RE: [office] [OASIS Issue Tracker] Commented: (OFFICE-3028) Updatedigital signatures for better XaDeS support

[Hanssens Bart <Bart.Hanssens@fedict.be>]

Hi,

>> I would not make signing mandatory in cases when the time was not obtained from a trusted source.
>> That is, the time was not supplied by a "Time-Stamping-Authority". This excludes case 1. As for XadES,
>> I would require validation data for the time stamp.
>
> This was also attempting to standardize the existing implementation. It is fine with me if the signing time
> is not mandatory, but I know I have places in my code where I emit some element, and then have an 
> improper assumption that others emit it as well. If we all agree to put the same elements, then it helps
> interoperability. However, IIRC, the untrusted signing time is a required XAdES element for the lowest
> levels of XAdES. The timestamp time could well be days or even weeks later. I think it is fine to have an
> untrusted signing time as long as you treat it as untrusted.

From the XAdES spec:

"A XAdES-BES signature MAY also contain the following properties: 
 - the SigningTime signed property
...

So it is untrusted, not mandatory, but IMHO it is still useful...

Bart