Nobody cares about signatures

When was the last time you lay awake at night, wondering whether Caran d’Ache or Faber-Castell had the better ink? Never? Then you are in good company. Yet somehow for decades the technical community harboured the belief people would become experts so they could properly manage their keys and make a choice on which signature or cryptography standard to use for their emails. Here is the shocker: They never will. Nor should they have to. Life is complicated enough already.

But this attitude is why many attempts at improving usability of cryptography in the past have primarily focused on making something cumbersome and annoying a little shinier. Care for an example? Anyone can create a key that claims to be the key of any person, real or not. To know you have the key for the person you are thinking of, they need to personally give you the identifier, the so-called fingerprint, of their actual key. This used to be a long string of hexadecimals. Now we have come up with a way to have them compare three to five words from a dictionary instead. But we are not getting rid of the need to manually confirm key authenticity. Which is putting lipstick on a pig.

It is not like we do not know any better. James Gaskin once famously paraphrased “Nobody cares about Backup — People only care about restore.” Which is another way of saying: it is the utility that people care about. Not what needs to be done in order to achieve it. I know this will hurt some people. It is cryptography. Mathematically pristine and beautiful. How can we even think to hide it away? Arthur C. Clarke once wrote that sufficiently advanced technology is indistinguishable from magic. That is: it is invisible, elegant and we do not see how it works. It is finally time for cryptography to become sufficiently advanced.

To do that, we need to eliminate key management. Not just make it slightly better. It must disappear into our verified, true digital self. This digital self then carries verification of our identity by third parties, such as governments, banks or notaries. Such trust agents allow us to map a digital account to a real person with good levels of confidence.

Building this true digital self is the core of what Vereign has been working on. But just as physical life knows us in different roles and profiles, our true digital self needs to give us the power of choosing which role we are acting in, and how much of our identity to attach to an interaction. We are calling those profiles “passports” and a user might have different passports for work, family or social media.

All interactions are based on passports. Invisible to the users, each passport carries its own, unique key and the verification of identity. So now we can be certain keys belong to people, yet people have nothing to do with key management. All they touch are passports. Everything they care about are meaningful interactions — person to person. The rest happens invisible, in the background, like magic.

But there is something else to consider. If we had to use different cars for different kinds of roads it is hard to imagine that cars would have become as pervasive as they are today. So passports need to become universal. They need to become available to people in any application or service without the need to change habits or migrate to a different application. Which is why we have built the system so it can easily be integrated anywhere.

But as with any new approach, it is hard to imagine what this might look like in practice. So for our prototype we not only validated the concept and approach, we also decided to provide passports to some existing applications. The largest email platform and the second most popular office application seemed like a good starting place to do that. So we have built our prototype around Google Chrome with Gmail, and LibreOffice Online and if you would like to experience what a world without key management might look like, sign up for the prototype.

Without ever touching key management you will be sending signed S/MIME emails in less than three minutes. You will not even notice that you are sending signing messages, nor will you ever need to learn what S/MIME actually stands for. Because you should not have to. Now imagine you could sign your name in the same way to anything, anywhere. And have others do the same in their interactions with you.

A universal layer of trust based on “magical” cryptography incorporating keyless key management and universal signatures. An internet that is not account to account, but person to person instead. That is what Vereign is working on. Join our community and let us know where you need this most.