Comments on OASIS OpenDocument v1.2 csprd02-part3

Nick Pope & Juan Carlos Cruellas - Experts ETSI Technical Committee on Electronic Signatures and Infrastructures

27 December 2010

We welcome the adoption of the adoption of XAdES in ODF and will provide shortly the revised draft technical specification, to be TS 102 918, for the association of advanced electronic signatures (AAdES), including XAdES signatures, with objects within a package. It is our aim that this be compatible with the use of ODF.

We have reviewed OpenDocument v1.2 csprd02-part3 and have identified the following areas where we believe further clarification is required:

1. The note in page 16 differentiates between files that are part of the "OpenDocument package" and files that are part of "the content stored within the package"....The text seems to say that files within META-INF folder are of the first type...What exactly is the semantic difference between this "opendocument package" and the "content stored within the package"?

2. Also in the note the sentence: "Therefore, different rules regarding the resolution of relative IRIs may apply". Then there is a rule on what has to be considered the base IRI. Is this the only aspect where the resolution of relative IRIs are different? If not, what other aspects are different? Should the specification detail them or are general enough as to be already specified elsewhere, and if so, where?

3. How the resolution of relative IRIs specified in 3.7 would affect a regular XMLDSIG implementation that resolves relative IRIs following the general principles of RFC 3986 but do not take into consideration 3.7? Are we right if we assume that they could fail in successfully referencing data objects within the package if they do not implement that section?.

4. Section 5.3 point 1 reads:

"A <ds:Reference> element which has a Type attribute value of "http://docs.oasisopen. org/office/v1.2/OS/OpenDocument-v1.2.odt" shall refer to files in the same package in the accordance with the procedure for resolving IRIs 3.7, except that the file entry path shall be the name of the signature file with its relative path omitted"

What is the reason for this exception in the general processing of section 3.7, where in its first point the file entry path included the relative path? would not be worth to include the rationale for this as a note?

5. Could it be possible to include as informative annexes examples of resolution of relative IRIS for illustrating the process described in 3.7, and also some examples of referencing from digital signatures?

"Thales e-Security Limited is incorporated in England and Wales with company registration number 2518805. Its registered office is located at 2 Dashwood Lang Road, The Bourne Business Park, Addlestone, Nr. Weybridge, Surrey KT15 2NX.

The information contained in this e-mail is confidential. It may also be privileged. It is only intended for the stated addressee(s) and access to it by any other person is unauthorised. If you are not an addressee or the intended addressee, you must not disclose, copy, circulate or in any other way use or rely on the information contained in this e-mail. Such unauthorised use may be unlawful. If you have received this e-mail in error please delete it (and all copies) from your system, please also inform us immediately on +44 (0)1844 201800 or email postmaster@thales-esecurity.com. Commercial matters detailed or referred to in this e-mail are subject to a written contract signed for and on behalf of Thales e-Security Limited".

office-comment message

Comments on OASIS OpenDocument v1.2 csprd02-part3