Verification of-email signatures gains ground via new key system

The ability to use electronic forms of communication such as e-mail and to manage documents on computers raises numerous security issues. How do you guarantee that an e-mail comes from the person who appears to have signed it?

How do you ensure a computer-held document - say, a contract - hasn't been altered by a third party? And why should one country recognise another's system for securing such information?

In the 1990s, experts offered several solutions for these challenges, but the one that gained widespread acceptance is a complicated system known as public key infrastructure. This infrastructure is a blend of software, encryption technologies, and services that allow businesses and individuals to secure their communications and business transactions on the internet.

This global system depends on the worldwide use of mathematically-generated "keys" that can encode and decode information, at the same time creating a unique "electronic signature" for the sender. A "digital certificate" is issued with a person's key, and guarantees to the recipient that a person using a key is who they say they are. The certificates in turn are issued and managed by an international network of "certification authorities", of which An Post is one here.

The key system thus guarantees the identity of each party in a digital transaction, and those identities are further verified by the digital certificates. The system also supports "non-repudiation" - meaning a party to a transaction cannot later say they weren't part of the transaction. This is an important legal guarantee for online agreements, from an internet purchase to a contract. Increasingly non-repudiation will be useful in court as proof that a given person sent an e-mail or other electronic document used in evidence.

Baltimore bet early on public key infrastructure and produces a range of these products, a decision that helped guarantee its initial success.