Re: [dss-x-comment] Local signatures: DSS/XML => JSON alternatives

[Juan Carlos Cruellas <cruellas@ac.upc.edu>]

Dear Anders,

On behalf of the DSS-X TC, I would thank you for your interesting 
emails...the TC is taking notice of their contents and will take them 
into consideration

Best regards

Juan Carlos Cruellas DSS-X TC co-chair
El 02/06/14 15:15, Anders Rundgren escribió:
> Dear List,
> There was recently a discussion about signatures in LinkedIn 
> (Electronic / Digital Signature in the EU).
> http://docs.oasis-open.org/dss-x/localsig/v1.0/csprd01/localsig-v1.0-csprd01.pdf 
>
>
> Andreas Kühne thought that I should post my comments to the DSS-X list 
> as well and here they are :-)
>
> I understand that you wanted to keep the DSS standard as unchanged as 
> possible, right?
>
> I have not bothered about existing standards so in my take on local 
> signatures the SignatureRequest provides the entire document while the 
> SignatureResponse *minimally* only holds the associated signed digest:
> http://webpki.org/papers/wasp/wasp-tutorial.pdf
>
> Another thing which I consider crucial is the ability to "filter out" 
> keys that the RP isn't interested in. This is also a part of 
> a"companion" authentication solution I'm working on:
> http://webpki.org/papers/PKI/webauth.pdf
>
> You do several references to SIM-cards and ISO 7816. Personally I 
> don't think any of the ETSI standards for SSCD will get far in mobile 
> devices; tablets do for example not even come with SIM-cards 
> generally. The following developments looks quite promising:
> http://images.apple.com/iphone/business/docs/iOS_Security_Feb14.pdf
> https://www.samsungknox.com/en
>
> Unfortunately Europe is pretty disconnected from this after the sad 
> demise of Nokia.
>
> Lately I have rewritten all my stuff to use JSON as well, not because 
> it is better, but due to fact that Android doesn't come with XSD 
> support and I guess it never will.  Anyway, the resulting code became 
> comparable while the library got 2 MB shorter (dropped XERCES) so I 
> don't regret this change although it was a bit hard.
>
> Since XMLDSig doesn't have a direct JSON counterpart, I also designed 
> such a thing:
> https://openkeystore.googlecode.com/svn/resources/trunk/docs/jcs.html
>
> Regards,
> Anders Rundgren
>
> --
> This publicly archived list offers a means to provide input to the
> OASIS Digital Signature Services eXtended (DSS-X) TC.
>
> In order to verify user consent to the Feedback License terms and
> to minimize spam in the list archive, subscription is required
> before posting.
>
> Subscribe: dss-x-comment-subscribe@lists.oasis-open.org
> Unsubscribe: dss-x-comment-unsubscribe@lists.oasis-open.org
> List help: dss-x-comment-help@lists.oasis-open.org
> List archive: http://lists.oasis-open.org/archives/dss-x-comment/
> Feedback License: http://www.oasis-open.org/who/ipr/feedback_license.pdf
> List Guidelines: http://www.oasis-open.org/maillists/guidelines.php
> Committee: 
> http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=dss-x
> Join OASIS: http://www.oasis-open.org/join/