ETSI EN 319 102-1-2016 Electronic Signatures and Infrastructures (ESI) Procedures for Creation and Validation of AdES Digital Signatures Part 1 Creation and Validation (V1 1 1)《电子签_1.pdf

1、 ETSI EN 319 102-1 V1.1.1 (2016-05) Electronic Signatures and Infrastructures (ESI); Procedures for Creation and Validation of AdES Digital Signatures; Part 1: Creation and Validation EUROPEAN STANDARD ETSI ETSI EN 319 102-1 V1.1.1 (2016-05) 2 Reference DEN/ESI-0019102-1 Keywords electronic signatur

2、e, security, trust services ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice The present documen

3、t can be downloaded from: http:/www.etsi.org/standards-search The present document may be made available in electronic versions and/or in print. The content of any electronic and/or print versions of the present document shall not be modified without the prior written authorization of ETSI. In case

4、of any existing or perceived difference in contents between such versions and/or in print, the only prevailing document is the print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document

5、 may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at https:/portal.etsi.org/TB/ETSIDeliverableStatus.aspx If you find errors in the present document, please send your comment to one of the following services: https:/porta

6、l.etsi.org/People/CommiteeSupportStaff.aspx Copyright Notification No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI. The content of the PDF version shall not be modifie

7、d without the written authorization of ETSI. The copyright and the foregoing restriction extend to reproduction in all media. European Telecommunications Standards Institute 2016. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTMand the ETSI logo are Trade Marks of ETSI registered for the benefit of

8、its Members. 3GPPTM and LTE are Trade Marks of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. GSM and the GSM logo are Trade Marks registered and owned by the GSM Association. ETSI ETSI EN 319 102-1 V1.1.1 (2016-05) 3 Contents Intellectual Property Rights 6g3

9、Foreword . 6g3Modal verbs terminology 6g3Introduction 6g31 Scope 7g32 References 7g32.1 Normative references . 7g32.2 Informative references 8g33 Definitions and abbreviations . 9g33.1 Definitions 9g33.2 Abbreviations . 11g34 Signature creation . 12g34.1 Signature creation model 12g34.2 Signature cr

10、eation information model 13g34.2.1 Introduction. 13g34.2.2 Signature Creation Constraints . 14g34.2.3 Signers document (SD) 14g34.2.4 Signers document representation (SDR) 15g34.2.5 Signature attributes . 15g34.2.5.1 General requirements 15g34.2.5.2 Signing certificate identifier 15g34.2.5.3 Signatu

11、re policy identifier . 16g34.2.5.4 Signature policy store 16g34.2.5.5 Data content type 16g34.2.5.6 Commitment type indication . 16g34.2.5.7 Counter signatures . 17g34.2.5.8 Claimed signing time 17g34.2.5.9 Claimed signer location . 17g34.2.5.10 Signers attributes 17g34.2.6 Data to be signed (DTBS)

12、. 17g34.2.7 Data to be signed (formatted) (DTBSF) . 18g34.2.8 Data to be signed representation (DTBSR) . 18g34.2.9 Signature . 18g34.2.10 Signed data object (SDO) . 18g34.2.11 Validation data 18g34.3 Signature Classes and Creation Processes 19g34.3.1 Introduction. 19g34.3.2 Creation of Basic Signatu

13、res . 20g34.3.2.1 Description 20g34.3.2.2 Inputs . 20g34.3.2.3 Outputs 20g34.3.2.4 Processing . 20g34.3.2.4.1 Selection of documents to sign 20g34.3.2.4.2 Signature attribute and parameters selection . 21g34.3.2.4.3 Pre-signature presentation . 21g34.3.2.4.4 Signature invocation 21g34.3.2.4.5 Signin

14、g. 22g34.3.2.4.6 Signer authentication . 22g34.3.2.4.7 SDO composition 22g34.3.3 Creation of a Signature with Time 22g34.3.3.1 Description 22g34.3.3.2 Inputs . 23g34.3.3.3 Outputs 23g34.3.3.4 Process 23g34.3.4 Creation of Signatures with Long-Term Validation Material . 24g3ETSI ETSI EN 319 102-1 V1.

15、1.1 (2016-05) 4 4.3.4.1 Description 24g34.3.4.2 Inputs . 24g34.3.4.3 Outputs 24g34.3.4.4 Process 24g34.3.5 Creation of Signatures providing Long Term Availability and Integrity of Validation Material . 25g34.3.5.1 Description 25g34.3.5.2 Inputs . 25g34.3.5.3 Outputs 26g34.3.5.4 Process 26g35 Signatu

16、re validation 26g35.1 Signature validation model . 26g35.1.1 General requirements 26g35.1.2 Selecting validation processes 29g35.1.3 Status indication of the signature validation process and signature validation report. 30g35.1.4 Validation constraints . 35g35.1.4.1 General requirements 35g35.1.4.2

17、X.509 Validation Constraints 36g35.1.4.3 Cryptographic Constraints 36g35.1.4.4 Signature Elements Constraints 36g35.2 Basic building blocks . 37g35.2.1 Description 37g35.2.2 Format Checking 37g35.2.2.1 Description 37g35.2.2.2 Inputs . 37g35.2.2.3 Outputs 37g35.2.3 Identification of the signing certi

18、ficate . 38g35.2.3.1 Description 38g35.2.3.2 Inputs . 38g35.2.3.3 Outputs 38g35.2.3.4 Processing . 38g35.2.4 Validation context initialization 38g35.2.4.1 Description 38g35.2.4.2 Inputs . 39g35.2.4.3 Outputs 39g35.2.4.4 Processing . 39g35.2.5 Revocation freshness checker . 40g35.2.5.1 Description 40

19、g35.2.5.2 Inputs . 40g35.2.5.3 Output . 41g35.2.5.4 Processing . 41g35.2.6 X.509 certificate validation . 41g35.2.6.1 Description 41g35.2.6.2 Inputs . 42g35.2.6.3 Outputs 42g35.2.6.4 Processing . 42g35.2.7 Cryptographic verification 44g35.2.7.1 Description 44g35.2.7.2 Inputs . 44g35.2.7.3 Outputs 44

20、g35.2.7.4 Processing . 44g35.2.8 Signature acceptance validation (SAV) 45g35.2.8.1 Description 45g35.2.8.2 Inputs . 45g35.2.8.3 Outputs 45g35.2.8.4 Processing . 46g35.2.8.4.1 General requirements . 46g35.2.8.4.2 Processing AdES attributes . 46g35.2.9 Signature validation presentation building block

21、48g35.3 Validation process for Basic Signatures . 48g35.3.1 Description 48g35.3.2 Inputs 48g3ETSI ETSI EN 319 102-1 V1.1.1 (2016-05) 5 5.3.3 Outputs 48g35.3.4 Processing. 49g35.4 Time-stamp validation building block 51g35.4.1 Description 51g35.4.2 Inputs 51g35.4.3 Outputs 51g35.4.4 Processing . 51g3

22、5.5 Validation process for Signatures with Time and Signatures with Long-Term Validation Material . 51g35.5.1 Description 51g35.5.2 Inputs 52g35.5.3 Outputs 52g35.5.4 Processing . 52g35.6 Validation process for Signatures providing Long Term Availability and Integrity of Validation Material 54g35.6.

23、1 Introduction. 54g35.6.2 Additional building blocks 55g35.6.2.1 Past certificate validation 55g35.6.2.1.1 Description 55g35.6.2.1.2 Input 55g35.6.2.1.3 Output 55g35.6.2.1.4 Processing 56g35.6.2.2 Validation time sliding process . 56g35.6.2.2.1 Description 56g35.6.2.2.2 Input 56g35.6.2.2.3 Output 57

24、g35.6.2.2.4 Processing 57g35.6.2.3 POE extraction 58g35.6.2.3.1 Description 58g35.6.2.3.2 Input 58g35.6.2.3.3 Output 59g35.6.2.3.4 Processing 59g35.6.2.4 Past signature validation building block . 59g35.6.2.4.1 Description 59g35.6.2.4.2 Input 59g35.6.2.4.3 Output 59g35.6.2.4.4 Processing 59g35.6.3 V

25、alidation Process for Signatures providing Long Term Availability and Integrity of Validation Material . 60g35.6.3.1 Description 60g35.6.3.2 Input 61g35.6.3.3 Output . 61g35.6.3.4 Processing . 61g3Annex A (informative): Validation examples . 64g3A.1 General remarks and assumptions 64g3A.2 Symbols 64

26、g3A.3 Example 1: Revoked certificate . 65g3A.3.1 Introduction 65g3A.3.2 Basic signature validation 65g3A.3.3 Validating a Signature with Time . 65g3A.3.4 Example 2: Revoked CA certificate . 66g3A.3.5 Basic signature validation 67g3A.3.6 Validation of a Signature with Time 67g3A.3.7 Long-Term Validat

27、ion 67g3Annex B (informative): Signature Classes and AdES Signatures 71g3Annex C (informative): Conformance Checking . 72g3History 74g3ETSI ETSI EN 319 102-1 V1.1.1 (2016-05) 6 Intellectual Property Rights IPRs essential or potentially essential to the present document may have been declared to ETSI

28、. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is availabl

29、e from the ETSI Secretariat. Latest updates are available on the ETSI Web server (https:/ipr.etsi.org/). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000

30、314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Foreword This European Standard (EN) has been produced by ETSI Technical Committee Electronic Signatures and Infrastructures (ESI). The present document is part 1 of a multi-part deliv

31、erable covering Procedures for Creation and Validation of AdES Digital Signatures, as identified below: Part 1: “Creation and Validation“; Part 2: “Signature Validation Report“. National transposition dates Date of adoption of this EN: 29 April 2016 Date of latest announcement of this EN (doa): 31 J

32、uly 2016 Date of latest publication of new National Standard or endorsement of this EN (dop/e): 31 January 2017 Date of withdrawal of any conflicting National Standard (dow): 31 January 2017 Modal verbs terminology In the present document “shall“, “shall not“, “should“, “should not“, “may“, “need no

33、t“, “will“, “will not“, “can“ and “cannot“ are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of provisions). “must“ and “must not“ are NOT allowed in ETSI deliverables except when used in direct citation. Introduction The present document ai

34、ms to meet the general requirements of the international community to provide trust and confidence in electronic transactions, including, amongst other, applicable requirements from Regulation (EU) No 910/2014 i.15. ETSI ETSI EN 319 102-1 V1.1.1 (2016-05) 7 1 Scope The present document specifies pro

35、cedures for: the creation of AdES digital signatures (specified in ETSI EN 319 122-1 i.2, ETSI EN 319 132-1 i.4, ETSI EN 319 142-1 i.6 respectively); establishing whether an AdES digital signature is technically valid; whenever the AdES digital signature is based on public key cryptography and suppo

36、rted by public key certificates. To improve readability of the present document, AdES digital signatures are meant when the term signature is being used. NOTE 1: Regulation (EU) No 910/2014 i.15 defines the terms electronic signature, advanced electronic signature, electronic seals and advanced elec

37、tronic seal. These signatures and seals are usually created using digital signature technology. The present document aims at supporting the Regulation (EU) No 910/2014 i.15 for creation and validation of advanced electronic signatures and seals when they are implemented as AdES digital signatures. T

38、he present document introduces general principles, objects and functions relevant when creating or validating signatures based on signature creation and validation constraints and defines general classes of signatures that allow for verifiability over long periods. The following aspects are consider

39、ed to be out of scope: generation and distribution of Signature Creation Data (keys, etc.), and the selection and use of cryptographic algorithms; format, syntax or encoding of data objects involved, specifically format or encoding for documents to be signed or signatures created; and the legal inte

40、rpretation of any signature, especially the legal validity of a signature. NOTE 2: The signature creation and validation procedures specified in the present document provide several options and possibilities. The selection of these options is driven by a signature creation policy, a signature augmen

41、tation policy or a signature validation policy respectively. Note that legal requirements can be provided through specific policies, e.g. in the context of qualified electronic signatures as defined in the Regulation (EU) 910/2014 i.15. 2 References 2.1 Normative references References are either spe

42、cific (identified by date of publication and/or edition number or version number) or non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the referenced document (including any amendments) applies. Referenced documents which are no

43、t found to be publicly available in the expected location might be found at http:/docbox.etsi.org/Reference. NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee their long term validity. The following referenced documents are necessary for

44、the application of the present document. 1 IETF RFC 5280: “Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile“. 2 ISO/IEC 9594-8:2014: “Information technology - Open Systems Interconnection - The Directory - Part 8: Public-key and attribute certificate

45、 frameworks“. 3 IETF RFC 3161: “Internet X.509 Public Key Infrastructure; Time Stamp Protocol (TSP)“. ETSI ETSI EN 319 102-1 V1.1.1 (2016-05) 8 4 ETSI TS 119 172-1: “Electronic Signatures and Infrastructures (ESI); Signature Policies; Part 1: Building blocks and table of contents for human readable

46、signature policy documents“. 5 Common PKI Specifications for Interoperable Applications from T7 CAdES digital signatures; Part 1: Building blocks and CAdES baseline signatures“. i.3 ETSI EN 319 122-2: “Electronic Signatures and Infrastructures (ESI); CAdES digital signatures; Part 2: Extended CAdES

47、signatures“. i.4 ETSI EN 319 132-1: “Electronic Signatures and Infrastructures (ESI); XAdES digital signatures; Part 1: Building blocks and XAdES baseline signatures“. i.5 ETSI EN 319 132-2: “Electronic Signatures and Infrastructures (ESI); XAdES digital signatures; Part 2: Extended XAdES signatures

48、“. i.6 ETSI EN 319 142-1: “Electronic Signatures and Infrastructures (ESI); PAdES digital signatures; Part 1: Building blocks and PAdES baseline signatures“. i.7 ETSI EN 319 142-2: “Electronic Signatures and Infrastructures (ESI); PAdES digital signatures; Part 2: Additional PAdES signatures profile

49、s“. i.8 IETF RFC 5652: “Cryptographic Message Syntax (CMS)“. i.9 IETF RFC 4998: “Evidence Record Syntax (ERS)“. i.10 IETF RFC 6283: “Extensible Markup Language Evidence Record Syntax (XMLERS)“. i.11 Void. i.12 IETF RFC 6960: “X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP“. i.13 ETSI EN 319 422: “Electronic Signatures and Infrastructures (ESI); Time-stamping protocol and time-stamp token profiles“. i.14 ECRYPT II Yearly Report on Algorithms and Keysizes (2010-2011), Revision 1.