14
Security, Control, and Digital Signatures
This chapter describes issues relating to security and digital signatures.
Note:
Admittedly, many more topics on security should be addressed. These additional topics may be
discussed in a later release of this document.
Tracking and Controlling Templates Through Unique Identifiers
This section describes how templates can be uniquely identified. It also explains the requirements XFA
template designing applications and XFA processing applications must satisfy to retain such identification.
Uniquely identifying an XFA template allows its use to be tracked and controlled, whether the template is
used for form fill-in or is modified by other template designers for another purpose.
IMPORTANT:
All applications that produce XFA templates (XFA template designers) or that process forms
based on XFA templates (XFA processing applications) are required to respect template-creator unique
identifiers and time stamps.
Unique Identifiers and Time Stamps
The XDP representation of XFA include a Universally Unique Identifier (UUID) and a time stamp. The UUID
is kept with the template throughout its life and the time stamp is updated whenever the template is
modified. The presence of the UUID and time stamp allows XFA template designing and XFA form
processing applications to track and control XFA templates.
The UUID and time stamp are included in any serialized representation of the template. In XDP format, this
information appears in the XDP root element as the attributes
UUID
and
timeStamp
(“XDP
on page 785).
If an XFA form is stored in PDF format, the UUID and time stamp are lost.
Processing Requirements for Template Designing Applications
If an XFA template designing application opens a template that omits a UUID, it must create one for it. If it
opens a template that includes a UUID, it must not change the value of that UUID.
XFA template designing applications must update a template’s time stamp whenever the template is
changed.
Processing Requirements for XFA Processing Applications
Although XFA processing applications cannot change a template, they can be directed to submit an XFA
template to a server. In such a situation, the XFA processing application must include in its submittal the
UUID and time stamp from the original template.
The following template segment includes an submit button that causes the data and template to be
submitted to the server.
401