1、 ETSI TS 119 102-1 V1.0.1 (2015-07) Electronic Signatures and Infrastructures (ESI); Procedures for Creation and Validation of AdES Digital Signatures; Part 1: Creation and Validation TECHNICAL SPECIFICATION ETSI ETSI TS 119 102-1 V1.0.1 (2015-07)2 Reference RTS/ESI-0019102-1-TS Keywords electronic
2、signature, security, trust services ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice The present
3、 document can be downloaded from: http:/www.etsi.org/standards-search The present document may be made available in electronic versions and/or in print. The content of any electronic and/or print versions of the present document shall not be modified without the prior written authorization of ETSI.
4、In case of any existing or perceived difference in contents between such versions and/or in print, the only prevailing document is the print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the
5、document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at http:/portal.etsi.org/tb/status/status.asp If you find errors in the present document, please send your comment to one of the following services: https:/portal.
6、etsi.org/People/CommiteeSupportStaff.aspx Copyright Notification No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI. The content of the PDF version shall not be modified
7、without the written authorization of ETSI. The copyright and the foregoing restriction extend to reproduction in all media. European Telecommunications Standards Institute 2015. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTMand the ETSI logo are Trade Marks of ETSI registered for the benefit of it
8、s Members. 3GPPTM and LTE are Trade Marks of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. GSM and the GSM logo are Trade Marks registered and owned by the GSM Association. ETSI ETSI TS 119 102-1 V1.0.1 (2015-07)3 Contents Intellectual Property Rights 6g3For
9、eword . 6g3Modal verbs terminology 6g3Introduction 6g31 Scope 7g32 References 8g32.1 Normative references . 8g32.2 Informative references 8g33 Definitions and abbreviations . 9g33.1 Definitions 9g33.2 Abbreviations . 11g34 Signature creation . 12g34.1 Signature creation model 12g34.2 Signature creat
10、ion information model 14g34.2.1 Introduction. 14g34.2.2 Signature Creation Constraints . 14g34.2.3 Signers document (SD) 15g34.2.4 Signers document representation (SDR) 15g34.2.5 Signature attributes . 15g34.2.5.1 General requirements 15g34.2.5.2 Signing certificate identifier 16g34.2.5.3 Signature
11、policy identifier . 16g34.2.5.4 Signature policy store 16g34.2.5.5 Data content type 16g34.2.5.6 Commitment type indication . 17g34.2.5.7 Counter signatures . 17g34.2.5.8 Claimed signing time 17g34.2.5.9 Claimed signer location . 17g34.2.5.10 Signers attributes 17g34.2.6 Data to be signed (DTBS) . 1
12、8g34.2.7 Data to be signed (formatted) (DTBSF) . 18g34.2.8 Data to be signed representation (DTBSR) . 18g34.2.9 Signature . 18g34.2.10 Signed data object (SDO) . 18g34.2.11 Validation data 18g34.3 Signature Classes and Creation Processes 19g34.3.1 Introduction. 19g34.3.2 Creation of Basic Signatures
13、 . 20g34.3.2.1 Description 20g34.3.2.2 Inputs . 20g34.3.2.3 Outputs 20g34.3.2.4 Processing . 21g34.3.2.4.1 Selection of documents to sign 21g34.3.2.4.2 Signature attribute and parameters selection . 21g34.3.2.4.3 Pre-signature presentation . 21g34.3.2.4.4 Signature invocation 22g34.3.2.4.5 Signing.
14、22g34.3.2.4.6 Signer authentication . 22g34.3.2.4.7 SDO composition 22g34.3.3 Creation of a Signature with Time 23g34.3.3.1 Description 23g34.3.3.2 Inputs . 23g34.3.3.3 Outputs 23g34.3.3.4 Process 23g34.3.4 Creation of Signatures With Long-Term Validation Data 24g34.3.4.1 Description 24g3ETSI ETSI T
15、S 119 102-1 V1.0.1 (2015-07)4 4.3.4.2 Inputs . 24g34.3.4.3 Outputs 24g34.3.4.4 Process 25g34.3.5 Creation of Signatures with Archival Data . 25g34.3.5.1 Description 25g34.3.5.2 Inputs . 26g34.3.5.3 Outputs 26g34.3.5.4 Process 26g35 Signature validation 26g35.1 Signature validation model . 26g35.1.1
16、General Requirements. 26g35.1.2 Selecting validation processes 28g35.1.3 Status indication of the signature validation process and signature validation report. 29g35.1.4 Validation constraints . 34g35.1.4.1 General Requirements . 34g35.1.4.2 Chain Constraints 35g35.1.4.3 Cryptographic Constraints 35
17、g35.1.4.4 Signature Elements Constraints 35g35.2 Basic building blocks . 35g35.2.1 Description 35g35.2.2 Format Checking 36g35.2.2.1 Description 36g35.2.2.2 Inputs . 36g35.2.2.3 Outputs 36g35.2.3 Identification of the signing certificate . 37g35.2.3.1 Description 37g35.2.3.2 Inputs . 37g35.2.3.3 Out
18、puts 37g35.2.3.4 Processing . 37g35.2.4 Validation context initialization 37g35.2.4.1 Description 37g35.2.4.2 Inputs . 38g35.2.4.3 Outputs 38g35.2.4.4 Processing . 38g35.2.5 Revocation freshness checker . 39g35.2.5.1 Description 39g35.2.5.2 Inputs . 39g35.2.5.3 Output . 40g35.2.5.4 Processing . 40g3
19、5.2.6 X.509 certificate validation . 40g35.2.6.1 Description 40g35.2.6.2 Inputs . 40g35.2.6.3 Outputs 40g35.2.6.4 Processing . 41g35.2.7 Cryptographic verification 42g35.2.7.1 Description 42g35.2.7.2 Inputs . 42g35.2.7.3 Outputs 43g35.2.7.4 Processing . 43g35.2.8 Signature acceptance validation (SAV
20、) 43g35.2.8.1 Description 43g35.2.8.2 Inputs . 43g35.2.8.3 Outputs 44g35.2.8.4 Processing . 44g35.2.8.4.1 General requirements . 44g35.2.8.4.2 Processing AdES attributes . 45g35.2.9 Signature validation presentation building block 46g35.3 Validation process for Basic Signatures . 46g35.3.1 Descripti
21、on 46g35.3.2 Inputs 47g35.3.3 Outputs 47g3ETSI ETSI TS 119 102-1 V1.0.1 (2015-07)5 5.3.4 Processing . 47g35.4 Validation process for time-stamps 48g35.4.1 Description 48g35.4.2 Inputs 49g35.4.3 Outputs 49g35.4.4 Processing . 49g35.5 Validation process for Signatures with Time and Signatures with Lon
22、g-Term Validation Data . 49g35.5.1 Description 49g35.5.2 Inputs 49g35.5.3 Outputs 50g35.5.4 Processing . 50g35.6 Validation process for Signatures with Archival Data . 51g35.6.1 Introduction. 51g35.6.2 Additional building blocks 52g35.6.2.1 Past certificate validation 52g35.6.2.1.1 Description 52g35
23、.6.2.1.2 Input 52g35.6.2.1.3 Output 52g35.6.2.1.4 Processing 53g35.6.2.2 Validation time sliding process . 53g35.6.2.2.1 Description 53g35.6.2.2.2 Input 53g35.6.2.2.3 Output 54g35.6.2.2.4 Processing 54g35.6.2.3 POE extraction 55g35.6.2.3.1 Description 55g35.6.2.3.2 Input 55g35.6.2.3.3 Output 55g35.6
24、.2.3.4 Processing 55g35.6.2.4 Past signature validation building block . 56g35.6.2.4.1 Description 56g35.6.2.4.2 Input 56g35.6.2.4.3 Output 56g35.6.2.4.4 Processing 56g35.6.2.5 Evidence record validation building block 57g35.6.2.5.1 Description 57g35.6.2.5.2 Input 57g35.6.2.5.3 Output 57g35.6.2.5.4
25、Processing 57g35.6.3 Long term validation process 58g35.6.3.1 Description 58g35.6.3.2 Input 58g35.6.3.3 Output . 59g35.6.3.4 Processing . 59g3Annex A (informative): Validation examples . 61g3A.1 General remarks and assumptions 61g3A.2 Symbols 61g3A.3 Example 1: Revoked certificate . 62g3A.3.1 Introd
26、uction 62g3A.3.2 Basic signature validation 62g3A.3.3 Validating a signature with time . 63g3A.3.4 Example 2: Revoked CA certificate . 63g3A.3.5 Basic signature validation 64g3A.3.6 Validation of a signature with time 64g3A.3.7 Long-Term-Validation . 64g3Annex B (informative): Signature Classes and
27、AdES Signatures 68g3History 69 ETSI ETSI TS 119 102-1 V1.0.1 (2015-07)6 Intellectual Property Rights IPRs essential or potentially essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and
28、non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (http:/ipr.etsi.org). Pu
29、rsuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present d
30、ocument. Foreword This Technical Specification (TS) has been produced by ETSI Technical Committee Electronic Signatures and Infrastructures (ESI). The present document is part 1 of a multi-part deliverable covering Procedures for Creation and Validation of AdES Digital Signatures, as identified belo
31、w: Part 1: “Creation and Validation“; Part 2: “Validation Report“. Modal verbs terminology In the present document “shall“, “shall not“, “should“, “should not“, “may“, “need not“, “will“, “will not“, “can“ and “cannot“ are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verb
32、al forms for the expression of provisions). “must“ and “must not“ are NOT allowed in ETSI deliverables except when used in direct citation. Introduction The present document aims to meet the general requirements of the international community to provide trust and confidence in electronic transaction
33、s, including, amongst other, applicable requirements from Regulation (EU) No 910/2014 i.15. ETSI ETSI TS 119 102-1 V1.0.1 (2015-07)7 1 Scope The present document specifies procedures for: the creation of AdES digital signatures (specified in ETSI TS 119 122-1 i.2, ETSI TS 119 132-1 i.4, ETSI TS 119
34、142-1 i.6 respectively); establishing whether an AdES digital signature is technically valid; whenever the AdES digital signature is based on public key cryptography and supported by public key certificates. To improve readability of the document, AdES digital signatures are meant when the term sign
35、ature is being used. NOTE: Regulation (EU) No. 910/2014 i.15 defines the terms electronic signature, advanced electronic signature, electronic seals and advanced electronic seal. These signatures and seals are usually created using digital signature technology. The present document aims at supportin
36、g the Regulation (EU) No 910/2014 i.15 for creation and validation of advanced electronic signatures and seals when they are implemented as AdES digital signatures. The present document introduces general principles, objects and functions relevant when creating or validating signatures based on sign
37、ature creation and validation constraints and defines general classes of signatures that allow for verifiability over long periods. The following aspects are considered to be out of scope: generation and distribution of Signature Creation Data (keys etc.), and the selection and use of cryptographic
38、algorithms; format, syntax or encoding of data objects involved, specifically format or encoding for documents to be signed or signatures created; and the legal interpretation of any signature, especially the legal validity of a signature. ETSI ETSI TS 119 102-1 V1.0.1 (2015-07)8 2 References 2.1 No
39、rmative references References are either specific (identified by date of publication and/or edition number or version number) or non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the reference document (including any amendments)
40、 applies. Referenced documents which are not found to be publicly available in the expected location might be found at http:/docbox.etsi.org/Reference. NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee their long term validity. The follow
41、ing referenced documents are necessary for the application of the present document. 1 IETF RFC 5280: “Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile“. 2 ISO/IEC 9594-8:2014: “Information technology - Open Systems Interconnection - The Directory - P
42、art 8: Public-key and attribute certificate frameworks“. 3 IETF RFC 3161: “Internet X.509 Public Key Infrastructure; Time Stamp Protocol (TSP)“. 4 ETSI TS 119 172-1: “Electronic Signatures and Infrastructures (ESI); Signature Policies; Part 1: Building blocks and table of contents for human readable
43、 signature policy documents“. 2.2 Informative references References are either specific (identified by date of publication and/or edition number or version number) or non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the referen
44、ce document (including any amendments) applies. NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee their long term validity. The following referenced documents are not necessary for the application of the present document but they assist t
45、he user with regard to a particular subject area. i.1 IETF RFC 4158: “Internet X.509 Public Key Infrastructure: Certification Path Building“. i.2 ETSI TS 119 122-1: “Electronic Signatures and Infrastructures (ESI); CAdES digital signatures; Part 1: Building blocks and CAdES baseline signatures“. i.3
46、 ETSI TS 119 122-2: “Electronic Signatures and Infrastructures (ESI); CAdES digital signatures; Part 2: Extended CAdES signatures“. i.4 ETSI TS 119 132-1: “Electronic Signatures and Infrastructures (ESI); XAdES digital signatures; Part 1: Building blocks and XAdES baseline signatures“. i.5 ETSI TS 1
47、19 132-2: “Electronic Signatures and Infrastructures (ESI); XAdES digital signatures; Part 2: Extended XAdES signatures“. i.6 ETSI TS 119 142-1: “Electronic Signatures and Infrastructures (ESI); PAdES digital signatures; Part 1: Building blocks and PAdES baseline signatures“. i.7 ETSI TS 119 142-2:
48、“Electronic Signatures and Infrastructures (ESI); PAdES digital signatures; Part 2: Additional PAdES signatures profiles“. i.8 IETF RFC 3852: “Cryptographic Message Syntax (CMS)“. i.9 IETF RFC 4998: “Evidence Record Syntax (ERS)“. i.10 IETF RFC 6283: “Extensible Markup Language Evidence Record Synta
49、x (XMLERS)“. ETSI ETSI TS 119 102-1 V1.0.1 (2015-07)9 i.11 W3C Recommendation (2008): “XML Signature Syntax and Processing“. i.12 IETF RFC 6960: “X.509 Internet Public Key Infrastructure Online Certificate Status Protocol - OCSP“. i.13 ETSI TS 119 422: “Electronic Signatures and Infrastructures (ESI); Time-stamping protocol and time-stamp profiles“. i.14 ECRYPT II Yearly Report on Algorithms and Keysizes (2010-2011), Revision 1.0, 30. June 2011. i.15 Regulation (EU) No 910/2014 of the European Parliament and of
