Lesson 7: Key Decision 1 - Type of Credential Used (continued)
For example, consider the following two types of credentials:
- Shared secrets in the form of PINs or passwords
- Certificates associated with private-public key pairs that are used to execute digital signatures
Example Solutions | Solution A PINs or Passwords |
Solution B Private-Public Key Pairs |
---|---|---|
Issuing Credential | Requires Secure Socket Layer (SSL), Transport Layer Security (TLS) or another technology during setup to protect them as they travel between registrant and system. | The private key—which is used to execute the signatures—can be generated at the user's work station, so may not need to travel between registrant and system. |
Binding Signature to Document Content | Execution of a PIN- or password-based signature does not bind it to the document signed, so the system must provide additional functionality to provide for signature binding. | The digital signature executed with the private key is bound to the document signed because the signature is just the hash value of the document content encrypted with the private key. |
Signature Validation | Can rely wholly on internal system records of PINs or passwords registered or issued by the system. | Where the certificate associated with the key pair is issued by a third party—for example, where this is a PKI certificate—then validation requires interaction with the issuing authority to determine that the certificate is valid. |
Including Signatures in Copies of Record | Signatures consisting of the PIN or password "in the clear" need "shielding" on the CORs—for example by being encrypted or hashed—so that PINs and passwords are not compromised by providing access to the CORs. | Access to a digital signature on a COR does not raise any issues of credential compromise because a digital signature does not include and provides no way to derive the private key needed to execute it. |