Re: [pkix] Research question: Witnessing by digital signature

[Jorge López <[e-mail]>]

Dear Liaquat,

(sorry if I have missed some information) I have skim read document D1.1
Part 3: Signature Policies, and it seems that the Project uses ETSI
Signature Policies, and that the "binding" between the multiple signatures
(when needed) is made in human-readable documents rather than by means of
automated processes. Am I right?

Jorge.

2010/6/11 Liaquat Khan <[e-mail]>

>  Note the large European project “PEPPOL” (Pan-European Public Procurement
> On-Line) considers multiple signature options as part of the Signature
> Policy.   It seems logical place to me.
>
>
>
> Regards
>
> LK
>
>
>
> *From:* [e-mail] [mailto:[e-mail]] *On Behalf Of
> *Jorge López
> *Sent:* 11 June 2010 13:22
> *To:* Pope, Nick
> *Cc:* pkix; [e-mail]
>
> *Subject:* Re: [pkix] Research question: Witnessing by digital signature
>
>
>
> Mmm, not so sure about that. Current signature policy is already
> transaction/document oriented, as it establishes the requirements to be
> fulfilled for the generation and validation of the signature, but within the
> transaction scope. There are fields that specifically fix the
> business/transactional context. The necessity I mentioned is what happens
> when more than one signature is needed to complete the transaction.
>
>
>
> Well, you could do that at document/application level, but the cumbersome
> is guaranteed. An extended signature policy, like the one proposed in the
> aforementioned paper, can fill that gap in a seamlessly manner, and not
> application-dependent one.
>
>
>
> Regards,
>
>
>
> Jorge.
>
>
>
> 2010/6/11 Pope, Nick <[e-mail]>
>
> Denis,
>
>
>
> With PDF's this is handled by producing a document template with the layout
> including the placement of signatures.  I think this is an issue for the
> document standards applying signatures not for signatures standards.
>
>
>
> Nick
>
>  -----Original Message-----
> *From:* [e-mail] [mailto:[e-mail]] *On Behalf Of
> *Denis Pinkas
> *Sent:* 11 June 2010 09:54
> *To:* Jorge López; swilson
> *Cc:* pkix
> *Subject:* Re: [pkix] Research question: Witnessing by digital signature
>
> Hi,
>
>
>
> You are right: there is no signature policy standard or technical document
> that helped to establish the dependences and relationships among several
> signatures.
>
>
>
> The current concept of "signature policy" applies to a single signature.
> If a document has multiple signatures, each one can be done under a
> different signature policy.
>
>
>
> So the "missing" concept is a "document signature policy" (not to be
> confused with  a "signature policy") which would tell,
> how many electronic signatures are needed, which signature policies are
> acceptable for each one, whether they need to be parallel
> or embedded, which commitment types must be present, etc ...
>
>
>
> This combination of criteria could be important and all these verifications
> are currently left to the application.
>
> It is questionnable whether this should be standardized now or left to the
> application.
>
>
>
> Denis
>
>
>
>  ----- Message reçu -----
>
> *De :* Jorge López
>
> *À :* Stephen Wilson
>
> *Date :* 2010-06-11, 10:17:44
>
> *Sujet :* Re: [pkix] Research question: Witnessing by digital signature
>
>
>
> Hi,
>
>
>
> Among other open issues, a technical one lies in the fact that currently
> there is no signature policy standard or technical document that helped to
> establish the dependences and relationships among several signatures to make
> them legally binding. It would be the scenario of a witness or notary, who
> must countersign a former signature to make the transaction
> effective. This limitation was pointed out by ETSI in a technical
> report published in 2003 [1]. To the best of my knowledge, little research
> has been done in this direction [2].
>
>
>
> Regards,
>
>
>
> [1] ETSI TR 102 045 - Electronic Signatures and Infrastructures (ESI);
> Signature policy for extended business model v1.1.1. European
> Telecommunications
>
> Standards Institute (ETSI), March 2003
>
> [2] Jorge L. Hernandez-Ardieta, Ana I. Gonzalez-Tablas, Benjamin Ramos and
> Arturo Ribagorda. Extended Electronic Signature Policies. 2nd ACM
> International Conference on Security of Information and Networks (SIN 2009),
> pp. 268--277, ACM Press. North Cyprus. 2009.
>
>
>
> 2010/6/10 Stephen Wilson <[e-mail]>
>
>
> Has any work been done in PKIX or elsewhere on formal witnessing of digital
> signatures?  And/or ... does anyone in the group know of real life instances
> where a digital signature is witnesses and attested to using another dig
> sig?
> Cheers,
>
> Stephen Wilson
> Managing Director
> Lockstep Group
>
> Phone [phone]
>
> www.lockstep.com.au <http://www.lockstep.com.au>
> Lockstep Consulting provides independent specialist advice and analysis
> on digital identity and privacy.  Lockstep Technologies develops unique
> new smart ID solutions that enhance privacy and prevent identity theft.
>
>
>
> _______________________________________________
> pkix mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/pkix
>
>
>
>  *Consider the environment before printing this mail.*
>
> *"Thales e-Security Limited is incorporated in England and Wales with
> company registration number 2518805. Its registered office is located at 2
> Dashwood Lang Road, The Bourne Business Park, Addlestone, Nr. Weybridge,
> Surrey KT15 2NX.*
>
> *The information contained in this e-mail is confidential. It may also be
> privileged. It is only intended for the stated addressee(s) and access to it
> by any other person is unauthorised. If you are not an addressee or the
> intended addressee, you must not disclose, copy, circulate or in any other
> way use or rely on the information contained in this e-mail. Such
> unauthorised use may be unlawful. If you have received this e-mail in error
> please delete it (and all copies) from your system, please also inform us
> immediately on [phone] or email [e-mail].
> Commercial matters detailed or referred to in this e-mail are subject to a
> written contract signed for and on behalf of Thales e-Security Limited".*
>
>
>