ETSI TR 102 923-2010 Electronic Signatures and Infrastructures (ESI) PDF Advanced Electronic Signatures (PAdES) Usage and implementation guidelines (V1 1 1)《电子签名和基础结构(ESI) 高级电子签名(P.pdf

1、 ETSI TR 102 923 V1.1.1 (2010-07)Technical Report Electronic Signatures and Infrastructures (ESI);PDF Advanced Electronic Signatures (PAdES);Usage and implementation guidelinesETSI ETSI TR 102 923 V1.1.1 (2010-07) 2Reference DTR/ESI-000086 Keywords e-commerce, electronic signatures, security, PAdES

2、ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice Individual copies of the present document can b

3、e downloaded from: http:/www.etsi.org The present document may be made available in more than one electronic version or in print. In any case of existing or perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF). In case of dispute, the re

4、ference shall be the printing on ETSI printers of the PDF version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documen

5、ts is available at http:/portal.etsi.org/tb/status/status.asp If you find errors in the present document, please send your comment to one of the following services: http:/portal.etsi.org/chaircor/ETSI_support.asp Copyright Notification No part may be reproduced except as authorized by written permis

6、sion. The copyright and the foregoing restriction extend to reproduction in all media. European Telecommunications Standards Institute 2010. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTM, TIPHONTM, the TIPHON logo and the ETSI logo are Trade Marks of ETSI registered for the benefit of its Members

7、. 3GPPTM is a Trade Mark of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. LTE is a Trade Mark of ETSI currently being registered for the benefit of its Members and of the 3GPP Organizational Partners. GSM and the GSM logo are Trade Marks registered and owned

8、 by the GSM Association. ETSI ETSI TR 102 923 V1.1.1 (2010-07) 3Contents Intellectual Property Rights 5g3Foreword . 5g3Introduction 5g31 Scope 6g32 References 6g32.1 Normative references . 6g32.2 Informative references 6g33 Definitions and abbreviations . 7g33.1 Definitions 7g33.2 Abbreviations . 7g

9、34 Background: PAdES historical context . 8g35 Using PAdES 8g35.1 Parts of PAdES specification 8g35.2 PAdES, ISO 32000-1, CAdES and XAdES . 9g35.3 Selecting the right PAdES Profile 10g35.3.1 Selecting the right CMS/CAdES-based PAdES Profile 10g35.3.2 Selecting the right XAdES-based PAdES Profile . 1

10、0g35.4 PAdES types vs. CAdES/XAdES types . 11g35.4.1 PAdES and CMS (PAdES Part 2) . 12g35.4.2 PAdES Part 3 and CAdES 13g35.4.3 PAdES Part 4 and CAdES 13g35.4.4 PAdES and XAdES (PAdES Part 5) . 14g35.4.5 PAdES Part 6 14g36 Implementing PAdES . 14g36.1 Implementing PAdES Part 2 14g36.1.1 Serial and Pa

11、rallel signatures 15g36.1.2 Signature time-stamp 15g36.1.3 Revocation information at the time of signing 15g36.1.4 Signature validation 15g36.2 Implementing PAdES Part 3 15g36.2.1 Features provided 15g36.2.2 PDF signature dictionary 16g36.2.3 PAdES Part 3, CAdES and incorporation of signed attribute

12、s . 16g36.2.4 Signature Policy and ISO 32000 seed values 16g36.2.5 Signature validation 17g36.2.6 Time-stamp on signed content 17g36.3 Implementing PAdES Part 4 17g36.3.1 Achieving long term signatures in PAdES . 17g36.3.2 Rationale for the new PDF container objects 18g36.3.3 New PDF container objec

13、ts for LTV material 18g36.3.3.1 The Document Security Store . 18g36.3.3.2 The Document Time-stamp . 19g36.3.4 Signature Validation . 20g36.3.5 No references to validation material in PAdES Part 4 20g36.4 Implementing PAdES Part 5 21g36.4.1 Implementing Profiles for XAdES-signed XML documents embedde

14、d in PDF containers . 21g36.4.1.1 Implementing Basic Profile . 21g36.4.1.1.1 Serial and Parallel signatures . 21g36.4.1.1.2 XAdES signed XML documents to be embedded . 21g36.4.1.1.3 XAdES properties 21g36.4.1.1.4 Signing the embedding PDF document . 22g36.4.1.2 Implementing Long Term Profile . 22g3E

15、TSI ETSI TR 102 923 V1.1.1 (2010-07) 46.4.1.2.1 Signature Validation 22g36.4.2 Implementing Profile for XAdES signatures on XFA forms 22g36.4.2.1 Implementing Basic Profile . 23g36.4.2.1.1 Signing the signed properties 23g36.4.2.1.2 Serial and Parallel signatures . 23g36.4.2.1.3 XAdES properties 23g

16、36.4.2.2 Implementing Long Term Profile . 23g36.4.2.2.1 DSS Dictionary 23g36.4.2.2.2 Validation process . 24g36.5 Implementing PAdES Part 6 24g36.5.1 Content of signature appearance . 24g36.5.2 Encoding of the signature appearance 24g36.5.3 Implementing signature verification representation 25g3Hist

17、ory 26g3ETSI ETSI TR 102 923 V1.1.1 (2010-07) 5Intellectual Property Rights IPRs essential or potentially essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be f

18、ound in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (http:/webapp.etsi.org/IPR/home.asp). Pursuant to

19、 the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document.

20、Foreword This Technical Report (TR) has been produced by ETSI Technical Committee Electronic Signatures and Infrastructures (ESI). Introduction Electronic documents are a major part of a modern companies business. Trust in this way of doing business is essential for the success and continued develop

21、ment of electronic business. It is, therefore, important that companies using electronic documents have suitable security controls and mechanisms in place to protect their documents and to ensure trust and confidence with their business practices. In this respect the electronic signature is an impor

22、tant security component that can be used to protect information and provide trust in electronic business. ISO 32000-1 i.6 specifies a digital form for representing documents called the Portable Document Format (PDF) that enables users to exchange and view electronic documents easily and reliably, in

23、dependent of the environment in which they were created or the environment in which they are viewed or printed. ISO 32000-1 i.6 identifies the ways in which an electronic signature, in the form of a digital signature, may be incorporated into a PDF document to authenticate the identity of the user a

24、nd validate integrity of the documents content. These signatures are based on the same CMS technology and techniques as TS 101 733 i.3 (CAdES), but without the extended signature capabilities of CAdES. TS 102 779 i.16: “PDF Advanced Electronic Signatures (PAdES)“, in its parts 1 to 6 specify formats

25、 for including management of Advanced Electronic Signatures within PDF framework, as well as to deal with visual signatures and visual representation of Advanced Electronic Signatures verification. As such, PAdES is also a set of standards that support European requirements for electronic signatures

26、 and includes features to support validation of signatures which are stored for years or even decades. ETSI ETSI TR 102 923 V1.1.1 (2010-07) 61 Scope The present document provides: 1) Guidance on expected usage of PAdES signatures for securing PDF documents. 2) Guidance on the implementation of PAdE

27、S requirements. Readers should note that this is not a normative document, but an informative one. As such, no mandatory requirements are specified in the present document, but recommendations and suggestions on what authors of the document think that a correct usage of PAdES would be, and also deta

28、ils and recommendations that might be useful for PAdES implementers. NOTE: These guidelines includes information collected derived from the ETSI PAdES FAQ web site at the time of publication. Further details and more up to date information may be found by reference to the web site at 2 References R

29、eferences are either specific (identified by date of publication and/or edition number or version number) or non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the reference document (including any amendments) applies. Referenced

30、 documents which are not found to be publicly available in the expected location might be found at http:/docbox.etsi.org/Reference. NOTE: While any hyperlinks included in this clause were valid at the time of publication ETSI cannot guarantee their long term validity. 2.1 Normative references The fo

31、llowing referenced documents are necessary for the application of the present document. Not applicable. 2.2 Informative references The following referenced documents are not necessary for the application of the present document but they assist the user with regard to a particular subject area. i.1 A

32、dobe XFA: “XML Forms Architecture (XFA) Specification“. i.2 Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for Electronic Signatures. i.3 ETSI TS 101 733: “Electronic Signatures and Infrastructures( ESI); CMS Advanced Electronic Signat

33、ures (CAdES)“. i.4 ETSI TS 101 903: “XML Advanced Electronic Signatures (XAdES)“. i.5 OASIS-DSSX: “Profile for comprehensive multi-signature verification reports for OASIS Digital Signature Services. Committee Draft Version 1.0“. i.6 ISO 32000-1: “Document management - Portable document format - Par

34、t 1: PDF 1.7“. NOTE: Available at http:/ i.7 ETSI TS 102 778-1: “Electronic Signatures and Infrastructures (ESI); PDF Advanced Electronic Signature Profiles; Part 1: PAdES Overview - a framework document for PAdES“. ETSI ETSI TR 102 923 V1.1.1 (2010-07) 7i.8 ETSI TS 102 778-2: “Electronic Signatures

35、 and Infrastructures (ESI); PDF Advanced Electronic Signature Profiles; Part 2: PAdES Basic - Profile based on ISO 32000-1“. i.9 ETSI TS 102 778-3: “Electronic Signatures and Infrastructures (ESI); PDF Advanced Electronic Signature Profiles; Part 3: PAdES Enhanced - PAdES-BES and PAdES-EPES Profiles

36、“. i.10 ETSI TS 102 778-4: “Electronic Signatures and Infrastructures (ESI); PDF Advanced Electronic Signature Profiles; Part 4: PAdES Long Term - PAdES LTV Profile“. i.11 ETSI TS 102 778-5: “Electronic Signatures and Infrastructures (ESI); PDF Advanced Electronic Signature Profiles; Part 5: PAdES f

37、or XML Content - Profiles for XAdES signatures“. i.12 ETSI TS 102 778-6: “Electronic Signatures and Infrastructures (ESI); PDF Advanced Electronic Signature Profiles; Part 6: Visual Representations of Electronic Signatures“. i.13 IETF RFC 3852 (2004): “Cryptographic Message Syntax (CMS)“. i.14 IETF

38、RFC 3709: “Internet X.509 Public Key Infrastructure: Logotypes in X.509 Certificates“. i.15 IETF RFC 3739: “Internet X.509 Public Key Infrastructure: Qualified Certificates Profile“. i.16 ETSI TS 102 779: “Speech and multimedia Transmission Quality (STQ); Multi-component KPI“. i.17 IETF RFC 3161: “I

39、nternet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)“. 3 Definitions and abbreviations 3.1 Definitions For the purposes of the present document, the following terms and definitions apply: conforming signature handler: software application, or part of a software application, that knows h

40、ow to perform digital signature operations (e.g. signing and/or verifying) in conformance with ISO 32000-1 i.6 and the requirements of the appropriate profile PDF serial signature: specific signature workflow where the second (and subsequent) signers of a PDF not only sign the document but also the

41、signature of the previous signer and any modification that may also have taken place (e.g. form fill-in) PDF signature: binary data object based on the CMS (see RFC 3852 i.13) or related syntax containing a digital signature placed within a PDF document structure as specified in ISO 32000-1 i.6, cla

42、use 12.8 with other information about the signature applied when it was first created signature dictionary: PDF data structure, of type dictionary, as described in ISO 32000-1 i.6, clause 12.8.1, table 252 that contains all the information about the Digital Signature signer: entity that creates an e

43、lectronic signature validation data: data that may be used by a verifier of electronic signatures to determine that the signature is valid (e.g. certificates, CRLs, OCSP responses) verifier: entity that validates an electronic signature 3.2 Abbreviations For the purposes of the present document, the

44、 following abbreviations apply: AdES Advanced Electronic Signatures CAdES CMS Advanced Electronic Signature NOTE: See TS 101 733 i.3. ETSI ETSI TR 102 923 V1.1.1 (2010-07) 8CMS Cryptographic Message Syntax NOTE: As specified in RFC 3852 i.13. CRL Certificate Revocation List DSS Document Security Sto

45、re ESI Electronic Signatures and Infrastructure GSM Global System for Mobile communication LTV Long Term Validation OCSP Online Certificate Status Protocol PAdES PDF Advanced Electronic Signature PAdES-BES PAdES Basic Electronic Signature PAdES-EPES PAdES Explicit Policy Electronic Signature PDF Por

46、table Document Format PKCS Public Key Cryptography Standards XAdES XML Advanced Electronic Signatures NOTE: See TS 101 903 i.4. XFA XML Forms Architecture XML eXtensible Markup Language 4 Background: PAdES historical context Over the last decade, ETSI ESI TC has defined a complete framework for Adva

47、nced Electronic Signatures (AdES henceforth), specifying formats and management procedures for such signatures in the most popular syntaxes that currently deal with electronic documents and electronic signatures, namely: ASN.1 (CAdES), PDF (PAdES) and XML (XAdES). Traditionally CAdES has been used i

48、n those environments that traditionally have used CMS (mostly binary documents) and where some of the features brought by AdES signatures are required. XAdES signatures have been used within environments where XML documents require usage of AdES signatures, although they have also been used for sign

49、ing binary documents. PAdES specification brings to the PDF signatures (and by doing this, to the PDF documents framework) features already incorporated to binary and XML electronic documents through the usage of CAdES and XAdES signatures, namely: capability for incorporating a soundful repertoire of signed properties qualifying both the signature and/or the signatory (i.e. role of the signer, claimed signing time, etc), and those ones that may deal