RE: [id-cloud] Gap Analysis Use Case 9: Cloud Signature Services

[Moberg Dale <dmoberg@axway.com>]

---

Use Case 9: Cloud Signature Services

Short description:
There is a business need in many applications to create digital signatures
on documents and transactions. When applications, and users, move into the
cloud so should also the signing services. Both users and applications have
a need to sign documents.

Relevant applicable standards:

OASIS Digital Signature Services (DSS) TC
http://www.oasis-open.org/committees/tc_home.php?wg_abbrev=dss

"The Digital Signature Services (DSS) specifications describe two XML-based request/response protocols a signing protocol and a verifying protocol. Through these protocols a client can send documents to a server and receive back a signature on the documents; or send documents and a signature to a server, and receive back an answer on whether the signature verifies the documents. The DSS Core specifications provide the basic protocols and elements which are adapted to support specific use cases in the DSS profiles."

Also note "the following profiles of the OASIS Digital Signature Services:

    XML Timestamping Profile
    Signature Gateway Profile
    German Signature Law Profile
    Entity Seal Profile
    Electronic PostMark (EPM) Profile
    Abstract Code-Signing Profile
    J2ME Code-Signing Profile
    Asynchronous Processing Abstract Profile
    Advanced Electronic Signature Profiles"

Analysis notes:
    
Basic functionalities of signing and verifying are specified, as are specialized profiles.

Possible GAPs identified:

At most, perhaps a specialized profile is needed?