ETSI EN 319 162-1-2016 Electronic Signatures and Infrastructures (ESI) Associated Signature Containers (ASiC) Part 1 Building blocks and ASiC baseline containers (V1 1 1 Includes D_1.pdf

1、 ETSI EN 319 162-1 V1.1.1 (2016-04) Electronic Signatures and Infrastructures (ESI); Associated Signature Containers (ASiC); Part 1: Building blocks and ASiC baseline containers floppy3EUROPEAN STANDARD ETSI ETSI EN 319 162-1 V1.1.1 (2016-04) 2 Reference DEN/ESI-0019162-1 Keywords ASiC, e-commerce,

2、electronic signature, security ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice The present docu

3、ment can be downloaded from: http:/www.etsi.org/standards-search The present document may be made available in electronic versions and/or in print. The content of any electronic and/or print versions of the present document shall not be modified without the prior written authorization of ETSI. In ca

4、se of any existing or perceived difference in contents between such versions and/or in print, the only prevailing document is the print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the docum

5、ent may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at https:/portal.etsi.org/TB/ETSIDeliverableStatus.aspx If you find errors in the present document, please send your comment to one of the following services: https:/po

6、rtal.etsi.org/People/CommiteeSupportStaff.aspx Copyright Notification No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI. The content of the PDF version shall not be modi

7、fied without the written authorization of ETSI. The copyright and the foregoing restriction extend to reproduction in all media. European Telecommunications Standards Institute 2016. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTMand the ETSI logo are Trade Marks of ETSI registered for the benefit

8、of its Members. 3GPPTM and LTE are Trade Marks of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. GSM and the GSM logo are Trade Marks registered and owned by the GSM Association. ETSI ETSI EN 319 162-1 V1.1.1 (2016-04) 3 Contents Intellectual Property Rights

9、5g3Foreword . 5g3Modal verbs terminology 5g3Introduction 5g31 Scope 7g32 References 7g32.1 Normative references . 7g32.2 Informative references 8g33 Definitions and abbreviations . 9g33.1 Definitions 9g33.2 Abbreviations . 9g34 General Syntax . 10g34.1 Description of main features of Associated Sign

10、ature Containers . 10g34.1.1 Basic container structure . 10g34.1.2 Container types . 10g34.2 General requirements . 11g34.3 Associated Signature Container Simple (ASiC-S) . 11g34.3.1 Introduction. 11g34.3.2 General requirements for ASiC-S . 11g34.3.3 Detailed format for ASiC-S 12g34.3.3.1 Media type

11、 identification 12g34.3.3.2 Contents of the container 12g34.3.4 Long term availability and integrity of ASiC-S 14g34.4 Associated Signature Container Extended (ASiC-E) . 15g34.4.1 Introduction. 15g34.4.2 General requirements of ASiC-E 16g34.4.3 Detailed format for ASiC-E with XAdES . 16g34.4.3.1 Med

12、ia type identification 16g34.4.3.2 Contents of Container . 16g34.4.3.3 ASiC-E with XAdES example (informative) 18g34.4.4 Detailed format for ASiC-E with CAdES - time assertions 18g34.4.4.1 Media type identification 18g34.4.4.2 Contents of Container . 18g34.4.5 Long term availability and integrity of

13、 ASiC-E 21g35 ASiC baseline containers 21g35.1 ASiC levels . 21g35.2 General requirements . 22g35.2.1 Algorithm requirements 22g35.2.2 Notation for requirements . 22g35.3 Requirements for ASiC baseline containers . 23g35.3.1 ASiC conformance 23g35.3.2 Requirements for ASiC-S . 23g35.3.2.1 General re

14、quirements for ASiC-S . 23g35.3.2.2 Requirements for ASiC-S with CAdES signature . 23g35.3.2.3 Requirements for ASiC-S with XAdES signature . 24g35.3.3 Requirements for ASiC-E with XAdES signature 24g3Annex A (normative): ASiC metadata specification, data naming and referencing 25g3A.1 The mimetype

15、file 25g3A.2 Media type registrations . 25g3A.3 ASiC XML Schema . 26g3ETSI ETSI EN 319 162-1 V1.1.1 (2016-04) 4 A.4 ASiCManifest element . 26g3A.4.1 Semantics . 26g3A.4.2 Syntax . 26g3A.5 XAdESSignatures element . 27g3A.5.1 Semantics . 27g3A.5.2 Syntax . 28g3A.6 Naming and referencing data within AS

16、iC 28g3A.7 ASiCArchiveManifest file content and rules . 29g3Annex B (informative): ASiC examples 30g3B.1 Examples of ASiC-S 30g3B.1.1 PDF document associated with CAdES Signature . 30g3B.1.2 Simple document time stamp . 30g3B.1.3 Signature of a ZIP file with an ASiC-S container 30g3B.2 Example of AS

17、iC-E with XAdES 31g3History 32g3ETSI ETSI EN 319 162-1 V1.1.1 (2016-04) 5 Intellectual Property Rights IPRs essential or potentially essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members an

18、d non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (https:/ipr.etsi.org/)

19、. Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the prese

20、nt document. Foreword This European Standard (EN) has been produced by ETSI Technical Committee Electronic Signatures and Infrastructures (ESI). The present document is part 1 of a multi-part deliverable specifying Associated Signature Containers (ASiC), as identified below: Part 1: “Building blocks

21、 and ASiC baseline containers“; Part 2: “Additional ASiC containers“. National transposition dates Date of adoption of this EN: 25 April 2016 Date of latest announcement of this EN (doa): 31 July 2016 Date of latest publication of new National Standard or endorsement of this EN (dop/e): 31 January 2

22、017 Date of withdrawal of any conflicting National Standard (dow): 31 January 2017 Modal verbs terminology In the present document “shall“, “shall not“, “should“, “should not“, “may“, “need not“, “will“, “will not“, “can“ and “cannot“ are to be interpreted as described in clause 3.2 of the ETSI Draf

23、ting Rules (Verbal forms for the expression of provisions). “must“ and “must not“ are NOT allowed in ETSI deliverables except when used in direct citation. Introduction When signing data, the resultant signature needs to be associated with the data to which it applies. This can be achieved either by

24、 creating a data set which combines the signature and the data that was signed (e.g. by enveloping the data with the signature or including a signature element in the data set) or placing the (detached) signature in a separate resource and have some external means for associating the signature with

25、the data to which it applies. While there are some advantages to the use of detached signatures, most significantly their non-modification of the original data objects, there remains a risk that the signature becomes separated from the data to which it applies and so losing the association. Therefor

26、e, many application systems have developed their own technique for combining a detached signature with the signed object in some form of container so that they can be more easily distributed and guarantee that the correct signature and any relevant metadata is used when validating. The same requirem

27、ents apply to associate time assertions (i.e. time-stamp tokens or evidence records) to their associated data. ETSI ETSI EN 319 162-1 V1.1.1 (2016-04) 6 The present document defines a standardized use of container types to establish a common way for associating files containing data objects with fil

28、es containing digital signatures and/or time assertions. Using a common container form and associated information will facilitate data interchange and interoperability among various signing and validation services. Whilst ZIP 5 provides a basic container structure that can associate files containing

29、 data objects (file objects) and the signature(s) that apply to them, there is a recognized need for additional structure and metadata about the association, for example to link a particular signature with the file object to which it is applied. Other formats have already been specified for the use

30、of ZIP based structures to bind together a number of file objects with related metadata. This includes OCF 4 which was originally designed for use by eBooks but has been adopted as the basis for other containers, for example ODF 6. The present document builds on this work specifically addressing the

31、 requirements of associating a digital signature with any type of data, independent of the needs of any particular document or data type. The present document is intended to cover containers including digital signatures and time assertions supported by PKI and public key certificates, and aims to me

32、et the general requirements of the international community to provide trust and confidence in electronic transactions, including, amongst other, applicable requirements from Regulation (EU) No 910/2014 i.3. The present document is part of a rationalized framework of standards (see ETSI TR 119 000 i.

33、9). ETSI TR 119 100 i.1 provides guidance on how to use the present document within the aforementioned framework. ETSI ETSI EN 319 162-1 V1.1.1 (2016-04) 7 1 Scope The present document specifies Associated Signature Containers (ASiC) which bind together into one single digital container based on ZIP

34、 5 either detached digital signatures or time assertions, with a number of file objects (e.g. documents, XML structured data, spreadsheet, multimedia content) to which they apply. The present document specifies general purpose ASiC containers building blocks and a limited set of baseline containers.

35、 ASiC supports the following signature and time assertion formats: CAdES object incorporating CAdES signatures (ETSI EN 319 122-1 1 and ETSI EN 319 122-2 11); XAdES signatures (ETSI EN 319 132-1 2 and ETSI EN 319 132-2 12); IETF RFC 3161 3 and updated by IETF RFC 5816 13 time-stamp tokens; and IETF

36、RFC 4998 8 or IETF RFC 6283 9 evidence records. NOTE 1: No restriction is placed on time assertions eventually used within CAdES signatures or XAdES signatures. The building blocks defined in the present document support additional features not supported by the aforementioned formats, such as time-s

37、tamping and CAdES signing of multiple content and XAdES parallel signatures, that can be used in other contexts. The present document defines baseline containers which provide the basic features necessary for a wide range of business and governmental use cases for electronic procedures and communica

38、tions to be applicable to a wide range of communities when there is a clear need for interoperability. The present document aims at supporting associated signature containers in different regulatory frameworks. NOTE 2: Specifically, but not exclusively, ASiC Associated Signature Containers specified

39、 in the present document aim at supporting electronic signature and electronic seal as per Regulation (EU) No 910/2014 i.3. The present document defines four levels of ASiC baseline containers addressing incremental requirements to maintain the availability and integrity of the containers over the l

40、ong term, suitably profiled for reducing the optionality as much as possible, in a way that a certain level always addresses all the requirements already addressed at levels that are below it. The present document does not address the identification of the validation policy to be used for verifying

41、a container that contains time assertions. 2 References 2.1 Normative references References are either specific (identified by date of publication and/or edition number or version number) or non-specific. For specific references, only the cited version applies. For non-specific references, the lates

42、t version of the referenced document (including any amendments) applies. Referenced documents which are not found to be publicly available in the expected location might be found at http:/docbox.etsi.org/Reference. NOTE: While any hyperlinks included in this clause were valid at the time of publicat

43、ion, ETSI cannot guarantee their long term validity. The following referenced documents are necessary for the application of the present document. 1 ETSI EN 319 122-1: “Electronic Signatures and Infrastructures (ESI); CAdES digital signatures; Part 1: Building blocks and CAdES baseline signatures“.

44、ETSI ETSI EN 319 162-1 V1.1.1 (2016-04) 8 2 ETSI EN 319 132-1: “Electronic Signatures and Infrastructures (ESI); XAdES digital signatures; Part 1: Building blocks and XAdES baseline signatures“. 3 IETF RFC 3161: “Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)“. 4 ISO/IEC TS 30135

45、 (all parts): “Information technology - Digital publishing - EPUB3“. NOTE: Available at http:/idpf.org/epub/30/spec/epub30-ocf.html. 5 Application Note: “APPNOTE.TXT - .ZIP File Format Specification“, PKWARE Inc., September 2012. NOTE: Available at http:/ 6 OASIS: “Open Document Format for Office Ap

46、plications (OpenDocument) Version 1.2; Part 3: Packages“ 29 September 2011. 7 IETF RFC 3986: “Uniform Resource Identifier (URI): Generic Syntax“. 8 IETF RFC 4998: “Evidence Record Syntax (ERS)“. 9 IETF RFC 6283: “Extensible Markup Language Evidence Record Syntax (XMLERS)“. 10 ISO/IEC 21320-1: “Infor

47、mation technology - Document Container File - Part 1: Core“. 11 ETSI EN 319 122-2: “Electronic Signatures and Infrastructures (ESI); CAdES digital signatures; Part 2: Extended CAdES signatures“. 12 ETSI EN 319 132-2: “Electronic Signatures and Infrastructures (ESI); XAdES digital signatures; Part 2:

48、 Extended XAdES signatures“. 13 IETF RFC 5816: “ESSCertIDv2 Update for RFC 3161“. 14 W3C recommendation: “XML Signature Syntax and Processing“. 15 ISO/IEC 10646: “Information technology - Universal Coded Character Set (UCS)“. 2.2 Informative references References are either specific (identified by d

49、ate of publication and/or edition number or version number) or non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the referenced document (including any amendments) applies. NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee their long term validity. The following referenced documents are not necessary for the applicatio