SHA-1 is considered insecure while the EU pretends to legislate "advanced" e-signatures

Google announced that it is updating its Chrome browser to display warnings on web sites that use HTTPS (SSL/TLS) backed by a digital certificate signed with SHA-1.  In Why Google is Hurring the Web to Kill SHA-1, Eric Mill gives many reasons why Google is pushing ahead of schedule to rid the web of SSL certs that are considered less secure because they are signed by a Certificate Authority (CA) using SHA-1.

While it's true that SHA-1 is approaching the end of its useful life, it's stubbornly present in many systems and applications.  Getting rid of it isn't easy.  But we have to start sometime!

Of course, creating useful collisions in SHA-1 is still mostly an uncertain game.  We have not heard of any actual SHA-1 collisions that are useful.  "Useful" is a key consideration in that creating a second set of data the hashes to the same SHA-1 hash as some "real" document is hard enough, but doing so in which that second data is a meaningful replacement for the first is even harder.  If a collision could change "$100" to "$200," you'd have a real problem (of course this is just a short text example to illustrate the point, not a real scenario).  But if "x4z]" ended up hashing to the same as "$100", it would be less interesting because the replacement is not meaningful and thus would not be a realistic spoof.

While the Google announcement surrounds SSL certificates, digital signatures for e-signatures are likely a bigger problem.  SSL certificates tend to be renewed every 1 to 3 years, so they do not last very long, and most new certificates issued will use SHA-2 instead of SHA-1.

Digital signatures on documents tend to be "forever."  They do not expire.  While the user's signing keys may change from time to time, once a digital signature is applied to a document, it remains that way going forward.  Since most e-sign vendors use SHA-1 in their digital signatures (aside from the few odd players that don't appear to use any digital signatures at all like Sertifi and AssureSign), all documents being signed may be forged in the future.  Fortunately, most documents become somewhat obsolete after years go by (that is, few want to forge a 5-year sales agreement for example).

In the EU, they promote word play like "advanced" and "qualified" for electronic signatures based on digital signatures created using a typical PKI in which the signer has been issued a digital certificate (no doubt signed with SHA-1!) for a private key the user keeps secure.  This sounds good, but of course has serious flaws:

1. Users cannot deny an electronic signature created using their "advanced/qualified" signature. The EU law says these are guaranteed to be valid.  No wet signature ever had such an absurd notion attached to it; that's why we have courts to decide based on evidence.
2. Users may in fact not keep their private keys secure. Users are famous for being unable to keep such stuff secure because they really have no idea what their encryption keys are or how exploits can take place.  Every virus and hack attack is a potential theft of a user's encryption keys.
3. All encryption requires software and hardware, and all software and hardware is vulnerable to attack. Thus, your keystore can be hacked. The device the key is stored on can be hacked. The device (like a PC, phone or tablet) the key is used on can be hacked.  Any network connections involved can be hacked. As the various credit card hacks have shown, devices can be hacked, replaced or have another device put in the middle of the communications cable (or wireless).
4. The user may forget the password related to securing their private key. While this would prevent future signing, it could also mean that all data encrypted for storage would no longer be accessible.  There will be millions of users who will lose a lot of their data because it's encrypted using a key they no longer have access to.
5. Users can be tricked into using their keys insecurely, including phishing attacks and social engineering attacks.
6. What happens to all digitally signed documents done between the loss of control of a user's keys and detection that the keys were lost?  A user can revoke his keys, but only once he knows something has gone wrong.  But that user will not know what, if anything, was ever forged.
7. How can a user know where his forged credentials are being used?  Cannot!
8. Once a digital signature is applied by a user, that document will remain secure only for as long as the digital signature is valid. If the digital signature uses SHA-1, that may only be a few years away.

With services like Yozons Open eSignForms, many of these issues do not exist. When a credit card number and information is stolen, a user eventually finds out because invalid charges appear on his or her statement.  The credit card company can go back and find all fraudulent charges and reverse them.  Something similar happens when using an e-signature service -- the only signed documents you have can be found in the service.  Any fraudulently signed documents can be discovered and invalidated.  There is recourse to such a loss that is guaranteed to happen frequently across a large pool of users.

Documents digitally signed using Yozons Open eSignForms employ a 4096-bit RSA keypair with SHA-512.  This is not the norm among esign vendors who generally use much less secure technologies (including those absolutely worthless vendors/products that don't digitally sign at all).  While the greater security provided by Yozons is powerful today, eventually it will no longer be considered secure just like SHA-1's fate today and MD5 before.

Unlike "advanced" e-signatures created by users for themselves, a service can ensure documents are secure going into the distant future.  For example, if a digitally signed document in Yozons previously used 1024-bit RSA with SHA-1 (a very typical scenario still in practice today), our technology could easily retrieve that document, ensure the older digital signature is still valid, and if so, then re-digitally sign the document using 4096-bit RSA with SHA-512.  Such a document can remain secure for as long as necessary.

It is time for SHA-1 to be retired.  Yozons has updated all of its server SSL certificates to ensure they are protected with SHA-2.  But what about all those web sites and users who do this for themselves?  They most likely will not be on top of security issues like this, and that's the very problem we solve for our customers and their users.

Shared web services can cost your business

One of the great things about the Internet and the advent of web services (shared software as a service or SaaS) is the ability for businesses to jump into new technologies with relatively low barriers for entry.

For many large enterprises, deploying and managing hardware servers inside a data center for new services desired by a particular department is a death sentence for the project.  The teams are understaffed and overwhelmed supporting the myriad systems already deployed.  There is no operational expertise in-house for the new services.  For small companies, such deployments are often cost prohibitive because they lack the technical skills and resources to make it a success.

Purchasing web services has solved these problems very well.  Departments in enterprises and small businesses can essentially rent time on a large shared service, often paying for resources consumed (transactional) or users per month (subscription).  The cost of entry is low, and deployment tends to be quick.  It's a real benefit.

However, when the service offered is a core competency, using third party services is often undesirable and more costly than the price tag may suggest.  Web contracting and electronic signature services fit this bill for many companies.  Most companies realize that it is a trap to store key documents and contracts and allow customer interactions to be performed by a third-party vendor.  Of course, those service providers that offer "free tiers" tend to be the worst.  Instead of monetizing their purported service, you, their customer, is the actual product and they monetize you and your interactions with your customers instead.

With Yozons Open eSignForms, you have ultimate flexibility and complete brand control.  Each customer deployment is always an independent system: independent database and independent web application.  Even our lowest cost "shared hosting" only shares the physical server, but each customer running on that hardware has its own independent web application and database, keeping its users away from those of all other customers we service. 

Most SaaS vendors put millions of unrelated customers into a single huge system.  This makes migration away much harder, and of course creates a huge target for hackers who boast about big exploits and cause millions of user records to be stolen and sold on the black market.

Over time, the cost of paying a vendor to handle your contracting, your documents and the interactions with your customers, employees and business partners grows substantially.  Losing touch with your customers by using a third-party service is a cost few estimate correctly. 

Many companies initially jump on the SaaS bandwagon, giving them a leg up on the competition and providing services quickly at a low cost of entry.  But these companies ultimately ditch those early efforts and deploy their own services, which turns out to be more profitable for them and allows them to control their customer relationships and control their important business documents.

With Yozons Open eSignForms, you can easily migrate from shared hosting, but with fully independent customer systems, to private hosting, to bringing it all in-house.  You maintain full control over your independent system no matter how it's deployed, and that flexibility is what motivates companies to eventually abandon their forays into shared SaaS and instead take care of their own business themselves.

Have Internet, will travel

As I write this blog, sipping a cool rosé wine just outside of Walla Walla on an impressive compound once owned by a cell phone magnate, I cannot help but think how wonderful it is to have a job that allows me to work anywhere in the world almost as easily as when I'm home.

With a laptop, my new Asus second full HD monitor that is not any thicker than an iPad, and seemingly ubiquitous fast Internet/WiFi, working on the road is both comfortable, productive and liberating.

Summertime in Walla Walla is hot, in the 90s today, but all of the wineries and tasting rooms make you forget about the ever present sun beating down on your head.  This is a special place, so close to the Oregon border, but with rivers and mountains (mostly high hills for those who live near the Cascades and Olympics around Seattle), you almost forget that most of the land is flat and dry.  Walla Walla is home to their namesake sweet onion, but wineries have taken over.  You can't take a step without coming across another winery's tasting room.

I drove south today to see where the grapes are grown, and the vineyards are impressive.  It seems this has been a good summer and will yield a bumper crop.  The grapes are smaller compared to those we snack on, but they pack a powerful punch in the hands of talented vintners.  Amazingly, I've not tasted a "bad" wine, with whites, rosés and reds all in great form. 

It's a real shame that this part of my trip was marred by the tragic news of the earthquake in Napa that did considerable damage, including the oddity of seeing red wine flowing freely -- sadly down the gutters -- the result of broken barrels that tumbled.  The losses to Napa businesses and families is felt here in Walla Walla, showing that competition doesn't have to trump compassion.

Physical therapy is hard work made easier with secure online records

One of our earliest customers on Open eSignForms is a physical therapy office run by a woman and her small team of PTs.  She has studied myriad forms of physical therapy and massage, including quite a bit of advanced training in Kauai.  Nothing like a business need to study for three weeks on the garden isle!

One of the biggest pains for PTs is the need for accurate record keeping, especially when needed for audits by insurance companies and other legal proceedings as some of her customers were hurt in accidents that resulted in seeking her care. 

With Open eSignForms, she and her staff are able to record their findings on their Physical Therapy Initial Evaluation form, recording the patient's information, type of injury, current health condition, symptoms, medications and to note how well the patient is able to perform various activities.  They can also create PT Treatment Notes that correspond with insurance billing codes, as well as Progress Notes to record changes in patient's health and functional activities as well as to record impressions and treatment plans. Lastly, they can enter their Discharge Summary Note to track the various activities their patients were seeking treatment for, recording their goal at initial evaluation, and then recording their status at the time of discharge.

With these secure patient records maintained in her own independent system, there is no lost paperwork, access is restricted to authorized personnel, and all records can be reviewed even while traveling on business, or when in Kauai for more training!

Patents and the small business inventor

Patents are often described as as useful tool for small inventors and businesses to protect their intellectual property.  While not limited to small players, this is true, but only to a point and at a price.

Competitors with patents that may or may not apply to you can sue you over infringement. The cost of defending patent lawsuits is high and time consuming.  In our case, before our own patent application was approved, we were sued for infringement by a competitor who came to market years after us.  Even though it seemed obvious to us that the patent did not apply, the legal language of patent claims were challenging and imprecise.

Patent claims are legal claims, not technical specifications, and the patent itself describes a "preferred embodiment," so many other implementations that differ from the details of the patent, but provide similar functionality, are likely covered under the legal rule called the doctrine of equivalents.  The advice of a neighbor, who is an IP attorney for a large software company, was to settle.  While he said it might be distasteful, defending against infringement claims can be tricky, seemingly fickle, and surely will be expensive.  Winning may by pyrrhic victory at best, or a crippling loss at worst.  The suing company tends to have more time and money than small inventors running small businesses.  We've read of defenses costing $500,000 to $1 million, and can be $100,000 just to reach a settlement.  Our decision, bitter as it was, was to settle after spending what we'd consider two years of our own salary on lawyers and expert witnesses, and spending hours gathering documents and specifications and revenue numbers that had to be turned over during discovery.  Had the suing company offered us the terms we eventually settled on from the start, we'd have negotiated a license long before spending any money on lawyers and going through the hassles of discovery, preparing patent claims responses, etc.  But we were never afforded that courtesy, presumably because they just wanted to put us out of business with a lethal, legal blow.  We survived, but much less money and lots of wasted time and energy.

The cost of acquiring your own patent can be high, and often can take a long time.  The Yozons '079 patent took 6 years before it was awarded and issued.  Legal fees tend to mount as time seems to work to the advantage of lawyers more than inventors.  And you will need lawyers.  Remember that you will need to devote a lot of your own time and energy to acquire your patent as your lawyers will need a lot of information from you so they can understand it in detail.  Also, you'll need to be sure to keep up on the various maintenance fees the patent office requires after issuing your patent, though it's not clear how the USPTO is maintaining anything on your behalf.  It seems that you, the small inventor, are maintaining the patent office instead.

Even after you earn your patent, unexpected expenses and issues can crop up.  In our case, an unknown law firm filed an ex parte reexamination request, challenging the validity of our patent, even though we hadn't ever attempted to enforce our rights on anybody. For a big corporation, this may be business as usual, but for a small business, you will find it takes a lot more time to read other patents and help your lawyers defend your invention, the one you thought you already had and earned when the USPTO granted it.  Of course ever more legal fees will apply.

We were fortunate that our patent is strong, and we survived with all of our legal claims intact, without any modifications.  But we did spend a lot of time and money that could have been better used to run our business and pay salaries.  On a happier note, that big competitor who sued us years before for patent infringement was itself a target of a similar ex parte reexamination from the same firm that challenged ours.  In their case, it didn't turn out well as their patent was gutted, leaving only the final dependent claim that nobody likely infringed (including their own technology!).

But having a patent is not the same as being protected by the patent.  The USPTO won't help you defend what you might assume it asserted when it issued your patent in the first place, that your patent and legal claims are valid. That's left to you to do.

You can, of course, request that competitors and others who make, use or sell your invention acquire a license to your patent, or that they should cease doing whatever it is that infringes.  But that's easier asked than done.  If you are a small inventor, most likely they will simply say they do not infringe.  Some will not even respond at all.  They probably won't give you any details on why they don't infringe, even if you provide details on why you think they do.  They know that your bark is likely worse than your bite because defending your patent means more lawyers, and that means more time and money when you'd likely prefer to run your business to feed your family, pay your workers and serve your customers.

If you have a good idea, getting a patent is probably a wise move.  But remember that you need to expect to spend a lot of your time and your money acquiring, keeping and defending your patent.

Having a patent doesn't mean a thing if you cannot defend it, and most small inventors are up against better funded corporations that will use the legal system to their advantage, to dissuade you from moving forward because you fear you cannot afford the legal costs of securing your rights.  Others will use their patent portfolio against you, suggesting you may infringe any of a number of their patents even though they would never have suggested infringement if you didn't attempt to defend your own against them.

The patent system is flawed and doesn't serve the small inventor as much as you might think, but it really is your best hope in defending yourself from competitors who otherwise will make use of your invention, challenging you to an expensive legal fight.  When you are in a position to be up to that challenge, we wish all small inventors the best of luck.  Yozons is only now in a position to begin to defend its patent with the help of a law firm that believes enough in the strength of our case to partner with us.  Wish us luck!

Going Postal Prevented: Multi-deployments for an international corporation

The term "going postal" may have bad connotations, but for our S&P 500 customer, the post office has provided a huge opportunity that has spanned many decades and has led to myriad related products, services and software solutions.

Yozons has developed and deployed more than a handful of enterprise web applications for this customer, including divisions in the United States, Canada and Europe.  The web deployments are distinct geographically and by type of web contracting that takes place, mirroring the specialized divisions and needs of this international company.

They also have deployed our patented e-signature software on our managed private web server offering, complete with a warm standby operating in another state, freeing up their internal IT resources.  The private web server gives them the advantage of complete branding using their domain name and SSL certificate, custom secured FTP access to their back-end systems, as well as isolation of their data from our many other customers.  Furthermore, Yozons provides 24x7x365 monitoring and daily encrypted off-site storage of backups.
 
Several of their web applications involve multiple forms in a package, with a multi-step process involving their customers who sign the agreements, as well as outside third-parties who approve and authorize their customers’ applications. Reports keep them current on the status at all times.

Though Yozons generally discourages printing documents, signing and then faxing or mailing them back, a couple of deployments had this requirement as an option.  Regardless, Yozons delivered on time and within budget.  Yozons built into the web contracting process a fax processing step so that returned signed agreements can be uploaded, annotated and stored with the electronic version.  Having this feature ensures all agreement packages signed online and on paper are kept in the single encrypted repository with powerful search capabilities to find their agreements.

Web-based e-signature vendor acquires patent license

Yozons recently signed yet another licensee to the Yozons '079 patent. We expect more to come as vendors realize the reach of our patent's web-based, secure document delivery and optional electronic signature system and method, and support and acknowledge how Yozons has changed the landscape from a user-controlled PKI-based signature model to a lighter-weight server-controlled signature model.

This U.S.-based competitor develops and operates various web and mobile apps, and negotiated a patent license that fits their particular needs and ensures their thousands of daily clients are protected when using their online document signature service.

While the negotiations lasted over a month, we applaud the decision they reached after discussing the details with their attorney.  Because they were quick to understand the depth of our patent and how it applied to their technology, we were able to negotiate favorable terms.  Yozons prefers to have competitors so long as we are compensated for our invention that has created a healthy marketplace for web-based document processing services throughout the United States.

Their e-signatures service is typical of competitors who make use of our patent's teachings:

1. Documents are stored online in a centralized server.
2. Documents are transferred between parties securely, typically over HTTPS, in order to effect secure document delivery that ensures the privacy of the business communications.  HTTPS makes use of a traditional PKI in which the browser uses the web server's SSL digital certificate to establish a secure link using the web server's asymmetric public key, and then generates a unique symmetric encryption key that's shared only between the user and the server for the purpose of encrypting the document and related data transferred over that link. But the key is that previously, end-users created and exchanged their own keys, as well as performed their own encryption and digital signatures.
3. The entire process makes use of a web application, giving them the ability to communicate and e-sign with a myriad of devices connected over the Internet, including PCs, start phones and tablets.
4. The e-signing ceremony typically involves typing their name, drawing their signature or clicking in the relevant areas to indicate their agreement.
5. Typical routing of documents is handled using the e-mail address of the parties involved, generally sending a unique ID that links the user to the correct document and party in the online process.  Some users, typically customers of the service, authenticate using traditional username and password, and can initiate transactions, track them, download completed agreements, etc.
6. Users can add their electronic signatures quickly and easily, without requiring special client-side software, digital certificates, and/or key management.
7. The server provide an audit trail including IP addresses and timestamps.

A quick overview of the general breadth of the Yozons '079 patent, which has been practiced by Yozons since 2001, can be found in its FIELD OF INVENTION:

In general, the present application relates to computer software, hardware and communication networks, and in particular, to a system and method for securely processing digital documents, including appending digital signatures, without requiring pre-established individual identity verification, digital certificates, end-user cryptography, key management or key exchange.