I announced a few hours ago, on my presentation about ODF at Campus Party that on last week, the committee that develops ODF (OASIS ODF TC) has approved a proposal presented by me and Bob Jolliffe (Government of South Africa) regarding digital signatures support on ODF 1.2.
The use of XMLDSig for digital signatures in ODF 1.2 had been previously approved and in our proposal, we extend this support incorporating XAdES, an extension to XMLDSig developed by ETSI which incorporates, among other features, the vector “time” in the digital certificates.
XAdES was also incorporated by the ICP-Brazil (Brazilian framework and legal requirement regarding Digital Signatures) on its latest version, finalized in December 2008.
The original proposal was presented by us at the ODF TC in July 2008, proposed a change at the ODF 1.2 schema to identify signature type used (XMLDSig or one of the possible XadES types), in addition to describing the mechanisms used to identify the signed XML stream.
After a series of discussions with experts from the ODF committee and also some external experts, as the people who developed XAdES within ETSI, we decided to simplify the proposal, but we are committed to establish in the medium term a framework for digital signatures within the ODF specification. With the simplification made, we indicated clearly that they are accepted XMLDSig signatures and its extensions (XAdES).
The next version of ODF - that stills without a name within the committee - we will work to incorporate within the specification, profiles of existing digital signatures (this is something we couldn’t do today, because the real world applications of digital signatures as the ICP-Brazil still very rare to find… In Brazil we are in the vanguard, believe in it or not).
As soon as the version 1.2 of ODF is approved at the committee, which I expect to occur in the next months, we (me and Bob) will start working to specify the framework for digital signatures and we already agreed that one of the profiles will be the ICP -Brazil.
The incorporation of these profiles on the next version of the ODF specification will be important, because it will allow developers to have in hand, inside the ODF spec, all the documentation needed to validate and support the specific profiles of digital signature, without the need to consult any external reference (just to give you an an idea, if someone today wants to implement the ICP-Brazil on an application, will need to consult the documentation available in Brazil, which is all in Portuguese. I almost had to translate all the ICP-Brazil spec documents to explain some things to the other members of the committee).
It was a great pleasure to have worked for all these months on this proposal within the committee and it is very gratifying to participate in the ODF development committee (I hope that other Brazilians and Latin American folks felt animated with that history and participate more in international committees like this one. It may sounds incredible to some people, but we really have something to contribute from Brazil and Latin America).
I want to thanks to the staff of the ITI (National Institute of Information Technology) that technically supported us during this process and a super special thanks to Bob Jolliffe, who helped me in this work (and Bob, we have much work ahead and count on me).
Finally, every time you use a digital signature on a ODF document, remember that the specification for this was made by a Brazilian (Latin American) and a South African. In times of Barack Obama, this is at least, a very interesting observation