OPC: contents of SignatureProperty

[Jim Thatcher]

Murata-san,

After a careful review of digital signature parts created by Microsoft Office 2007, 2010, and 2013 I think the issue you raise below is a misunderstanding rather than a conflict. I acknowledge that such a misunderstanding is very likely to occur based on the current text of Digital Signatures section 13 of ISO/IEC 29500-2, and we will want to improve that text as part of our revision efforts.

I think the confusion comes from a lack of clarity about Object elements in the Signature element. Section 13.2.4.1 uses confusing language regarding package-specific Object element(s). Paragraph 2 requires that a "producer shall create one and only one package specific Object element in the Signature element." Then paragraph 3 states that the "producer shall create package-specific Object elements ... (emphasis added)". Note the use of the plural "elements". I had to read through this a few times before realizing that the use of the plural in paragraph 3 does not give permission to include more than one package-specific Object element in any given Signature, but is only there to provide an anchor for the limitations that follow, that the package-specific Object element in a Signature must contain exactly one Manifest element, and exactly one SignatureProperties element.

In order to fully understand the content in the signatures written by Microsoft Office a reader needs to look beyond the description of package-specific Object elements in Section 13.2.4.1 to Section 13.2.4.2 which states that the "producer shall create a Signature element that contains exactly one local-data, package-specific Object element and zero or more application-defined Object elements." The Object element written by MS Office with the ID of "idOfficeObject" is an application-defined Object element, so the restrictions and requirements related to package-specific Object elements in 13.2.4.1 do not apply to that Object element. If you look at the package-specific Object element (with the ID of "idPackageObject") you will find a SignatureProperties element that meets the requirements in 13.2.4.1 paragraph 3.d. As you noted in your first message, Section 2.5.2.5 of MS-OFFCRYPTO accurately describes the contents of the Microsoft Office application-defined Object element.

    <SignatureProperties>
      <SignatureProperty Id="idSignatureTime" Target="#idPackageSignature">
        <mdssi:SignatureTime>
          <mdssi:Format>YYYY-MM-DDThh:mm:ssTZD</mdssi:Format>
          <mdssi:Value>2014-02-26T19:11:27Z</mdssi:Value>
        </mdssi:SignatureTime>
      </SignatureProperty>
    </SignatureProperties>

I'll work on a proposal to make it more clear earlier in Section 13 that a digital signature part can have multiple Object elements, but exactly one of those must be the package-specific Object element.

Jim

From: eb2mmrt at gmail.com [mailto:eb2mmrt at gmail.com] On Behalf Of MURATA Makoto
Sent: Monday, February 24, 2014 10:00 PM
To: SC34
Subject: Re: OPC: contents of SignatureProperty

I still believe that there is a conflict here, but I
would like to make a comment about the
schema.

The SigantureProperty element in question appears within
an Object element.  The complex type for Object has
<any namespace="##any" processContents="lax"/>.

Does this wild card allow the SignatureProperty element
to have any attributes and contents?  No, processContents="lax"
implies that "*validate* if you can, don't worry if you can't"
(W3C XML Schema Part 1)

Regards,
Makoto

2014-02-25 11:56 GMT+09:00 MURATA Makoto <eb2m-mrt at asahi-net.or.jp<mailto:eb2m-mrt at asahi-net.or.jp>>:
I am studying digital signature in Office for the standardization
of XAdES.

I find that both Word 2007 and [MS-OFFCRYPTO] ignores a requirement
in 29500-2:2012.

13.2.4.1 "Modifications to the XML Digital Signature
Specification" in 29500-2:2012 specifies that "A
SignatureProperty element shall contain exactly one
SignatureTime child element".

However, Word 2007 creates a different child element.

      <SignatureProperty Id="idOfficeV1Details" Target="#idPackageSignature">
        <SignatureInfoV1 xmlns="http://schemas.microsoft.com/office/2006/digsig">
          ...
        </SignatureInfoV1>
      </SignatureProperty>

This appears to follow "2.5.2.5 idOfficeObject Object Element"
in [MS-OFFCRYPTO]

"A SignatureProperties element containing a SignatureProperty
element, which MUST contain a SignatureInfoV1 element that
specifies the details of a digital signature in a
document. The following XML Schema specifies the contents of
the SignatureProperty element: "

I think that there is a clear conflict here.

--
Regards,

Makoto



--

Praying for the victims of the Japan Tohoku earthquake

Makoto
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.vse.cz/pipermail/sc34wg4/attachments/20140226/987f3c9e/attachment-0001.html>