Public key infrastructures (PKIs) are starting to be deployed by businesses, industrial/trade organizations, and government agencies to enable and secure electronic transactions. PKIs have enabled businesses and government agencies to perform previously paper-based signed transactions electronically. PKIs provide the capability to authenticate users and to permit them to sign digital data in a technically non-reputable fashion. Many general purpose applications, such as word processors, electronic mail clients, and web browsers, now permit an individual to use a digital signature certificate (an electronic document binding an identity to a digital signature public key) to sign digital data. The digital signature along with the information that was digitally signed is placed into a proprietary format (e.g. Adobe PDF, Microsoft Word) that is unique to the vendor and/or application. As a result, the recipient of digitally signed data must have the specific application that was used to generate the digital signature to verify the digital signature.

The innumerable digitally signed information formats that are interpretable only by a specific signing application is undermining the intent of fielding interoperate PKIs. The intent behind development of a PKI has always been the provision of security services within and between PKIs. The proprietary nature of the digitally signed information resulting from the way applications leverage the different PKIs threatens that goal, and most vendors are not willing to adopt another vendor's digitally signed information without seeing a specific economic gain.

The objective of this research is to develop a common signed information format that could be used independent from the signing application. This would enable interoperability of digital signature generation and verification regardless of the application used to generate the digital signature and would result in greater end user acceptance, since users will not be required to manage multiple or special signature verification applications. The method employed by the research is to work with a particular commercial industry (i.e. the healthcare industry) to develop a standard, interoperable format for digitally signed information that can ultimately be used not only in the healthcare industry, but for all digital signatures employed across all industries.

Signing Models

There are several different signing models that are needed by the health care industry. These models represent the information that must be incorporated into a common signed information format for it to be useful for health care industry business processes.

Simple Single Signature

This is the simplest format and applies where a single individual signs a set of information that is contained in a form, a letter, or in a file. Figure 1 shows an annotated x-ray signed by a physician as an example of how this signature type is used in the health care industry.

Figure 1 - Annotated X-ray Signed by a Physician

Simple Multiple Signature

This format applies where multiple individuals sign a set of information that is contained in a form, a letter, or in a file. In this case, the individuals sign exactly same set of information and all modifications to the information are made before any of the individuals sign the information. This implies that the signer is acknowledging only seeing the set of information signed, not the fact the other signatures are present. Figure 2 shows an annotated x-ray signed by two physicians as an example of how this signature type is used in the health care industry.

Figure 2 - Annotated X-ray Signed by Two Physicians

Multiple Signature Enveloping

This format applies where multiple individuals in a specific hierarchical order sign a set of information that is contained in a form, a letter, or in a file. In this case, the individuals all sign the same set of information, with later signatures also signing previous signatures. The first signatory signs the digital information. The second signatory signs the digital information along with the first signature. The third signatory signs the digital information along with the first and second signatures, and so forth. If there is a need to modify the digital information being signed, the process starts from the beginning with the corrected information. Figure 3 shows an example hospital purchase order signed by the requester and two levels of hospital management.

Figure 3 - Purchase Order with Multiple Hierarchical Signatures

Single Signature per Information Set

This format applies where multiple signatures appear in one document, but each signature applies to a specific and separate set of information within the document. Figure 4 shows an example athletic program participation application where each signatory is responsible for the signing their own information.

Figure 4 - Application to Participate in Athletic Programs with Separate Signatures for Different Parts of the Application

Multiple Signature Enveloping with Information Addition Only

This format applies where multiple signatures appear in a single document and each signature covers all information available at the time of signing, including previous signatures. Additions to the information set made after an individual's signature has been applied are not signed or acknowledged. Figure 5 shows an example of multiple signature enveloping using a patient's chart.

Figure 5 - Patient Chart with Multiple Signatures where Signatory Signs all Information on the Chart at the Time of Signing

Multiple Version Multiple Signature Enveloping with Information Addition and Removal

This format applies where one document contains multiple signatures and each individual can unilaterally modify (add/remove) information prior to signing. Additions/modifications to the information set made after an individual's signature has been applied are not signed or acknowledged.

Please read our NIST disclaimer and privacy policy.
The Computer Security Resource Center is in the Computer Security Division of the Information Technology Laboratory at the National Institute of Standards and Technology .
NIST is an agency of the U.S. Commerce Department's Technology Administration.
Please send comments or suggestions to kathy.lyons-burke@nist.gov
Last Modified: December 15, 2000.