1. European Signatures versus Global SignaturesRome, 7 April, 2003 EESSI open specifications and interoperability The state of the art in Italy Giovanni Manca Authority for Information Technology in the public administration

2. European Signatures versus Global SignaturesRome, 7 April, 2003 Digital signature in Italy Why “Interoperability” ? The problems The solutions The future perspective AGENDA

3. European Signatures versus Global SignaturesRome, 7 April, 2003 13 accredited certificate service providers About 600.000 qualified certificates About 10.000 qualified certificates in public administration About 250.000 non qualified certificates for tax filing and ID cards (5.2 signatures) Digital Signature in Italy

4. European Signatures versus Global SignaturesRome, 7 April, 2003 The Directive : “...the interoperability of electronic- signatures products should be promoted...” (whereas 5) Interoperability is prerequisite for electronic documents exchange Interoperability in PKI can be achieved  using standards (e.g.: EESSI deliverables)  using specific technical agreements Why “interoperability” ?

5. European Signatures versus Global SignaturesRome, 7 April, 2003 A signer “subscribes” an object (an electronic document, data in a transaction, a web form, an e- mail message, etc.) A verifier checks the signature in order to ascertain:  who signed  which is the legal effectiveness of the signature (e.g: 5.1 or 5.2)  which are the signature limitations  the signed data integrity and origin What is interoperability - 1

6. European Signatures versus Global SignaturesRome, 7 April, 2003 A signer might use a SSCD on different clients The signature software can be :  an e-mail client  a web browser  a generic software application What is interoperability - 2

7. European Signatures versus Global SignaturesRome, 7 April, 2003 Documents encoding (DER, B64, XML, etc.) Certificate extensions Enveloping (PKCS#7, S/MIME, ISO 9796-2, XMLDSIG, XAdES, “Adobe signatures”, etc.) Use of CRL (e.g.: Crl Distribution Point format) E-mail messages signatures (constraints on the e- mail environment) The problems - 1

8. European Signatures versus Global SignaturesRome, 7 April, 2003 Understanding of time stamping (RFC 3161 ?) Definition of the character encoding (codepage) Identify qualified certificates limitations (attributes) Portability of smart cards (e.g. APDU) The problems - 2

9. European Signatures versus Global SignaturesRome, 7 April, 2003 PKCS#7 Signed Data PKCS#7 Data MIME

10. European Signatures versus Global SignaturesRome, 7 April, 2003 Encoding agreements (e.g. DER) Harmonized certificate profile (highlighted by TR 102 153) Choice of envelope (e.g. PKCS#7) Test bed for CRL or OCSP. CRLs are critical and this is one of the most important interoperability problems. The solutions - 1

11. European Signatures versus Global SignaturesRome, 7 April, 2003 EESSI deliverables: - ETSI TS 101 862 (Qualified certificate profile) - ETSI TS 101 861 (Time stamping profile) - ETSI TS 101 733 (Electronic signature formats) - ETSI TS 101 903 (XML Advanced electronic signatures) RFCs (e.g. 3280, 3369, 3370) ISO (e.g. 9594-8, 18014-1) The solutions - 2

12. European Signatures versus Global SignaturesRome, 7 April, 2003 A minimum profile for signed documents A common set of APDU in smart cards (e.g. : Italian memorandum of understandment with smart card manifacturers) A test bed (official or not official) for the exchange of the signed documents The solutions - 3

13. European Signatures versus Global SignaturesRome, 7 April, 2003 IDA CA-Bridge is useful for adding trust to inter- government applications (doesn’t solve interoperability) Interoperability rules are mandatory for the market and especially for manufacturers E-Europe projects harmonisation Strong and well defined legal environment The future of interoperability

14. European Signatures versus Global SignaturesRome, 7 April, 2003 Envelope profile, data and CRL DP format Certificate profile - formats Certificate profile - semantics Signatures format (e.g.:XMLDSIG, etc.) Authentication methods (e.g.: biometrics, etc.) Suggested priorities

15. European Signatures versus Global SignaturesRome, 7 April, 2003 Thanks for your attention