RE: [dss-x] Remarks on the ETSI - PAdES visible signature document

["Pope, Nick" <Nick.Pope@thales-esecurity.com>]

Title: Message

Ezer,

 

I note your point.  The current text does not preclude applications to select image (it says what it should include not what it should NOT include).  This option is not specifically mentioned as we wish to encourage use of certified images then this can be verified.

 

Nick

-----Original Message-----
From: Ezer Farhi [mailto:Ezer@arx.com]
Sent: 13 May 2010 11:18
To: dss-x
Subject: [dss-x] Remarks on the ETSI - PAdES visible signature document

Hi All,

 

I went over the draft of the ETSI PAdES document and I have one general remark:

 

The document refers to using an image of a hand-written signature and requires getting the hand-written signature from the X509 Certificate of the signer.

I think that is a preferred option however, for the following reasons I think that the document should allow images to be selected by applications for the following reasons:

- It will take a while for CAs to enhance certificates with the new extension. And also what if the CA policy is not to enhance the certificate with a handwritten signature?

- A signer may have several graphical signatures (regular one, Initials, different colors of graphical signatures, ...)

- The same may go for company Logo, should this also be part of the signer certificate as well?

 

I think that the document should be more flexible on this requirement and maybe tag the fact the image was retrieved from the certificate in a different manner (for example, mark this in the Visual Representation of the advanced signature) but still allow incorporating handwritten signatures or Logos as part of the signature ceremony.

 

Regards,

Ezer

 

 

Ezer Farhi | VP Engineering | ARX
phone: +972.3.9279529 | fax: +972.3.9230864 | email: ezer@arx.com | www.arx.com

 

Consider the environment before printing this mail.

"Thales e-Security Limited is incorporated in England and Wales with company registration number 2518805. Its registered office is located at 2 Dashwood Lang Road, The Bourne Business Park, Addlestone, Nr. Weybridge, Surrey KT15 2NX.

The information contained in this e-mail is confidential. It may also be privileged. It is only intended for the stated addressee(s) and access to it by any other person is unauthorised. If you are not an addressee or the intended addressee, you must not disclose, copy, circulate or in any other way use or rely on the information contained in this e-mail. Such unauthorised use may be unlawful. If you have received this e-mail in error please delete it (and all copies) from your system, please also inform us immediately on +44 (0)1844 201800 or email postmaster@thales-esecurity.com. Commercial matters detailed or referred to in this e-mail are subject to a written contract signed for and on behalf of Thales e-Security Limited".