1、 ETSI TS 119 144-2 V2.1.1 (2016-06) Electronic Signatures and Infrastructures (ESI); PAdES digital signatures - Testing Conformance and Interoperability; Part 2: Test suites for testing interoperability of PAdES baseline signatures TECHNICAL SPECIFICATION ETSI ETSI TS 119 144-2 V2.1.1 (2016-06)2 Ref
2、erence RTS/ESI-0019144-2 Keywords e-commerce, electronic signature, interoperability, PAdES, profile, security, testing ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucrati
3、f enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice The present document can be downloaded from: http:/www.etsi.org/standards-search The present document may be made available in electronic versions and/or in print. The content of any electronic and/or print versions of the pres
4、ent document shall not be modified without the prior written authorization of ETSI. In case of any existing or perceived difference in contents between such versions and/or in print, the only prevailing document is the print of the Portable Document Format (PDF) version kept on a specific network dr
5、ive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at https:/portal.etsi.org/TB/ETSIDeliverableStatus.aspx If you find errors in t
6、he present document, please send your comment to one of the following services: https:/portal.etsi.org/People/CommiteeSupportStaff.aspx Copyright Notification No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm except as a
7、uthorized by written permission of ETSI. The content of the PDF version shall not be modified without the written authorization of ETSI. The copyright and the foregoing restriction extend to reproduction in all media. European Telecommunications Standards Institute 2016. All rights reserved. DECTTM,
8、 PLUGTESTSTM, UMTSTMand the ETSI logo are Trade Marks of ETSI registered for the benefit of its Members. 3GPPTM and LTE are Trade Marks of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. GSM and the GSM logo are Trade Marks registered and owned by the GSM Asso
9、ciation. ETSI ETSI TS 119 144-2 V2.1.1 (2016-06)3 Contents Intellectual Property Rights 4g3Foreword . 4g3Modal verbs terminology 4g31 Scope 5g32 References 5g32.1 Normative references . 5g32.2 Informative references 5g33 Definitions and abbreviations . 6g33.1 Definitions 6g33.2 Abbreviations . 6g34
10、Overview 6g35 Testing interoperability of PAdES-B-B signatures 6g36 Testing interoperability of PAdES-B-T signatures 9g37 Testing interoperability of PAdES-B-LT signatures 11g38 Testing interoperability of PAdES-B-LTA signatures . 12g39 Testing PAdES baseline signatures augmentation interoperability
11、 15g310 Testing negative PAdES baseline signatures . 17g310.1 PAdES-B-B signatures test cases . 17g310.2 PAdES-B-T signatures test cases . 17g310.3 PAdES-B-LTA signatures test cases 17g3History 18g3ETSI ETSI TS 119 144-2 V2.1.1 (2016-06)4 Intellectual Property Rights IPRs essential or potentially es
12、sential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs not
13、ified to ETSI in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (https:/ipr.etsi.org/). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as
14、 to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Foreword This Technical Specification (TS) has been produced by ETSI Technical Committee Electronic Signatures and Infrast
15、ructures (ESI). The present document is part 2 of a multi-part deliverable covering PAdES digital signatures - Testing Conformance and Interoperability. Full details of the entire series can be found in part 1 i.1. Modal verbs terminology In the present document “shall“, “shall not“, “should“, “shou
16、ld not“, “may“, “need not“, “will“, “will not“, “can“ and “cannot“ are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of provisions). “must“ and “must not“ are NOT allowed in ETSI deliverables except when used in direct citation. ETSI ETSI TS
17、 119 144-2 V2.1.1 (2016-06)5 1 Scope The present document defines a number of test suites to assess the interoperability between implementations claiming conformance to PAdES baseline signatures 2. The test suites are defined with four different layers reflecting the four different levels of PAdES b
18、aseline signatures: Tests suite addressing interoperability between applications claiming B-B level conformance. Tests suite addressing interoperability between applications claiming B-T level conformance. Tests suite addressing interoperability between applications claiming B-LT level conformance.
19、Tests suite addressing interoperability between applications claiming B-LTA level conformance. Test suites also cover augmentation of PAdES baseline signatures and negative test cases. These test suites are agnostic of the PKI infrastructure. Any PKI infrastructure can be used including the one base
20、d on EU Member States Trusted Lists. 2 References 2.1 Normative references References are either specific (identified by date of publication and/or edition number or version number) or non-specific. For specific references, only the cited version applies. For non-specific references, the latest vers
21、ion of the referenced document (including any amendments) applies. Referenced documents which are not found to be publicly available in the expected location might be found at http:/docbox.etsi.org/Reference. NOTE: While any hyperlinks included in this clause were valid at the time of publication, E
22、TSI cannot guarantee their long term validity. The following referenced documents are necessary for the application of the present document. 1 ETSI EN 319 122-1: “Electronic Signatures and Infrastructures (ESI); CAdES digital signatures; Part 1: Building blocks and CAdES baseline signatures“. 2 ETSI
23、 EN 319 142-1: “Electronic Signatures and Infrastructures (ESI); PAdES digital signatures; Part 1: Building blocks and PAdES baseline signatures“. 2.2 Informative references References are either specific (identified by date of publication and/or edition number or version number) or non-specific. Fo
24、r specific references, only the cited version applies. For non-specific references, the latest version of the referenced document (including any amendments) applies. NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee their long term validi
25、ty. The following referenced documents are not necessary for the application of the present document but they assist the user with regard to a particular subject area. i.1 ETSI TR 119 144-1: “Electronic Signatures and Infrastructures (ESI); PAdES digital signatures - Testing Conformance and Interope
26、rability; Part 1: Overview“. i.2 ETSI TR 119 001: “Electronic Signatures and Infrastructures (ESI); The framework for standardization of signatures; Definitions and abbreviations“. ETSI ETSI TS 119 144-2 V2.1.1 (2016-06)6 i.3 ETSI EN 319 102-1: “Electronic Signatures and Infrastructures (ESI); Proce
27、dures for Creation and Validation of AdES Digital Signatures; Part 1: Creation and Validation“. 3 Definitions and abbreviations 3.1 Definitions For the purposes of the present document, the terms and definitions given in ETSI TR 119 001 i.2 and the following apply: negative test case: test case for
28、a signature whose validation according to ETSI EN 319 102-1 i.3 would not result in TOTAL-PASSED 3.2 Abbreviations For the purposes of the present document, the abbreviations given in ETSI TR 119 001 i.2 apply. 4 Overview This clause describes the overall approach used throughout the present documen
29、t to specify test suites for PAdES baseline signatures interoperability testing. ETSI EN 319 142-1 2 defines four different levels of PAdES baseline signatures. The test suites are defined with different layers reflecting the levels of PAdES baseline signatures specified in ETSI EN 319 142-1 2: Test
30、ing PAdES signatures interoperability between applications claiming B-B level conformance. Testing PAdES signatures interoperability between applications claiming B-T level conformance. Testing PAdES signatures interoperability between applications claiming B-LT level conformance. Testing PAdES sign
31、atures interoperability between applications claiming B-LTA level conformance. Testing augmentation of PAdES signatures from B-T level to B-LTA level. Negative test cases for PAdES baseline signatures: - PAdES-B-B signatures test cases. - PAdES-B-T signatures test cases. - PAdES-B-LTA signatures tes
32、t cases. 5 Testing interoperability of PAdES-B-B signatures The test cases in this clause have been defined for different combinations of PAdES-B-B signatures attributes. Mandatory attributes for PAdES-B-B signatures described in ETSI EN 319 142-1 2, clauses 6.2 and 6.3, shall be present. Table 1 sh
33、ows which attributes are required to generate PAdES-B-B signatures for each test case. ETSI ETSI TS 119 144-2 V2.1.1 (2016-06)7 Table 1: Test cases for PAdES-B-B signatures TC ID Description Pass criteria Signature attributes PAdES/BB/1 This is the simplest PAdES-B-B signatures interoperability test
34、 case. The signature ONLY CONTAINS the mandatory PAdES attributes. Positive validation. The signature dictionary shall contain Type, Contents, Filter, SubFilter, M and ByteRange entries. The DER-encoded CMS binary data object included in the Contents entry shall include the SigningCertificate (in Si
35、gnedData.certificates field), ContentType, ESSSigningCertificateV2 and MessageDigest attributes. SignatureDictionary o Type o Sig o Filter o Adobe.PPKLite o SubFilter o ETSI.CAdES.detached o M o ByteRange o Contents (DER CMS) o Certificates SigningCertificate o ContentType o MessageDigest o ESSSigni
36、ngCertificateV2 PAdES/BB/2 In this PAdES-B-B signatures interoperability test case the signature dictionary contains the same entries used in test case PAdES/BB/1 with the addition of Location, ContactInfo and Reason entries. ContentType, ESSSigningCertificateV2 and MessageDigest attributes shall be
37、 added to the PDF signature included in the Contents entry as specified in CAdES 1. Positive validation. The signature dictionary shall contain Type, Contents, Filter, SubFilter, M, Location, Reason and ByteRange entries. The DER-encoded CMS binary data object included in the Contents entry shall in
38、clude the SigningCertificate (in SignedData.certificates field), ContentType, ESSSigningCertificateV2 and MessageDigest attributes. SignatureDictionary o Type o Sig o Filter o Adobe.PPKLite o SubFilter o ETSI.CAdES.detached o M o Location o ContactInfo o Reason o ByteRange o Contents (DER CMS) o Cer
39、tificates SigningCertificate o ContentType o MessageDigest o ESSSigningCertificateV2 PAdES/BB/3 In this PAdES-B-B signatures interoperability test case the PDF signature contains ContentTimeStamp attribute in addition to ContentType, ESSSigningCertificateV2 and MessageDigest attributes included to t
40、he PDF signature included in the Contents entry as specified in CAdES 1. Positive validation. The signature dictionary shall contain Type, Contents, Filter, SubFilter, M and ByteRange entries. The DER-encoded CMS binary data object included in the Contents entry shall include the SigningCertificate
41、(in SignedData.certificates field), ContentType, ESSSigningCertificateV2, ContentTimeStamp and MessageDigest attributes. SignatureDictionary o Type o Sig o Filter o Adobe.PPKLite o SubFilter o ETSI.CAdES.detached o M o ByteRange o Contents (DER CMS) o Certificates SigningCertificate o ContentType o
42、MessageDigest o ESSSigningCertificateV2 o ContentTimeStamp ETSI ETSI TS 119 144-2 V2.1.1 (2016-06)8 TC ID Description Pass criteria Signature attributes PAdES/BB/4 This test case tests a PAdES-B-B signature with an instance of ClaimedAttribute of SignerAttributesV2 attribute. ContentType, ESSSigning
43、CertificateV2, MessageDigest and SignatureTimeStamp attributes shall also be added to the PDF signature included in the Contents entry as specified in CAdES 1. Positive validation. The signature dictionary shall contain Type, Contents, Filter, M, SubFilter and ByteRange entries. The DER-encoded CMS
44、binary data object included in the Contents entry shall include the SigningCertificate (in SignedData.certificates field), ContentType, ClaimedAttribute (included in SignerAttributesV2), ESSSigningCertificateV2, MessageDigest attributes. SignatureDictionary o Type o Sig o Filter o Adobe.PPKLite o Su
45、bFilter o ETSI.CAdES.detached o M o ByteRange o Contents (DER CMS) o Certificates SigningCertificate o ContentType o MessageDigest o ESSSigningCertificateV2 o SignerAttributesV2 ClaimedAttribute PAdES/BB/5 This test case tests a PAdES-B-B signature with an instance of CertifiedAttributeV2 of SignerA
46、ttributesV2 attribute. ContentType, ESSSigningCertificateV2, MessageDigest and SignatureTimeStamp attributes shall also be added to the PDF signature included in the Contents entry as specified in CAdES 1. Positive validation. The signature dictionary shall contain Type, Contents, Filter, M, SubFilt
47、er and ByteRange entries. The DER-encoded CMS binary data object included in the Contents entry shall include the SigningCertificate (in SignedData.certificates field), ContentType, CertifiedAttributesV2 (included in SignerAttributesV2), ESSSigningCertificateV2, MessageDigest attributes. SignatureDi
48、ctionary o Type o Sig o Filter o Adobe.PPKLite o SubFilter o ETSI.CAdES.detached o M o ByteRange o Contents (DER CMS) o Certificates SigningCertificate o ContentType o MessageDigest o ESSSigningCertificateV2 o SignerAttributesV2 CertifiedAttributeV2 PAdES/BB/6 This test case tests a PAdES-B-B signat
49、ure with M, Reason, and Location entries in signature dictionary and MessageDigest, SignaturePolicyIdentifier, ContentType and ESSSigningCertificateV2 attributes in the CAdES 1 signature included in the Contents entry. Positive validation. The signature dictionary shall contain Type, Contents, Filter, SubFilter, M, Reason, Location and ByteRange entries. The DER-encoded CMS binary data object included in the Contents entry shall include the SigningCertificate (in SignedData.certificates field), ContentType, ESS
