Report - Browser Digital Signature Standards

Although S/MIME has its uses, WebSigning (signing forms in a web browser environment), has become a more significant signature tool for many e-governments. This is mostly due to the fact that interactive services are considerably more flexible than static e-mail, but it also depends on the ease of establishing confidentiality through HTTPS.

However, there is a fly in the soup. There is no standard for WebSigning, making this facility costly to deploy as well as non-interoperable.

Recently a number of leading pharmaceutical companies who have formed an authentication forum (SAFE - http://www.safe-biopharma.org), launched an internally developed standard called USSI (Universal SAFE Signing Interface) [1,2].

However, similar WebSigning "standards" have also been launched by:
- The Swedish government [1, 2] - http://www.bankid.com
- The Austrian government - http://www.buergerkarte.at/konzept/securitylayer/spezifikation/aktuell/
- The Norwegian government [1] - http://www.handel.no/pkiforum/seid/index.asp?id=1185

- The Danish government [1] - http://www.openoces.org
- The Estonian government [1] - http://www.openxades.org
- The Hongkong government [2] - https://e-business.hongkongpost.com/ecertdeveloper/eng/downloads.jsp
- The DoD - Not public
- Dozens of independent software vendors

2] NDA protected.

Somewhat surprising, the people who seem to be the least aware of these efforts to transform the ubiquitous Internet browser from being a "Universal Thin Client", to become a "Universal PKI-enabled Thin Client" are actually the browser vendors and W3C!

Anders Rundgren

Disclaimer: The views expressed in this message are solely the author's and should not be attributed to his employer or their clients

pki-tc message