Selected problems of the e-signature law and of its implementation Doc. RNDr. Daniel Olejár, CSc. Department of computer science Comenius University, Bratislava

Background and history of Slovak e-signature law (1) The changes induced by use of information and communication technologies (ICT) serious obstacle - lack of trust caused by security problems: how to guarantee the integrity and authenticity of messages cryptographic solutions: digital signatures based on one- way hash functions and asymmetric ciphers e-commerce: international character, the national solutions must be mutually compatible EU - Directive 1999/93/EC on a Community framework for electronic signatures

Background and history of Slovak e-signature law (2) Ministry of economy is preparing Slovak e-signature law since 1999 and produced numerous versions of the law the governmental proposals were repeatedly returned by Legislative council the slowly evolving e-commerce needs the law An expert group was created in the end of 2000 under Slovak computer science society. This group prepared another e-signature law, which was submitted to the Parliament as a deputy proposal Governmental proposal of e-signature law was not completed yet

Key problems of e-signature law (1) Creating e-signature law we compared many national laws, model law of UNCITRAL and international standards though they differ, they must address some basic problems. The difference between governmental and deputy proposals can be demonstrated especially on these basic problems: the approach how to write the law: up to down or down to up the philosophy of the law (Directive of EU or a model law of UNCITRAL or another national law) technological neutrality vs. practical solutions (electronic signature implemented by digital signature)

Key problems of e-signature law (2) Scope of the law (open or closed systems) levels of e-signatures and certificates (ordinary and advanced e-signatures, ordinary and qualified certificates) electronic signatures of legal persons and CA PKI architecture hierarchical tree or a mesh? Cryptographic key management –generation of cryptographic keys for clients, –client’s key protection, – key escrow –key ageing

Key problems of e-signature law (3) Role of state in building PKI - the State electronic signature bureau Security problems: –protection of cryptographic keys (cryptographic key management in CA) –availability of archived data –secure storage of clients private (signing) key –during creating an e-signature use of private key in plaintext form do you know what are you signing?

Conclusions The idea of electronic signature is relatively simple. The implementation of cryptographic solutions causes lot of problems of legislative, technological, cryptological, information security, organisational and other character. We discussed some of problems we considered most important to write a practically apply-able law. More information