|
From: André C. <and...@te...> - 2016-03-31 07:34:47
|
Dear SignServer developper On behalf of a customer, I send you this e-mail because he is interested in a signing solution. Unlike to CRS, where a CA creates and sign certificates, the customer would like to have signed hash values (e.g.: hash of a document, code, etc.). These hash values refer to a document will be produced by an external application (please see illustration below or in the attachment). [image: cid:image002.png@01D1893B.2C9FA1F0] As a special criteria the customer is interested in particular for a possible implementation of the *level 2 sole control* regarding TS 419 241 respectively EN 419 241. Our understanding with respect to level 2 sole control have I added to the PS. If EJBCA dose currently not support level 2 sole control, what is the size of the estimated effort/cost and what kind problems there are still to be resolved. Your sincerely André Clerc *PS:* Our understanding with respect to Level 2 Sole Control is such that, a commitment to release a signature have to be protect by multiple factors. One allowed way for a multi-factor authentication is provided by the signature creation device itself. Another method is a multi-factor authentication of the signer by the server signing application followed by a commitment protect by 1 factor (please review the attached diagram in the slide 13 and 17) in a secure way. -- André Clerc Expert IT Security Consultant *TEMET AG* Basteiplatz 5, CH-8001 Zürich T: +41 79 222 22 54 | Büro: +41 44 302 24 42 and...@te... | www.temet.ch |