Re: [dss-x] Comments on visible signature profile

[Ernst Jan van Nigtevecht <ejvn@sonnenglanz.net>]

Feedback inline..

On 25-6-2012 19:00, Juan Carlos Cruellas wrote:
> Hi,
>
> Below follow some comments related to the visible signature profile. 
> They are on Committee Specification v01 of 8 May 2010
>
> Line 57:  "is related to the binary digital signature". I would 
> propose to get rid of "binary" and leave "digital signature" only 
> (this may be a CMS or a XML or even a PDF signature)....
I agree, the words binary and digital are so closely related... and both 
are about (format) representation not visualization ...

Another proposal, if we reconsider "to view displayed information" (can 
we view non-displayed information?) as well:
" (..) there is a need to visualize the (characteristics of the) digital 
signature."

Line 59, include " , the validity of the digital signature,  " because 
usually this is one of the main items to consider.

Line 63: the phrase "the important element" does not add any useful 
information, and can be left out: Proposal:
" (..) information replace the digital signature." or:
" (..) information replace the digital signature, it only visualizes the 
most relevant characteristics of the digital signature."

> Line 63: This is the first place where the term "visible Signatures" 
> appears, without any definition. Befor that line other terms have been 
> used "visible information" (of the signature), "displayed 
> information"...I am not sure about the usage of this term...in fact, 
> the Part 6 of PAdES, which I would say could be strongly related to 
> our profile has as title: "Visual Representations of Electronic 
> Signatures". In its scope it defines:
>
> . Signature appearance: visual representation of the human act of 
> signing placed within a PDF document at signing time and linked to an 
> advanced electronic signature
>
> . Signature verification representation: visual representation of the 
> verification of an advanced electronic signature.
>
> Link to part 6 of PAdES:
> http://etsi.org/deliver/etsi_ts/102700_102799/10277806/01.01.01_60/ts_10277806v010101p.pdf 
>
>
> I would propose to consider the possibility of changing of hte term 
> "visible signatures" for a term more accurate to what we mean, i.e., a 
> visual representation of the signature...
Agree, ... because in PDF (as an example) you can visualize a 
non-visible signature... (to make things worse).

The term 'visual representation of a digital signature' sounds good. We 
also need a short term...: 'visualized digital signature'?

> . Line 92: apparently another term "visible content"
>
> . Lines 96 to 98:  In the first line I read: "..the document already 
> contain visible signature placeholders (named "signature fields")...", 
> so this to me means that signature fields are fields for the visual 
> representation of a signature....Then lines 97 to 98 read: "As part of 
> the digital signature operation, the client will need to specify which 
> signature field should be signed"...this to me means that some of the 
> fields where the visual information will appear will actually be 
> signed, and others no...but the key issue is that the term "signature 
> field" is not a field where the digital signature goes, but the field 
> where a visual representation of a digital signature appears....am I 
> correct? 
That's right. The signature field only visualizes some characteristics 
of a digital signature. (The field is actually not 'signed', it's the 
document that is signed... and some characteristics are visualized and 
put into that field; it also incorporates some 'behaviour': whenever the 
user clicks on that field more information of the corresponding digital 
signature is visualized. )

Line 98: "which signature field should be signed." --> proposal: "which 
signature field should be used to hold (contain) the visualized digital 
signature."

> and if so, wouldn't a change in the naming be worth?
I think so :-) because the term 'signature field' is very PDF related... 
(we don't  have signature fields in XML documents... )
Proposal: 'signature field' --> 'signature visualization field'.

> . Line 266 to 276. FieldName...I copy the wording of the two first lines:
> "This optional input will define the identitiy of a signature field to 
> be signed. This parameter will be sent when it is required to 
> incorporate a visible signature into the given field."
>
> So the text seems to indicate that this field first identify the field 
> to be signed (?) and second the field where the visual representation 
> of the signature will be included... so, this seems to indicate that 
> the visual representation has to be included in the field, and that 
> this field must be signed....am I right?
Agree. Note that the document is signed, not the field. The field is 
just a way to point to the location where the visualized digital 
signature has to be put.

> Line 579. FieldName for optional input for verification. The spec 
> reads that it  "willd efine the identitiy of a signature field to be 
> verified"...what exactly validating only one field means?...and what 
> is its relationship with the validation of a signgature?
Formally, a signature field cannot be verified. It is just a field.

I would say:
"This optional output will define the identity of a signature 
visualization field that corresponds to a (verified) digital signature."

Line 591: as part of the profile for the VerifyRequest:
"This optional input will define whether the verification service should 
embed into the visible signature an (..)"
this sounds a bit strange to me because the document will be changed: 
some new information is embedded into an existing field. Unless the 
visualization field is not part of the signed data.. such as newly 
created data. Maybe it was the idea to extend the document with new 
information (similar to PAdES-LTV)...???

Line 617: regarding Optional Output <FieldName>:
"This optional output will define the identity of a signature field that 
is verified. This parameter will be replied for every signature field 
that is validated in the document as part of the signature validation 
service."

Note the ".. will be replied for every signature field .. ".
How do you know to which digital signature it belongs? There is no 
reference... just a 'name' of a field. Maybe it is just a way to get all 
the fieldnames, and do a VerifyRequest for each of them..?? see line 580:

Line 580: "This optional input will define the identity of a signature 
field to be verified. This parameter will be sent in a scenario where it 
is required to validate only a certain field." (...  a certain digital 
signature referenced by the field...)

From the text, it's purpose is not clear to me...

> Regards
>
> Juan Carlos.
>
>
>
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dss-x-unsubscribe@lists.oasis-open.org
> For additional commands, e-mail: dss-x-help@lists.oasis-open.org