General

Re: What exactly is signed using entire form signature

yoav — Wed, 04 Oct 2006 07:22:35 GMT

Ted,
You are right about singing the XSN, but from the point of view of the end user it is a problem because only the developer signes the template / XSN. As a user you don't have any guarentee that after signing a form the creator of the form will not change the xsn.
Any suggestions ?

Re: What exactly is signed using entire form signature

Ted Fitch — Mon, 11 Sep 2006 05:35:28 GMT

You can sign the entire xsn so someone can't go in and change the label:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/ipsdk/html/ipsdkDigitallySigningData_HV01126125.asp

What exactly is signed using entire form signature

yoav — Wed, 06 Sep 2006 11:13:29 GMT

Signing a form (entire or sections) appears to sign only the xml content and not the labels stored in the XSN.
This can resolve in looking at a form signed with different labels then they were when signing by changing the XSN or creating a new one with same ID.
Scenario:
Sign form.
Open XSN and change label.
Re-open form - you don't get any message of template update (as apposed to adding or deleting controls that do show warnings).
If the label for example is currency - this could be meaningful....

Am I missing something?