RE: [dss-x] Remarks on the ETSI - PAdES visible signature document

Title: Message

Ezer,

 

I note 
your point.  The current text does not preclude applications to select 
image (it says what it should include not what it should NOT include).  
This option is not specifically mentioned as we wish to encourage use of 
certified images then this can be verified.

 

Nick

  

  
-----Original Message-----
From: Ezer Farhi 
  [mailto:] 
Sent: 13 May 2010 11:18
To: 
  dss-x
Subject: [dss-x] Remarks on the ETSI - PAdES visible signature 
  document

  

  
Hi All,

  
 

  
I went over the draft of the ETSI 
  PAdES document and I have one general remark:

  
 

  
The document refers to using an 
  image of a hand-written signature and requires getting the hand-written 
  signature from the X509 Certificate of the signer. 

  
I think that is a preferred option 
  however, for the following reasons I think that the document should allow 
  images to be selected by applications for the following 
  reasons:

  
- It will take a while for CAs to 
  enhance certificates with the new extension. And also what if the CA policy is 
  not to enhance the certificate with a handwritten signature?

  
- A signer may have several 
  graphical signatures (regular one, Initials, different colors of graphical 
  signatures, ...)

  
- The same may go for company 
  Logo, should this also be part of the signer certificate as 
  well?

  
 

  
I think that the document should 
  be more flexible on this requirement and maybe tag the fact the image was 
  retrieved from the certificate in a different manner (for example, mark this 
  in the Visual Representation of the advanced signature) but still allow 
  incorporating handwritten signatures or Logos as part of the signature 
  ceremony.

  
 

  
Regards,

  
Ezer

  
 

  
 

  
Ezer 
  Farhi | VP Engineering | ARX 
  
phone: +972.3.9279529 | fax: +972.3.9230864 | email:  | www.arx.com 

  

  

  
 

Consider the environment before printing this mail.

"Thales e-Security Limited is incorporated in England and Wales with company registration number 2518805. Its registered office is located at 2 Dashwood Lang Road, The Bourne Business Park, Addlestone, Nr. Weybridge, Surrey KT15 2NX.

The information contained in this e-mail is confidential. It may also be privileged. It is only intended for the stated addressee(s) and access to it by any other person is unauthorised. If you are not an addressee or the intended addressee, you must not disclose, copy, circulate or in any other way use or rely on the information contained in this e-mail. Such unauthorised use may be unlawful. If you have received this e-mail in error please delete it (and all copies) from your system, please also inform us immediately on +44 (0)1844 201800 or email . Commercial matters detailed or referred to in this e-mail are subject to a written contract signed for and on behalf of Thales e-Security Limited".