Re: [ubl-security] Where to go from here

[Andrea Caccia <andrea.caccia@studiocaccia.com>]

Il giorno 27/ago/2010, alle ore 18.25, Oriol Bausą Peris ha scritto:
> 
> I think the line started by Roberto identifying requirements and their solution is maybe the best approach to get to the simplest hence complete solution.
I agree with you and I'm trying to improve his proposal in 2 points:
- to find out a common way to link the signature, when needed, to parts of the UBL document
- to exclude from signing the metadata and linking information only if really required, as we have also security requirements to consider, not only business ones. Excluding all the UBLextensions and cac:Signatures can be an option (to be used carefully) but not the sole solution

Andrea