ETSI TS 119 172-1-2015 Electronic Signatures and Infrastructures (ESI) Signature Policies Part 1 Building blocks and table of contents for human readable signature policy documents.pdf

1、 ETSI TS 119 172-1 V1.1.1 (2015-07) Electronic Signatures and Infrastructures (ESI); Signature Policies; Part 1: Building blocks and table of contents for human readable signature policy documents TECHNICAL SPECIFICATION ETSI ETSI TS 119 172-1 V1.1.1 (2015-07)2 Reference DTS/ESI-0019172-1 Keywords e

2、lectronic signature, e-commerce, trust services ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice

3、 The present document can be downloaded from: http:/www.etsi.org/standards-search The present document may be made available in electronic versions and/or in print. The content of any electronic and/or print versions of the present document shall not be modified without the prior written authorizati

4、on of ETSI. In case of any existing or perceived difference in contents between such versions and/or in print, the only prevailing document is the print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document should be awa

5、re that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at http:/portal.etsi.org/tb/status/status.asp If you find errors in the present document, please send your comment to one of the following services: ht

6、tps:/portal.etsi.org/People/CommiteeSupportStaff.aspx Copyright Notification No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI. The content of the PDF version shall not

7、be modified without the written authorization of ETSI. The copyright and the foregoing restriction extend to reproduction in all media. European Telecommunications Standards Institute 2015. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTMand the ETSI logo are Trade Marks of ETSI registered for the b

8、enefit of its Members. 3GPPTM and LTE are Trade Marks of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. GSM and the GSM logo are Trade Marks registered and owned by the GSM Association. ETSI ETSI TS 119 172-1 V1.1.1 (2015-07)3 Contents Intellectual Property R

9、ights 5g3Foreword . 5g3Modal verbs terminology 5g3Introduction 5g31 Scope 7g32 References 7g32.1 Normative references 7g32.2 Informative references . 7g33 Definitions and abbreviations . 9g33.1 Definitions . 9g33.2 Abbreviations 11g34 Signature policies and signature policy document . 12g3Annex A (n

10、ormative): Table of contents for signature policies expressed as human readable documents . 14g3A.1 Introduction 14g3A.1.1 Overview . 14g3A.1.2 Business or Application Domain . 14g3A.1.2.1 Scope and boundaries of signature policy 14g3A.1.2.2 Domain of applications 14g3A.1.2.3 Transactional context .

11、 14g3A.1.3 Document and policy(ies) names, identification and conformance rules 15g3A.1.3.1 Signature policy document and signature policy(ies) names . 15g3A.1.3.2 Signature policy document and signature policy(ies) identifier(s) 15g3A.1.3.3 Conformance rules . 15g3A.1.3.4 Distribution points . 15g3

12、A.1.4 Signature policy document administration 15g3A.1.4.1 Signature policy authority 15g3A.1.4.2 Contact person . 16g3A.1.4.3 Approval procedures 16g3A.1.5 Definitions and Acronyms . 16g3A.2. Signature application practices statements . 16g3A.3 Business scoping parameters 16g3A.3.1 BSPs mainly rela

13、ted to the concerned application/business process . 16g3A.3.1.1 BSP (a): Workflow (sequencing and timing) of signatures . 16g3A.3.1.2 BSP (b): Data to be signed . 17g3A.3.1.3 BSP (c): The relationship between signed data and signature(s) . 18g3A.3.1.4 BSP (d): Targeted community . 18g3A.3.1.5 BSP (e

14、): Allocation of responsibility for signature validation and augmentation 18g3A.3.2 BSPs mainly influenced by the legal/regulatory provisions associated to the concerned application/business process 19g3A.3.2.1 BSP (f): Legal type of the signatures . 19g3A.3.2.2 BSP (g): Commitment assumed by the si

15、gner . 19g3A.3.2.3 BSP (h): Level of assurance on timing evidences 20g3A.3.2.4 BSP (i): Formalities of signing 20g3A.3.2.5 BSP (j): Longevity and resilience to change 21g3A.3.2.6 BSP (k): Archival 21g3A.3.3 BSPs mainly related to the actors involved in creating/augmenting/validating signatures . 21g

16、3A.3.3.1 BSP (l): Identity (and roles/attributes) of the signers . 21g3A.3.3.2 BSP (m): Level of assurance required for the authentication of the signer 22g3A.3.3.3 BSP (n): Signature creation devices. 22g3A.3.4 Other BSPs 22g3ETSI ETSI TS 119 172-1 V1.1.1 (2015-07)4 A.3.4.1 BSP (o): Other informati

17、on to be associated with the signature 22g3A.3.4.2 BSP (p): Cryptographic suites . 22g3A.3.4.3 BSP (q): Technological environment . 23g3A.4 Requirements / statements on technical mechanisms and standards implementation 23g3A.4.1 Technical counterparts of BSPs - Statement summary 23g3A.4.2 Input and

18、output constraints for signature creation, augmentation and validation procedures 25g3A.4.2.1 Input constraints to be used when generating, augmenting and/or validating signatures in the context of the identified signature policy . 25g3A.4.2.2 Output constraints to be used when validating signatures

19、 in the context of the identified signature policy . 36g3A.4.2.3 Output constraints to be used for generating/augmenting signatures in the context of the identified signature policy 36g3A.5 Other business and legal matters 38g3A.6 Compliance audit and other assessments . 39g3Annex B (normative): Com

20、mitment types . 40g3Annex C (normative): Constraints in the context of EU legislation 41g3Annex D (normative): Signature application practices statements . 42g3D.1 General requirements . 42g3D.2 Signature application practices statements . 42g3D.2.1 Legal driven policy requirements 42g3D.2.2 Informa

21、tion security (management system) requirements . 42g3D.2.3 Signature Creation and Signature Validation processes requirements 43g3D.2.4 Development Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates a

22、re available on the ETSI Web server (http:/ipr.etsi.org). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) whi

23、ch are, or may be, or may become, essential to the present document. Foreword This Technical Specification (TS) has been produced by ETSI Technical Committee Electronic Signatures and Infrastructures (ESI). The present document is part 1 of a multi-part deliverable specifying Signature Policies as i

24、dentified below: Part 1: “Building blocks and table of contents for human readable signature policy documents“; Part 2: “XML Format for signature policies“; Part 3: “ASN.1 Format for signature policies“; Part 4: “Signature validation policy for European qualified electronic signatures/seals using tr

25、usted lists“. Modal verbs terminology In the present document “shall“, “shall not“, “should“, “should not“, “may“, “need not“, “will“, “will not“, “can“ and “cannot“ are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of provisions). “must“ an

26、d “must not“ are NOT allowed in ETSI deliverables except when used in direct citation. Introduction A digital signature is always used in a context, either implicit or explicit, e.g. as part of a business process. That context can impose various types of requirements such as requirements related to

27、the application and/or the business process for which implementation of a digital signature is required (e.g. which document(s)/data, in which steps of the business process one would need to sign and how): requirements influenced by legal provisions associated to the application and/or business cont

28、ext in which the business process takes place (e.g. the level of assurance on evidences and the longevity of such evidences); requirements on the actors involved in the creation/validation of signatures; and/or requirements linked to the technological environment in which the process takes place. NO

29、TE 1: Regulation (EU) No 910/2014 i.1 defines the terms electronic signature, advanced electronic signature, qualified electronic signature, electronic seal, advanced electronic seal and qualified electronic seal. These electronic signatures and seals can be created using digital signature technolog

30、y. NOTE 2: When not stated otherwise in the present document, “signature“ denotes “digital signature“. ETSI ETSI TS 119 172-1 V1.1.1 (2015-07)6 Implementing digital signatures into a business process very often implies considering more than one signature to make a transaction effective or to give le

31、gal validity to one or several documents. Those signatures can be parallel and independent over the content (e.g. such as those of a buyer and seller on a contract); or enveloping countersignatures where each countersignature covers both content and all previous signature(s); or not-enveloping count

32、ersignatures where each countersignature covers previous signature(s) but not the previously signed content; or a mix of such signatures. Since very complex situations can arise when considering multiple signatures, specific requirements on their sequencing and respective scope in terms of data to b

33、e signed needs to be considered to ensure their correct implementation into the concerned work-flow. There needs to be some way of expressing all applicable requirements into rules for creating, augmenting, and validating a single signature or a set of signatures in the context in which that(these)

34、signature(s) have been applied so that the concerned parties, signers and relying parties, can abide by the applicable rules. The purpose of a signature policy is to describe the requirements imposed on or committing the involved actors (signers, verifiers, relying parties and/or potentially one or

35、more trust service providers) with respect to the application of signatures to documents and data that will be signed in a particular context, transaction, process, business or application domain, in order for these signatures to be considered as valid or conformant signatures under this signature p

36、olicy. The establishment of such rules into a signature policy results from the need: to document the decisions resulting from an analysis driven by a business or application context on how the concerned signature(s) needs to be implemented to meet the needs of the specific business application or e

37、lectronic process it(they) support; and to specify the means for the creation, augmentation or long term management and verification of all the features of the concerned signature(s). ETSI ETSI TS 119 172-1 V1.1.1 (2015-07)7 1 Scope The present document defines the building blocks of signature polic

38、y and specifies a table of contents for human readable signature policy documents. 2 References 2.1 Normative references References are either specific (identified by date of publication and/or edition number or version number) or non-specific. For specific references, only the cited version applies

39、. For non-specific references, the latest version of the reference document (including any amendments) applies. Referenced documents which are not found to be publicly available in the expected location might be found at http:/docbox.etsi.org/Reference. NOTE: While any hyperlinks included in this cl

40、ause were valid at the time of publication, ETSI cannot guarantee their long term validity. The following referenced documents are necessary for the application of the present document. 1 ETSI EN 319 142-1: “Electronic Signatures and Infrastructures (ESI); PAdES digital signatures; Part 1: Building

41、blocks and PAdES baseline signatures“. 2 ISO 19005-2:2011: “Document management - Electronic document file format for long-term preservation - Part 2: Use of ISO 32000-1 (PDF/A-2)“. 3 ETSI TS 103 172: “Electronic Signatures and Infrastructures (ESI); PAdES Baseline Profile“. 2.2 Informative referenc

42、es References are either specific (identified by date of publication and/or edition number or version number) or non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the reference document (including any amendments) applies. NOTE:

43、While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee their long term validity. The following referenced documents are not necessary for the application of the present document but they assist the user with regard to a particular subject area. i.1

44、Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC. i.2 ETSI TR 119 001: “Electronic Signatures and Infrastructures (ESI); The framework for st

45、andardisation of signatures; Definitions and abbreviations“. i.3 ETSI TR 119 100: “Electronic Signatures and Infrastructures (ESI); Business Driven Guidance for Signature Creation and Validation“. i.4 ETSI EN 319 102-1: “Electronic Signatures and Infrastructures (ESI); Procedures for Signature Creat

46、ion and Validation of AdES Digital Signatures; Part 1: Creation and Validation“. i.5 ETSI TS 119 312: “Electronic Signatures and Infrastructures (ESI); Cryptographic Suites“. i.6 ISO/IEC 27001: “Information technology - Security techniques - Information security management systems - Requirements“. i

47、.7 ISO/IEC 27002: “Information technology - Security techniques - Code of practice for information security management“. i.8 ETSI TS 103 173: “Electronic Signatures and Infrastructures (ESI); CAdES Baseline Profile“. ETSI ETSI TS 119 172-1 V1.1.1 (2015-07)8 i.9 ETSI TS 103 171: “Electronic Signature

48、s and Infrastructures (ESI); XAdES Baseline Profile“. i.10 Unified Modelling Language. NOTE: Available at http:/www.uml.org/#UML2.0. i.11 ETSI TS 102 231: “Electronic Signatures and Infrastructures (ESI); Provision of harmonized Trust-service status information“. i.12 ETSI TS 119 612 (V1.1.1): “Elec

49、tronic Signatures and Infrastructures (ESI); Trusted Lists“. i.13 IETF RFC 5280: “internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile“. i.14 IETF RFC 6960: “X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP“. i.15 Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a Community framework for electronic signatures. i.16 Commission Decision 2009/767/EC of 16 October 2009 setting out measures facilitating the