<div dir="auto">Interesting about ETSI.<div dir="auto">They are though fairly late to the party.</div><div dir="auto"><br></div><div dir="auto">cheers</div><div dir="auto">Anders</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sun, 5 May 2019, 22:05 Ralph Bragg, <<a href="mailto:ralph.bragg@raidiam.com">ralph.bragg@raidiam.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-GB" link="blue" vlink="purple">
<div class="m_5379397811099459776WordSection1">
<p class="MsoNormal">Hi,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Please see attached the communication from ETSI regarding choices of standards that have been adopted by the standards bodies specifically highlighting some concerns with HTTP Signature.<u></u><u></u></p>
<p><span style="font-family:"TimesNewRomanPSMT",serif">Firstly, ETSI ESI has become aware that some PSD2 API standards communities are considering adoption of the Internet Draft standard for HTTP Signatures (</span><span style="font-size:10.0pt;font-family:"TimesNewRomanPSMT",serif;color:blue"><a href="https://tools.ietf.org/html/draft-cavage-http-signatures-10" target="_blank" rel="noreferrer">https://tools.ietf.org/html/draft-cavage-http-signatures-10</a></span><span style="font-size:10.0pt">)</span><span style="font-family:"TimesNewRomanPSMT",serif">.
It should be noted that: </span><u></u><u></u></p>
<ol start="1" type="1">
<li><span style="font-family:"TimesNewRomanPSMT",serif">HTTP Signature has status draft only and has not necessarily undergone full review by cryptographic experts concerning possible vulnerabilities inherent to that format
<u></u><u></u></span></li><li><span style="font-family:"TimesNewRomanPSMT",serif">It makes no direct provision for preventing certificate substitution attacks and can consequently be vulnerable such attacks (cf. RFC 5035, <a href="https://tools.ietf.org/rfcmarkup/5035" target="_blank" rel="noreferrer">https://tools.ietf.org/rfcmarkup/5035</a>
- Enhanced Security Services for S/MIME) <u></u><u></u></span></li></ol>
<p style="margin-left:18.0pt"><span style="font-family:"TimesNewRomanPSMT",serif">ETSI ESI has published a set of standards, commonly referred to a CAdES and XAdES for digital signatures applied to binary or XML data formats, which support signing arbitrary
content even for signatures detached from the data being protected (reference: EN 319 122 and EN 319 132 respectively) which could be used for PSD2 APIs. Also the ETSI PAdES (EN 319 142) standard can be used for signing PDF documents. These mature standards
provide protection against known risks, can be used to assure the evidential value of the signatures over the long term and are the accepted formats for advanced electronic signatures and seals under the eIDAS regulation 910/2014.
</span><u></u><u></u></p>
<p><b><span style="font-family:"TimesNewRomanPSMT",serif">ETSI is also working on an equivalent standard digital signature format to apply signatures to JSON data structures. This builds on the existing IETF RFC 7515 standard for JSON Web Signatures.
</span><u></u><u></u></b></p>
<p class="MsoNormal">Cheers,<u></u><u></u></p>
<p class="MsoNormal">Ralph<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Openid-specs-fapi <<a href="mailto:openid-specs-fapi-bounces@lists.openid.net" target="_blank" rel="noreferrer">openid-specs-fapi-bounces@lists.openid.net</a>> on behalf of Anders Rundgren via Openid-specs-fapi <<a href="mailto:Openid-specs-fapi@lists.openid.net" target="_blank" rel="noreferrer">Openid-specs-fapi@lists.openid.net</a>><br>
<b>Reply-To: </b>Financial API Working Group List <<a href="mailto:Openid-specs-fapi@lists.openid.net" target="_blank" rel="noreferrer">Openid-specs-fapi@lists.openid.net</a>><br>
<b>Date: </b>Sunday, 5 May 2019 at 20:42<br>
<b>To: </b>Financial API Working Group List <<a href="mailto:Openid-specs-fapi@lists.openid.net" target="_blank" rel="noreferrer">Openid-specs-fapi@lists.openid.net</a>><br>
<b>Cc: </b>Anders Rundgren <<a href="mailto:anders.rundgren.net@gmail.com" target="_blank" rel="noreferrer">anders.rundgren.net@gmail.com</a>><br>
<b>Subject: </b>[Openid-specs-fapi] Fwd: New specs for Hashlink and HTTP Signatures released<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt">F.Y.I<u></u><u></u></p>
<div>
<div>
<p class="MsoNormal">---------- Forwarded message ---------<br>
From:<strong><span style="font-family:"Calibri",sans-serif">Manu Sporny</span></strong> <<a href="mailto:msporny@digitalbazaar.com" target="_blank" rel="noreferrer">msporny@digitalbazaar.com</a>><br>
Date: Sun, 5 May 2019, 20:34<br>
Subject: New specs for Hashlink and HTTP Signatures released<br>
To: W3C Credentials CG <<a href="mailto:public-credentials@w3.org" target="_blank" rel="noreferrer">public-credentials@w3.org</a>><u></u><u></u></p>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
<br>
Hi all,<br>
<br>
New specs have been published for Hashlink:<br>
<br>
<a href="https://tools.ietf.org/html/draft-sporny-hashlink-03" target="_blank" rel="noreferrer">https://tools.ietf.org/html/draft-sporny-hashlink-03</a><br>
<br>
... and for HTTP Signatures:<br>
<br>
<a href="https://tools.ietf.org/html/draft-cavage-http-signatures-11" target="_blank" rel="noreferrer">https://tools.ietf.org/html/draft-cavage-http-signatures-11</a><br>
<br>
Some highlights from the most recent specs:<br>
<br>
HTTP Signatures<br>
* 25 implementations! (no, that is not a typo)<br>
* Used by PSD2, Berlin Group, and STeT (European banking standards)<br>
* Used for banking standards in Europe, OCAP-LD, HTTP-based DID Auth<br>
Secure Data Hub authz (spec on its way in Summer 2019)<br>
* We are putting together a test suite in order to do real interop<br>
testing for the 25 existing implementations.<br>
<br>
Hashlink<br>
* We failed to specify that arbitrary metadata is possible, this<br>
version fixes that.<br>
* Added Security Considerations section wrt. DO NOT use MD5/SHA-1, etc.<br>
<br>
These are a few of our building block specs for some of the technologies<br>
being worked on by the CCG.<br>
<br>
-- manu<br>
<br>
-- <br>
Manu Sporny (skype: msporny, twitter: manusporny)<br>
Founder/CEO - Digital Bazaar, Inc.<br>
blog: Veres One Decentralized Identifier Blockchain Launches<br>
<a href="https://tinyurl.com/veres-one-launches" target="_blank" rel="noreferrer">https://tinyurl.com/veres-one-launches</a><u></u><u></u></p>
</div>
</div>
</div>
</div>
</div>
</blockquote></div>