RE: [ubl-ndrsc] Digital Signatures

[Paul Thorpe <thorpe@oss.com>]

On Wed, 4 Jun 2003, CRAWFORD, Mark wrote:

> Paul Wrote -  
> > If there is no authenication, who will trust the UBL 
> > documents outside of
> > their own organization.  The point of UBL is business to 
> > business communication,
> > right?
> 
> 
> But why does the document itself need to have the digital signature.  I can understand the need for ensuring authentication and non-repudiation, but shouldn't this be a function of the exchange mechanism - such as ebMS - and not the individual payloads?
> 
> Mark   

This is something I was also thinking about overnight.  If we omit the
signatures from the document, an external technique such as PGP or SSL or
HTTPS can be used to transmit the documents in a secure manner, so we
could leave the authenication issue to the businesses themselves rather
than including it in the UBL schemas.

Paul