Hi Peter, Tim,
Sorry for the late response. We have
reviewed the proposal for signature reference. Below is our comment:-
- The signature reference calls
for the usage of detached signature. This would be useful in scenario
where binary data is involved and where the referenced signature is always
available and accessible via the specified URL
- Both ebXML messaging service
and COML however uses the enveloped approach, wherein the digital
signature (digsig) is embedded inside the message itself. In the case of
COML, XPath is being used to reference the appropriate section of the
payload that needs the digsig. This is a preferred approach where we need
to perform online verification of digsig. Hence, there will not be a need
to make reference to an external resource, which may not be available at
the time when the digsig verification is being performed. This reduces the
possibility of digsig failure.
We would urge that you study the COML
approach in handling digsig for XML payload.
Regards
Kama
UBL TSC Chair
-----Original
Message-----
From: Tim McGrath
[mailto:tmcgrath@portcomm.com.au]
Sent: Tuesday, September 13, 2005 9:06 PM
To: ubl-tsc@lists.oasis-open.org
Subject: [ubl-tsc] [Fwd: [ubl-psc]
Proposal for a signature refenrence]
forwarded from Peter
Borresen.
this is a sample isnatcen of his propsoed digital signature approach. can
we get some technical feedback on the suitability of this for our needs.
-------- Original Message --------
Hallo Thomas and Procurement subcommitee
Please find my proposal for a signature reference in the xml-spy screen
dump and xml example file.
Best regards
Peter L. Borresen
<<SignatureReference.gif>> <<UBL-Order-1.0-Office-Example_with
signatureReference.xml>>
--
regards
tim mcgrath
phone: +618 93352228
postal: po box 1289 fremantle western australia 6160
DOCUMENT ENGINEERING: Analyzing and Designing Documents for Business Informatics and Web Services
http://mitpress.mit.edu/catalog/item/default.asp?sid=632C40AB-4E94-4930-A94E-22FF8CA5641F&ttype=2&tid=10476