text: Electronic Signatures & Electronic Invoices Anna Nordén TrustWeaver TrustWeaver • Swedish IT security product company • PKI-based product integrated in applications • Merges law and technology • Ensures security compliance • Current focus on electronic invoicing • About me • Worked with e-signatures since 1997 • UNCITRAL • International Chamber of Commerce (ICC) • TrustWeaver since start 2001 Presentation overview A. Electronic Signatures I PKI and Digital Signatures II What is an Electronic Signature? III Legal Aspects of Electronic Signatures IV The EU e-Signature Directive B. Electronic Invoices I PKI and Digital Signatures PKI Technlogy • Public key cryptography • Key pair, a private and a public key • What the private key encrypts, only the public key can decrypt and vice versa - clever, no need to exchange one secret key! • Encrypt a message digest using a private key = digital signature • Encrypt a session key using a public key = confidentiality Digital signatures allows you to... • know which private key sent a message (authentication) • know that the message has not been altered (integrity) • Effect: the person who sent the message cannot later deny this (non-repudiation) The Identification Issue • Excellent technology, but how do you know who the owner of the private key is? He says his name is Bill Gates... Certification Authority (CA) 1. Verifies the identity of the key holder 2. Issues a digital identity (certificate) linked to the key pair How do you know the value of a digital signature? Certificate request Certificate request Patric Sporrong Patric Sporrong Tekki AB Tekki AB Blond, blue eyes Blond, blue eyes Passport nr 1234567- Passport nr 8910 1234567-8910 PKI Players and Rules Rules in the policy-based PKI • Certificate Policy (CP) – what the CA should do • Certification Practice Statement (CPS) – how the CA fulfills CP requirements • Contract with certificate holder • Notification of (or contracts with) relying parties Who can be a CA? • 1995 – Vision of the Global CA • 2005 – Global CA vision is dead • Reality – different CA structures depending on situation • National CAs (Gov = CA) • Public CAs (e.g VeriSign = CA) • Customer base (e.g. Bank, Insurance comp. = CA) • Supplier network (e.g. Product Company = CA) • Some are open, many are closed Take aways • Policy-based PKI is an infrastructure including technical, legal and policy components that can be used for • Digital Signature, providing • integrity • authenticity • non-repudiation • Encryption, providing • confidentiality II What is an Electronic Signature? The "Signature" concept • "A mark to tie information to the person signing" • Authenticity • Integrity • Non-repudiation • Paper world – ink on paper (handwritten signature) • Electronic world – digital signature (based on PKI) • The term "electronic signature" used for methods to replace the handwritten signature The technical vs the legal concept •Digital Signature (PKI) is a security technology; meant to ensure integrity and authenticity •"Signature" is a (legal) concept from the paper world; meant to have legal effect, equal a handwritten signature The technical e-signature concept • Digital Signature (based on PKI technology) • A security technology meant to ensure • Authenticity (identity) • Integrity (data unchanged) • Non-repudiation (denial not possible) • PKI also used for encryption • Confidentiality (data kept private) => Technical definition The legal e-signature notion •Technology-neutral term signifying all methods to legally sign (although definition varies between laws) •Aims to replace the handwritten signature in the paper world ("The signer signs a contract") => Functional definition Legal e-signature notion Comparison e-signature definitions in laws Data in electronic form affixed to or associated with a data message + • UNCITRAL MLEC: identify signatory + indicate his approval • EU e-signature directive: method of authentication • US ESIGN Act: intent to sign • Russian e-sign act: identity + integrity • Sweden: identity + integrity So in practice, what constitutes a legal electronic signature? • Click OK-box on a web page ? • Name typed at the bottom of an email ? • A voice message saying "I hereby sign and agree to this contract" ? • A digital signature ? Just because something is an electronic signature doesn't mean it is good evidence! Legal e-signature vs technical dig-signature Example of confusion EU VAT directive on electronic invoicing • Refers to signing with "electronic signature" • According to definition it is a digital signature (PKI) • NOT for legal effect, not to replace a handwritten signature in the paperworld • Merely to ensure integrity and authenticiy of the signed data • Good example of when a digital signature is used only for technical security purposes Take aways • Don't forget to separate e-signatures used for legal acts, and e-signatures used only to achieve technical security (digital signatures) • Digital signatures often most appropriate for legal acts – incorporates good evidence • E-signatures very often used as a synonym for digital signatures (PKI) • But e-signature definitions in laws vary • E-signature =\= proof III Legal aspects of Electronic Signatures Legal certainty of an e-signature • Possibility to enforce a signature (Enforceability) • Or recover damages (Liability) Enforceability ("Is an Electronic Signature valid?") • Admissibility as evidence • Not allowed to deny admission only because electronic • Legal effect • Non-discrimination • Not allowed to deny legal effect only because electronic • May still deny legal effect due to insufficient security • Equivalence to handwritten signatures • Possible in some jurisdictions Don't forget evidence! • Although most electronic signatures can be "legally valid", some are better than others from evidence perspective • PKI "incorporates enforceability" • Pay attention to policies and procedures "Reasonable reliance" • Before relying on a signature, the relying party needs to perform certain steps to verify the trustworthiness of the certificate • Relying party obligations • Check certificate's validity (not expired or revoked, CA- chain etc) • Check usages restrictions and liability limitations CA Liability • CA liability for fawlty services • Registration of key holder, issuing of certificate, publishing of revocation information etc • Sometimes explicit legislation, otherwise general tort law • Rule of thumb: if CA has been negligent it will be held liable • Basis for judging negligence is CA's communicated policies and practices • Limitation of liability – adequate notice IV EU E-Signature Directive The directive • Aims to facilitate use of e-signatures and contribute to their legal recognition + open the EU market for e-sigs and certification services • Includes rules on • Legal effect • Liability • Voluntary accreditation • Supervision of CAs Electronic Signature • Data in electronic form • Attached to or logically associated with other electronic data • Serve as a method of authentication = PKI, PIN, password, ... Advanced Electronic Signature • Uniquely linked to the signatory • Capable of identifying the signatory • Created with means under signatory's sole control • Any subsequent change of the data is detectable • = policy-based PKI Qualified Electronic Signature • Advanced electronic signatures • Based on a "qualified certificate" • Created by a "secure signature creation device" (SSCD) • = PKI based on EU standards + hardware Legal effect • QES satisfy legal requirements in relation to electronic documents like a handwritten signature in relation to paper documents • Sufficient but NOT necessary! • Non-discrimination of e-signatures in general • Not denied legal effect • Not denied admissibility as evidence in court Current status and problems of Directive • Interoperability • Cross-border recognition • Autmated signing • Solutions? • More standards (ETSI) • EU validation body Electronic invoicing in EU Invoicing Directive 2001/115/EC (2006/112/EC) • Electronic invoicing • Since 2004 all Member States must accept e-invoices • Prerequisites: • Customer accepts invoice in electronic format • Ensure integrity and authenticity in transport and storage • Storage, outsourcing & self-billing • Transposed to Member State law • Variations: options in Directive, but also impact of pre- existing laws • Compliance: not with Directive but local requirements applied by tax authorities Authenticity and integrity guarantee • In transmission and storage, by means of • ALT 1: Electronic Signatures • ALT 2: "EDI" (legally defined) with contractual security processes • Exception • ALT 3: Countries allowed to accept "other means" – no cross-border acceptance guarantee The risks of non-compliance • Loss of buyer's right to reclaim input VAT (also retroactively) • In some countries: fines • Slow and costly audit processes The VAT mechanism and risks Audit up to 11 years later: Invoice Non-compliant Supplier Payment Contract price Buyer + invoice Contract price + VAT VAT (10-25%) Contract price + VAT Deducts VAT paid to supplier from own VAT VAT + Fines VAT collected on payments fines sales Tax authorities EU Invoicing Directive Objective: uniform e-invoicing requirements Directive • Integrity and authenticity 2001/115 – guarantees through e- "Invoicing signatures or "EDI" Directive" • Storage of invoices in any European country • Content of invoices • Outsourcing of invoice issuance to third party • Self-billing EU Invoicing Directive Result: 27 different country laws differing on many accounts EU: a multi-layered fragmented legal landscape Country implementations Invoicing Directive 2001 Country implementations E-signature Directive 1999 Country implementations EDI Recommendation 1994 EDI option • Contractual security processes required • With transport-level security (e.g. SSL) only, procedures, logs, audit trails needed • Save proof of integrity and authenticity guarantee for ten years • Summary statements often required • paper form • country-specific requirements • Differing requirements (e.g. FR, BE, ES) • "Automated, machine-to-machine, unambiguous processing"= "web-EDI", manual self-billing, downloading from seller server are not viewed as EDI • Not accepted as secure in e.g. CH Point-to-point security (e.g. SSL, AS2) (Arguably) de facto authenticity and integrity between points No inherent auditability Requires system and process (audit trail) documentation including change management system to prove safeguards were applied across multiple generations of technology, staff and processes. ? Signatures: the audit advantage Tax authorities Anytime, anywhere: De facto authenticity and integrity Inherent auditability e-Signature requirements "High" and "low" security countries is a simplification, high diversity of approaches is more correct: CA country of establishment and operation Data centre security Hardware and software components Country A Accreditation / certification / supervision / audit Subject identification procedures Tax-specific identification (VAT nr) in certificate Law enforcement disclosure Permitted applications and purposes Liability Relying party obligations Country B Backup procedures Signing automation & batch signing Supplier/buyer processes Self-certification What-You-See-Is-What-You-Sign …. PDF PDF Signature RosettaNet S/MIME signature XML XML Signature IDOC PKCS#7 signature ##### ##### ##### ##### Anna Nordén firstname.lastname@example.com + 46 (0)8 410 057 93 www.trustweaver.com


text: New stories Upcoming Incoming 30° Make Bayonetta Dance Anywhere With The Power Of Augmented Reality 16m ago - Siliconera: "Bayonetta 2 from Platinum Games and Nintendo is coming out for Wii U in Japan in ju... | Wii U Comments (0) Geobros Source 40° Assassin's Creed Unity Dev Interview 23m ago - Ubisoft Producer Vincent Pontbriand reveals the latest details about Assassin's Creed Unity and t... | PC Comments (3) awkwardhamster Source 40° Mario Takes On Minecraft in Hilarious Video 23m ago - Many people, when asked to name a video game character, will answer with the mustachioed plumber... | Culture Comments (1) WutangClam Source 30° BlazBlue: Clonephantasma Review 23m ago - The BlazBlue franchise has quickly become one of the biggest 2D fighters in gaming. Since its fir... | 3DS Comments (0) beef3e Source D/A+ invisiblegame... Ad Start Making Games for the PS4 Now - Want to design the next generation of video games? Start learning game design today. Click for more info on how to get started. | Promoted post Read More SiteBot 20° Lethal League Review | Twinfinite 24m ago - James of Twinfinite writes "Balls are fun. Hitting balls at people is fun. Hitting balls at peopl... | PC Comments (0) Naktul Source 4/5 twinfinite.net

subset: commoncrawl


text:
TAMPA BAY —Doug Fister came to the Tigers with the lowest run support in the American League. If anyone can win with Miguel Cabrera, Brennan Boesch and Alex Avila missing from the lineup behind him for various reasons, it's him.
In fact, he did. With a wicked dart to his fastball and strong command of his secondary pitches, Fister five-hit the Rays over seven innings, sending the Tigers to their sixth win in seven games with a 2-0 shutout of the Rays Thursday afternoon at Tropicana Field.
The win took the four-game series in favor of the Tigers, who moved 6 1/2 games ahead of the Indians atop the AL Central and seven games up on the third-place White Sox.


text:
My Two Cents (Daily) - How to Train Your Dragon 2 announced, plus new Jeremy Brett/Sherlock Holmes details & more http://t.co/NoqEHshXED
Now then, hard to believe though it may seem, today marks the 35th Anniversary of Richard Donner's original Superman: The Movie. So Michael Coate has cooked up a great retrospective look back at that debut release, including a fine new interview with film historian Bruce Scivally and soundtrack producer and film music preservationist Mike Matessino. We hope you enjoy it!
Enjoy the rest of your weekend. Stay tuned...
- Bill Hunt


text:
Showing: 1-4 of 4
Welcome to the Marquette-Gwinn Service Area Page!
Welcome to the Marquette-Gwinn Service Area page for GSNWGL! Volunteers here have so much to share with each other. On this site we will include a calendar of Service Area program activities for 2013-14 Documents specific to our Service Area program activities News from our...
|29 Jul, 2013
2015 Washington D.C. Bus Trip
Washington DC here we come! We are so excited to announce the Marquette-Gwinn Service Area bus trip to Washington DC July 17-26, 2015. It is going to be an amazing, educational and fun trip for everyone. We will board the bus on Friday, July 17th in Marquette (or along the route), stopping for...
|11 Jul, 2014
FAQ Washington D.C. Bound
FAQ: Washington DC Bound 1. What are the dates of the trip? The trip will begin Friday, July 17, 2015 and end on Sunday, July 26, 2015. 2. Who is eligible to participate in the trip? Any registered Girl Scout (Cadette and above) and registered adults. 3. If I am not registered as a...
|14 Jul, 2014
Marquette-Gwinn Calendar 2014-15
Date Leaders Meetings 6:30 - 8:00 p.m. Location 2014-15 Marquette-Gwinn Area Girl Scouts Sept 9 Kick-Off for the new year! All leaders and troop assistants please come. Let Mary Vertanen know if you are bringing children so we have enough...
|28 Jul, 2014
Powered by KBPublisher (Knowledge base software)


text:
We are a young and vibrant Official MINI dealer in Edinburgh, Scotland with a fresh approach and a mission to offer something different. Our extensive range of services and vehicles means we've got something to suit everyones budget. If you are looking for Used MINI in Scotland you are in luck - We have a huge range available for you to browse online or at our fantastic showroom right down at the beach in Leith.
Peter Vardy MINI Edinburgh specialise in the sales of the the entire collection of New MINI cars including the Brand New 2014 Hatch, Convertible, Paceman, Countryman, Clubman and Clubvan.
View Our range of Approved Used MINI's. We are committed to offering the best prices on all our new and used cars. Check out our latest MINI offers for the best deals today.
MINI Motability from Peter Vardy
We also have dedicated MINI Motability specialists to assist our disabled customers through the process of buying a new car.
MINI Car Servicing, Finance & Aftersales
In addition to car sales, we also offer TLC Servicing and MOTs, as well as MINI Select Finance options - you can even get accepted for financing online today! Look after your new car with regular servicing and TLC maintenance checks. We've got all the bases covered!
Official Edinburgh MINI Dealer
For a closer look at the full range of MINI's, stop by our Edinburgh Dealership today where we're looking forward to helping you. Find your local Peter Vardy MINI Dealer in Edinburgh, close to Motherwell, Dunfermline, Falkirk, Livingstone and only 1 hour from Glasgow.
Visit our offical MINI website here: www.petervardymini.co.uk
Dont Forget - We want to buy your MINI too
To get a quick valuation please fill in your details here and a member of our friendly buying team will be in touch with a valuation, or if you prefer you can call us Monday - Friday on 0131 468 7373.
Finance example: Used MINI One D 1.6
|48 Months
|48 Monthly Payments:
|OTR Cash Price:
|Customer Deposit:
|Credit Arrangement Fee:
|Optional Final Payment:
|Total Amount Payable:
|Amount of Credit:
|Rate of Interest:
|Representative APR:


text:
You will see a watermark in the bottom right corner of all our images, however, that will not appear on your product when you order it.
Leo Kottke's live music career is celebrated in the concert memorabilia available at Wolfgang's Vault. The Collection is divided into Leo Kottke Posters, Leo Kottke Photographs, Leo Kottke Apparel as well as other Leo Kottke memorabilia such as vintage tickets backstage passes and media like Rolling Stone magazines.