RE: [dss] client-side hashing

["Kaliski, Burt" <BKaliski@rsasecurity.com>]

> I see that there are two types of service.

I agree with the dichotomy.

> The other is a pure signing service where the server just
> returns a digital signature against a document.

Is there any interest in a blind signature service? In such a service, the
server would return a digital signature without ever seeing the hash. This
would prevent the server from subsequently "linking" the digital signature
with the user who requested it.

-- Burt

-----Original Message-----
From: Nick Pope [mailto:pope@secstan.com]
Sent: Wednesday, February 05, 2003 5:49 AM
To: Pieter Kasselman; jmessing@law-on-line.com; Trevor Perrin; Rich Salz
Cc: dss@lists.oasis-open.org
Subject: RE: [dss] client-side hashing


I see that there are two types of service.

A notarisation type of signing service where the trusted third party
examines the document to be signed and only signs if the document meets
certain requirements, and possibly archives the document on behalf of the
requestor.  The other is a pure signing service where the server just
returns a digital signature against a document.

In the second case I see no difference between the document or a hash of the
document being submitted.   In both cases if "birthday attacks" are
considered to be a risk, and there exist two documents with the same hash
value, assuming that the signature algorithms uses encrypted hashes, then
substitution can occur whether or not the hash is calculated at the client
or server.

Is the DSS concerned with what I refer to as a notarisation type service?
If so we need a use case.

Nick