1. Multimedia Communication and Information Logistics for AFTER-SALES AND PRODUCT LIFE- CYCLE SUPPORT Click to edit Master title style www.remtec.fi

2. © Copyright Remtec Systems, Ltd., All rights reserved. XML and Digital Signatures A Key to Reliable eBusiness Jörgen Westerling Remtec Systems Ltd.

3. © Copyright Remtec Systems, Ltd., All rights reserved. 24.8.2015 CONTENTS eBusiness scenarios Why do we need signatures? Types of security services What is a digital signature? The XML Signature WG Application integration Digital signature issues

4. © Copyright Remtec Systems, Ltd., All rights reserved. 24.8.2015 eBUSINESS SCENARIOS Official communication with public institutions  application forms, identity documents, tax declarations, etc. Contractual relations in open networks  eBuying, eSelling, financial transactions, etc. Identifying or authorising purposes  validate the identity of a correspondent, etc.

5. © Copyright Remtec Systems, Ltd., All rights reserved. 24.8.2015 WHY DO WE NEED SIGNATURES? Signatures are authentic Signatures are unforgeable Signatures are not reusable Signed documents are unalterable Signatures can not be repudiated

6. © Copyright Remtec Systems, Ltd., All rights reserved. 24.8.2015 TYPES OF SECURITY SERVICES Authentication  Identification  Real-world equivalent: passport Confidentiality  Privacy  Real-world equivalent: sealed envelope Non-repudiaton  Signatures  Real-world equivalent: personal signature

7. © Copyright Remtec Systems, Ltd., All rights reserved. 24.8.2015 WHAT IS A DIGITAL SIGNATURE? A digital signature  confirms the identity of a message sender  confirms the authenticity of the message  confirms the integrity of the message  is verifiable  cannot be retracted

8. © Copyright Remtec Systems, Ltd., All rights reserved. 24.8.2015 HOW DIGITAL SIGNATURES WORK Message Buy 100 stock A6HR40 HT84K8 Message Digest One-way Hash Function f(msg) irw983jkaf9 Digital Signature Message Buy 100 stock Encrypted Message Sender’s Private Key

9. © Copyright Remtec Systems, Ltd., All rights reserved. 24.8.2015 HOW DIGITAL SIGNATURES WORK irw983jkaf9 Digital Signature Message Buy 100 stock Encrypted Message A6HR40 HT84K8 Message Digest One-way Hash Function f(msg) A6HR40 HT84K8 Message Digest Sender’s Public Key

10. © Copyright Remtec Systems, Ltd., All rights reserved. 24.8.2015 XML AND DIGITAL SIGNATURES  More and more of eBusiness transactions in our networks are XML-based.  There is a real need for leveraging digital signature technology in these transactions.  XML offers a established framework for transmitting signed content and generic tools for the processing and verification of signatures.

11. © Copyright Remtec Systems, Ltd., All rights reserved. 24.8.2015 THE XML SIGNATURE WG XML Signature Requirements public WD  August 20, 1999 The mission of the WG  develop a XML syntax used for digital signatures  develop procedures for computing and verifying digital signatures Signatures will provide  data integrity, authentication and/or non-repudiation

12. © Copyright Remtec Systems, Ltd., All rights reserved. 24.8.2015 THE XML SIGNATURE WG Signature requirements  XML-signatures apply to any resource addressable by a locator  XML-signatures must be able to apply to a part or totality of an XML document  An XML document of a certain type must still be recognizable as its original type when signed  Must permit the use of arbitrary encryption alogrithms

13. © Copyright Remtec Systems, Ltd., All rights reserved. 24.8.2015 THE XML SIGNATURE WG XML-Signature Scenarios document  describes different uses of XML-based digital signatures  enveloped-, unenveloped content etc. A proposal to the XML Signature WG  Richard D. Brown, GlobeSet, Inc.  base for future work

14. © Copyright Remtec Systems, Ltd., All rights reserved. 24.8.2015 APPLICATION INTEGRATION  For example a browser plug-in to add digital signatures to XML messages  Application services to verify digital signatures  XML provides the framework

15. © Copyright Remtec Systems, Ltd., All rights reserved. 24.8.2015 APPLICATION INTEGRATION XML Form XML Form Add Server Signature Commit Transaction Commit Transaction Data (XML) Decoding Sign Message Sign Message Add Client Signature Verify Server Signature Posted HTML Form XML Message (signed by server) XML Message (signed by both server and client) ServerBrowser

16. © Copyright Remtec Systems, Ltd., All rights reserved. 24.8.2015 DIGITAL SIGNATURE ISSUES Time Stamping  a signature having been found once to be valid, shall continue to be so, for the same data, months or years later Key Length & Encryption Technology  a breakthrough in encryption technology may “reveal” all signatures made with that technology Legal issues globally and locally applied  different rules in different parts of the world

17. © Copyright Remtec Systems, Ltd., All rights reserved. 24.8.2015 PUBLIC KEY INFRASTRUCTURE Certification Authority User Directory Services

18. © Copyright Remtec Systems, Ltd., All rights reserved. 24.8.2015 CONCLUSION Businesses have to gain confidence in the security and confidentiality of eBusiness transaction. This will lead to real eBusiness growth.  Transaction security  Transaction confidentiality