Digital signature technology has firmly established itself in IT systems. It is used in key system components; its absence would essentially make the operation of secure communication protocols impossible. This, in turn, would paralyze a number of key areas of data exchange – including parts of banking IT systems. While the digital signature embedded in protocols is widely used, its application at the highest levels of communication protocols in a way visible to the user is not widespread and encounters a number of fundamental difficulties. These result not from a lack of technological capabilities, but from a misunderstanding of their nature, from erroneous economic assumptions, and finally from the lack of a favorable legal environment. At the stage of the wave of legislative initiatives, including those in Poland, the focus was on regulating the area related to the field of activity of natural persons. Applications regarding the activities of business entities and public entities were to be handled through actions performed by natural persons. The experience of recent years indicates that this approach turned out to be a mistake – the widespread use of electronic signatures initiated by private individuals did not occur.
Lobbying for electronic signatures
Analyzing the emerging legal acts, one can notice a strong tendency to introduce the obligation to use a secure electronic signature based on a qualified certificate. The amendment of regulations concerning the Social Insurance Institution (ZUS) turns out to be particularly interesting. The currently functioning system for authenticating communication between the payer and ZUS is based on digital signature technology. Both a classic digital signature (RSA) and a standard encoding method were used here. The private key protection system was designed in accordance with the risk assessment – the key is protected in a manner adequate to the level of protection of data transmitted by the payer – without the use of special hardware devices. Public key authentication was based on standard X.509 technology – de facto the only one at the time the system was created.
The article comes from the magazine “e-Fakty” 5/2006.