Subject: Standards for Web-signing II

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 28 Oct 2003 14:46:37 +0100

The answer to my earlier request seems to be:

There are apparently no standards and nothing in the works either
with respect to signing on-line data on the web using Internet browsers.

Since web-signing is today [*] used by many, many, more people
and organizations than there are users of signed e-email, I remain puzzled.

Is the PKI community really just a bunch of "nerds", mostly
out of touch with the needs of the market?  The question is open.

*] Like Scandinavian banks having > 0.5M of users.
All current systems rely on entirely proprietary mechanisms.
Most of the vendors even require NDAs for getting the documentation.

Anders Rundgren

----- Original Message -----
From: "Anders Rundgren" <[email-masked]>
To: <[email-masked]>; <[email-masked]>; <[email-masked]>
Sent: Tuesday, September 02, 2003 14:07
Subject: [pki-tc] Standards for Web-signing

Folks,
I just wanted to know the status of possible standardization
efforts regarding signing on-line forms etc. on web.  As web-signing
is a core function of many e-governments when communicating
with their citizens it seems that this should be standardized if
not already is.

Pointers are welcome.  Off-list or on-list.

rgds
Anders Rundgren

To unsubscribe from this mailing list (and be removed from the roster of the OASIS TC), go to
http://www.oasis-open.org/apps/org/workgroup/pki-tc/members/leave_workgroup.php.

---

From: "Markus Lorch" <[email-masked]>
Date: Tue, 28 Oct 2003 14:01:14 -0500

Anders,

isn't the XML Signature a standard that can be used for this

see
Mark Bartel et al, "XML Signature Syntax and Processing", World Wide Web
Consortium Recommendation, February 2002

Markus

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Anders Rundgren
> Sent: Tuesday, October 28, 2003 8:47 AM
> To: [email-masked]; [email-masked]; [email-masked]
> Subject: Standards for Web-signing II
> 
> 
>

---

From: "Anders Rundgren" <[email-masked]>
Date: Tue, 28 Oct 2003 20:58:59 +0100

Markus,

XML Signature standard essentially define something like
CMS/PKCS #7 in XML.  The standard "talks" about the signing
process but does not define any interface between the browser
and the signature requester which is what is needed among
many things in order to achieve a web-signing standard.

But this one is just for starters, the browser-interface for
on-line certfication processes (which seem to be the future)
is also not standardized.  MSFT's Xenroll has no implementation
in Mozilla or Netscape.  Few serious systems for this reason
build on Xenroll but rather on proprietary solutions.  Xenroll
is also in my opinion an unsatisfactory solution as the GUI
should be the same for each CA rather than all over the map.

rgds
Anders

----- Original Message ----- 
From: "Markus Lorch" <[email-masked]>
To: "'Anders Rundgren'" <[email-masked]>; <[email-masked]>
Sent: Tuesday, October 28, 2003 20:01
Subject: RE: Standards for Web-signing II

Anders,

see

Markus

---

From: "Florian Oelmaier" <[email-masked]>
Date: Wed, 29 Oct 2003 01:37:05 +0100

> > Folks,
> > I just wanted to know the status of possible 
> standardization efforts 
> > regarding signing on-line forms etc. on web.  As 
> web-signing is a core 
> > function of many e-governments when communicating with 
> their citizens 
> > it seems that this should be standardized if not already is.
> > 

Most products out there are more or less compliant with the identrus
specifications for websigning (ISIL & ISPI). These specifications are
not openly available but from a technical point of view these specs are
not limited to identrus usage.

-- 
Florian Oelmaier
SyTrust