Re: [ubl-security] E-archiving UBL documents with external attachments

The UBL Security SC has focused on defining a way to digitally sign a UBL document by using UBL Extension capabilities and existant digital signature standards such as XML Dsig or XAdES. I think you are going one step further as your requirement is to sign a package: A signature for the UBL document plus the binary attachments.

As you suggest, using External References can be a solution for this, as you are able to add the document hash in the external reference class, technically you can always sign the main UBL document which contents the hashes of the external binary objects. I am not a lawyer though, so maybe other people more knowledgable in legal aspects can confirm or rebate this point.

El 18/10/2010, a las 18:08, Pim van der Eijk escribió:

How do UBL projects handle this, as many UBL documents need to be archived for years for legal reasons? From an e-archiving point of view, is it really important, or even legally required, that a UBL document and any externally referenced payloads were sent as a single message? I would think that being able to send attachments with documents in a single MIME envelope is mainly convenience, and that in theory it should be possible to send attachments separately, or just reference them, as long as they are and remain retrievable, have the referenced content-id (or other external reference type), the document hash is valid, and the document containing the hash is signed or sealed. Can external references be used with documents and attachments that that need to be archived in compliance with relevant laws?

ubl-security message