Feds Approve Bank to Certify Digital Signatures

[Bill Stewart <bill.stewart@pobox.com>]

There was a note to Dave Farber's list that the Office of the 
Comptroller of Currency has approved Zion's First National Bank
to certify digital signatures.  Since they're in Utah, Zion's has
a certain amount of legal infrastructure in place.
The text version of the story is at 
http://www.occ.treas.gov/ftp/release/98-4.txt
and the 20-page PDF with gory details is at
http://www.occ.treas.gov/ftp/release/98-4att.pdf

They're going to offer digital signature certificates
with the usual binding of a key to a body plus papers,
and provide software to support it.  Some of their software
can be used for encryption, and unfortunately they're
going to offer key escrow, though as a separate business
service, with keys encrypted by the key's corporate owner
as well as by the bank for protection, but it's not
going to be a mandatory service, and they have no intention
of offering escrow for signature keys, only encryption keys.
Their documentation does talk a good bit about crypto technology,
in layman's terms, and about risk management and Y2000 compliance,
and also in great detail about how things like this are
standard banking functions applied in a digital environment
(to convince the OCC to let them offer it, since they're a bank
and aren't supposed to offer non-bank-related services).

There's also a story in Network World at
http://www.nwfusion.com/news/0202rsa.html
about Verisign and Entrust CAs plans for IPOs.
				Thanks! 
					Bill
Bill Stewart, bill.stewart@pobox.com
PGP Fingerprint D454 E202 CBC8 40BF  3C85 B884 0ABE 4639