Suggestion for new work - profile for visible signaures

["Uri Resnitzky" <Uri@arx.com>]

Hello all,

I would like to suggest that the DSS TC develop a new profile to handle
visible signatures.

This profile will enable a client to submit a document to the server and
ask that the document be signed after adding a signature field / block
to a certain page in certain coordinates and dimensions. The signature
block could have some text attributes displayed such as signer's name
(taken from the signer certificate's Subject Common Name attribute for
example), signature date/time, etc. In addition the signature block
could have some graphic elements such as a graphical signature image
held by the server in association with the signer's key, a company logo,
etc. Additional features may include supporting multiple signature
fields in the same document, sectional signatures, etc.

The main advantage of this profile would be in connection with document
formats which natively support interactive visible digital signature
fields. One such (non-XML) format is PDF (recently announced to be
submitted as an ISO standard). Other formats may include the XML-based
OASIS ODF and Microsoft OOXML, as well as non-XML formats such as TIFF,
etc.

An interesting challenge would be to design the profile in a generic
manner so that it can support as many features without being tied to any
specific file type.

In my experience visual signatures (and especially graphical signature
images) greatly enhance the user acceptance and usability of a digital
signature system.

The profile can also cover auxiliary activities such as:
1. adding an empty signature field into a document (specifying at
document/template design time where signature lines should be in the
document, who should sign them, etc)
2. registering a graphical signature image to be associated with a
certain signing key.
3. enumerating signature fields and extracting various attributes
While not directly involved with the calculation or verification of a
digital signature, these auxiliary activities are useful when building
on overall solution for document signing. Of-course such activities can
also be left aside to be specified as an additional profile or protocol.

Thanks,

- Uri

Uri Resnitzky
Chief Scientist
ARX
http://www.arx.com