US Higher Education PKI targets digital signatures

Apparently the HEPKI-TAG is evaluating signature tools.

http://middleware.internet2.edu/hepki-tag/new/signing4.html

Since I have been working with such for a long time, I have concluded that there is room for two rather different approaches.

Off-line/Document Centric Signatures

The first one is what I would call "traditional" where the signer (human or server) signs a document that can be distributed "as is" to relying parties. Currently it appears that the Adobe PDF format would be most suitable since the reader is free and usually installed as well on most computers and operating systems. An important characteristic of document-oriented signature schemes, is that the document itself contains the signatures. The major long-term application for document-centric signatures seems to be for distributing various kinds of "certificates" like diplomas, permits, etc. that can be shown to other parties as well as being printed. Signatures may be created off-line or on-line. Some EU governments intend to use organization(only)-signed PDFs as a means to distribute digitally signed data to their "customers".

On-line/Transaction Oriented Signatures

In the EU, where signing is already an established high-volume e-government activity (C2G), the concept of transaction-signatures is prevailing. In such scenarios, the user is connected to a web service, and signs a request issued by the service (=server) when a certain process step is to be passed. A major difference compared to document centric signatures, is that such signatures are stored and validated by on-line systems only. Since the EU has the same problem as HEPKI regarding the number of choices of on-line signature products to use, I and a number of other people are trying to establish a standard for this kind of signatures. If we will be successful or not is yet to be seen...

Currently on-line signatures have almost exclusively been consumed by the requesting party only, but the goal with the EU projects (there are more than one...) is to make these schemes usable also for organization-to-organization workflow. In order to fulfill this task, most if not all proposals are based on XML and XML Schemas since the ability to directly integrate PDF, HTML or Word in an integrated workflow is rather limited (they are only used as display formats). I believe that these systems will exchange messages in XML (using SOA), where the outer container typically will be organization(only)-signed and optionally embed signatures of employees and/or citizens. That is, each task-set will have its unique XML Schema. Note that this has nothing to do with sending documents over e-mail, this is rather integrated workflow, similar to what banks have had for decades, although e-government tasks are considerably more complex than payment transactions.

An important characteristic of on-line signatures is that they can handle both multiple signatures and validation without requiring the client software (or user) to deal with "foreign" PKIs, expired certificates etc. This makes on-line signatures an ideal choice for high-volume applications where you can afford to create a web service.

One of these EU standardization efforts: http://middleware.internet2.edu/pki06/proceedings/rundgren-websigning.ppt

Anders Rundgren

pki-tc message