THE QUEST FOR SIMPLICITY IN SECURITY: DIGITAL SIGNATURES MADE SIMPLE - Cyberwar-Netwar: Security in the Information Age - page 33

Chapter 2
THE QUEST FOR SIMPLICITY IN SECURITY: DIGITAL
SIGNATURES MADE SIMPLE
Dr. Gadi Aharoni
Algorithmic Research, 10 Nevatim Street, Kiryar Matalon, 49561 Petaca Tikva, Israel
Abstract: Digital Signatures is an important technology that allows documents and transactions to be signed and
sealed electronically in a way that preserves the data integrity of the document and provides absolute
proof of the identity of the signer. This technology facilitates the transition to complete paperless
environments and has been adopted by most legal systems around the world. But Digital Signature
systems present a serious practical problem when trying to deploy them for wide use. This problem is
centred on the question of how to handle the digital signature keys for a large community of users.
This presentation examines the problem of key management for Digital Signature systems and suggests
a solution, named CoSign, which automatically centrally manages all the keys and certificates
throughout their lifecycle. With such a solution the use of Digital Signatures becomes simple for
administrators to deploy, easy for users to use, and therefore practical to implement in the real world.
Key words: Digital Signatures, signature identity, signature keys, paperless environment
1. INTRODUCTION
I am from a company called AR which stands for Algorithmic Research. This
company has been in the data security business for more than 16 years and was
established by a couple of Ph.D students and Adi Shamil who is a very well-known
photographer. He is most well-known for being the S in the RSA algorithm. And the
company has been involved for the past 16 years in everything that has to do with
encryption.
Normally you encrypt because you want to keep information private. In this
presentation I will focus on digital signatures and authentication mechanisms. And as I
am sure you are aware, authentication means how I prove my identity when I am
connected to a certain system or to a certain computer.
There are various ways of achieving authentication. When we say authentication, we
normally mean strong cryptographic authentication. AR is in business mostly for
servicing the finance industry, mainly in Europe and the Far East. In Germany, a lot of
the finance industry including Deutsche Bank uses components of ours. In the Far East,
we are mostly in Singapore, Taiwan, Hong Kong and the Philippines. A good example is
Singapore. Singapore has 30 banks and each and every one of these 30 banks uses
components of ours, starting with DBS bank, the largest bank in Singapore, which uses a
number of our systems.
We also have systems in the non-financial world. I mention two here. One is a very
well-known French pay-TV company called Canal +. We developed for Canal + the
smart cards that are used in the setup box. We developed the first RSA smart card for
Canal + in 1989, starting the application in 1990. We have about 15 million of our smart
cards as part of the Canal + conditional access system today. Another very good
customer of ours is a US based company called EMC. It is a very large storage company,
selling large storage devices. We secure all access into those storage devices from the