The decree enabling government electronic transactions is now at the final stage. I expect to see a lot of e-government services this year. The Information and Communication Technology (ICT) ministry is running a GDI Camp to train 200 programmers in the government sector for the new technology, including that related to the act.
There is a misunderstanding, however, that under the new law, electronic documents in any format, i.e, fax, e-mail, .doc, .xls, will be legally equivalent to paper with signatures. It is true that all electronic documents can now be used as evidence in court but it does not mean that the judge must always believe in them. This is similar to the current practice that the plaintiff must first prove to the court that the signature on the paper is authentic.
This process needs a third party such as a bank cashier (in the case of a dud cheque) to testify in court in order to confirm the written signature. If the same process is applied to electronic documents, it will be impractical for a plaintiff with limited computer knowledge to prove authenticity. The act then provides under Article 26 that if the electronic document is created by an algorithm that transforms it into "digital signature", the burden of proof by the plaintiff shall be waived.
It is therefore necessary for all electronic documents to be stored in the digital-signature format. The Public Key Infrastructure or PKI is a tool to create digital signatures. The PKI is based on an asymmetric key framework, meaning that those who would like to carry out electronic transactions must have two virtual keys - a private key and a public key. Both virtual keys are indeed small electronic files. When you create an electronic document in .doc or e-mail, you must use your private key to encrypt it in order to transform the document into a digital signature. In case of a conflict, the parties involved can use this digital signature to prove their case in court, similar to the way they used a signed paper document.
It is quite difficult to explain the concept. It is even much more difficult to train programmers to develop the application using this technology. Therefore, the ICT ministry created the system for them to try on. Readers who are interested in experiencing the digital signature process are encouraged to try it at this website: http://pki.velocall.com/cryptoWebTools/index.html
For Internet Explorer users, you need to install Java Virtual Machine which you can download by clicking on "demoTools" on the upper right screen as shown above. To test the system, the ministry has created trial accounts as 1, 2, 3, 4, which you can download by inputting "1" on first panel of the demoTools page, then click "download" to save the file called user1.key on any directory on your hard disk.
Now you are ready to try the PKI. The first lesson is to show that PKI enables us to verify each other. You can input "This email address is being protected from spambots. You need JavaScript enabled to view it." on the "Email of Sender" and click "Verify Certificate" button. The program will then search the e-mail address at the server and search for the information in the public key of the user. Then it will return the detail of that user, such as, real name, organisation, address. This will enable us to know whom we are dealing with.
You might want to send a secret message to the recipient. The PKI enables you to do this. For example, input This email address is being protected from spambots. You need JavaScript enabled to view it. on the "Email of Receiver" and write something on the Message box, then click "Encrypt". The program will automatically pull the public key of user2 to encrypt the message and return some unreadable message. If you send this message to user2, he can easily read it by clicking "Decrypt", the program will ask for his private key that can be downloaded from demoTools page.
If the sender would like to sign on the message, he can click "Signing" on the bottom panel. The program will ask for his private key and produce a digital signature in the bottom box. Learning by doing through the examples on this website enables students to clearly understand the PKI system. In addition, they can develop their own applications without writing any code to encrypt/decrypt a message. They can simply link their web-based application to the related applets of the demo page and enjoy all of the features we have just discussed on their own applications.
Autor(en)/Author(s): Arnat Leemakdej
Quelle/Source: Bangkok Post, 10.07.2007
