Microsoft has decided to support the EU digital signature format XAdES in Office 2010.

Read more about this at: http://blogs.technet.com/office2010/archive/2009/12/08/digital-signitures-in-office-2010.aspx

This format builds on the XML Digital signature standard from W3C which is the globally accepted standard for XML signatures.
Read More...

International characters are becoming a growing pain for Internet protocol design.
Many protocols just deal with 7-bit ASCII on the basic protocol level while there is an increasing demand for information expression in local languages at the application layer. Various protocols like Internet mail and DNS has addressed this issue by defining conventions to carry international characters over 7-bit ASCII. The problem is rather straightforward as long as the task is limited to presentation of data in a local language context, but grows to a very hard problem when the task is expanded to comparison of canonicalized strings from different sources. The problem is even harder if consistency between visual matching and matching of encoded character strings is required.

The technical plenary at the 76th IETF in Hiroshima (November 8-13 2009) recently focused in on this particular problem. Read More...

I’m currently writing a new standard for TLS which will allow the client to cache big portions of static data exchanged during TLS handshake negotiations and allow the server to omit resending this data on consecutive handshakes, such as in consecutive re-negotiations.

My slides for the TLS meeting today at the Hiroshima IETF, showing the basic approach. is available here: Cached Info (PDF).


Read More...

A new embarrassing attack was recently discovered and exploited on Server Certificates and their validation in many current browser environments.

The discovery is that current deployment of domain name matching between the domain expressed in the certificate and the domain protected by the certificate use string matching which treat character 00 (\0) as end of string.
Read More...

The TLS workgroup in the IETF (Internet Engineering Task Force) is currently heavily engaged in finding a quick solution to the just recently discovered and published attack against TLS using TLS renegotiaion. Read More...

The first IETF draft is posted:
draft-santesson-pkix-certimage-00

The first draft is a result from an initial design process within the editorial team as well as discussions with partners and members of the CA Browser Forum.
This draft will initiate discussion in the PKIX WG whether to accept this as an adopted work item.
Read More...

The Electronic Signature Initiative group of the European Telecommunication Standards Institute, ETSI ESI, approved PAdES, the European standard for PDF Advanced Electronic Signatures on March 18, 2009.

PAdES, or ETSI standard TS 102 778, is ETSI’s continuation of EU commission funded standardization of Advanced Electronic Signatures in support of the EU Electronic Signature Directive from 1999. PAdES is the third signature standard in the ETSI series covering signatures on PDF documents. Previously published ETSI signature standards have specified signatures on XML documents (XAdES) and signatures using CMS (CAdES) where CMS is the ASN.1 based signature (Cryptographic Message Syntax) developed by IETF as part of the S/MIME standards series for secure e-mail.
Read More...

Do we need hash functions with no security properties in order to not confuse their use with cases when security is a requirement. A current discussion in the International standards community is trying to decide whether to standardise hash functions without security properties.

Read More...

How can we provide applications with standard User Interface tools to display a meaningful representation of an electronic identity (eID)
Read More...

A possible but unexplored optimisation of the TLS handshake is to cache server certificates. I’m proposing a new IETF standard that specifies a method to accomplish this. Read More...