What the advantage of sequentialy signing a document? That means signing a document by two people in a sequential manner?
-
Could you elaborate on this a bit? The question seems slightly vague.– IsziCommented Jan 21, 2011 at 5:46
-
lets say there is a document and userA signs it and then userB signs the sign of userA. Is there a advantage in doing this ?– user1157Commented Jan 21, 2011 at 8:11
-
Would you mind editing the question, so folks don't have to look thru the comments?– nealmcbCommented Jan 21, 2011 at 20:44
2 Answers
If by "sequential signing" you mean "signing the encoded signature of someone (computed over a given document)", then this can be viewed as a kind of "countersignature", meant as a formal approval in a multi-layered hierarchy. E.g. some employee signs a purchase contract but it must also be approved by his chief.
CMS contains a format for that (section 11.4 in RFC 5652). However, CMS does that only on the "raw" encoded signature, without the original document or even any indication of which signature algorithm was actually used in the first place; this opens the road to a variety of tricks which make the actual semantics of CMS countersignatures a bit hard to nail down. For instance, it is possible, given an arbitrary bit string, to create an asymmetric key pair for which the bit string becomes a valid signature over an arbitrary document; so not only does the countersignature not prove that the countersigner saw the original document, but it is also possible that the countersigner saw another document and another public key for which the signature looked valid.
What you said it's a something like Public Key Infrastructure (PKI), in PKI we use sequential signing because we want to ensure that the last sign was reliable, therefor someone else (UserB) must sign last sign(UserA) and other one(UserC) must sign UserB and so on, this chain continued until someone that was trusted to us (TTP Trusted third party) sign the last person sign, we call this user CA (Certificate Auttority). the reason that we need CA is that we have limited trusted sign in our operating system (or Web Browser or ...) and we can not save all users signature so must have sequential signing to reach some trusted one.
we have 3 architecture for this:
1- nNet Architecture:
2- Hierarchical Architecture:
3- Synthetic Architecture