I am trying to identify if there are any standards (accepted by the EU) regarding client-side digitally signing the form-data before it is submitted.
So the constraints are:
- know standard
- accepted by the EU
- client-side (we need proof of origin not tamper-proofing)
- can work with web-forms related content (k/v pairs of data)
- the output of the process should be machine readable (ex.: form-urlenc, JSON, bson, msgpack)
- the output format should not have ambiguity issues (meaning not bloody XML*, maybe not form-urlenc either)
My read-up on the subject so far
XMLDSIG is bad since XML can be canonicalized a zillion different ways making the signature not valid or worse an attached XSD or XSLT (or even CSS) can alter the visible rendering (depending on visualisation tool) of the data content meaning it can alter its meaning exposing users to possible scams.
PAdES is already being used in our public administration and our project scope might cover having to build PDF files with embedded forms and digital signature.
PGP/GPG or S/MIME could be a valid contender for the role but idk if they're officially recognized or standardize by EU laws. On the other hand both of these carry their signatures appended to the data.
I'm doing research for a government project (in Romania) trying to implement digital signatures over simple web-forms.
I know Estonia, Belgium, France and Germany already have similar systems in place for electronic identity cards and hardware digital signature of documents as well as some frameworks/tools they use (ex.: hwcrypto.js).
But I'd like to understand their full process, for example do they digitally sign entire documents or just some raw data in a machine readable format (as described above).
Do they require electronic ID cards or can it be used with a certificate file you have on disk.