ID Conflict avoidance between multiple signature blocks

     There is one potential problem caused by the requirement that
SignatureProperty blocks have document-wide ID's in order to be referenced.
When multiple signers are creating Signature's, it is possible for them to
have a collision in the ID between signature properties produced by
essentially similar code on their separate machines.  This problem can be
avoided between signatures with no extra data because most elements of
Signature do not have to have an ID.  However, neither Object nor Manifest
can be referenced within the signature if they do not have one.  Since the
various signature blocks probably don't get to see each other until after
the signatures have been completed, they must assign their identities in
ignorance of whatever the other may be using.  It may be best to assign a
root for all these labels either to a random value or by the digest of the
signer's certificate, and form ID's by concatenating programmer-friendly
strings to that.  The root could be assigned to Signature or SignedInfo.

          Tom Gindin

Received on Thursday, 13 April 2000 19:04:16 UTC