Electronic Signatures and Encryption
Graphical User Interface (GUI)

Part 1/2

OpenOffice.org 2.0 (OOo) and StarOffice (SO) 8

The following spec defines only user interface/interaction (UI/GUI).

Please see also see Part 2 and 3:

• Part 2: Technical Specification for Electronic Signatures and Security

http://specs.openoffice.org/appwide/security/Technical_Specification_for_Electronic_Signatures_and_Security.sxw

• Part 3: Specification for Macro Security

http://specs.openoffice.org/appwide/security/Specification_for_Macro_Security.sxw

for technical issues.

Abstract¹

Security for office document content can be divided into two features, digital signatures and encryption.

Digital signatures themselves are a relative new topic for office applications. However, the requirement to protect data from being modified is existing for a long time. In the past, it has been addressed by features that protect documents from being edited within the office application. With digital signatures, these features will be enhanced to offer secure protection of document content, inside OpenOffice.org(OOo)/StarOffice (SO), and outside of it.

Macro security is a very important topic, because when you download some macros or receive them via email you can't know if you can trust them or if they may harm your system.

You can not easily figure out if the macro could do any harm, so the decision whether to trust a macro or not to trust can be made based on the trustworthiness of the macro author. But how can you know that the macro really comes from the author it claims to come from, or that it was not modified by somebody else?

The best way to do this are digital certificates and signatures. The author can sign the macro with his private keys, everybody can verify the signature with the authors public keys. The digital signature will also assure that the content was not modified.

Encryption is a feature that is supported by office applications for a long time. Enhancement in this area mainly affected the encryption algorithm itself, that became more secure. However, since there was no standardized way how encryption algorithms are applied to documents, processing such document files outside an office application was elaborate. By supporting new XML encryption standards, and due to OO.o/SO's XML file format, this will become much easier.

i-Team Members

Approved for Implementation

Document Change History

Glossary

1 Motivation

Many governments in different countries are starting to move to paper-less communication with their citizens. Examples for this are the “BundOnline”⁵ e-government initiative in Germany or eGov⁶ in the US.

Since in many cases confidential and personal data needs to be exchanged it is mandatory to use appropriate security mechanisms like digital signatures and encryption. This is necessary in order to ensure that information does not get changed on the way between the citizen and the public authority.

Also it must be possible to securely identify the author of a document. This is especially true for documents that are used for requesting ID related documents like a driver license, passport or a badge.

People become more and more sensitive about security issues, and macro viruses can do a lot of harm. People must have the possibility to configure which macros are allowed to run and which not, so digital signatures and authentication are very important for them.

In addition, after tragic events like the airplane attack on September 11 people are more and more concerned about security issues in general. Companies fear “cyber attacks” and viruses like the ILOVEYOU and Melissa macro virus, that caused a lot of damage.

2 User Scenarios

This specification covers security and signature related issues. So the user scenarios are separated into two parts.

2.1 Security Related Scenarios

1. User A is an attorney at law and uses OpenOffice to edit/revise legal related documents. She uses change tracking in her documents very often, but she is aware of the potential danger of those working draft information when those might become public, because others can use such information against herself. Susan spends a lot of time controlling her final documents, that they do not contain track changes information anymore, but she always has a bad feeling using change tracking function at all.

   1. Add a new application privacy option to warn the user about tracked changes, versioning and notice information in current documents when the user saves, prints (not for versioning), PDFs (not for versioning) or sends a document.

2. User B works for the Police Department as a secretary. She works in a department working on police internal inquiries. She writes down reports recorded on tapes. Since she has fears that her name could become known to the reported person, she always takes care that she removes her name from the properties of the document before saving the file. She always has a bad feeling, because she has to do it manually, but she could not remove her name from the User settings options of OOo, because in letters templates the fields will not be filled in were she needs her name in.

   1. There is no automatism to do not store personal information within the file in OOo.

   1. Add an application privacy option to do not add personal information to the file properties when saving a file.

3. User C works as a Controller in a company. He creates reports in Calc about the departments he is responsible for as a financial controller. He provides his report to the executive management of the company, but the report will be forwarded to the assistant of his manger. The information he is providing is very crucial and he has fears that the data could be changed before reaching his manager. Since the manager's assistant must have rights to print the document, because his manager insists of having a printed copy for his records, he has to give modify rights also to the assistant.

   1. No real solution for this problem until a document rights management model is supported by OOo. All other solutions like separate passwords for opening and modifying of a document are only generating a false sense of security, because a document that could be opened could be saved as a new doc or could be copied to a new document via the clipboard and then saved as a new file. Thus allows to modify the document's copy...

4. User D works in a bank. He often has to encrypt documents, because the content is related to customer's financial background. He is used to work with MS Office and hasn't used OOo before. When evaluating OOo he tries to encrypt a document. When calling the Save as dialog, he recognizes that there is a checkbox “Save with password”. He is wondering, where he has to enter the password first to save it with the file. He checks the complete dialog for options to set the password, but did not find any.

   1. Problem at this point is, that he did not know that the password dialog appears when saving the document because he had never used OOo before. Once he is used to this behavior, the function could be easily accessed.

   1. Change the check box into a button. If this is not possible, the password dialog has to appear directly after checking the box or the wording has to be changed.

5. User E works at the University: She works on confidential data for her professor, so she decides to encrypt the document. Since she has worries not to remember the password, she decides to use her boyfriend's sure and last name as a password. She types in “Greg Smith” and recognizes the space between the names. She removes the Space, since she is not sure if it is allowed within a password. Then she works on the data and saves her changes frequently. In the evening she closes the document and shuts down the computer. On the next day she has an appointment with her professor and tries to open the document. She types in “Gregsmith” in one word at the password prompt, since she remembers that she has removed the space in the middle. Then she confirms the password dialog, but the document could not be loaded and OOo raises a dialog that the password is wrong. She calls the product support to decrypt the document, but the support could not help her. The document's data is lost.

   1. She does not know that passwords are case sensitive and that spaces would have been allowed within the password. Furthermore she was not aware, that there is no way back when the password is lost and so she has not stored the password in a save place.

   1. Add a hint to the password dialog to explain that passwords are case sensitive and could contain spaces and other special characters. Furthermore we have to add a note that there is no way to decrypt the file without the password.

6. User F is a Manager: He uses many different text document templates for his work. One of these templates is used for the monthly report of his division. Since these reports contain crucial data, he must ensure that this document is always saved with a password. He is missing a document option to force or recommend encrypted saving of the document.

   1. Add a new document option to prompt a dialog when saving documents that currently have no given password and recommended to save this document always with a password.

7. User G is an English teacher: She works on courses written as text documents. These documents will be printed by her customers at home. Some customers saved changes to the document by mistake in the past, because the documents have read write access.

   1. Already possible in OOo 1.1. to publish those document as a PDF files via the integrated PDF export. Furthermore the setting “Printing modifies document” in Tools-Option of OOo has to be deactivated. Furthermore the document could already be opened Read-only by a checkbox in the File-Open Dialog. But maybe this one is an issue when supporting signatures, because modifying the document (properties) will withdraw document's signature.

8. User H has to use a specific encryption method, because it fulfills the defined security requirements

   1. User can choose between different encryption types. (##FL->MHU: need more details from Matthias Huetsch). The dialog to choose from available methods can be called by the Tools-Options-Security-Security option-Advanced... button.

2.2 Signatures Related Scenarios

9. Department of Defense (DOD): The DOD is currently rolling out the DOD Common Access Card to all the employees. The card holds certificates and supports Java. Microsoft offers a solution for signing emails and potentially documents using the DOD Common Access Card.

   Typically a user would use encryption for the email in order to prevent that unauthorized users can access the content. Attached documents would be signed for non-repudiation and integrity purposes but not encrypted. The email would not necessarily be signed, because the enclosed document would be the critical element. Besides, it often is not desired to encrypt documents because once the email has been received the document can be stored at a secure location. However, for both encrypting the email and signing the document the same technology (i.e. the DOD Common Access Card) should be used.

   1. ##FL->MHU:?

10. Government: An example for a scenario in the government space would be a foreign citizen who needs to extend/renew his passport. First, he would either download a form from a public web site or via email from a consulate employee. Maybe this form would already have some personal and confidential data. Thus this form would have to be both signed and encrypted. Now the citizen would complete the form, sign and encrypt it and send it back. Finally the consulate employee would check the content of the form and send a signed (approved) and encrypted copy back to the citizen.

    1. Sign Complete OOo Documents

    2. Encrypt complete documents

11. Education: Signing and encrypting documents in the education area is interesting, because it can replace the paper process of correcting dissertations, etc. Students would send their signed dissertations to professors, who would make annotation, sign these annotation and send the signed document back to the student.

    1. Sign Complete OOo Documents

    2. Encrypt complete documents

    3. Protect content via password and allow to add annotations (comments) or tracked changes only

    4. Sign tracked changes or annotations (not for OO.org 2.0)

12. Enterprise: In enterprise environments signed documents can replace contracts and legal agreements. For this purpose documents often go through many reviews by different people that belong to different departments and companies. Therefore, it's required that it's always verifiable who made changes to a document at what time. In addition, there are often predefined approval processes that the office suite and related collaboration tools could support.

    1. Sign Complete OOo Document

    2. Allow multiple signatures

    3. Protect content via password and allow to add annotations (comments) or tracked changes only.

13. User AA writes contracts in Writer. The contracts will be personalized directly in Writer. Since some parts must not be changed he want's to protect these section and to sign them.

    1. Sign Section in Writer (not for OO.org 2.0)

    2. Protection for signed sections (not for OO.org 2.0)

14. User AB works on official company wide calculations. These calculations must not be changed and are tested. The data will be collected by Managers. Each Manager saves the document after he has filled in his data and saves it as a new version in the document. This saved version will be signed.

    1. Sign Single Table in Calc (not for OO.org 2.0)

    2. Sign versions of a document (##FL->MHU/MIB: Is this covered when Versions is active?)

15. GUI related requirements

    1. Show Signatures

       1. Application title “(Signed)”

       2. Symbol in status bar

       3. Symbol on objects, Calc tables, sections

       4. Document properties

    2. Warning Dialogs

       1. Signature is lost when

          1. saving document in non OOo XML format

          2. save as (a copy) in XML-Format

          3. Deleting a signature

          4. document is modified

             1. Undo after signing = modify = signature lost

          5. Content is not completely visible due to

             1. view settings

             2. track changes with not accepted/rejected parts

             3. notices

          6. formatting (i.e. hidden)

          7. linked sections, objects (i.e. graphics, OLE or DDE)

          8. fields

16. Renew signature if signed area has been changed

    1. Withdraw all assigned signatures and sign new

17. User AF works in a small company. They want to use signatures to sign documents, but the do not want to create official certificates because these cost money. The want to trust themselves.

    1. Create a self signed Certificate. ##FL->MHU: What's about this one.

2.3 Macro Security Related Scenarios

1. Macro security

   1. Security 18: Authorization, Fine Grained Macro Security.
      OOo should allow to restrict the level of access to resources that components and scripts have. Configure policies which code from which author is allowed to read and write files, make system calls and other things.

2. Macro security

   1. Security 21: Completely disable scripting.
      Done in SO7: tools/options/security => Run macro never.

3. Security Level

   1. Security 23: Default macro security settings must be set to “high”.

4. Security Level

   1. Security 26: Support high, medium and low security settings. Maximum security allows only signed macros to run. Medium allows signed macros to run and asks for execution of unsigned macros. Low executes all macros without any confirmation.

5. User AD develops macros in OO.org. The macros will be attached to documents and will be used within the company. He has problems that users suppress the execution of this macro, but the companies management does not allow to disable macro warning in OO.org.

   1. Sign OOo Script Projects. The user could trust a source, so that these macros will be executed automatically without displaying any further macro warnings.

3 Goals for Macro and Document Security

A must have for OpenOffice.org 2.0 are digital signatures for macros and authentication, so people can configure which macros are allowed to run and which not, based on the author of the macro.

Fine grained macro security, where you can configure in detail what macros from different authors are allowed to do would be nice, but this can not be done in the OpenOffice.org 2.0 time frame, because on top of digital signatures and authentication you need configuration of policies, and each API implementation that directly accesses any resources must check if the permissions for that are granted.

Please see scenario section above for detailed goals of Macro and Document Security based on digital Signatures.

4 Requirements and Dependencies

4.1 Dependencies

The thumbnail feature has to be adjusted when this feature has been implemented:

http://specs.openoffice.org/appwide/desktop_integration/ooo_file_thumbnails.sxw

4.2 Requirements

Please see scenario section on page 4 (above) for requirements.

4.3 Technical Dependencies

Please see technical specification for details: http://specs.openoffice.org/appwide/security/Technical_Specification_for_Electronic_Signatures_and_Security.sxw

5 Competitive Analyses

6 Detailed Specification

This specification defines the basic feature set for encryption and signing document for OpenOffice.org (OO.org) 2.0.

Please see also see Part 2 for technical issues:

• Part 2: Technical Specification for Electronic Signatures and Security

http://specs.openoffice.org/appwide/security/Technical_Specification_for_Electronic_Signatures_and_Security.sxw

6.1 Document encryption

The OO.org document encryption will changed to a W3C conform encryption. New Options-Security Dialog

The following dialog replaces the Security tab page in tools options.

Item	English	German	Comments
Label	Security options	Sicherheitsoptionen
Label	Warn if document contains recorded changes, versions, hidden information or notes when	Warnen wenn ein Dokument aufgezeichnete Änderungen, Versionen, versteckte Informationen oder Notizen enthält
Label	saving or sending documents	Speichern oder Senden solcher Dokumente
Label	printing documents	Dokument drucken
Label	signing documents	Dokumente signieren
Label	creating PDF-files	PDF-Dateien erzeugen
Label	Remove personal information on saving	Benutzerdaten nicht speichern
Label	Recommend password protection on saving	Kennwortschutz beim Speichern empfehlen
Button	Advanced	Erweitert
Label	Adjust the security level for executing macros and specify trusted macro developers.
Button	Macro Security	Makro Sicherheit
Label	File sharing options for this document
Label	Recommend to open document read-only
Label	Record changes
Button	Protect Records	Aufzeichnungen schützen
Button	Unprotect Records	Schutz aufheben

6.1.1 Show warning dialogs if the document contains recorded changes, versions or notices when

• “Saving or sending documents” Option (default off)

  The following warning dialog appears if one of the following is contained in a document and the document will be saved (or send as an email). Furthermore the “saving or sending documents warning” on the security tab page has to be turned on:

  • recorded changes

  • notices

  • document file contains versions

    Warning Dialog String List

Item	English	German	Comments
Dialog text	The document being saved contains: * recorded changes * notes * document file contains versions Do you want to continue? Button1: Yes Button2: No		Displayed are only those things contained in the current doc.

• “Printing documents” Option (default off)

The following warning appears when printing a document, if one of the following is a visible part of the document and the warning function itself is turned on in Tools-Options-Security:

• shown recorded changes

• shown notices

Warning Dialog String List

Item	English	German	Comments
Dialog text	The document being printed contains: * shown recorded changes * shown notes Do you want to continue? Button1: Yes Button2: No Button3: Printing Options...		Displayed are only those things currently visible/printable in the current doc.

The Printing Options... button calls the Printing Options dialog, were the user can change the behavior for printing notes.

• “Signing documents” Option (default on)

  The following warning is shown directly before the Digital Signature dialog appears (please see page 65 in chapter 6.5 below for dialog details), if the document contains one of the following and the warning option is turned on in Tools-Options-Security:

  • recorded changes

  • document file contains versions

  • notices in Writer and Calc

  • fields

  • references to other sources (i.e. linked sections or linked graphics)

Warning Dialog String List

Item	English	German	Comments
Dialog text	The document being signed contains: * recorded changes * document file contains versions * notes * fields * references to other sources (i.e. linked sections or linked graphics) Do you want to continue? Button1: Yes Button2: No		Displayed are only those things contained in the current doc.

• “Creating PDF-files” Option (default off)

The following warning dialog appears if the PDF export warning in Tools-Options-Security is turned on and if the document contains one of the following:

• shown recorded changes in Writer

• shown notices in Writer or Calc

Warning Dialog String List

Item	English	German	Comments
Dialog text	The document being “PDF'ed” contains: * shown recorded changes * shown notes Do you want to continue? Button1: Yes Button2: No		Displayed are only those things contained in the current doc.

• “Remove personal information on saving” Option

• Today these information could only be deleted manually in File – Properties – General by pressing the delete button. This new feature removes exactly the same information automatically on save.

• “Recommend password protection on saving” option calls the following notice dialog each time an currently unsaved and unprotected document is to be saved.

  • Furthermore the “Save with password” option in the Save as dialog will be (pre)checked one time for all documents. The user can un-check this setting to save a file explicit without a password, this un-checked status is saved for runtime of that document.

  • If “Save All” from the file menu is chosen and one or more documents do not have an assigned password, those documents get the focus (and are temporarily restored when they were minimized to an icon) and the following notice dialog is called for each document.

    After saving of all documents has been finished, the focus will be reset to document and position where the user was when calling “Save All” or AutoSave.

Note Dialog String List

Item	English	German	Comments
Dialog Title	Password Protection Recommended
Dialog text	Due to an application setting it is recommended to save documents with password protection. Do you want to assign a password for the current document before saving? Button1: Assign password Button2: Save anyway	##	[Assign password] button calls the normal assign password dialog. [Save anyway] button saves document without assigning a password .

• Record Changes

  This setting activates the changes tracking function for the current document. Furthermore the records could be protected by pressing the Protect Records... button. If the records are protected, the button label changes to Unprotect changes. If the button is pressed in this state the Enter Password dialog (see illustration 86 on page 58) appears. If the password is entered correctly, the button changes back to the initial label Protect Records.

  If the records are protected by a password and the checkbox for Record Changes will be unchecked, the password dialog appears as described for above for pressing the button Unprotect Changes.

• Recommend to Open documents read-only

  This setting will be saved with the current document. If this options is set and the document is opened, the following dialog appears and recommends to open the document in read-only mode:

Item	English	German	Comments
Dialog text	$PATHANDFILENAME should be opened in read-only mode unless changes to it need to be made. Open in read-only mode? Button1: Yes Button2: No Button3: Cancel	##

6.2 New Password Dialog

The overworked password dialogs replace the current ones office wide.

The O.K. Button is disabled until the minimum length of 5 characters hasn't been entered. The dialog shows a notice about keeping passwords in a safe place,

• the case-sensitiveness of passwords

• the minimum length of 5 characters.

• Note: If we are able to export (not for OO.org 2.0) encrypted MS documents, the minimum length of 5 for a password is not valid. This means that the OK button is always enabled and the notice text in the password dialog is displayed as follows.

  Changed Warning in Password Dialog for Importing MS Document with passwords

Item	English	German	Comments
Text	Caution: If you lose or forget the password, it cannot be recovered. It is advisable to keep passwords in a safe place. Passwords are case-sensitive.		.

The password has to be retyped correctly in the "Reenter Password" field.

Password Dialog Strings

Item	English	German	Comments
Text	Caution: If you lose or forget the password, it cannot be recovered. It is advisable to keep passwords in a safe place. Passwords are case-sensitive and at least five characters long.		.
Label	Enter Password	Kennwort eingeben
Label	Reenter Password	Kennwort wiederholen
Label	Enter password to open the file:	Kennwort zum Öffnen der Datei eingeben:

If the the reentered password does not match to the original one, the following notice dialog appears:

Error Dialog:

Item	English	German	Comments
Notice Dialog	The password confirmation does not match. Button1: OK	Die Kennwortbestätigung ist ungültig.	Dialog has an OK button.

The password dialog is being shown after pressing the OK button. The focus is then set to the Reenter Password field. The field itself is empty.

An overworked Enter Password dialog replaces the current (OO.org 1.1) dialog. The notice shown is the same as in the define password dialog above.

If the password entered does not match to the document password, the following dialog appears:

Warning Dialog:

Item	English	German	Comments
Notice Dialog	The password is incorrect. The document cannot be opened.	Das Kennwort ist ungültig. Das Dokument kann nicht geöffnet werden.	Dialog has an OK button.

6.3 The Menu Entries for Signing

6.3.1 Save & Sign entry in the File Menu

The following entries will be added to the menu of Writer, Impress, Draw,Calc and the basic IDE to sign the current document content or document macro (in the basic IDE).

Item	English	German	Comments
Main Menu entry	Save and Sign ...	Speichern & Signieren	behind current Save all entry in the File menu. The Save and Sign dialog is called.

6.3.2 Entry in File - Send Menu

The following entry will be added to the menu of Writer, Impress, Draw,Calc and the basic IDE to sign the current document content or document macro (in the basic IDE).

Item	English	German	Comments
Menu entry	Signed document as e-mail	Signiertes Dokument als E-Mail

6.3.3 Save and Sign info dialog

The following dialog appears, if the current document is modified and the document has not been saved to a file.

The following dialog is shown, if the document is modified and contains a digital signature:

Item	English	German	Comments
Dialog Tile	Save and Sign	Speichern und Signieren
Dialog text	The document has to be saved before signing. Saving the document removes all present signatures. Do you want to continue saving? Button1: Save and Sign... Button2: Cancel	##

After confirming the Sign & Save dialog with Save and Sign button, the Save as dialog appears. After saving the document, the Digital Signature dialog (please see page 65 in chapter 6.5 below for dialog details) appears to sign the document.

If the document is modified and unsigned, the following dialog appears:

Item	English	German	Comments
Dialog Tile	Save and Sign	Speichern & Signieren
Dialog text	The document has to be saved before signing. Do you want to continue saving? Button1: Save and Sign... Button2: Cancel	##

If the document is not modified and already signed, the following dialog appears:

Item	English	German	Comments
Dialog Tile	Save and Sign	Speichern & Signieren
Dialog text	The document is signed. Do you want to add another signature or do you want to remove current signature(s) and sign again? Button1: Add signature... Button2: Cancel	##	Add signature button calls the Digital Signature dialog.

6.3.4 Open a Signed Document with an Invalid Signature

If a document's signature is invalid, the following dialog is shown:For Document Content

Item	English	German	Comments
Dialog Tile	Invalid Document Signature	Ungültige Dokument Signatur
Dialog text	This digital signed document content does not match the current document signature. This could be the result of a document manipulation or a structural document damage (i.e. due to data transmission). We recommend you to not trust the current document content. Do you want to continue loading the document? Button1: Yes Button2: No	##	Add signature button calls the Digital Signature dialog. The "No" button is defaulted.

For Document Macros

Item	English	German	Comments
Dialog Tile	Invalid Macro Signature	Ungültige Makro Signatur
Dialog text	The digital signed document macros do not match the current document macros signature. This could be the result of a document manipulation or a structural document damage (i.e. due to data transmission). We strongly recommend you to not trust the current macro. Do you want to continue loading the document? Button1: Yes Button2: No	##	Add signature button calls the Digital Signature dialog. The "No" button is defaulted.

For Program Packages:

Item	English	German	Comments
Dialog Tile	Invalid Package	Ungültiges Paket
Dialog text	The digital signed package does not match the current package signature. This could be the result of a package manipulation or a structural document damage (i.e. due to data transmission). We strongly recommend you to not trust the current signature. Do you want to continue adding loading the packagedocument? Button1: Yes Button2: No	##	Add signature button calls the Digital Signature dialog. The "No" button is defaulted.

6.4 Digital Signatures

Document content and document macros can be digitally signed independently. Saving the document content does not remove the signature of a document macro.

6.4.1 General behavior when signing a document:

• If a signed document is loaded, OO.org shows a little seal on the right side of the modified field. The seal will be withdrawn, if the document gets changed.

  

  

  

  

• The following icons have been designed by Stella Schulze (original Files will be provided by Stella as PNG files):

  26*26 pixel:

  26*26 pixel (high contrast):

  16*16 pixel:

  16*16 pixel (high contrast):

  11*16 pixel:

  11*16 pixel (high contrast):

• A double click on the icon shows the dialog with signing information of current document.

• Tip help of icon in status bar

  Tip Help String List

Item	English	German	Comments
Tip help	This document has been digitally signed	Dieses Dokument wurde digital signiert	in document view
Tip help	The document macros have been digitally signed	Die Dokumentmakros wurden digital signiert	in basic IDE
Tip help	The document content and macros have been digitally signed	Die Dokumentinhalt und -makros wurden digital signiert	Shown if document content and macros are signed.

• Context Menu Signature Sign in Status bar

  The sign in the status bar has a context menu with the following entries:

Item	English	German	Comments
Context Menu	Show signature...	Signatur anzeigen...	Calls the Digitally Signature Dialog
Context Menu	Remove signature...	Signatur entfernen...	Removes signature and saves file
Context Menu	Add signature...	Signatur hinzufügen...	Calls the Digitally Signature Dialog

• Furthermore the application title shows a note (Signed) or (Signed document macros) right behind the documents or basic libraries file name in the title bar.

  

Item	English	German	Comments
Text	(Signed)	(Signiert)	for document content
Text	(Signed Macro)	(Signiertes Makro)	for basic macros

• Signing requires the OO.org file format.

  The following warning dialog appears when document will be saved in a non OpenOffice.org format and the file was already signed:

  Warning Dialog String List

Item	English	German	Comments
Dialog text	Saving will remove all existing signatures. This document must be saved as a %PRODUCTNAME document before it can be digitally signed. Do you want to continue saving the document? Button1: Yes Button2: No	##	[[Yes] button saves the document in the choosen format. [No] button aborts the saving and goes back to the Save dialog.

The following warning dialog appears when the document is saved in a non OpenOffice.org format and should be signed ("Save and Sign" functionality):

Warning Dialog String List

Item	English	German	Comments
Dialog text	This document must be saved as a %PRODUCTNAME document before it can be digitally signed. Do you want to save in the %PRODUCTNAME format and continue signing? Button1: Yes Button2: No	##	[[Yes] button saves the document in the OO.org format using the current filename and location. [No] button aborts the signing process.

• If a document has already been saved with a signature, OO.org raises a dialog when the user saves the document again.

Warning Dialog String List

Item	English	German	Comments
Dialog text	Saving will remove all existing digital signatures in the document. Continue with save? Button1: Yes Button2: No Button3: Sign & Save	##	[Yes] button saves the document [No] button aborts the saving [Sign & Save] Calls Digital Signature dialog

6.5 Digital Signatures Dialog

The following dialogs are called when a document has to be signed.

6.5.1 Digital Signature Dialog For Documents

6.5.2 Digital Signature Dialog For Document Macros

6.5.3 Digital Signature Dialog For Program Packages

The list box shows all currently assigned signatures of the current document.

String list

6.5.4 Select Signature (Add...) Dialog

The following dialog is called if the Add... button is pressed in the Digital Signature Dialog. The view button allows to view at the current selected certificate. If no certificate is selected (default when calling the dialog), the button is disabled.FST: Shouldn't the dialog be named Select Signature ? Currently this is a bit confussing.

String List

Item	English	German	Comments
Title	Select Certificate	Zertifikat auswählen
Label	Issued to	Ausgestellt für
Label	Issued by	Ausgestellt durch
Label	Expiration Date	Ablaufdatum

6.5.5 View Certificate Dialog

The Certificate dialog is called when the View Certificate button is pressed in the Digital Signatures dialog. The dialog consists of three tabpages.

String List

Item	English	German	Comments
Tab page Label	General
Tab page Label	Details
Tab page Label	Certification Path
Label	Certification Information
Label	This CA Root certificate is not trusted. ...???
Label	Issued to:
Label	Issued by:
Label	Valid from %SDATE% to %EDATE%
Label	You have a key that corresponds to this certificate

String List

Item	English	German	Comments
Column Label	Field	Feld
Column Label	Value	Wert
Field label text 1	Version
Field label text 2	Serial Number
Field label text 3	Issuer
Field label text 4	Valid from
Field label text 5	Valid to
Field label text 6	Subject
Field label text 7	Public key
Field label text 8	Enhanced Key Usage
Field label text 9	Authority Key Identifier
Field label text 10	Thumbprint algorithm
Field label text 11	Thumbprint

String List

Item	English	German	Comments
Button	Certification path	Digitale Signatur...
Label	Certification status	Digital signiert
Cert. Status text	??
Cert. Status text	??

6.6 Document Properties

The document properties dialog shows the name, date and time when the document has been signed. If more than one signature is assigned to a document, the dialog shows only “Multiple signed document” instead of name and date of the signer.

Item	English	German	Comments
Button	Digital Signature...	Digitale Signatur...
Label	Digitally signed	Digital signiert
Label	Multiple signed document	Mehrfach signiertes Dokument

The Digital Signature... button calls a the Digital signature dialog to show all currently assigned signatures. The Digital Signature dialog allows to remove a signature from the document.

6.6.1 Changed Default Setting in Tools-Options

In OO.org 1.1 printing sets the document modified status. This could be disabled by a Tools-Option setting, but the default is currently set to on, so that printing modifies the document. This causes a problem, because printing a signed document prompts for saving the document on closing, but saving would remove the assigned signature.

Since this is not only a problem when having a signature, the setting '[ ] Printing sets document modified status' in Tools-Options-StarOffice-General will be changed to off by default.

6.7 Macro Security

6.7.1 Security Warning Dialog

The following dialog appears, if a document contains macros.

[Add Dialog Mockup Here]

6.7.2 Macro Security Dialog

The Macro dialog is completely redesigned. The old concept of “trusted pathes” for libraries has been dropped. The new dialog uses a security level concept. The levels High, Medium and Low are used. Medium is default.

##FL->MT: How do we want to handle self written/recorded macros – could we sign them for personal use on this computer? What will be the default?

the settings button switches the tab page to the Trusted Sources one and sets the focus to the new path field.

The Add... button calls a folder picker dialog. The Remove buttons are only enabled, if an entry is selected within the list box. The View button is also only enabled, if a certificate is selected and calls the View Certificate dialog described in chapter 6.5.5 View Certificate Dialog on page 67.

The Remove button is disabled as long as nothing is selected in the Trusted sources list box.

Macro Organizer Dialog String - Modules List

6.7.3 Trust Source of Macro Dialog for Signed Macros

OO.org raises a dialog if a signed macro will be loaded with the document and it's source has not been trusted before. This dialog allows the user to add the source to trusted sources and execute the macro.

String List

6.7.4 Enable/Disable Document Macro Dialog for Unsigned Macros

String List

6.8 Error Conditions

None

7 Future Tasks (not relevant for OO.org 2.0)

The following tasks are not planned to be implemented for OO.org 2.0.

7.1 Signing of Sections in Writer

OO.org Writer allows to sign sections independently from signing the whole document.

• A signed section is automatically write protected (password is optional).

• The signature of a section gets lost, if the protection of the section gets removed.

• A double click on the signed icon in the status bar shows the signature.

• Only the content of the section will be signed. The formatting (i.e. paragraph templates) is not signed. This allows the section to be an active part of the document.

  

  

  

  

  Icons will be provided directly by Stella Schulze

7.2 Signing of Table Sheets in Calc

OO.org Calc offers the possibility to sign table sheets independently from signing the whole document. The table sheet will be signed as is with references, with fields and formulas.

• A signed table sheet gets protected without password.

• The signature of a table sheet gets lost, if the content of the signed sheet will be modified.

• A double click on the signature icon shows the signature.

  

• The new password dialog layout will be used for protect document and protect table dialog

  

  Protect Sheet Strings

Item	English	German	Comments
Button	Digital Signature...	Digitale Signatur...

7.2.1 Other Future Tasks

• What's about imported MS documents?

• Set permissions restriction for a document (User Rights Management)

  • Per User

  • Per Group

  • Permission types

    • Read/Write access to document

    • Add comments only

    • Read-only access to document

    • Load a different version of the document??

    • Saving document under a new file name / Send document (i.e. as an e-mail)

    • Content copying or extraction via clipboard

    • Form field fill-in

    • Signing

    • Content linking allowed (only possible if content is not encrypted

    • Printing / PDF creation

  • Problems

    • How to deal with MS documents with permissions?

8 Legal Issues

None

9 Notes

10 References and Links

Signatures:

http://www.w3.org/Signature/

Here is a list of rules and regulations that have special security requirements:

• Government Paperwork Elimination Act (GPEA)

• Health Insurance Portability and Accountability Act (HIPAA)

• 21 CFR Part 11 (pharmaceutical industry)

• German Act regarding Digital Signatures
  (German: “Signaturgesetz” - http://www.bsi.de/esig/basics/legalbas/sigg2001.pdf)

• Electronic Signatures Directive by the EC
  (http://www-personal.umich.edu/~rmann/Statutes/Electronic%20Signatures%20Directive.PDF)

• European Electronic Signature Standardization Initiative (EESSI)

• www.osci.de , http://www.bund.de/BundOnline-2005-.6164.htm