Re: [jose] comments on draft-jones-json-web-signature and draft-jones-json-web-encryption

[Phillip Hallam-Baker <[e-mail]>]

As a legal matter, the US has legislation that recognizes someone saying
'Yes' into a telephone handset as an 'Electronic Signature'.

MACs are not digital signatures but they are clearly an acceptable
electronic signature under that act. So I don't see that there is really a
problem including MACs in a 'signature document' provided that users
understand this.


The term 'signature' has several meanings in and out of the field. A legal
signature has five or six different significances and digital signatures
only provide equivalents for some of them.


I would rather just keep the term as it is rather than rathole on it. The
terms Authentication and Integrity are not synonymous either, as some
people seem to be suggesting. Trying to make this wording more accurate
seems to be having the opposite effect to me.

A MAC and a Digital Signature always provide an integrity check but they
only provide a proof of authenticity if the provenance of the verification
key is established.


If I buy a Ming Vase, the integrity of the vase is demonstrated by checking
that it is not chipped, the authenticity of the vase depends on it actually
being Ming Dynasty.