We are pleased to introduce Manuel José Lucena López as a new guest blogger in September. Manuel is a PhD in Information Technology from Jaén University (Spain), a recognized expert in cryptography and a regular collaborator in Kriptópolis. His book Criptografía y Seguridad en Computadores (a free electronic book under the Creative Commons license) is a classic in Spain, a reference book used in dozens of universities by thousands of students who take their first steps in this circle.

Manuel banked on Negonation from the start. In fact, he is one of the first negonators. In 2004, when the project was merely an abstract heap of ideas, we would meet on the first Saturday of each month in Madrid in a room given to us by the people at Biblioteca de las Indias Electrónicas. The collaborators came from all over Spain; Manuel came from Jaén each Saturday after a long train ride. Manuel now works in the X.509 certificate validation algorithm of our Validation Authority. A detailed mathematical task which suits him to a tee and whose result will be made into free software.

Without further ado, maestro, welcome to the blog. Post no. 50 is all yours…

Anyone who’s been to London will immediately recognize the famous warning sign in the underground stations whose aim is to remind us to mind the gap between the platform and wagons. In IT, there is something very similar: we have to manage in various planes and consider the gaps between them.

Every time we want to solve a problem using computers, we necessarily have to move in three different universes, each one with its own rules: firstly, there is the real world, the everyday world, which is where the problem usually arises; secondly, but no less important, is the abstract world, where the mathematical formalisms (usually algorithms) that help to build the necessary software lie; and finally, there is the world of electrons, cables, bits, memories, buses and other electronic components of the computer itself, which provides support to the algorithms while helping create representations of the problems and their corresponding solutions that are readable in the real world. For example, it is no use designing a very beautiful algorithm that is mathematically elegant and impeccable if the physical support where it must run – the computer – is unable to execute it in a practical way.

The digital signature is one of those applications in which those three planes interact in a more fascinating way and where, at the same time, the “gaps” between each plane are more evident. This would explain many of the difficulties experienced by several digital signature applications when reaching the general public.

When people sign a document in the traditional way, they produce a mark as a result of the interaction between the pen or fountain pen and the paper, and which responds to the biomechanical characteristics of their arm. Those characteristics can be analyzed by a graphologist in order to detect a forgery. But don’t let us fool ourselves: a signature can be forged. The thing is we know that the probability of achieving this is low, and we have learnt to accept that risk (like so many others), so we sleep at night without too many problems.

A digital signature has to be analyzed using the aforementioned three planes. In the mathematical plane, we can say that we have techniques that provide an extraordinarily high security level, so the risks at this level are practically zero. However, it gets complicated (very much so) if we want to build a “real” solution for the real world. In fact, when I digitally sign a document, in reality it is the computer that is making the calculations, and my role is limited to contributing some kind of proof (password, device, etc.) to accredit my identity. And the process of providing that proof, from the time it comes from me to the moment it is reflected in the appropriate sequence of bits inside the computer’s memory, can become a real minefield. Going through it in an absolutely secure way is practically impossible but I am convinced that, if done appropriately, the risks can be reduced to considerably lower levels than those present in the traditional signature.

The Tractis project has shown me the enormous importance of correctly minding all the gaps between the digital signature from a mathematical standpoint and the digital signature as an application for real world users. After listening to the team’s members, I realize the complexity of making things simple and useful for people. I don’t know if this adventure will be successful but I can safely say that, in pure Hollywood style, if anyone can achieve it, it is them.

Julian Inza debuts as one of our first guest bloggers. Julian is a recognized expert in digital signatures and security. He has an impressive CV which can be summarized as “he invented the digital signature sector in Spain”. In 1995, he designed Spain’s first Certification Authority and, subsequently, he’s been involved in nearly all the others (Banesto, FESTE, Camerfirma, etc.) directly or as an adviser. He was Senior Vicepresident of Mobipay International and a pioneer in nearly all electronic banking initiatives (virtual banking, virtual TPV, WAP banking, cyberstore [GPL license], SET Fácil, pre-paid virtual cards, etc.).

He is currently the General Manager of Albalia Interactiva, Coordinator of Foro de Evidencias Electrónicas and a Professor at Instituto de Empresa. He has his own blog, “Todo es electrónico,” and he likes Ska.

It’s been great working with him and with Fernando Pino of Albalia. It’s hard to imagine other people with more knowledge about digital signatures and, at the same time, who want to learn new things.

The 1999/93/EC Directive on Electronic Signatures states that, in the last 7 years, an electronic signature with certain requirements is equal to a handwritten signature but that, without those requirements, it also has legal effects.

Until now, all the systems implementation that accepted electronic signatures, especially those using transnational software, such as the Tax Authorities or any telematic registers of the Public Authorities, limited (illegally) the certificates that could be used in the electronic signatures to those issued by a few Certification Service Providers. That is to say, in addition to the few situations where digital signatures can be used, they are badly implemented.

I am proud to announce that Tractis is ending that situation and, to some extent, thanks to Fernando Pino and yours truly. Thanks to David Blanco for his confidence in Albalia Interactiva and the fact that he has enabled us to develop our ideas of what a correct electronic signature implementation should be like in this project.

Although ease of use is one of the Project’s essential factors, what is actually concealed is an infrastructure that implements concepts such as ES-C “Complete Signatures” that are defined in the TS 101 903 standard and automatic recognition of Certification Service Providers with total guarantee.

It’s not a trivial challenge. The European Commission’s Information Society Thematic Portal publishes the information to which article 11 of the Directive refers. According to that article, member States must indicate how to find all the Certification Service Providers that operate in their sphere. Until two months ago, Spanish data were not available, even though the Spanish Ministry of Industry, Tourism and Trade posted on its web site a list of CSPs which had notified their data, in accordance with Electronic Signature Law 50/2003.

Therefore, at this moment, Tractis is the solution in any category, accepted by more certification authorities, without being detrimental to the security level required of an information society’s service provider of this type. Moreover, the system is flexible and enables new providers to enter easily. It can even be extended to provide support to PGP-based firms if the parties recognize themselves in this identification mode, although this may not be the best consideration from a legal standpoint.

Including time information and validation in electronic signatures creates long-term digital proof which will be welcomed by users if they have to exercise their rights with Tractis’ trustworthy third-party services a long time after the signature of the contract and even in conventional disputes.

I can’t hide the fact that I’m proud to present the baby right now when the parents are about to give birth to it officially, at which time I will join the other “people in labor” at Negonation, wishing this innovating family all the best in raising their computer offspring.

Something similar happened at Yahoo!: the original idea was more or less to help people locate sites on an increasingly larger web by developing a catalog. Pursuing that ideal made Yahoo! what it is today: a very profitable company which, in fact, has a very small catalog left. The same can be said of eBay, Skype and even Napster: the initial idea was to solve a problem, meet a need, create a platform, etc. When business came, if it did, it came afterwards. They are companies that created developments which benefited many other people and companies in their activities, businesses and pleasure – veritable creators of ecosystems generated around an ideal.
Give me a starting point, an idea and an adequate development and, with the right combination of factors, the result is the development, as an unpredictable fractal architecture, of an entire superstructure of delicate interrelations, crystals and lines of varied forms and structures, i.e. an ecosystem around an ideal. I’m not going to be as mad or as presumptuous as to compare Tractis with eBay, Google, Yahoo!, Skype or Napster, whether in terms of the type of project, the nature of the ideal and, especially, in terms of its dimension. From what I can see here, what has led me to collaborate enthusiastically is that same essence, the aroma of a project focused on ideals, but with the capacity to execute that you recognize in the people with whom you have often spoken. All you have to do is read this blog’s first post to see that this project is superb. Can a platform that generates value to many other people and businesses also be a good deal, like a fractal organized around its original crystal? If so, all the better, wonderful. Citing the ineffable Mike Wazowski, of Monsters, Inc., “apart from achieving it, we will have laughed a lot”.

Good luck!