Who writes the standards.
ISO, ETSI, CEN, IETF, W3C and industry forums: a map of standardization.
Laws say what effect a signature has. Technical standards say how it is made. Between the two lies an ecosystem of organizations, committees and forums that rarely makes headlines, but that determines whether a signature made in one country can be verified in another, whether a document will still be readable in twenty years, and whether two systems can talk to each other. Knowing that map helps you read any technical proposal with a critical eye.
Why standards are needed
A law requiring that a signature make it possible to "detect any subsequent alteration" does not say which algorithm to use, what format to store the signature in, or how to validate a certificate. If each provider solved this in its own way, no document would be verifiable outside the system that created it. Technical standards are the common language that turns a legal requirement into something any software can check.
The organizations and what they do
| Organization | What it is | Key contributions to signatures |
|---|---|---|
| ITU | The United Nations agency for telecommunications. | Recommendation X.509, the origin of the certificate format used worldwide. |
| IETF | An open community that defines internet protocols. | The certificate and revocation profile (RFC 5280), timestamps (RFC 3161), the syntax for signed messages (CMS) and online status checking (OCSP). |
| ISO and IEC | International standards bodies, with joint committees for information technology. | The PDF format (ISO 32000), PDF for archiving (ISO 19005), information security (ISO/IEC 27001) and identity frameworks. |
| ETSI | The European Telecommunications Standards Institute. | Its Electronic Signatures and Infrastructures committee drafts the advanced signature formats (PAdES, CAdES, XAdES), validation rules and requirements for trust service providers. |
| CEN | The European Committee for Standardization. | Requirements for signature creation devices and for server signing systems. |
| W3C | The consortium that defines web standards. | XML Signature and the verifiable credentials data model. |
| OASIS | An open standards consortium. | Protocols for signing and verification services. |
Industry forums
Alongside the formal bodies there are forums where industry agrees on common rules with major practical impact.
- The CA/Browser Forum. It brings together certification authorities and makers of browsers and operating systems. It sets the baseline requirements for the certificates those programs accept, and its influence extends to trust in general.
- The Cloud Signature Consortium. It defined a common interface for remote signing in the cloud, so that an application can request signatures from different providers in the same way.
- The PDF Association. It promotes PDF standards, including the signature layer, and interoperability between readers.
How they fit together
- The law sets the requirement. For example, that an advanced electronic signature must detect alterations.
- An implementing act refers to standards. Many regulations cite specific standards as a means of compliance.
- Standards build on one another. An ETSI format uses X.509 certificates, IETF syntax and ISO's PDF.
- Audits verify compliance. And trusted lists publish the result.
Electronic signatures depend on a standardization ecosystem: ITU and IETF for certificates and protocols, ISO and IEC for formats and management, ETSI and CEN for the European framework, W3C and OASIS for the web, and forums such as the CA/Browser Forum and the Cloud Signature Consortium. Laws refer to these standards, and interoperability depends on their being applied.
Sources
- IETF, RFC 5280, Internet X.509 Public Key Infrastructure Certificate and CRL Profile
- IETF, RFC 3161, Time Stamp Protocol, 2001
- ISO 32000 2, Portable Document Format 2.0
- ETSI EN 319 142, PDF Advanced Electronic Signatures (PAdES)
- CA/Browser Forum, Baseline Requirements
- Cloud Signature Consortium, API specification