0

Background story; government issues new IDs (eID) which can hold certificates and you can sign documents with it, using card reader and some software that signs document itself (while I do research lots of sites address this software https://store.ardaco.com/en/13-qsign-premium) + government issues software also but is not documented in english (worthless mentioning here).

I have a relative which is a doctor and faces problem with storing dozens of documents (each patients visit) in case of inspection. With new eID there is a legislation change that companies (doctors) can store documents using hard drive but all documents must be signed with eID (data integrity + timestamp).

Software (qSign) above solves one problem - signing the document(s), but does not solve recording archives (kind of like version control).

So to solve both problems I googled around and there is a possibility to use git + GPG to sign commits/tags.

When I sign "commit" does git signs file itself or just the information about commit? Is it possible to sign file also?

Is using git viable or I should just drop the idea?

I called government about the issue (did not propose using git etc. because of "IT language barrier"). Government only requires that if doctor uses option to store / archive documents on hdd it must be properly signed by eID. So when inspection comes then IT guy can confirm yes Mr. X T signed this document at 12:00am 24/1/2015.

edit

From user guide (eID client) I can translate.
- certificate propagator
Certificate propagator after inserting eID card in card reader challenge user to insert PIN code. After valid PIN code is inserted certificates are copied to Windows Certificate Storage.

So I assume I can use these certificates to sign documents as I please.

Improve this question
4
  • When signing a document using this software, what is the output of the signing process?
    – user
    Jun 1, 2016 at 13:51
  • Digital Signature is not the same as encryption, can you confirm if a "signature" is what is required? In terms of Git it only means "I assure that this commit was performed by this person" it has nothing to do with confidentiality
    – Purefan
    Jun 1, 2016 at 13:54
  • @Purefan Thank you I understand the logic. Yes only signature is required as I understand you create a file (pdf) and use software from (ardaco, disig, ditec) to sign document (people on discussion forums I do research at use signing only PDF files but I would like to be able to sign txt files / rtf files). There is no requirement from government about cryptography (but I am interested in it also).
    – Kyslik
    Jun 1, 2016 at 13:58
  • @MichaelKjörling signed PDF, (verifiable in Acrobat Reader). Guide also mentions D.Signer/XAdES. en.wikipedia.org/wiki/XAdES
    – Kyslik
    Jun 1, 2016 at 14:08

1 Answer 1

Reset to default
2

Taking a look at git signing process, it says that only commit information can be source verified by this method. After version 1.8.3, git can also sign commits and merge requests.

The person who execute those operations provides the gpg key password for signing, and everyone that looks at the commit, tag and merge can see if it comes from a "trusted source" by checking the public part of the gpg key.

However, this solution does not encrypt individual files. It's just for checking that commits are actually from a trusted source. What could help you is to "enforce" commit hooks usin eID on your relative's document repository.

tl,dr: Git does not encrypt individual files so, it will not be a viable solution to you

Improve this answer
2
  • yes I've read the guide, and did not understand the part "signing commits" as @Purefan explained that it is in fact information about commit that is signed not file itself. I can create automated job before each commit to encrypt file / sign it then also sign the commit information. Thank you for information.
    – Kyslik
    Jun 1, 2016 at 14:07
  • NP. You could use some client-side hooks on your repository to force the eID signing with git
    – user28177
    Jun 1, 2016 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.