Tools and documentation for Standard Signing Policy Names

This page features tools and documentation related to a proposal for standard signing policy names to give a better and more clearly defined meaning to digital signatures.

The problem that we address here is how to differentiate the importance and intention of a digital signature; for example made under a contract, versus at the door for a delivery receipt.

The general proposal that we make is to prepare a set of standardised signing policies through a Universal Resource Name, which is a possible syntax for Policy URIs embedded in signing systems.

All software on this page is available under the Gnu GPL License. Other, commercially more usable licenses can only be obtained through negotiation with OpenFortress.

Documentation

A full report is available on the preparation for this project. It gives a full specification of the solution as we currently envision it, and it explains how we arrived at this solution.

• Report: Giving Meaning to Digital Signatures

The technical specification itself is available separately. This is basically the same as chapter 3 of the report, but in reStructuredText format so that it can be easily converted into an internet-draft and RFC.

• Specification: Syntax, Semantics and Procedures for Standard Signing Policy Names

Library

A library has been developed in C:

• C source code under GPL license.
• API documentation under GPL license.

Utilities

To make it easy to work with the new URN scheme and the required XML module description files, two graphical tools have been developed. Both tools are presented here as a Java Webstart application. In order to run them, you need Java 2 Standard Edition (J2SE) version 5.0 or higher (Windows/Linux/Solaris or Mac OS).

• Module Composer to compose XML module description files, under GPL license.
• URN Composer to compose a URN from a set of module, see note below, under GPL license.
• JAVA source code under GPL license.

Note: in order to use the URN Composer, one needs to have access to one or more XML module descriptions. These are stored in either a user-specific location (like ~/.sigpol on unix) or a system-wide location (/usr/share/sigpol on unix). The Module Composer will automatically save the module descriptions in the correct directory. It will also tell you which locations are used for your specific platform.

Status

Project news weblog

This project is currently on hold. The logical next step would be to craft it into an internet standard through the IETF. We are willing to invest labour into that, but we are looking for partners for whom this is interesting enough to compensate our time spent on that.