The business case for signatures - is it really there?

[Mikkel Hippe Brun <mhb@itst.dk>]

Dear all,

A signature class is now being proposed to be a part of all UBL documents.

The following business case for this class has been explained to me: Prior
to the exchange of a UBL document, authorized persons may have been required
to digitally approve internal process steps. For an electronic order this
could be the flow:

1. An employee in Big Inc. (Mrs. Imonitorstock) discovers that the stock of
pencils is critically low and sends a request to the purchasing department.
This request is digitally signed.
2. An employee (Mr. Underdog) in the purchasing department creates an Order
and sends it to his boss Mr. Imakethedecision. The signature part of the
Order contains metadata about the signature applied by Mrs. Imonitorstock.
The order is off course signed by Mr. Underdog.
3. Mr. Imakethedecision verifies the signature applied by the order by Mr.
Underdog, adds another ten pencils to the order. The signature metadata of
Mr. Underdog is added to the order and the order is digitally signed by Mr.
Imakethedecision and sent to the supplier.

The above example demonstrates that the signature part proposed to all UBL
messages contains information about previous signatures and approvals
involved in the internal workflow of the organization sending a message. It
is not an attempt to store metadata about the signature applied to the
message on its way from sender to receiver. (This would off course also be
impossible unless you only signed a subset of the document).

The need for the Signature class has come up in the Transport group and
probably for a good reason. I propose that we do not add the Signature class
to documents where we have not seen a strong business case from a real
domain. Academic arguments stating that it would be "nice to have" do not
carry the same weight.

Let's keep UBL on the 80/20 track.

- mikkel


Mikkel Hippe Brun 
Chief Consultant, M.Sc. 
Phone: +45 3337 9220 
Cell: +45 2567 4252 
E-mail: mhb@itst.dk 

National IT and Telecom Agency 
Office of IT Strategy 
Holsteinsgade 63 
DK-2100 Copenhagen Ø 
Denmark 
Phone: +45  3545 0000 
Fax: +45 3545 0010 
www.itst.dk 
itst@itst.dk