RE: [ubl-security] E-archiving UBL documents with external attachments

["Pim van der Eijk" <pvde@sonnenglanz.net>]

Hello,

Thanks to both of you for good comments, as usual.
Do you have a contact person, or a public mailing list, for
the VCD?  

Pim
 

-----Original Message-----
From: Roberto Cisternino [mailto:roberto@javest.com] 
Sent: 19 October 2010 10:54
To: Oriol Bausą Peris
Cc: Pim van der Eijk; ubl-security@lists.oasis-open.org
Subject: Re: [ubl-security] E-archiving UBL documents with
external attachments

Hi Pim,

I think every country has its laws, but the most common law
in EU about archiving is about storing the view of the
document (see PDF/A-1)

I do not know many other formats sanctioned for legal
archiving.

Pratically every Nation should endorse a new format of
archiving before using it legally.

The general archiving of course is always possible, but one
should be able to reproduce a stable view of the document
for the Authorities, so why
PDF/A-1 is enough adopted.

I personally think PDF/A-1 is an "old" archiving format
today as we are more required to store a structured document
than a raster or PDF graphic chunks.
Maybe PDF/A-2 is in this direction... but I would like to
see UBL endorsed for legal archiving around the globe (with
a shared methodology)

The PEPPOL VCD (Virtual Company Dossier) has some
involvments with these attachments and reference problems,
maybe you could share with them some of your thoughts.

Technically you could add a PDF/A-1 version into an UBL
document inside an UBLExtension, but again this practice
should be endorsed by the relevant Authorities.

As Governments are moving to Open Source I believe
OpenDocument represent a good sample for solving the
archiving issue.

But UBL is a structured document and I am not aware of
existing specific methodologies to archive structured
business documents.

So my final suggestion is to follow the VCD project as it
will be endorsed in all EU.

Best regards

Roberto Cisternino

> Hi Pim,
>
> The UBL Security SC has focused on defining a way to
digitally sign a 
> UBL document by using UBL Extension capabilities and
existant digital 
> signature standards such as XML Dsig or XAdES.  I think
you are going 
> one step further as your requirement is to sign a package:
A signature 
> for the UBL document plus the binary attachments.
>
> As you suggest, using External References can be a
solution for this, 
> as you are able to add the document hash in the external
reference 
> class, technically you can always sign the main UBL
document which 
> contents the hashes of the external binary objects. I am
not a lawyer 
> though, so maybe other people more knowledgable in legal
aspects can 
> confirm or rebate this point.
>
> Best regards,
> Oriol
>
> El 18/10/2010, a las 18:08, Pim van der Eijk escribió:
>
>> How do UBL projects handle this, as many UBL documents
need to be 
>> archived for years for legal reasons? From an e-archiving
point of 
>> view, is it really important, or even legally required,
that a UBL 
>> document and any externally referenced payloads were sent
as a single 
>> message?  I would think that being able to send
attachments with 
>> documents in a single MIME envelope is mainly
convenience, and that 
>> in theory it should be possible to send attachments
separately, or 
>> just reference them, as long as they are and remain
retrievable, have 
>> the referenced content-id (or other external reference
type), the 
>> document hash is valid, and the document containing the
hash is 
>> signed or sealed.  Can external references be used with
documents and 
>> attachments that that need to be archived in compliance
with relevant laws?
>
>


--
* JAVEST by Roberto Cisternino
*
* Document Engineering Services Ltd. - Alliance Member
* UBL Italian Localization SubCommittee (ITLSC), co-Chair
* UBL Online Community editorial board member (ubl.xml.org)
* Italian UBL Advisor

  Roberto Cisternino

  mobile: +39 328 2148123
begin_of_the_skype_highlighting              +39
328 2148123      end_of_the_skype_highlighting
  skype:  roberto.cisternino.ubl-itlsc

[UBL Technical Committee]
    http://www.oasis-open.org/committees/ubl

[UBL Online Community]
    http://ubl.xml.org

[UBL International Conferences]
    http://www.ublconference.org

[UBL Italian Localization Subcommittee]
    http://www.oasis-open.org/committees/ubl-itlsc

[Iniziativa divulgativa UBL Italia]
    http://www.ubl-italia.org