health along with the Federal Government of Education, hired Identrus to develop a system that can allow higher institutions to electronically send transcripts securely, using digital signature technology. Identrus together with Scott Rea of Dartmouth College, developed a test concept application that allows Dartmouth College and University of Wisconsin to exchange transcript data electronically and securely. This application will eventually be used to exchange transcript information between all colleges/institutions nationwide.

This application uses the Post-secondary Education Standard Council (P.E.S.C)[7] standard transcript XML format, which has been converted to Infomosaic SecureForm Designer/SecureSign Document Signer XML Form format. By utilizing Infomosaic’s SecureXML/SecureSign for signing the transcript XML Forms the application is able to guarentee transcripts authenticity and integrity to the user on the other end.

Benefits

This application provides the benefits of instantaneous results, efficiency, and reduction of costs. By using this secure and electronic application, users can quickly request an electronic copy of their transcript online, be approved by the system instantaneously, and sent a copy automatically. The universities can also receive transcript information from other institutions, quickly verify their authenticity, and input the data automatically into their systems. Institutions can save a lot of money from “special paper” costs, as the application allows users to print a copy electronically, reducing the need for institutions to send paper copies. If the application can be developed to generically adapt to all institutions, eventually, there will be a universal way to transfer transcript information between all types of educational institutions nationwide.

Future

Although the application has not yet deployed fully, it offers huge benefits for the future. Right now, the application template is school specific, which does not provide the universal capabilities that National Institute of Health and Federal Government of Education want. Each time a new school is added, a new template must be made which can take a some time to develop. Identrus and Scott Rea are currently working on creating one generic template using Infomosaic products so that all schools can easily use and adapt the application into their system. Eventually, this universal template can be used between many institutions, not just between the two test schools.

[1] Dartmouth College Website: <http://www.dartmouth.edu/home/>
[2] University of Wisconsin Website: <http://www.wisc.edu/>
[3] National Institute of Health Website: <http://www.nih.gov/>
[4] Federal Government of Education Website:< http://www.ed.gov/index.jhtml>
[5] Identrus Website: < http://www.identrus.com/>
[6] http://www.dartmouth.edu/~reg/services/transcripts.html
[7] P.E.S.C Website: <http://www.pesc.org/>

Friday, June 24, 2005

Countries who have enacted a digital signature law

I believe in a few years all countries on earth will give legal validity to digital signatures. The following countries have already enacted a digital signature law/policy that I know of. Please feel free to submit additional countries to help keep this list up to date and complete.

Belgium
Brazil
Canada
Chile
Egypt
France
Germany
Hungary
India
Mexico
Netherlands
United Kingdom
USA

Thursday, June 23, 2005

How to convince your CIO and your legal counsel

In order to convince your CIO and/or your legal counsel that your implementation of digital signature in your application meets all the legal requirements you should prepare document with the following items:

1. Explain the digital signature process including a half page overview of PKI

2. Explain the XML Signature format: SignedInfo, Reference, Transforms, SignatureValue etc.

3. Show a printout of the XML Form before it has been filled, after it has been filled and after it has been signed. Highlight the data being signed.

4. Show the result of the signature verification process. Show them the signed content extracted by the Infomosaic SecureXML Digital Signature after signature verification.

5. Show a block diagram for the certificate validation which takes place during the signing process and during the signature verification process.

6. Show a tampered signed XML Form and show a screen shot of the system where it shows the signature verification failure.

7. Show what happens if a user tries to use an expired or revoked certificate.

8. Show the result of signed document access which was created using a valid certificate but was subsequently revoked. The system should report a valid signature. The best way to achieve this is to include the CAM/OCSP Validation response or the fetched CRL during signature creation and then get the certificate status from this response if the current status of the certificate is revoked. Alternately you can compare the certificate revocation time with signature creation time and report the status at the time of the signature creation.

9. Show the result of signed document access which was created using a valid certificate which is now expired. The system should report a valid signature and certificate as of the signature creation time.

If you need help preparing such a document or any other issues related to digital signature usage and/or technology, please feel free to contact me.