Is Europe’s Experience in E-Signatures and Digital IDs Valuable for Australia?

Europe has been running a legislative framework for electronic signatures and digital identities since 1999. In 2014, the European Parliament introduced a significant upgrade by presenting electronic identification and trust services for electronic transactions in the internal market, or eIDAS, regulation.

In light of recent initiatives in Australia to improve legislation for doing business remotely, this experience is valuable because the European community was among the first in the world to introduce electronic signatures, and it developed a unique legal and technological framework that many other countries borrowed.

Though the experience is full of pitfalls and drawbacks, which are also valuable to consider. It also has a significant gap in the use of blockchains and addressing the issue of the legal validity of blockchain transactions, including smart contracts.

Bullet points:

• eIDAS distinguishes three levels of electronic signatures depending on the credibility of the technology.
• “Electronic signature” is a legislative notion, while “digital signature” is the technology underneath the first two levels of electronic signatures.
• Digital signature means the use of public key cryptography, also known as asymmetric cryptography.
• eIDAS’s Public Key Infrastructure is based on a system of trusted third parties. Trust Service Providers, known as TSPs, are independent certified market players that provide customers with electronic signatures/digital identities.
• QES: a qualified electronic signature is a nonrepudiable signature, meaning that the signatory cannot deny that they are the originator of such a signature. It is ensured by two-factor/multifactor authentication and the use of cryptographic devices.
• Before eIDAS regulation, the EU market suffered from interoperability issues. TSPs did not cooperate and limited the use of their services to keep customers within their technological frameworks.
• eIDAS is highly centralized.
• eIDAS is highly standardized.
• Digital certificates, or digital identity records, are stored on third-party servers; therefore, they are not under users’ control. Services are at risk of distributed denial-of-service and man-in-the-middle attacks.
• TSPs do not utilize the advantages of blockchain technology.
• There is a gap of TSP services on blockchain. Blockchain private keys have no QES status. Therefore, their legal applicability is significantly limited.

Let us drill down to details.

We must separate the notion of an electronic and digital signature. The first one is the most general concept. It means any type of e-signature, including a digital one. A person’s name under an email and a scan of a handwritten, hardcopy signature are kinds of electronic signatures. They ensure the lowest level of credibility though, as they can be easily faked.

The digital signature is a cryptographic function based on public key, or asymmetric, cryptography.

An asymmetric pair consists of a user’s private key and their public key. The private key is used to encrypt messages. Let us agree that throughout this article a “message” means anything that the user wants to sign, such as a contract, email, media file, blockchain transaction, checksum, etc. The public key is used to decrypt a user’s message. Private and public keys are mathematically connected.

If Alice encrypted a message and sent it to Bob, Bob can decrypt it using Alice’s public key. Another’s public key will not decrypt it. So, he can be sure that Alice’s private key signed it. Therefore, a private key is used to create digital signatures for messages. The user will keep it private and safe. On the contrary, the user may want to share the public key among counterparties or even the general public. Hence, we can consider the public key as a digital identity.

However, pure public key cryptography is hard to use practically in the real world. If Charley stole Alice’s private key and signed the message, Bob would think that Alice signed it. To address it, people use Public Key Infrastructure, known as PKI, where trusted third parties play a crucial role.

Alice first will ask Dave, who is a certificate authority, to verify her identity. Dave will include Alice’s public key in the file and mark it valid. It is called a certificate. Dave will store it on his server, and each time anyone makes inquiries about Alice’s digital identity, the server will respond that Alice’s public key is valid. But if Alice lost her key, she would ask Dave to mark it invalid. Therefore, even if Charley stole Alice’s private key, when Bob verifies the message through Dave’s server, he would know that it was invalid by the moment when it was signed.

There is also a Timestamping Authority in PKI. This is another third-party actor that provides timestamps for signatures. In this way we know when the signature took place.

In the European market, certificate authorities are called Trust Service Providers.

To ensure the credibility of a newly created digital identity, or public key certificate, Alice normally will visit Dave’s office and show her ID. Therefore, if Bob trusts Dave, he does not need to know and meet Alice in person. They can interact remotely.

eIDAS established three levels of electronic signatures depending on their credibility.

Qualified Electronic Signature: a nonreputable, highly secured scheme. Alice must store her private key on a special certified cryptographic device, such as a smart card, USB token, crypto wallet, etc. Nobody, not even Alice, can extract the private key from the device. The process of signing is performed within the device in protected software. Even if Alice loses it, nobody can use it because it also requires Alice’s secret PIN code. Also, at the moment of signing, a trust service provider, Dave, verifies Alice’s identity to make sure that the device and PIN are not stolen. For example, Alice will receive a text message with a secret code or will use other forms of two-factor or multifactor authentication. QES is used for undeniable legal actions, meaning that Alice will not be able to say that it was not her signature; she will have to prove that it was stolen.

Advanced Electronic Signature, or AES: In this scheme, it is accepted that the private key will not be stored on a secured device, though it still must be PIN and 2FA protected.

Other electronic signatures: eIDAS also recognizes technological neutrality and the right to use other types of signatures. Though in disputes, parties may deny their authorship. Technical expertise and evidence of authenticity might be needed to address this.

How will people know which TSP is to be trusted and which is compromised? There is a top-level private key that belongs to someone whom everybody trusts: the government. It announces one private key as a root record, which is used to sign lower-level certificates. Therefore, if the provider Dave loses control over his system, the government will mark his certificate invalid and reissue a new one.

As you see, this system is highly centralized. Alternatively, there is an unconventional system known as a web of trust. Users identify themselves by creating their lists of trusted public keys and roots. Though this approach has not become widespread, it is an officially recognized eIDAS/TSP scheme that is supported by various technical standards and security protocols, which makes the domain stable and predictable.

Why is this system convenient?

For example, Estonian e-Residency is nothing more than a smart card with a private key that can be used to sign transactions. Say Alice lives in Australia, and she visits the Estonian embassy and receives her smart card. In this case, the embassy plays the role of a TSP. Now, Alice can remotely register her Estonian company and do multiple legal actions online, including signing contracts.

The Australian legal framework does not recognize nonreputable signatures. Any technologies are equal and can be used as electronic signatures as long as they can ensure some level of certainty in “who signed what.”

Australian lawyers, based on the existing legislative uncertainty and precedents, recommend avoiding electronic signatures in the corporate sphere in favor of paper documents signed with wet-ink signatures, which does not sound like we are in the 21st century.

The Australian system is ad hoc. For example, in electronic land title deeds where legislators have defined specific regulations for electronic forms, Australians use a similar PKI system based on certificate authorities, though their keys are not reusable elsewhere.

People have to use different technologies and approaches in different cases, which may require managing multiple keys and passwords and supporting the validity of numerous digital identities. Inevitably, it leads to higher transaction costs.

If there was an overall, national PKI system recognized across public and commercial services, people could use one approach in various schemes.

Let’s say that if Alice could get her generally recognized private key, she would use it to register her company, register her car, pay taxes and fines, or even vote in elections. Nowadays, if Alice needs to apply for a certificate for working with children, she will go to a post office and pay $125 Australian dollars. The post office staff will check her ID and photograph her on their camera for one reason only: to verify her identity and tell the government agency that Alice is truly Alice so that the agency can issue the certificate. Something similar will happen with other public services. Whereas if Alice had one general digital identity, this transaction could cost just a few cents. It would involve neither post office nor agency labor at all due to full automation.

There was one significant flaw until 2016: TSPs were not obliged to interoperate with each other. If Alice got her key from Dave, and Bob received his key from Eve, Alice and Bob could not sign a contract. They must be either Dave’s or Eve’s clients.

eIDAS regulation addressed the issue of interoperability. For example, an Estonian smart card opens the doors to all EU member states’ markets.

With blockchain, cryptocurrency is attached to an address. The address is nothing more than a representation of a user’s public key. If Alice wants to spend her coins, she creates a transaction — which is technically a command for the blockchain node to spend these coins from one address in favor to another — and signs it using her private key.

At a more abstract level, blockchain itself is nothing more than a list of records:

• Alice sent five coins to Bob. Alice’s signature.
• Bob sent three coins to Charley. Bob’s signature.
• […]

This creates a few aspects to consider.

If we identify the address, it will become the user’s identity. The private key can be used to authenticate both blockchain transactions and other transactions off-chain because it is just a standard cryptographic key. To make it work together, there must be a developed PKI over the blockchain.

To develop a PKI, we can use blockchain itself to store the certificates. It will mitigate the risks of DDoS and man-in-the-middle attacks. What are these? Say Dave’s server is under a DDoS attack and therefore cannot respond to inquiries. So, when Bob receives a message, he cannot verify if Alice’s identity is valid or not. In a man-in-the-middle attack, Alice’s certificate is faked, meaning that when Bob checks the message, Dave’s server says that the message belongs to Alice while in reality it belongs to someone else.

All this can be addressed by storing certificates on-chain. Hence, counterfeiting will be impossible, and the blockchain will always be accessible for inquiries.

Of course, this is true unless a permissioned distributed ledger is used instead of blockchain. In this case, the credibility of the ledger relies on the authority — be it a single actor or a defined group of “validators” — that runs the ledger, which is equivalent to a centralized system.

Another advantage of the public ledger is that blockchain-based PKIs do not require a centralized Timestamping Authority. The blockchain stores transactions chronologically that cannot be altered. Blockchain is a kind of decentralized “timestamping machine.”

If Alice has her private key and recognized blockchain address, she will be able to perform legally binding transactions on the blockchain, such as execute smart contracts and insert legally important data, which by default will be considered as Know-Your-Customer checked.

To ensure the EU’s equivalent of QES, Alice will have to use a hardware cryptocurrency wallet, which protects her private key from theft.

Eventually, the main advantage of blockchains is that they play the role of a decentralized public infrastructure with append-only repositories and a native mechanism to authenticate transactions through public key cryptography.

To address the issue of one root of trust, communities may create their customized webs of trust on blockchains. By the way, this is probably the reason why the concept of a web of trust did not become mainstream before. There was no such public decentralized infrastructure as blockchain. Blockchain is that common pipeline, a spare environment where independent parties interact peer-to-peer without relying on someone’s will and authority.

The world is moving in the direction of digitizing the various spheres of our life. The unification of approaches to managing digital identities is the call to address issues of transaction speed and costs, extensive labor, convenience and usability of technologies, along with the issue of trust, assuming that blockchain is in use.

The views, thoughts and opinions expressed here are the author’s alone and do not necessarily reflect or represent the views and opinions of Cointelegraph.