DSG handling of JSON signature

[JohnMoehrke]

https://github.com/IHE/IT-Infrastructure/blob/master/Proposals/IHE_Profile_Proposal_Template-jDSG.docx

[JohnMoehrke]

Given that DSG covers use-cases but uses XML-Signature for the signature document
When a product or organization wants to use JSON signature documents

Update DSG profile with an option to use JSON signature as the signature document. Otherwise everything else stays the same. That is to use external signature document with an XDS relationship to the signed document, where the signature is over the signed document as a binary object.

[JohnMoehrke]

I could help with the changes, but don't have the json signature expertise. We need an expert on json signature.

[slagesse-epic]

I don't read this proposal as asking for the signatures to be JSON, I read it as asking for a way to sign a document where the document itself is JSON formatted (Ie, a FHIR Document Bundle in JSON format).

[JohnMoehrke]

yes, I spoke with @litlfred , and that discussion was indicating the gap was the signature format, not the object being signed... I do agree that the proposal does look more like wanting to sign natively json objects.

[lukeaduncan]

Yes, this was meant to be about the signature format, but I think perhaps both, although I thought it already covered if the document was natively JSON, right? Or just any document format? I don't know if it touches on serialization though or if that would be an issue unless you're serializing from the object to check the signature instead of just reading from the serialized document.

[JohnMoehrke]

current DSG is content agnostic... meaning it signs the document that it is signing as a binary blob. So it can already sign a JSON document, such as a FHIR-Document encoded in JSON.

[litlfred]

Confirming that it is intended to be the signature format itself. The reference to FHIR json documents was more of thinking about keeping things in the same tool chain (there may be a preference to have a JSON signature for a JSON document rather than all the sudden having to load up an XML stack) Cheers, -carl

…

On Wed, Feb 15, 2023, 17:28 John Moehrke ***@***.***> wrote: yes, I spoke with @litlfred <https://github.com/litlfred> , and that discussion was indicating the gap was the signature format, not the object being signed... I do agree that the proposal does look more like wanting to sign natively json objects. — Reply to this email directly, view it on GitHub <#195 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAFBVYRWRN3QXBV4DLEPB43WXT7ZFANCNFSM6AAAAAAU4ZH45M> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[litlfred]

IHE_Profile_Proposal_Template-jDSG.docx
clarifications in an updated proposal is here.....

[JohnMoehrke]

WHO is looking for support in augmenting the IHE DSG profile to support JSON signatures. Expertise with JAdES is needed. Please see the attached Request for Quotation and refer to https://www.who.int/about/accountability/procurement/principles-and-processes for additional guidance. Responses should be sent to [email protected] by Monday February 27. rfp-fhir-doucments-in-trust-architecture.docx

p.s. I asked, and there's no geographical or citizenship restrictions?

[JohnMoehrke]

rfp fhir doucments in trust architecture.docx

[JohnMoehrke]

IHE_Profile_Proposal_Template-jDSG.docx clarifications in an updated proposal is here.....

The proposal in the IT-Infrastructure repo has been updated.

[lukeaduncan]

https://docs.google.com/document/u/0/d/1qgkbFfBUTKSBlY2vCq0I13j8JhTVADNL/edit?pli=1
https://www.hl7.org/fhir/us/pacio-adi/

[JohnMoehrke]

https://github.com/IHE/ITI.DSGj