Authentic Data Collection in an Untrustworthy Computer Environment

A central matter in e-commerce and e-government is digital contracting and signing. The processes to be supported are to ensure a trustable and provable sequence of acts between the parties concerned following legal rules in a fast and flexible manner. Complex infrastructures like PKIs have been established to cope this task. But still there is a big lack: creating signatures in an untrustworthy computer environment. In this paper the problem of using desktop computer systems with or without card readers for signing documents containing binding declarations of intends for legal transactions will be discussed. Starting with analysing the process of digital signing and its key issues, the representation will point out that today’s common way of having documents digitally signed can be compromised despite the usage of so called class 3 card readers with smart cards and certificates of trustworthy CAs. The weak points of the employed signing process will be rolled out and a method will be introduced that guarantees the authenticity of signed data. As practical solution of the method explained a mobile device implementation pattern is presented. Finally an outlook will be given how to arrange processes and systems in order to provide e-contracting services in a flexible and trustable way.