Microsoft supports EU Signature standard in Office 2010

Microsoft has decided to support the EU digital signature format XAdES in Office 2010.

Read more about this at:

This format builds on the XML Digital signature standard from W3C which is the globally accepted standard for XML signatures.

Internationalization - A growing pain for Internet protocol design

International characters are becoming a growing pain for Internet protocol design.
Many protocols just deal with 7-bit ASCII on the basic protocol level while there is an increasing demand for information expression in local languages at the application layer. Various protocols like Internet mail and DNS has addressed this issue by defining conventions to carry international characters over 7-bit ASCII. The problem is rather straightforward as long as the task is limited to presentation of data in a local language context, but grows to a very hard problem when the task is expanded to comparison of canonicalized strings from different sources. The problem is even harder if consistency between visual matching and matching of encoded character strings is required.

The technical plenary at the 76th IETF in Hiroshima (November 8-13 2009) recently focused in on this particular problem. Read More...

TLS Cached Info update

I’m currently writing a new standard for TLS which will allow the client to cache big portions of static data exchanged during TLS handshake negotiations and allow the server to omit resending this data on consecutive handshakes, such as in consecutive re-negotiations.

My slides for the TLS meeting today at the Hiroshima IETF, showing the basic approach. is available here: Cached Info (PDF).


Null Prefix attack against TLS Server Certificates

A new embarrassing attack was recently discovered and exploited on Server Certificates and their validation in many current browser environments.

The discovery is that current deployment of domain name matching between the domain expressed in the certificate and the domain protected by the certificate use string matching which treat character 00 (\0) as end of string.

New attack against TLS

The TLS workgroup in the IETF (Internet Engineering Task Force) is currently heavily engaged in finding a quick solution to the just recently discovered and published attack against TLS using TLS renegotiaion. Read More...

IETF agrees to develop Visual eID standard

The PKIX group of the Internet Engineering Task Force has decided to adopt the work item to develop a standard for visual representation of e-identification certificates.

The PKIX group accepted the draft proposed by the
Visual eID project as starting point for the standards work.
The current PKIX draft can be found
here.

FIrst visual eID draft posted

The first IETF draft is posted:

The first draft is a result from an initial design process within the editorial team as well as discussions with partners and members of the CA Browser Forum.
This draft will initiate discussion in the PKIX WG whether to accept this as an adopted work item.

Scalable Image Formats

In the discussions concerning a visual image of an identity certificate, the image format of choice is a hot topic.

The issuer of the certificate knows what the image should look like but don’t know the type, size and resolution of the screen where it will be displayed. Therefore, what we need is a scalable image format that can render text and graphical elements.

Choosing one image format has however turned out to be a bit problematic.

Cert Cache adopted as TLS standards work

Today (March 26) at the IETF 74 conference, the TLS working group decided to adopt the certificate cache work with the intention to develop this to a new TLS standard. The decision was made after my presentation of the certcache proposal at the TLS working group.

The basic idea behind this proposal can be found in this
blog article.
The first draft (draft-santesson-tls-certcache-00) is available

ETSI approves new European PDF signature standard

The Electronic Signature Initiative group of the European Telecommunication Standards Institute, ETSI ESI, approved PAdES, the European standard for PDF Advanced Electronic Signatures on March 18, 2009.

PAdES, or ETSI standard TS 102 778, is ETSI’s continuation of EU commission funded standardization of Advanced Electronic Signatures in support of the EU Electronic Signature Directive from 1999. PAdES is the third signature standard in the ETSI series covering signatures on PDF documents. Previously published ETSI signature standards have specified signatures on XML documents (XAdES) and signatures using CMS (CAdES) where CMS is the ASN.1 based signature (Cryptographic Message Syntax) developed by IETF as part of the S/MIME standards series for secure e-mail.

Updating the IETF Time Stamp standard

The IETF standard for time stamps is currently being updated - But are the changes really necessary? Read More...

PKI Resource Query Protocol (PRQP) Deployed by Federal Bridge and OpenCA

A fairly new and unknown protocol, the PKI Resource Query Protocol (PRQP) developed in the IETF PKIX Work Group, is being deployed by the US Federal Bride and OpenCA, reports the editor of the current draft, Massimiliano Pala.


Defining Hash functions without security properties

Do we need hash functions with no security properties in order to not confuse their use with cases when security is a requirement. A current discussion in the International standards community is trying to decide whether to standardise hash functions without security properties.


Visual Electronic Identities

How can we provide applications with standard User Interface tools to display a meaningful representation of an electronic identity (eID)

Optimising TLS handshake through certificate caching

A possible but unexplored optimisation of the TLS handshake is to cache server certificates. I’m proposing a new IETF standard that specifies a method to accomplish this. Read More...