Report - Browser Digital Signature Standards

Although S/MIME has its uses, WebSigning (signing 
forms in a web browser environment), has become a more 
significant signature tool for many e-governments.  This is mostly due to 
the fact that interactive services are considerably more flexible than static 
e-mail, but it also depends on the ease of establishing confidentiality through 
HTTPS.

However, there is a fly in the soup.  There is no standard 
for WebSigning, making this facility costly to deploy as well as 
non-interoperable.

Recently a number of leading pharmaceutical 
companies who have formed an authentication forum (SAFE - http://www.safe-biopharma.org), 
launched an internally developed 
standard called USSI (Universal SAFE  Signing Interface) [1,2].

However, similar WebSigning "standards" have also been 
launched by:
- The Swedish government [1, 2] - http://www.bankid.com
- The 
Austrian government - http://www.buergerkarte.at/konzept/securitylayer/spezifikation/aktuell/
- The Norwegian government [1] - http://www.handel.no/pkiforum/seid/index.asp?id=1185

- The Danish government [1] - http://www.openoces.org
- The 
Estonian government [1] - http://www.openxades.org
- The Hongkong government [2] - https://e-business.hongkongpost.com/ecertdeveloper/eng/downloads.jsp
- The DoD - Not public
- Dozens of independent software 
vendors

 

1] In cooperation with commercial 
vendors.

2] NDA protected.

Somewhat surprising, the 
people who seem to be the least aware of these efforts to transform the 
ubiquitous Internet browser from being a "Universal Thin Client", to become a 
"Universal PKI-enabled Thin Client" are actually the browser vendors and 
W3C!

Anders Rundgren

Disclaimer: The views expressed in this 
message are solely the author's and should not be attributed to his employer or 
their clients