ETSI TS 102 778-5-2009 Electronic Signatures and Infrastructures (ESI) PDF Advanced Electronic Signature Profiles Part 5 PAdES for XML Content - Profiles for XAdES signatures (V1 1.pdf

1、 ETSI TS 102 778-5 V1.1.2 (2009-12)Technical Specification Electronic Signatures and Infrastructures (ESI);PDF Advanced Electronic Signature Profiles;Part 5: PAdES for XML Content -Profiles for XAdES signaturesETSI ETSI TS 102 778-5 V1.1.2 (2009-12)2Reference RTS/ESI-000082-5 Keywords e-commerce, el

2、ectronic signature, security ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice Individual copies

3、of the present document can be downloaded from: http:/www.etsi.org The present document may be made available in more than one electronic version or in print. In any case of existing or perceived difference in contents between such versions, the reference version is the Portable Document Format (PDF

4、). In case of dispute, the reference shall be the printing on ETSI printers of the PDF version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status o

5、f this and other ETSI documents is available at http:/portal.etsi.org/tb/status/status.asp If you find errors in the present document, please send your comment to one of the following services: http:/portal.etsi.org/chaircor/ETSI_support.asp Copyright Notification No part may be reproduced except as

6、 authorized by written permission. The copyright and the foregoing restriction extend to reproduction in all media. European Telecommunications Standards Institute 2009. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTM, TIPHONTM, the TIPHON logo and the ETSI logo are Trade Marks of ETSI registered f

7、or the benefit of its Members. 3GPPTM is a Trade Mark of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. LTE is a Trade Mark of ETSI currently being registered for the benefit of its Members and of the 3GPP Organizational Partners. GSM and the GSM logo are Tra

8、de Marks registered and owned by the GSM Association. ETSI ETSI TS 102 778-5 V1.1.2 (2009-12)3Contents Intellectual Property Rights 5g3Foreword . 5g3Introduction 5g31 Scope 6g32 References 7g32.1 Normative references . 7g32.2 Informative references 7g33 Definitions and abbreviations . 8g33.1 Definit

9、ions 8g33.2 Abbreviations . 9g34 Profiles for XAdES signatures of signed XML documents embedded in PDF containers 9g34.1 Overview 9g34.2 Profile for Basic XAdES signatures of XML documents embedded in PDF containers 11g34.2.1 Features . 11g34.2.2 General syntax and requirements 12g34.2.3 Requirement

10、s for applications generating signed XML document to be embedded . 12g34.2.4 Mandatory operations . 13g34.2.4.1 Protecting the signing certificate . 13g34.2.5 Requirements on XAdES optional properties . 13g34.2.5.1 The SigningTime element 13g34.2.5.2 The SignaturePolicyIdentifier element 13g34.2.5.3

11、 The SignatureProductionPlace element. 13g34.2.5.4 The SignerRole element 13g34.2.5.5 The SignedDataObjectFormat element . 13g34.2.5.6 The CommitmentTypeIndication element . 13g34.2.5.7 The AllDataObjectsTimeStamp element . 13g34.2.5.8 The IndividualDataObjectsTimeStamp element . 13g34.2.5.9 The Sig

12、natureTimeStamp element . 14g34.2.6 Serial Signatures . 14g34.2.6.1 The CounterSignature element 14g34.2.6.2 Detached serial signature 14g34.2.7 Parallel Signatures 14g34.3 Profile for long-term XAdES signatures of signed XML documents embedded in PDF containers 14g34.3.1 Features . 14g34.3.2 Upgrad

13、ing mechanism 14g34.3.3 Optional properties . 14g34.3.4 Validation Process 15g35 Profiles for XAdES signatures on XFA Forms 15g35.1 Overview 15g35.2 Profile for Basic XAdES signatures on XFA forms . 18g35.2.1 Features . 18g35.2.2 General syntax and requirements 18g35.2.3 Mandatory operations . 19g35

14、.2.3.1 Protecting the signing certificate . 19g35.2.4 Requirements on XAdES optional properties . 19g35.2.4.1 The SigningTime element 19g35.2.4.2 The SignaturePolicyIdentifier element 19g35.2.4.3 The SignatureProductionPlace element. 19g35.2.4.4 The SignerRole element 20g35.2.4.5 The SignedDataObjec

15、tFormat element . 20g35.2.4.6 The CommitmentTypeIndication element . 20g35.2.4.7 The AllDataObjectsTimeStamp element . 20g3ETSI ETSI TS 102 778-5 V1.1.2 (2009-12)45.2.4.8 The IndividualDataObjectsTimeStamp element . 20g35.2.4.9 The SignatureTimeStamp element . 20g35.2.5 Serial Signatures . 20g35.2.5

16、.1 The CounterSignature element 20g35.2.5.2 Detached serial signature 21g35.2.6 Parallel Signatures 21g35.3 Profile for long-term validation XAdES signatures on XFA forms (XAdES-LTV) 21g35.3.1 Overview 21g35.3.2 Features. 21g35.3.3 General Requirements . 21g35.3.4 Validation Process 22g35.4 Extensio

17、ns Dictionary. 22g3Annex A (informative): Matching of Basic PAdES-LTV XAdES-based profiles to XAdES . 23g3Annex B (informative): Change history . 25g3Annex C (informative): Bibliography . 26g3History 27g3ETSI ETSI TS 102 778-5 V1.1.2 (2009-12)5Intellectual Property Rights IPRs essential or potential

18、ly essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPR

19、s notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (http:/webapp.etsi.org/IPR/home.asp). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guaran

20、tee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Foreword This Technical Specification (TS) has been produced by ETSI Technical Committee Electronic Sig

21、natures and Infrastructures (ESI). The present document is part 5 of a multi-part deliverable. Full details of the entire series can be found in part 1 i.6. Introduction Electronic documents are a major part of a modern companies business. Trust in this way of doing business is essential for the suc

22、cess and continued development of electronic business. It is, therefore, important that companies using electronic documents have suitable security controls and mechanisms in place to protect their documents and to ensure trust and confidence with their business practices. In this respect the electr

23、onic signature is an important security component that can be used to protect information and provide trust in electronic business. The present document is intended to cover electronic signatures for electronic documents. This includes evidence as to its validity even if the signer or verifying part

24、y later attempts to deny (i.e. repudiates; see ISO/IEC 10181-4 i.1) the validity of the signature. Thus, the present document can be used for any document encoded in a portable document format (PDF) produced by an individual and a company, and exchanged between companies, between an individual and a

25、 governmental body, etc. The present document is independent of any environment; it can be applied to any environment, e.g. smart cards, GSM SIM cards, special programs for electronic signatures, etc. The European Directive on a community framework for Electronic Signatures defines an electronic sig

26、nature as: “Data in electronic form which is attached to or logically associated with other electronic data and which serves as a method of authentication“. The formats defined in the present document, are able to support advanced electronic signatures as defined in the Directive. ISO 32000-1 4 spec

27、ifies a digital form for representing documents called the Portable Document Format (PDF) that enables users to exchange and view electronic documents easily and reliably, independent of the environment in which they were created or the environment in which they are viewed or printed. ISO 32000-1 4

28、identifies the ways in which an electronic signature, in the form of a digital signature, may be incorporated into a PDF document to authenticate the identity of the user and validate integrity of the documents content. These signatures are based on the same CMS 6 technology and techniques as TS 101

29、 733 5 (CAdES), but without the extended signature capabilities of CAdES. This profile specifies digital signatures on XML content that may be carried in a PDF document using XAdES based signatures. ETSI ETSI TS 102 778-5 V1.1.2 (2009-12)61 Scope The present document defines four profiles that toget

30、her profile the usage of XAdES 1 signatures, as defined in TS 101 903 1, for signing XML content within the PDF containers. The scope of the present document is limited to the following cases: 1) One XML document (compliant with an arbitrary XML language, like UBL for e-Invoicing) that is completely

31、 or partially signed with at least one enveloped XAdES signature and that is incorporated within a PDF container as a so-called “embedded“ document. In this situation, both the XML document and the XAdES signature(s) are created independently of the PDF container and after their creation, embedded w

32、ithin this container. NOTE 1: Implementers should be aware that any subsequent approval signature (see ISO 32000-1 4 clause 12.8.1) as specified in TS 102 778-2 i.7, TS 102 778-3 i.8 or TS 102 778-4 i.9 also signs the embedded signed XML document. Any upgrade of the XAdES signature of the present do

33、cument to support validation long after the expiration of the signing certificate or other extended features such a countersignatures (e.g. using XAdES-C or XAdES-X or XAdES-A) would invalidate the aforementioned approval signatures. Implementers should also be aware that certification signatures (s

34、ee ISO 32000-1 4 clause 12.8.1) as specified in TS 102 778-2 i.7, TS 102 778-3 i.8 or TS 102 778-4 i.9 signing the embedded signed XML document, may be used in conjunction with the DocMDP dictionary, allowing changes in the embedded signed XML document (by upgrading the XAdES signatures, for example

35、) without invalidating such signatures. 2) Signed (with XML Sig or XAdES signature) dynamic XFA 2 forms. The present document specifies profiles that apply to two different scenarios, namely: signing only the XML data of the XFA form, or signing any part of the XFA form that may be signed with a XML

36、 Sig signature. NOTE 2: XFA forms build up an XML-based architecture for managing forms within the PDF framework. In this architecture data, structure and rendering details appear as XML contents. According to the XFA specification not all this XML content may be signed with XML Sig. Being XAdES sig

37、natures built on XML Sig, XAdES signatures may sign only those XML contents that XFA specification allows to be signed with XML Sig. NOTE 3: Readers should be aware that although PDF documents are addressed for human beings, XFA forms, being them based on XML, may be consumed by software application

38、s. In addition to that, conforming signature handlers may be able to identify what parts of a certain form are signed by an XAdES signature. For each case two profiles are specified, namely: 1) One profile intended to be used by a signer, where basic forms of XAdES signatures (namely XAdES-BES, XAdE

39、S-EPES and XAdES-T) on the corresponding XML content are profiled. 2) One profile applicable to any party relying on a signature over a long period (e.g. longer than the lifetime of the signing certificate, also called long-term signature in the present document). It may be applied by a party receiv

40、ing and verifying the document or the signing party who should also verify the document when applying long term verification. It specifies how to include validation information and to further protect the signature using time-stamps so that it is possible to subsequently verify a XAdES signature long

41、 after it was generated. For the first case the present document specifies requirements for embedding a signed (with XAdES signatures) XML document within a PDF container as an embedded file. For the second case the present document specifies requirements for generating XAdES signatures on only the

42、XML data of the form, or on any XML content of the XFA form that may be signed with a XML Sig signature. For both cases the present document specifies requirements on the XAdES properties both signed and unsigned. Also for both cases the present document specifies requirements for upgrading of XAdES

43、 signatures from basic to more advanced forms. ETSI ETSI TS 102 778-5 V1.1.2 (2009-12)72 References References are either specific (identified by date of publication and/or edition number or version number) or non-specific. For a specific reference, subsequent revisions do not apply. Non-specific re

44、ference may be made only to a complete document or a part thereof and only in the following cases: - if it is accepted that it will be possible to use all future changes of the referenced document for the purposes of the referring document; - for informative references. Referenced documents which ar

45、e not found to be publicly available in the expected location might be found at http:/docbox.etsi.org/Reference. NOTE: While any hyperlinks included in this clause were valid at the time of publication ETSI cannot guarantee their long term validity. 2.1 Normative references The following referenced

46、documents are indispensable for the application of the present document. For dated references, only the edition cited applies. For non-specific references, the latest edition of the referenced document (including any amendments) applies. 1 ETSI TS 101 903: “XML Advanced Electronic Signatures (XAdES)

47、“. 2 Adobe XML Architecture, Forms Architecture (XFA) Specification, version 2.5, (June 2007), Adobe Systems Incorporated. 3 W3C/IETF Recommendation: “XML-Signature Syntax and Processing“. 4 ISO 32000-1: “Document management - Portable document format - PDF 1.7“. NOTE: Available at http:/ 5 ETSI TS

48、101 733: “Electronic Signatures and Infrastructures (ESI); CMS Advanced Electronic Signatures (CAdES)“. 6 IETF RFC 3852 (2004): “Cryptographic Message Syntax (CMS)“. 7 W3C Recommendation (16 August 2006): “Extensible Markup Language (XML) 1.0 (Fourth Edition)“, edited in place 29 September 2006. 2.2

49、 Informative references The following referenced documents are not essential to the use of the present document but they assist the user with regard to a particular subject area. For non-specific references, the latest version of the referenced document (including any amendments) applies. i.1 ISO/IEC 10181-4: “Information technology - Open Systems Interconnection - Security frameworks for open systems: Non-repudiation framework“. i.2 ETSI TR 102 038: “TC Security - El