The problem is indeed to get trustworthy text from the PC, and that is troubling lawyers in the UK. One legal working party, without technical knowledge, developed the concept of a trusted word processor - that could be realised with a particular profile developed from the FINREAD spec (which GP is now involved in, and which has been accepted by ISO WG4 as a New Work Item for standardisation [1]) and trusted word processing software. However, there is also increasing interest in secure end-to-end methodology, which could result in a configuration where the trusted word processor runs on a central server with several thin client workstations, the text is streamed securely down to the secure token held by the person operating the workstation, and that token signs the entire document with his/her signature on behalf of his/her organisation.
The hash values could be generated at the PC and then only this result had to be padded and encrypted, but if the aim is to have a trustworthy signature this should be done by the card (the the problem is to get trustworthy clear text from the PC).
Peter
[1] Unfortunately, because of its origination in the banking world, FINREAD mandates EMV compliance. However the Wave group in the USA independently developed the concept, and Giesecke and Devrient have recently announced an alliance with the Wave group.
_______________________________________________ Muscle mailing list [email protected] http://lists.drizzle.com/mailman/listinfo/muscle
