Blockchain Transaction Lifecycle Security Standard Audit Framework

previous: Document Hashing Process | Contents | next: Enable Canceling Transactions

Document Signing Process

Statement of Requirement

Each Role that signs transaction data MUST document the signing process it uses, including the signature scheme, the encoding of the signature, and any domain separation applied. The documentation MUST cover any deviation from a standard it refers to, and MUST be sufficient for another party to reproduce the digest and verify the signature without tooling supplied by the signer.

See it in the specification

Applicability

All Roles that sign transaction data

Purpose

Enable any role receiving a transaction to establish independently what was signed

Audit Procedure

Verify that each procedure that signs transaction data is documented, including the signature scheme, the signature encoding, and any domain separation applied.

Reproduce the digest for a transaction using only the documentation, without any implementation supplied by the signer, and compare it with the digest the signer produced.

See also Document Hashing Process and Hash Transactions

Success Criteria

• Each procedure that signs transaction data is documented, including the signature scheme, the signature encoding, and any domain separation applied
• Any deviation from a standard the documentation refers to is described
• A digest reproduced from the documentation alone matches the digest produced by the signer

Best Practice

The documentation cites a published standard, and states explicitly and in detail wherever the implementation departs from it.

Failure Criteria

• A procedure signs transaction data, and the documentation is insufficient to determine the signature scheme used
• The documentation cites a standard the implementation does not follow exactly, and does not describe the differences
• The digest cannot be reproduced without tooling supplied by the signer

Key Evidence

• System documentation
• Source Code
• Reperformance

previous: Document Hashing Process | Contents | next: Enable Canceling Transactions