[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: RE: [office] [OASIS Issue Tracker] Commented: (OFFICE-3028) Updatedigital signatures for better XaDeS support
Hi, >> I would not make signing mandatory in cases when the time was not obtained from a trusted source. >> That is, the time was not supplied by a "Time-Stamping-Authority". This excludes case 1. As for XadES, >> I would require validation data for the time stamp. > > This was also attempting to standardize the existing implementation. It is fine with me if the signing time > is not mandatory, but I know I have places in my code where I emit some element, and then have an > improper assumption that others emit it as well. If we all agree to put the same elements, then it helps > interoperability. However, IIRC, the untrusted signing time is a required XAdES element for the lowest > levels of XAdES. The timestamp time could well be days or even weeks later. I think it is fine to have an > untrusted signing time as long as you treat it as untrusted. From the XAdES spec: "A XAdES-BES signature MAY also contain the following properties: - the SigningTime signed property ... So it is untrusted, not mandatory, but IMHO it is still useful... Bart
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]