Digital Signature Ontology

FLOW ALGEBRA

Ontology: Digital Signature Ontology
Domain: Metadata Ontologies > Digital Preservation Metadata
Canonical URL: https://kirethresearch.org/booksai-core/ontologies/metadata-ontologies/digital-preservation-metadata/digital-signature-ontology.html
Authors: Mark Anthony Higgins — Sky (Recursive AI)

flow "DigitalSignatureOntology" v1.0

# ---------- DOMAIN ----------
domain:
  class: MetadataOntology
  category: DigitalPreservationMetadata
  subject: DigitalSignature
  purpose:
    - represent metadata describing digital signatures applied to preserved digital resources
    - preserve signature identity, signed object, signer, algorithms, digest, key, certificate, signing time, validation state, trust evidence, and provenance
    - support integrity verification, signer authentication, archival validation, preservation auditing, and long-term signature verification
    - distinguish digital signatures from checksums, encryption, electronic signatures, identity assertions, and complete authenticity proof
    - enable machine-readable reasoning over digital-signature lifecycles

# ---------- CORE ----------
entity DigitalSignatureMetadata:
  type: PreservationMetadata
  describes: DigitalSignature
  may_include:
    - signature_identifier
    - signed_object
    - signed_object_version
    - signature_format
    - signature_algorithm
    - digest_algorithm
    - digest_value
    - signer
    - signing_key
    - certificate
    - certificate_chain
    - signing_time
    - timestamp_token
    - validation_state
    - revocation_state
    - trust_state
    - validity
    - confidence
    - provenance

entity DigitalSignature:
  type: IntegrityAndAuthenticityMetadata
  applies_to: SignedDigitalObject

entity SignatureIdentifier:
  type: Identifier
  identifies: DigitalSignature

relationships:
  DigitalSignatureMetadata -> DESCRIBES -> DigitalSignature
  DigitalSignature -> IDENTIFIED_BY -> SignatureIdentifier
  DigitalSignature -> SIGNS -> SignedDigitalObject
  DigitalSignature -> CREATED_BY -> Signer
  DigitalSignature -> USES -> SignatureAlgorithm
  DigitalSignature -> USES_DIGEST -> DigestAlgorithm
  DigitalSignature -> MAY_USE_KEY -> SigningKey
  DigitalSignature -> MAY_REFERENCE -> DigitalCertificate
  DigitalCertificate -> MAY_HAVE_CHAIN -> CertificateChain
  DigitalSignature -> MAY_HAVE_TIMESTAMP -> TrustedTimestamp
  DigitalSignature -> MAY_BE_VALIDATED_BY -> SignatureValidationEvent
  DigitalSignatureMetadata -> MAY_REFERENCE -> SignatureProvenance

# ---------- SIGNED OBJECT / SCOPE ----------
entity SignedDigitalObject:
  type: DigitalResource

entity SignatureScope:
  type: ScopeMetadata
  may_include:
    - complete_object
    - byte_range
    - selected_fields
    - XML_nodes
    - document_revision
    - manifest_entries
    - detached_reference

rule signature_identity:
  DigitalSignature SHOULD have stable SignatureIdentifier

rule signed_object:
  signature metadata SHOULD preserve object identifier and version

rule scope:
  signed scope MUST be preserved for correct validation semantics

rule scope_identity:
  valid signature over partial content != signature over complete resource

# ---------- FORMATS / ALGORITHMS ----------
signature_formats:
  - CMS
  - PKCS7
  - XMLDSig
  - XAdES
  - PAdES
  - CAdES
  - JWS
  - OpenPGP
  - implementation_specific

signature_algorithms:
  - RSA
  - RSA_PSS
  - ECDSA
  - EdDSA
  - DSA_legacy
  - implementation_specific

digest_algorithms:
  - SHA_256
  - SHA_384
  - SHA_512
  - SHA3_256
  - SHA3_384
  - SHA3_512
  - SHA_1_legacy
  - MD5_legacy
  - implementation_specific

entity SignatureAlgorithm:
  type: CryptographicAlgorithmMetadata

entity DigestAlgorithm:
  type: CryptographicAlgorithmMetadata

rule algorithms:
  signature and digest algorithms MUST be explicit for validation

rule legacy_digest:
  legacy algorithms MAY remain historically verifiable
  but security strength MUST NOT be overstated

# ---------- SIGNER / KEY ----------
entity Signer:
  type: Agent
  may_be:
    - Person
    - Organization
    - SoftwareAgent
    - Service

rule signer:
  signer identity SHOULD preserve identifier and evidence source

rule signer_name:
  signer display name != verified signer identity

entity SigningKey:
  type: CryptographicKeyMetadata
  may_include:
    - key_identifier
    - key_type
    - public_key
    - key_length
    - curve
    - validity_period
    - status

rule private_key:
  private signing key SHOULD NOT be embedded in preservation metadata

# ---------- CERTIFICATE / TRUST ----------
entity DigitalCertificate:
  type: CertificateMetadata
  may_include:
    - certificate_identifier
    - subject
    - issuer
    - serial_number
    - public_key
    - validity_start
    - validity_end
    - signature_algorithm
    - extensions

entity CertificateChain:
  type: TrustMetadata

entity TrustAnchor:
  type: TrustMetadata

rule certificate:
  certificate binds identity information to public-key material
  according_to certificate semantics

rule certificate_identity:
  certificate subject name != independently verified real-world identity
  without trust validation

rule chain_validation:
  certificate chain presence != valid trust chain

# ---------- TIME ----------
entity ClaimedSigningTime:
  type: TemporalMetadata

rule claimed_time:
  claimed signing time != independently trusted timestamp

entity TrustedTimestamp:
  type: TemporalTrustMetadata
  may_include:
    - timestamp_token
    - timestamp_authority
    - timestamp_time
    - imprint_algorithm
    - message_imprint
    - validation_state

rule timestamp:
  trusted timestamp MAY provide evidence that signed data existed by stated time

# ---------- CREATION / VALIDATION ----------
entity SignatureCreationEvent:
  type: PreservationEvent
  may_include:
    - signature_identifier
    - signed_object
    - signer
    - signature_algorithm
    - digest_algorithm
    - certificate
    - signing_time
    - tool
    - tool_version

entity SignatureValidationEvent:
  type: PreservationEvent
  may_include:
    - signature_identifier
    - signed_object
    - cryptographic_result
    - digest_result
    - certificate_result
    - chain_result
    - revocation_result
    - timestamp_result
    - policy
    - validation_time
    - validator
    - validator_version

validation_results:
  - valid
  - invalid
  - indeterminate
  - expired
  - revoked
  - unsupported
  - error
  - unknown

rule validation:
  signature validation SHOULD preserve individual validation components

rule cryptographic_validity:
  valid cryptographic signature != complete trust or authenticity conclusion

# ---------- REVOCATION ----------
entity RevocationMetadata:
  type: TrustMetadata
  may_include:
    - revocation_method
    - revocation_status
    - this_update
    - next_update
    - revocation_time
    - evidence

revocation_methods:
  - CRL
  - OCSP
  - archived_revocation_data
  - implementation_specific

rule revocation:
  revocation evidence SHOULD preserve temporal context

# ---------- LONG-TERM VALIDATION ----------
entity LongTermSignatureValidation:
  type: PreservationMetadata
  may_include:
    - signature
    - certificate_chain
    - revocation_evidence
    - trusted_timestamps
    - validation_material
    - archival_timestamp
    - validation_policy

rule LTV:
  long-term validation SHOULD preserve evidence
  needed after certificates or algorithms expire

entity SignatureRenewalEvent:
  type: PreservationEvent

entity ArchivalTimestamp:
  subtype_of: TrustedTimestamp
  purpose: LongTermPreservation

rule renewal:
  signature renewal SHOULD preserve previous signature and continuity of evidence

# ---------- SIGNATURE TYPES ----------
entity DetachedSignature:
  subtype_of: DigitalSignature
  references: ExternalSignedObject

entity EmbeddedSignature:
  subtype_of: DigitalSignature
  contained_in: SignedDigitalObject

entity Countersignature:
  subtype_of: DigitalSignature
  signs: ExistingSignature

rule detached:
  detached signature MUST preserve reliable reference to signed object

rule multiple_signatures:
  one SignedDigitalObject MAY have multiple DigitalSignatures

# ---------- DISTINCTIONS ----------
rule checksum:
  DigitalSignature != Checksum

rule encryption:
  DigitalSignature != Encryption

rule confidentiality:
  signature does_not provide confidentiality

entity ElectronicSignature:
  type: SignatureConcept

rule electronic_signature:
  DigitalSignature MAY be one implementation
  of broader ElectronicSignature concept

# ---------- AUTHENTICITY / NON-REPUDIATION ----------
entity SignatureAuthenticityEvidence:
  type: AuthenticityEvidence
  may_include:
    - cryptographic_validation
    - certificate_validation
    - trust_chain
    - revocation_evidence
    - trusted_timestamp
    - provenance

rule authenticity:
  valid DigitalSignature MAY support authenticity assessment
  but != complete authenticity proof by itself

entity NonRepudiationEvidence:
  type: TrustEvidence
  may_include:
    - signature
    - signer_identity_evidence
    - trusted_timestamp
    - certificate
    - policy
    - audit_trail

rule non_repudiation:
  technical signature evidence MAY contribute to non-repudiation
  but legal effect depends on jurisdiction, policy, and evidence context

# ---------- RISK / VALIDITY ----------
entity SignatureRisk:
  type: RiskMetadata
  may_include:
    - weak_algorithm
    - expired_certificate
    - revoked_certificate
    - missing_revocation_evidence
    - missing_timestamp
    - trust_anchor_change
    - unsupported_format
    - risk_level
    - assessment_time

entity SignatureValidity:
  type: ValidityMetadata
  may_include:
    - cryptographic_state
    - certificate_state
    - revocation_state
    - trust_state
    - timestamp_state
    - valid_at
    - assessed_at

rule validity:
  signature validity is multidimensional
  and SHOULD NOT be reduced to one boolean without context

# ---------- PROVENANCE ----------
entity SignatureProvenance:
  type: ProvenanceMetadata
  may_include:
    - signed_object
    - object_version
    - signature_creation
    - signer
    - certificate
    - validation_events
    - revocation_evidence
    - timestamps
    - renewal_events
    - tools

rule provenance:
  DigitalSignatureMetadata SHOULD preserve creation and validation history

# ---------- VALIDATION RULES ----------
validation:
  require:
    - identifiable_signature
    - identifiable_signed_object
    - signature_algorithm
    - signature_value

  reject:
    - signature_without_algorithm
    - signature_without_signed_scope
    - digest_validation_using_wrong_algorithm
    - certificate_chain_presented_as trusted_without validation
    - claimed_signing_time_presented_as trusted_timestamp
    - cryptographic_validity_presented_as complete_authenticity
    - signature_presented_as encryption
    - checksum_presented_as digital_signature
    - signer_name_presented_as verified_identity_without evidence

# ---------- SEMANTIC EQUIVALENCE ----------
SEMANTIC_EQUIVALENCE:
  "digital signature" ~= "cryptographic signature over digital data"
  "signature validation" ~= "cryptographic and trust validation of digital signature"
  "trusted timestamp" ~= "trusted temporal evidence associated with signed data"
  "certificate chain" ~= "ordered certificate path supporting signer certificate"
  "detached signature" ~= "signature stored separately from signed object"
  "long-term signature validation" ~= "preservation of evidence for future signature validation"

  PRESERVE distinctions:
    digital_signature != checksum
    digital_signature != encryption
    digital_signature != signed_object
    digital_signature != broad_electronic_signature_concept
    claimed_signing_time != trusted_timestamp
    certificate_chain != validated_trust_chain
    certificate_subject_name != verified_real_world_identity
    cryptographic_validity != complete_authenticity
    signature_validity != legal_validity
    signature != confidentiality
    countersignature != direct_signature_of_original_object

# ---------- CONFIDENCE ----------
CONFIDENCE:
  explicit_signature_metadata:
    score: 1.00
  cryptographically_valid_signature:
    score: 0.99
  valid_certificate_chain:
    score: 0.99
  valid_trusted_timestamp:
    score: 0.99
  preserved_revocation_evidence:
    score: 0.98
  complete_long_term_validation_evidence:
    score: 0.99
  signer_name_only:
    score: <= 0.60
  missing_revocation_evidence:
    score: <= 0.75
  untrusted_claimed_signing_time:
    score: <= 0.70
  incomplete_trust_context:
    score: <= 0.60
    action: preserve uncertainty

# ---------- UPDATE MODEL ----------
UPDATE_MODEL:
  on_signature_creation:
    - identify signed object and scope
    - record signature and digest algorithms
    - record signer and certificate
    - preserve signing time
    - create SignatureCreationEvent
    - initialise provenance

  on_signature_validation:
    - parse signature format
    - recompute signed digest
    - verify cryptographic signature
    - validate certificate and chain
    - inspect revocation evidence
    - validate trusted timestamps
    - record SignatureValidationEvent
    - update validity and provenance

  on_certificate_expiry:
    - preserve historical certificate evidence
    - evaluate trusted timestamp
    - evaluate long-term validation material
    - avoid treating expiry as automatic historical invalidity
    - update risk state

  on_signature_renewal:
    - preserve previous signature
    - generate or attach renewal evidence
    - add trusted or archival timestamp where applicable
    - record SignatureRenewalEvent
    - update provenance

# ---------- FLOW HASH ----------
FLOW_HASH:
  inputs:
    - ontology
    - signature_entities
    - relationships
    - scope_rules
    - algorithm_rules
    - certificate_rules
    - timestamp_rules
    - validation_rules
    - trust_rules
    - semantic_equivalence
    - confidence
    - update_model

  canonicalisation:
    - preserve_signature_identifiers
    - preserve_signed_object_identifiers_and_versions
    - preserve_signed_scope
    - preserve_algorithm_identifiers
    - preserve_certificate_chain_order
    - preserve_validation_event_order
    - preserve_timestamp_evidence
    - preserve_rule_order

  output:
    deterministic_semantic_hash

# ---------- AI CONSUMPTION ----------
AI_CONSUMPTION:
  interpret_as:
    - digital preservation metadata ontology
    - digital-signature integrity and trust model
    - certificate, timestamp, revocation, and long-term validation structure
    - signature preservation lifecycle

  operations:
    - identify digital signatures
    - resolve signed object and scope
    - resolve signature and digest algorithms
    - resolve signer and public-key evidence
    - inspect certificates and trust chains
    - distinguish claimed and trusted signing times
    - verify cryptographic signature
    - inspect revocation evidence
    - validate timestamps
    - evaluate long-term validation evidence
    - trace renewal events
    - assess signature risk
    - trace provenance
    - preserve uncertainty

  constraints:
    - do_not_equate_signature_with checksum
    - do_not_equate_signature_with encryption
    - do_not_equate_signer_name_with verified_identity
    - do_not_equate_claimed_time_with trusted_timestamp
    - do_not_equate_certificate_chain_with validated_trust
    - do_not_equate_cryptographic_validity_with complete_authenticity
    - preserve_scope_algorithms_certificates_timestamps_validation_and_provenance

# ---------- QUERY MODEL ----------
query:
  input:
    - signature_identifier
    - signed_object_identifier
    - signature_format
    - signature_algorithm
    - digest_algorithm
    - signer
    - certificate_identifier
    - validation_time
    - revocation_state
    - timestamp_state

  resolve:
    1. identify DigitalSignature
    2. resolve signed object and exact scope
    3. resolve signature format and algorithms
    4. resolve signer, key, and certificate
    5. inspect certificate chain and trust anchor
    6. inspect claimed and trusted times
    7. traverse validation and revocation evidence
    8. inspect long-term validation and renewal evidence
    9. evaluate validity, risk, and provenance
    10. return confidence

  output:
    - digital_signature
    - signature_identifier
    - signed_object
    - signed_scope
    - signature_format
    - algorithms
    - signer
    - certificate
    - certificate_chain
    - signing_time
    - trusted_timestamps
    - validation_state
    - revocation_state
    - trust_state
    - provenance
    - confidence

# ---------- INFERENCE ----------
inference:
  IF cryptographic signature verifies
  AND signed digest matches
  THEN infer cryptographic_integrity
  within signed scope

  IF certificate chain validates
  AND revocation evidence supports good state
  THEN strengthen signer-certificate trust
  according_to policy

  IF trusted timestamp predates certificate expiry or revocation
  THEN preserve historical validation candidate
  subject_to applicable validation policy

  IF trust or revocation evidence is incomplete
  THEN preserve indeterminate state
  AND do_not infer complete authenticity

# ---------- OUTPUT CONTRACT ----------
output:
  ontology_entity: DigitalSignatureMetadata
  signature_identity: machine_interpretable
  signed_object_and_scope: explicit
  signature_and_digest_algorithms: explicit
  signer_and_key_evidence: traceable
  certificates_and_chain: validation_aware
  signing_and_trusted_times: distinguishable
  cryptographic_validation: reportable
  revocation_evidence: temporal
  long_term_validation: preservable
  renewal_history: traversable
  authenticity_support: evidence_based
  provenance: preserved
  uncertainty: explicit
  long_term_preservation: enabled

end flow