Subject: R: Digital Signature Implementation Interoperability

From: "Santoni Adriano" <[email-masked]>
Date: Fri, 29 Oct 2004 08:47:50 +0200

>One of the explicitly stated premises of this group is that "among all the COTS 
>digital signature implementations there are no two that interoperate out of the box". 
>Interoperate here is to be understood as - a user of product A generates a digital 
>signature over some data and transmits it to a recipient using product B who is able 
>to verify the signature.(A and B not the same product.)

Among the several CSP's accredited in Italy (by www.cnipa.gov.it) under our national legislation on digital signatures and associated regulations, there is close to 100% interoperability as far as PKCS#7 signatures (RFC 2315) and associated qualified certificates are concerned. 

I can state that, because I am the coordinator of the permanent working group that organizes the periodic cross-testing. The different digital signature products subject to our periodic interoperability testing are at least 6.

Rgds,
  Adriano

Adriano Santoni
Actalis S.p.A. (www.actalis.it)
Milano, IT

-----Messaggio originale-----
Da: [email-masked] [mailto:[email-masked]] Per conto di Mike Henry
Inviato: mercoledì 27 ottobre 2004 17.05
A: [email-masked]
Oggetto: Digital Signature Implementation Interoperability

All.

I  recently attended a session of a working group whose charter is to "develop a strategy to address interoperability and implementation challenges with digital signatures" across a large government enterprise

One of the explicitly stated premises of this group is that "among all the COTS digital signature implementations there are no two that interoperate out of the box". Interoperate here is to be understood as - a user of product A generates a digital signature over some data and transmits it to a recipient using product B who is able to verify the signature.(A and B not the same
product.)
This premise is frequently briefed to senior decision makers as an absolute "there are none". It is not briefed as, for example, "there are problems in interoperability one has to choose carefully" or some other more nuanced estimate of the situation.

This premise is an important one to this working group. If it were demonstrably not so in one or two  instances it would probably just require more precision in choice of words. If it were not so in a sufficient number of instances (i.e product A interoperates with B, C, D and another set E, F, G all interoperate quite nicely among themselves ......) then it would likely have a significant impact on planning and future decisions.

I was troubled by the fact that there was no evidence offered in support of this defining premise other than  reference to undocumented phone survey results to some sample of digital signature product vendors. It may very well be the case that as of Oct 2004 the implementations of the standards have not resulted in any interoperability, but I was not convinced by the evidence presented.

I would very much appreciate hearing from anyone who has some independent testing results or practical experience on this topic. If this is not an appropriate topic for this list then an e-mail response would be fine.

Mike Henry

Michael C. Henry
Senior Systems Engineer
MTC
In Support of USMC PK-E Initiative Office

*******************Internet Email Confidentiality Footer*******************

Qualsiasi utilizzo non autorizzato del presente messaggio nonché dei suoi allegati è vietato e potrebbe costituire reato. Se ha ricevuto per errore il presente messaggio, Le saremmo grati se ci inviasse, via e-mail, una comunicazione al riguardo e provvedesse nel contempo alla distruzione del messaggio stesso e dei suoi eventuali allegati.
Le dichiarazioni contenute nel presente messaggio nonche' nei suoi eventuali allegati devono essere attribuite esclusivamente al mittente e non possono essere considerate come trasmesse o autorizzate da ACTALIS S.p.A.; le medesime dichiarazioni non impegnano ACTALIS S.p.A. nei confronti del destinatario o di terzi. 
ACTALIS S.p.A. non si assume alcuna responsabilita' per eventuali intercettazioni, modifiche o danneggiamenti del presente messaggio e-mail. 

Any unauthorized use of this e-mail or any of its attachments is prohibited and could constitute an offence. If you are not the intended addressee please advise immediately the sender by using the reply facility in your e-mail software and destroy the message and its attachments. The statements and opinions expressed in this e-mail message are those of the author of the message and do not necessarily represent those of ACTALIS S.p.A. Besides, The contents of this message shall be understood as neither given nor endorsed by ACTALIS S.p.A.. 
ACTALIS S.p.A. does not accept liability for corruption, interception or amendment, if any, or the consequences thereof.

---

From: [email-masked] (Peter Gutmann)
Date: Fri, 29 Oct 2004 20:53:23 +1300

"Santoni Adriano" <[email-masked]> writes:

>Among the several CSP's accredited in Italy (by www.cnipa.gov.it) under our
>national legislation on digital signatures and associated regulations, there
>is close to 100% interoperability as far as PKCS#7 signatures (RFC 2315) and
>associated qualified certificates are concerned.

As the provider of a security toolkit that has to comply with the Italian
requirements, I should add that the it's a helluva lot of work to get that
interoperability.  It's caused me more problems than any other signature
law/requirements because there are quite a number of extremely... unusual
things in there that are used nowhere else on earth.  So this isn't really a
valid sample, it's like the joke about portability where someone claims that
their code is portable because it runs on every VAX 11/750 running 4.3BSD
Tahoe that they've tried it on.

Peter.

---

From: "Anders Rundgren" <[email-masked]>
Date: Fri, 29 Oct 2004 21:55:57 +0200

Adriano,

I assume that your coordination is restricted to S/MIME and toolkits?
Because if we talk web-signatures not even the word interoperability
apply, as there by definition is nothing to be interoperable with.

This is a bit sad as web-sign is much more important thing than being
able to sign in a dull, off-line e-mail client environment.

All e-governments over the globe buy truly proprietary stuff as they
apparently have not realized that they actually are in the same boat.

Anders Rundgren
PKI technologist etc.

----- Original Message ----- 
From: "Santoni Adriano" <[email-masked]>
To: "Mike Henry" <[email-masked]>
Cc: <[email-masked]>
Sent: Friday, October 29, 2004 08:47
Subject: R: Digital Signature Implementation Interoperability

>to verify the signature.(A and B not the same product.)

Among the several CSP's accredited in Italy (by www.cnipa.gov.it) under our national legislation on digital signatures and
associated regulations, there is close to 100% interoperability as far as PKCS#7 signatures (RFC 2315) and associated qualified
certificates are concerned.

I can state that, because I am the coordinator of the permanent working group that organizes the periodic cross-testing. The
different digital signature products subject to our periodic interoperability testing are at least 6.

Rgds,
  Adriano

Adriano Santoni

-----Messaggio originale-----
Da: [email-masked] [mailto:[email-masked]] Per conto di Mike Henry
Inviato: mercoledì 27 ottobre 2004 17.05
A: [email-masked]
Oggetto: Digital Signature Implementation Interoperability

All.

I  recently attended a session of a working group whose charter is to "develop a strategy to address interoperability and
implementation challenges with digital signatures" across a large government enterprise

One of the explicitly stated premises of this group is that "among all the COTS digital signature implementations there are no two
that interoperate out of the box". Interoperate here is to be understood as - a user of product A generates a digital signature over
some data and transmits it to a recipient using product B who is able to verify the signature.(A and B not the same
product.)
This premise is frequently briefed to senior decision makers as an absolute "there are none". It is not briefed as, for example,
"there are problems in interoperability one has to choose carefully" or some other more nuanced estimate of the situation.

This premise is an important one to this working group. If it were demonstrably not so in one or two  instances it would probably
just require more precision in choice of words. If it were not so in a sufficient number of instances (i.e product A interoperates
with B, C, D and another set E, F, G all interoperate quite nicely among themselves ......) then it would likely have a significant
impact on planning and future decisions.

I was troubled by the fact that there was no evidence offered in support of this defining premise other than  reference to
undocumented phone survey results to some sample of digital signature product vendors. It may very well be the case that as of Oct
2004 the implementations of the standards have not resulted in any interoperability, but I was not convinced by the evidence
presented.

I would very much appreciate hearing from anyone who has some independent testing results or practical experience on this topic. If
this is not an appropriate topic for this list then an e-mail response would be fine.

Mike Henry

Michael C. Henry
Senior Systems Engineer
MTC

Qualsiasi utilizzo non autorizzato del presente messaggio nonché dei suoi allegati è vietato e potrebbe costituire reato. Se ha
ricevuto per errore il presente messaggio, Le saremmo grati se ci inviasse, via e-mail, una comunicazione al riguardo e provvedesse
nel contempo alla distruzione del messaggio stesso e dei suoi eventuali allegati.
Le dichiarazioni contenute nel presente messaggio nonche' nei suoi eventuali allegati devono essere attribuite esclusivamente al
mittente e non possono essere considerate come trasmesse o autorizzate da ACTALIS S.p.A.; le medesime dichiarazioni non impegnano
ACTALIS S.p.A. nei confronti del destinatario o di terzi.
ACTALIS S.p.A. non si assume alcuna responsabilita' per eventuali intercettazioni, modifiche o danneggiamenti del presente messaggio
e-mail.

Any unauthorized use of this e-mail or any of its attachments is prohibited and could constitute an offence. If you are not the
intended addressee please advise immediately the sender by using the reply facility in your e-mail software and destroy the message
and its attachments. The statements and opinions expressed in this e-mail message are those of the author of the message and do not
necessarily represent those of ACTALIS S.p.A. Besides, The contents of this message shall be understood as neither given nor
endorsed by ACTALIS S.p.A..
ACTALIS S.p.A. does not accept liability for corruption, interception or amendment, if any, or the consequences thereof.