<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Hello –<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">>
</span>Even if we introduce the new version of XAdES as part of the revision of OPC, the extension points will continue to be available.<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Perhaps I misunderstood, then. I thought the position was to effectively prohibit use of the current XAdES and only allow use of the new upcoming version. Even
discouraging use of the existing one in favor of the upcoming one seems a bit much in my mind. As long as OPC gives guidance on which choices to make when implementing XAdES, that should suffice for interoperability and leave flexibility to implementers to
choose what they support, however good or bad an idea it is – i.e., no signature, plain XMLDSig, current XAdES, upcoming XAdES.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I may not be familiar enough with the details of the upcoming XAdES, but I think the small number of interop requirements that we might want to add to OPC apply
equally to both the established and upcoming XAdES. I think it can be done in a way that is agnostic to which edition of XAdES implementers choose. I’m don’t think it’s quite right to think of a “Microsoft XAdES” as opposed to regular XAdES or XYZ Corp’s
XAdES. Our implementation is conformant XAdES and we simply publish a document containing information about the choices we made where XAdES allows flexibility so that others know what to expect in OOXML files generated by Office and what we didn’t implement
support for in Office.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Given the above…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">>
</span>It means that a set of conventions on the use of the new version of XAdES will be established. New applications based on the revised OPC will follow these conventions.<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I fully agree with the first sentence immediately above and think it applies to XAdES in general; or, slightly differently, to both the current and upcoming versions.
The second sentence could be taken to mean that use of the current XAdES is deprecated and implementations should use the upcoming one. The upcoming one is so early in its life that I think this might be premature. I may also be misinterpreting that second
sentence and this isn’t what you intended.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">>
</span>Then, we will have two sets of conventions: Microsoft XAdES and the revised OPC. They are unlikely to be identical.<span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I think this is the crux of what we need to figure out in detail. My impression is that XAdES hasn’t changed terribly in its markup details, which would allow
OPC to make restricting statements that would apply equally to current and upcoming XAdES. I may be wrong. Though if the differences are minor, we may simply note something like: for TS 101 903: foo, and for EN 319 132: bar. We have a proposed set of requirements
based on TS 101 903 in a draft we looked at in Bellevue, very similar to both MS-OFFCRYPTO and ODF 1.2, which we could evaluate against the latest draft of EN 319 132 to get a better idea of this.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">John<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> eb2mmrt@gmail.com [mailto:eb2mmrt@gmail.com]
<b>On Behalf Of </b>MURATA Makoto<br>
<b>Sent:</b> Wednesday, May 27, 2015 7:29 PM<br>
<b>To:</b> John Haug<br>
<b>Cc:</b> e-SC34-WG4@ecma-international.org<br>
<b>Subject:</b> Re: Japanese position on the introduction of XAdES to OPC.<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">John,<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I am afraid that I was not clear. OPC as of now already provides extension points. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">They allow third parties to introduce legitimate extensions. Microsoft XAdES is <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">such a legitimate extension.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Even if we introduce the new version of XAdES as part of the revision of OPC, <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">the extension points will continue to be available. Thus, Microsoft XAdES <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">will continue to be a legitimate extension of OPC. Implementations of
<br>
such extensions will continue to be conformant. Backward compatibility<br>
will not be destroyed.<br>
<br>
Then, what does it mean to incorporate the new version of XAdES into <br>
the revision of OPC? It means that a set of conventions on the use of <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">the new version of XAdES will be established. New applications <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">based on the revised OPC will follow these conventions.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">If we incorporate the existing version of XAdES into the revision of <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">OPC, we will establish a set of conventions on the use of <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">the existing version of XAdES. Then, we will have two <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">sets of conventions: Microsoft XAdES and the revised OPC. They <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">are unlikely to be identical. If they diverge, we will cause a lot <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">of troubles to users and implementations. I thus think that <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">not incorporating the existing version of XAdES into the <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">revised OPC is the best way to provide backward compatibility.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Perhaps, one solution is to provide an informative note about <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">the use of the existing XAdES in the OPC revision. The note <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">should say that such use IS conformant.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Regards,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Makoto<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">2015-05-28 8:19 GMT+09:00 John Haug <<a href="mailto:johnhaug@exchange.microsoft.com" target="_blank">johnhaug@exchange.microsoft.com</a>>:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I suspect my position on this would be easily guessed, but I strongly disfavor updating OPC in a way
that breaks backward compatibility. Even putting aside my Microsoft hat representing the single largest installed base of implementations of OPC, whether that be Office or XPS (both the .xps file format and Windows print spool format which implement ECMA-388,
which incorporates OPC by reference) or .NET Framework (System.IO.Packaging) or Windows Presentation Framework/XAML – and there are other implementers – I’d have to argue the point that where software has adopted digital signatures based on XMLDSig and gone
further, the existing XAdES specifications are what has been adopted. We’d do a disservice to current implementers and to users of many current documents to create a discontinuity in compatibility.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I believe we are getting too far down into the details of whatever work ETSI is doing now or may do
in the future to revise XAdES. There is risk I feel is inappropriate to take on in requiring use of a new, unpublished/unapproved proposed standard that has no adoption by industry while ignoring one that does have at least some industry adoption. Regardless
of considering which version to require, I don’t believe we need to or should mandate one version or another – let implementers decide what level of security they need for their application. I assert that our interest from the perspective of 29500 is to provide
requirements that improve interoperability among implementations of OPC that use XMLDSig and XAdES. And I still believe we can do that with simple statements like we’ve looked at before, ones that just require this choice or that where XAdES provides options
or leaves something as implementation-specific. Both the new and existing versions of XAdES are backward-compatible extensions of XMLDSig, the fundamental underlying technology the use of which is an important choice to make for the standard, so the previous
sentence should hold.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">>
</span>As you know, Japanese XAdES experts are unhappy with the MS implementation.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I think this is in reference to Office writing out SignaturePolicyIdentifier elements that are empty
or use SignaturePolicyImplied. Whether to allow that (which is legal XAdES) is a question we can take up along with the context of other related standards and implementations (e.g., ODF and MS-OFFCRYPTO make no statement on these elements). Chris and I can
raise those concerns with the development team here, but let’s leave any individual concerns with Office’s particular implementation choices separate from what we choose to specify in the standard.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">John</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">
<a href="mailto:eb2mmrt@gmail.com" target="_blank">eb2mmrt@gmail.com</a> [mailto:<a href="mailto:eb2mmrt@gmail.com" target="_blank">eb2mmrt@gmail.com</a>]
<b>On Behalf Of </b>MURATA Makoto<br>
<b>Sent:</b> Tuesday, May 26, 2015 8:02 PM<br>
<b>To:</b> SC34<br>
<b>Subject:</b> Japanese position on the introduction of XAdES to OPC.</span><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Dear colleagues,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">This mail is to describe the Japanese position on the <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">introduction of XAdES to OPC. Japan believes that the <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">ongoing revision of OPC (Open Packaging Conventions) <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">should use the first part of the new version of XAdES and<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">nothing else.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">As we have discussed, there are two versions of XAdES. An existing<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">version of XAdES is documented in ETSI technical specifications, while<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">a new and incompatible version is expected to become ENs (European<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Standards) in one year.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">The first version is already implemented by Microsoft Office. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">This means that, if we introduce this version of XAdES to OPC <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">as a standard, we will run the risk of making the current implementation<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">by Microsoft non-conformant. As you know, Japanese XAdES <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">experts are unhappy with the MS implementation.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">The latest version of XAdES consists of two specifications.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Apparently, Europe is committed to the first part. The second part <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">appears to be an alibi for not abandoning some<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">features of the old version.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Moreover, the first part does not use any external files. But the<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">second does. This means that if such external files exist in an OPC<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">package, they look like orphans and will be thrown away by many<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">implementations including MS Office. To avoid this problem, we will<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">have to introduce relationship types. Japan does not think that the <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">second part has advantages significant enough for this additional effort.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Regards,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Makoto<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><br>
<br clear="all">
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">-- <o:p></o:p></p>
<div>
<p class="MsoNormal"><br>
Praying for the victims of the Japan Tohoku earthquake<br>
<br>
Makoto<o:p></o:p></p>
</div>
</div>
</div>
</body>
</html>