W3C home > Mailing lists > Public > public-credentials@w3.org > November 2020

Re: Requirements for PDF as container for VC's

From: steve capell <steve.capell@gmail.com>
Date: Mon, 9 Nov 2020 11:52:44 +1100
Message-ID: <CAEMprtJKsEmct_FxXau=LewMioP+n2g8cCYdp8iLoM7GK8Pd0g@mail.gmail.com>
To: Leonard Rosenthol <lrosenth@adobe.com>
Cc: Adrian Gropper <agropper@healthurl.com>, Bill Claxton <williamc@itr8.com>, "public-credentials@w3.org" <public-credentials@w3.org>
thanks Leonard,

>Same way you protect the VC itself – Sign it!

Except that, in our use case, the VC issuer is the "oracle" (Exporting
Government Authority) that the verifier (Importing Government Authority)
trusts.  But the PDF is created by some other party in the exporting
jurisdiction.  So, even if they sign it, the signing identity won't match
the VC issuer identity.  Basically the verifier can check that it is signed
and that the signature is valid - but it doesnt really help because the
verifier doesnt know the PDF creator.

We are using the oracle as issuer VC model because to do otherwise would
impose more complexity on both the regulated community in the exporting
jurisdiction and on the verifier - to follow and confirm the trust chain
via a set of linked / embedded VCs.  This is a better future state but
seems too much of a leap to start with.

AS for not putting verification data on the human consumable form, that
also imposes too much of a leap for such a diverse set of stakeholders in
the internaitonal supply chain.

Thinking about it, I think the best way is for the oracle as issuer
(exporting government) to notarise the PDF and include the hash of the pdf
attachment in the VC.  then the verifier can just confirm that the hash of
the PDF they are holding is the same as the hash of the PDF that the oracle
notarised.

no?


On Mon, 9 Nov 2020 at 11:24, Leonard Rosenthol <lrosenth@adobe.com> wrote:

> > In the ideal world there are no PDFs that you need to trust, there is
> only data that the machine you trust can verify
>
> >
>
> You and I live in different ideal worlds 😊.
>
>
>
>
>
> > The attack vector that I’m trying to figure out a simple way to mitigate
> is where Malik manipulates the PDF rendered information without touching
> the (linked or embedded) VC
>
> >
>
> Same way you protect the VC itself – Sign it!   Apply a standard DigSig to
> the PDF – most likely one that is PAdES compliant for better acceptance
> world-wide.
>
>
>
> The other thing to consider is how technology/approaches such as the
> Content Authenticity Initiative (https://contentauthenticity.org/) can
> also be applied here to establish provenance of the document and its
> content throughout its lifecycle.
>
>
>
>
>
> > The community “learns” that a QR on a PDF means it is verifiable and
> when you see a green tick on scanning the QR, you look no further
>
> >
>
> Yes, this is why standards such as PAdES Part 6 are very clear about *
> *not** putting any form of validation information in the content of the
> page.  Too easy for forge.
>
>
>
>
>
> Leonard
>
>
>
> *From: *Steve Capell <steve.capell@gmail.com>
> *Date: *Sunday, November 8, 2020 at 5:40 PM
> *To: *Adrian Gropper <agropper@healthurl.com>
> *Cc: *Leonard Rosenthol <lrosenth@adobe.com>, Bill Claxton <
> williamc@itr8.com>, "public-credentials@w3.org" <public-credentials@w3.org
> >
> *Subject: *Re: Requirements for PDF as container for VC's
>
>
>
> Yes I think the machine version has to be the basis of trust.  In the
> ideal world there are no PDFs that you need to trust, there is only data
> that the machine you trust can verify
>
>
>
> The attack vector that I’m trying to figure out a simple way to mitigate
> is where Malik manipulates the PDF rendered information without touching
> the (linked or embedded) VC. Let’s say the VCs are a certificate of origin
> and a commercial invoice.  These documents can change hands many times
> between issuer and verifier.  Manufacturer, exporter, forwarder, carrier,
> financial service provider, bank, insurer, importer, customs agent,
> regulator - just a sampling of parties, any one of which could be Malik
>
>
>
> Today, there is only paper and people may verify the bit of paper by
> calling up the issuer.  A time consuming and expensive process
>
>
>
> In the end state, machines that people Trust algorithmically verify the VC
> data.  Much better.
>
>
>
> It’s the intermediate state that worries me.  Sometimes people look at the
> paper (PDF) version of the data supposedly in the vc and sometimes machines
> verify the vc.  The community “learns” that a QR on a PDF means it is
> verifiable and when you see a green tick on scanning the QR, you look no
> further.  This is the danger window.  And a few spectacular attacks could
> kill the whole VC framework in an industry sector
>
> Steven Capell
>
> Mob: 0410 437854
>
>
>
> On 9 Nov 2020, at 9:14 am, Adrian Gropper <agropper@healthurl.com> wrote:
>
> By analogy with DID resolution, I can't imagine how anything other than
> the machine representation could be the basis of trust. (trying to avoid
> the master language).
>
>
>
> It's then up to the verifier to confirm any human-consumable
> representation that is offered to them. They could send the PDF to a
> trusted resolver for confirmation or they could run a transform locally.
>
>
>
> If the issuer wants to sign the human-consumable representation, it should
> be up to them to use a transform they trust and they could really be
> signing just the machine readable version anyway because they trust their
> transformer.
>
>
>
> Can it be any other way?
>
>
>
> Adrian
>
>
>
> On Sun, Nov 8, 2020 at 3:52 PM Leonard Rosenthol <lrosenth@adobe.com>
> wrote:
>
> I realized after writing that my comment on #2 was not accessibility
> friendly.  It really should be “human consumable representation” since the
> content may be consumed in non-visible representations for the same purpose.
>
>
>
> Leonard
>
>
>
> *From: *Leonard Rosenthol <lrosenth@adobe.com>
> *Date: *Sunday, November 8, 2020 at 4:49 PM
> *To: *Steve Capell <steve.capell@gmail.com>
> *Cc: *Bill Claxton <williamc@itr8.com>, "public-credentials@w3.org" <
> public-credentials@w3.org>
> *Subject: *Re: Requirements for PDF as container for VC's
> *Resent-From: *<public-credentials@w3.org>
> *Resent-Date: *Sunday, November 8, 2020 at 4:48 PM
>
>
>
> Steven – we have to be careful to not to conflate issues…
>
>
>
> 1 – Can a machine determine if the data being used for presentation
> directly matches that used as “data”?   That problem can be solved by
> either have a single set of data that is used in both cases – though I am
> not aware of any situation where that is the case – in all cases there is a
> TRANSFORM from one to the other.  So if you aren’t using the same data,
> then you need a way to “connect the dots” so that it is clear what part of
> the presentation matches what part of the data.  PDF supports that using
> semantic tagging of content (as I showed in my presentation).
>
>
>
> 2 – Can a human determine if the data is correct?  Yes, by having a human
> visible representation the human verified that what they see is what they
> expect.
>
>
>
> 3 – Determine which representation – human or machine – is the “master”.
> In the eInvoicing standards of the EU, the machine readable XML is the
> master copy and the PDF presentation si just that – human readable
> presentation.  I would expect that in our VC cases the same would be true.
> No?
>
>
>
> Leonard
>
>
>
> *From: *Steve Capell <steve.capell@gmail.com>
> *Date: *Sunday, November 8, 2020 at 4:09 PM
> *To: *Leonard Rosenthol <lrosenth@adobe.com>
> *Cc: *Bill Claxton <williamc@itr8.com>, "public-credentials@w3.org" <
> public-credentials@w3.org>
> *Subject: *Re: Requirements for PDF as container for VC's
>
>
>
> As you all probably already know, the Singapore govt open attestation
> framework has a nice way of separating an issuer defined tenderer from the
> vc payload - which ensures the human viewer and machine reader always see
> the same data
>
>
>
> Of course the problem is that the verifier needs a link to the rendered
> view and that is often a QR on a PDF. But in that case there is no
> guarantee that the data on the PDF page is the same as the data in the
> linked VC - other than a human “yep, they look the same” eyeball.
>
>
>
> I’m not a PDF expert but I note that even the EU / German e-invoicing
> franework seems to have the same problem.  The XML data is attached to the
> PDF as meta data but there’s nothing to guarantee that the values in the
> xml (eg amounts and bank details) are the same as what’s in the PDF view.
> That opens up rather obvious avenues for fraud.
>
>
>
> Have I misunderstood? Does someone have a solution that can ensure that
> PDF rendered data is the same as PDF attached metadata ?
>
> Steven Capell
>
> Mob: 0410 437854
>
>
>
> On 9 Nov 2020, at 2:08 am, Leonard Rosenthol <lrosenth@adobe.com> wrote:
>
> Bill, thanks for sharing.  I read your evaluation link and there is a lot
> of good stuff there.   However, I am surprised that your concerns about PDF
> are around layout and rendering – since in that case, PDF is a better
> solution since the layout is defined by the issuer and the renderer simply
> follows the rules of ISO 32000.  So there is never a question about the
> rendering not matching what the issuer desires.
>
>
>
> However, I think you have an item later on that is more relevant and we
> should consider the importance of:
>
> > How do you assure that what’s in the layout matches the JSON data?
>
>
>
> Although I would change that to not be the layout (since the layout, or
> what I would call presentation) but instead be the data presented.
>
>
>
> Leonard
>
>
>
> *From: *Bill Claxton <williamc@itr8.com>
> *Date: *Sunday, November 8, 2020 at 8:35 AM
> *To: *"public-credentials@w3.org" <public-credentials@w3.org>
> *Subject: *Re: Requirements for PDF as container for VC's
> *Resent-From: *<public-credentials@w3.org>
> *Resent-Date: *Sunday, November 8, 2020 at 8:32 AM
>
>
>
> Kostas, hi -
>
> We spoke recently about this and I'm following the thread to see what the
> community thinks.  Happy that you're getting lots of input.
>
> I thought you may want to review my recent article "Evaluating
> Decentralised Identity Projects
> <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwmclaxton.medium.com%2F&data=04%7C01%7Clrosenth%40adobe.com%7C829871a090cf4804445808d884374f14%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C0%7C637404720436249091%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=vpmPzdXSJHeF6UgdbU6kq7RD6Fdcsoj1kfkbMQ8eQ0k%3D&reserved=0>".
> It's a sort of reviewer's guide for decentralised identity apps.  In
> particular, I would draw your attention to the point: "Have you separated
> layout from the rendering application, so that 3rd-parties (including
> verifiers) can render your certs?"  I intend to write a follow up about
> presentation layer and mention PDF encapsulation as an alternative, but one
> I am not much in favor of, for the reasons we discussed.
>
> *PS - For anyone else reading this thread, I was a PDF evangelist back in
> the early days of v4 and v5.  I am familiar with the encapsulation methods
> and indeed used them for a National Archives project in Singapore.*
>
> Regards, Bill Claxton (williamc@itr8.com)
> Facebook, Skype, MSN, Yahoo, Twitter, Flickr or Gmail: wmclaxton
> Voice, Text or Whatsapp: +65-9012-4327
>
> On 11/8/2020 5:17 PM, Kostas Karasavvas wrote:
>
> Hi Leonard,
>
>
>
> Thanks for initiating this. I have been thinking of this as well.
>
>
>
> On Sun, Nov 8, 2020 at 3:23 AM Leonard Rosenthol <lrosenth@adobe.com>
> wrote:
>
> Kicking off some discussions here – I’d like to start by putting down what
> I think are some “primary” requirements for the use of PDF in this
> context.  Am I missing anything?  Do you disagree with any of these?
> Feedback welcome!!
>
>
>
> *## Requirements*
>
>
>
> - Shall store the VC in native JSON-LD (w/optional compression)
>
> - VC should be in an easily accessible location (for both reading &
> writing)
>
>
>
> Agree. And JSON-LD is what we intend to use. There could also be a
> 'serialization/type' option to specify the serialization to accommodate
> other use cases (XML? CBOR-LD?), if need be.
>
>
>
> - Should require no language changes to PDF (except "metadata"-like
> values)
>
>     - implies compatibility with both PDF 1.7 and 2.0
>
>
>
> Agree. I assume that PDF 1.7 implies compatibility with older versions as
> well?
>
>
>
> - Shall be usable in conjunction with standard PDF Signing/Certification
>
>
>
> Makes sense. I have questions here wrt the PDF spec and how signing is
> happening (the 'hole' in the file approach) but these are for later.
>
>
>
> Regards,
>
> Kostas
>
>
>
>
>
>
>
> Leonard
>
>
>
>
> --
>
> Konstantinos A. Karasavvas
>
> Software Architect, Blockchain Engineer, Researcher, Educator
>
> https://twitter.com/kkarasavvas
> <https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftwitter.com%2Fkkarasavvas&data=04%7C01%7Clrosenth%40adobe.com%7C829871a090cf4804445808d884374f14%7Cfa7b1b5a7b34438794aed2c178decee1%7C0%7C0%7C637404720436259088%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=wV1IUTDVZ0KO%2BpqhwJpAMCuEUOL1yi96kEI%2BXnbjdpU%3D&reserved=0>
>
>
>
>
>

-- 
Steve Capell
Received on Monday, 9 November 2020 00:53:09 UTC

This archive was generated by hypermail 2.4.0 : Monday, 9 November 2020 00:53:10 UTC