Comments on use of Signatures in ODF

Title: Message

Comments on OASIS OpenDocument v1.2 csprd02-part3 

Nick 
Pope & Juan Carlos Cruellas - Experts ETSI Technical Committee on Electronic 
Signatures and Infrastructures

27 
December 2010

We welcome the adoption of the 
adoption of XAdES in ODF and will provide shortly the revised draft technical 
specification, to be TS 102 918, for the association of advanced electronic 
signatures (AAdES), including XAdES signatures, with objects within a 
package.  It is our aim that this be 
compatible with the use of ODF.

We 
have reviewed OpenDocument v1.2 csprd02-part3 and have identified the following 
areas where we believe further clarification is required:

1. The 
note in page 16 differentiates between files that are part of the "OpenDocument 
package" and files that are part of "the content stored within the 
package"....The text seems to say that files within META-INF folder are of the 
first type...What exactly is the semantic difference between this "opendocument 
package" and the "content stored within the package"?

2. 
Also in the note the sentence: "Therefore, different rules regarding the 
resolution of relative IRIs may apply". Then there is a rule on what has to be 
considered the base IRI. Is this the only aspect where the resolution of 
relative IRIs are different? If not, what other aspects are different? Should 
the specification detail them or are general enough as to be already specified 
elsewhere, and if so, where?

3. How 
the resolution of relative IRIs specified in 3.7 would affect a regular XMLDSIG 
implementation that resolves relative IRIs following the general principles of 
RFC 3986 but do not take into consideration 3.7?  Are we right if we assume that they could 
fail in successfully referencing data objects within the package if they do not 
implement that section?.

4. 
Section 5.3 point 1 reads:

"A 
<ds:Reference> element which has a Type attribute value of 
"http://docs.oasisopen. org/office/v1.2/OS/OpenDocument-v1.2.odt" shall refer to 
files in the same package in the accordance with the procedure for resolving 
IRIs 3.7, except that the file entry path shall be the name of the signature 
file with its relative path omitted"

What 
is the reason for this exception in the general processing of section 3.7, where 
in its first point the file entry path included the relative path? would not be 
worth to include the rationale for this as a note?

5. 
Could it be possible to include as informative annexes examples of resolution of 
relative IRIS for illustrating the process described in 3.7, and also some 
examples of referencing from digital 
signatures?

Consider the environment before printing this mail.

"Thales e-Security Limited is incorporated in England and Wales with company registration number 2518805. Its registered office is located at 2 Dashwood Lang Road, The Bourne Business Park, Addlestone, Nr. Weybridge, Surrey KT15 2NX.

The information contained in this e-mail is confidential. It may also be privileged. It is only intended for the stated addressee(s) and access to it by any other person is unauthorised. If you are not an addressee or the intended addressee, you must not disclose, copy, circulate or in any other way use or rely on the information contained in this e-mail. Such unauthorised use may be unlawful. If you have received this e-mail in error please delete it (and all copies) from your system, please also inform us immediately on +44 (0)1844 201800 or email . Commercial matters detailed or referred to in this e-mail are subject to a written contract signed for and on behalf of Thales e-Security Limited". 

Comments on OpenDocument-v1.2-csprd02-part3..pdf