1、 ETSI TS 119 162-2 V1.0.1 (2015-08) Electronic Signatures and Infrastructures (ESI); Associated Signature Containers (ASiC); Part 2: Additional ASiC containers TECHNICAL SPECIFICATION ETSI ETSI TS 119 162-2 V1.0.1 (2015-08)2 Reference RTS/ESI-0019162-2-TS Keywords ASiC, e-commerce, electronic signat
2、ure, security ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16 Siret N 348 623 562 00017 - NAF 742 C Association but non lucratif enregistre la Sous-Prfecture de Grasse (06) N 7803/88 Important notice The present document can be downl
3、oaded from: http:/www.etsi.org/standards-search The present document may be made available in electronic versions and/or in print. The content of any electronic and/or print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any existin
4、g or perceived difference in contents between such versions and/or in print, the only prevailing document is the print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subjec
5、t to revision or change of status. Information on the current status of this and other ETSI documents is available at http:/portal.etsi.org/tb/status/status.asp If you find errors in the present document, please send your comment to one of the following services: https:/portal.etsi.org/People/Commit
6、eeSupportStaff.aspx Copyright Notification No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI. The content of the PDF version shall not be modified without the written au
7、thorization of ETSI. The copyright and the foregoing restriction extend to reproduction in all media. European Telecommunications Standards Institute 2015. All rights reserved. DECTTM, PLUGTESTSTM, UMTSTMand the ETSI logo are Trade Marks of ETSI registered for the benefit of its Members. 3GPPTM and
8、LTE are Trade Marks of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. GSM and the GSM logo are Trade Marks registered and owned by the GSM Association. ETSI ETSI TS 119 162-2 V1.0.1 (2015-08)3 Contents Intellectual Property Rights 4g3Foreword . 4g3Modal verbs
9、 terminology 4g3Introduction 4g31 Scope 5g32 References 5g32.1 Normative references . 5g32.2 Informative references 5g33 Definitions and abbreviations . 6g33.1 Definitions 6g33.2 Abbreviations . 6g34 ASiC additional containers . 6g34.1 Introduction 6g34.2 ASiC-S additional containers . 6g34.2.1 ASiC
10、-S Time assertion additional container . 6g34.3 ASiC-E additional containers . 6g34.3.1 ASiC-E CAdES additional container 6g34.3.2 ASiC-E Time assertion additional container. 7g3Annex A (informative): Using ASiC with existing container specifications 8g3Annex B (informative): ASiC application to arc
11、hival systems using ER 10g3B.1 Introduction 10g3B.2 Extraction of one single signed data from the archive . 10g3B.3 Extraction of multiple signed data from the archive 10g3History 11g3ETSI ETSI TS 119 162-2 V1.0.1 (2015-08)4 Intellectual Property Rights IPRs essential or potentially essential to the
12、 present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: “Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI
13、in respect of ETSI standards“, which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (http:/ipr.etsi.org). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existenc
14、e of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Foreword This Technical Specification (TS) has been produced by ETSI Technical Committee Electronic Signatures and Infrastructures (ESI).
15、The present document is part 2 of a multi-part deliverable specifying Associated Signature Containers (ASiC), as identified below: Part 1: “Building blocks and ASiC baseline containers“; Part 2: “Additional ASiC containers“. Modal verbs terminology In the present document “shall“, “shall not“, “shou
16、ld“, “should not“, “may“, “need not“, “will“, “will not“, “can“ and “cannot“ are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of provisions). “must“ and “must not“ are NOT allowed in ETSI deliverables except when used in direct citation. In
17、troduction Part 1 of the present multi-part deliverable, ETSI TS 119 162-1 2 (ASiC part 1 henceforth) specifies the use of container structures for associating either detached CAdES 1 signatures or detached XAdES i.7 signatures or time assertions, with one or more signed objects to which they apply
18、and specifies a number of baseline containers that aim to fulfil the common use cases and allows a number of options. ETSI ETSI TS 119 162-2 V1.0.1 (2015-08)5 1 Scope Specific communities or use cases may have additional requirements that are not addressed by the baseline containers defined in ASiC
19、part 1 2 that can be built using the building blocks defined there or additional ones. The present document references such specific additional use of ASiC and aims to be used for containers that collects together electronic documents including those supported by OCF, ODF and UCF describing how thes
20、e container formats can be used to associate digital signatures with any data objects in the container. 2 References 2.1 Normative references References are either specific (identified by date of publication and/or edition number or version number) or non-specific. For specific references, only the
21、cited version applies. For non-specific references, the latest version of the referenced document (including any amendments) applies. Referenced documents which are not found to be publicly available in the expected location might be found at http:/docbox.etsi.org/Reference. NOTE: While any hyperlin
22、ks included in this clause were valid at the time of publication, ETSI cannot guarantee their long term validity. The following referenced documents are necessary for the application of the present document. 1 ETSI TS 119 122-1: “Electronic Signatures and Infrastructures (ESI); CAdES digital signatu
23、res; Part 1: Building blocks and CAdES baseline signatures“. 2 ETSI TS 119 162-1: “Electronic Signatures and Infrastructures (ESI); Associated Signature Containers (ASiC); Part 1: Building blocks and ASiC Baseline containers“. 2.2 Informative references References are either specific (identified by
24、date of publication and/or edition number or version number) or non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the reference document (including any amendments) applies. NOTE: While any hyperlinks included in this clause were
25、 valid at the time of publication, ETSI cannot guarantee their long term validity. The following referenced documents are not necessary for the application of the present document but they assist the user with regard to a particular subject area. i.1 PKWARE: “.ZIP Application Note“. NOTE: Available
26、at http:/ i.2 Universal Container Format (UCF). NOTE: Available at https:/ i.3 ISO/IEC TS 30135 (all parts): “Information technology - Digital publishing - EPUB3“. i.4 OASIS: “Open Document Format for Office Applications (OpenDocument) Version 1.2; Part 3: Packages“, 29 September 2011. i.5 IETF RFC
27、4998: “Evidence Record Syntax (ERS)“. i.6 IETF RFC 6283: “Extensible Markup Language Evidence Record Syntax (XMLERS)“. i.7 ETSI TS 119 132-1: “Electronic Signatures and Infrastructures (ESI); XAdES digital signatures; Part 1: Building blocks and XAdES baseline signatures“. ETSI ETSI TS 119 162-2 V1.
28、0.1 (2015-08)6 3 Definitions and abbreviations 3.1 Definitions For the purposes of the present document, the terms and definitions given in CAdES 1, XAdES i.7 and ASiC part 1 2 apply. 3.2 Abbreviations For the purposes of the present document, the abbreviations given in CAdES 1, XAdES i.7 and ASiC p
29、art 1 2 apply. 4 ASiC additional containers 4.1 Introduction This clause defines ASiC additional containers designed to maximize interoperability for ASiC for use cases considered of general use not covered by baseline containers specified in ASiC part 1 2 clause 5: ASiC-S with time assertion specif
30、ied in clause 4.2.1; ASiC-E with CAdES specified in clause 4.3.1; and ASiC-E with time assertion specified in clause 4.3.2. 4.2 ASiC-S additional containers 4.2.1 ASiC-S Time assertion additional container The present clause defines the ASiC-S Time assertion additional container. The requirement spe
31、cified in ASiC part 1 2 for ASiC-S shall apply with the following additional restrictions: a) it shall comply with the specific provision given in ASiC part 1 2, clause 4.3.3.1 item 2) a) and clause 4.3.3.2, item 4) a), 4) d) or 4) e); b) it may contain additional elements in the META-INF folder as
32、specified in ASiC part 1 2, clause 4.3.3.2 item 5) a) and 5) b); and c) it shall support ASiC part 1 2, clause 4.3.3.2 item 2); d) if one or more ASiCArchiveManifest files are present they shall comply with ASiC part 1 2, clause A.7 with the additional restriction that only SignedData shall be used
33、to include certificate and revocation information. 4.3 ASiC-E additional containers 4.3.1 ASiC-E CAdES additional container The present clause defines the ASiC-E CAdES additional container. The requirement specified in ASiC part 1 2 for ASiC-E shall apply with the following additional restrictions:
34、a) it shall comply with the specific provision given in ASiC part 1 2, clause 4.4.4.1 item 1) a) and clause 4.4.4.2, item 3) a); b) the CAdES signatures shall comply with CAdES 1 baseline profiles clause 6.3 B-B level, B-T level or B-LT level; c) it shall support ASiC part 1 2, clause 4.4.5 item 2).
35、 ETSI ETSI TS 119 162-2 V1.0.1 (2015-08)7 4.3.2 ASiC-E Time assertion additional container The present clause defines the ASiC-E time assertion additional container. The requirement specified in ASiC part 1 2 for ASiC-E shall apply with the following additional restrictions: a) it shall comply with
36、the specific provision given in ASiC part 1 2, clause 4.4.4.1 item 1) a) and clause 4.4.4.2, item 3) b) or 4) a) or 4) b); and b) it shall support ASiC part 1 2, clause 4.4.5 item 2). ETSI ETSI TS 119 162-2 V1.0.1 (2015-08)8 Annex A (informative): Using ASiC with existing container specifications Th
37、e present annex specifies recommendations for the use of ASiC containers in a way which is compatible with existing container specifications that define a file structure with associated metadata and signatures. The container may be realized either as a physical container based on ZIP i.1 as required
38、 by ASiC part 1 2, clause 4.4.2 item 1) or, when supported by the external specification, as an abstract container with a file system model supporting storage of files in a folder hierarchy. NOTE: UCF i.2 is an example of container formats supporting abstract containers. ASiC part 1 2, clause 4.4.2
39、item 3), clause 4.4.3.1 should apply. Clause 4.4.3.2 should apply with the following additional requirements: “mimetype“ may be present and should comply with ASiC part 1 2 and contain the media type identifying the container type, if applicable. “META-INF/container.xml“ may be present and should co
40、mply with OCF i.3. “META-INF/manifest.xml“ may be present and should comply with ODF i.4. “META-INF/metadata.xml“ may be present and should comply with ODF i.4. “META-INF/signatures.xml“ may be present and should comply with OCF i.3 if “mimetype“ is present and its value is “application/epub+zip“. “
41、META-INF/*signatures*.xml“ may be present and should comply with ODF i.4 if “mimetype“ is present and its value is an ODF supported media type. Other files defined in the OCF i.3, UCF i.2 and ODF i.4 formats may be present and combined within ASiC as appropriate and should not violate the format imp
42、lied by the “mimetype“ file. The following table specifies the general requirements that should apply for all ASiC-E containers. Table A.1 Container files or properties OCF ODF UCF Additional requirements and notes Mimetype may be present may be present may be present a META-INF/manifest.xml may be
43、present should be present may be present b META-INF/container.xml should be present may be present may be present c META-INF/metadata.xml may be present may be present may be present c META-INF/ *signatures*.xml should be present should be present should be present d Container filename extension sho
44、uld be present should be present should be present f, e Archive level ZIP comment may be present may be present may be present g, e Additional requirements: a) If present the value should be conformant to the relevant container specification. b) If present the content should be conformant to ODF i.4
45、. c) If present the content should be conformant to OCF i.3. d) The filename should be conformant to the relevant container specification. The content root element should be compliant with ASiC part 1 2, clause 4.4.3.2 item 3) b) for ODF i.4, item 3) c) for OCF i.3 and UCF i.2. e) If applicable (i.e
46、. the container is a physical container). ETSI ETSI TS 119 162-2 V1.0.1 (2015-08)9 f) The file extension should comply with the container media type associated to the container content or with ASiC part 1 2, clause 4.4.3.1 item 2) b). g) Presence and value should be as specified in ASiC part 1 2, cl
47、ause 4.4.3.1 item 3). ETSI ETSI TS 119 162-2 V1.0.1 (2015-08)10 Annex B (informative): ASiC application to archival systems using ER B.1 Introduction The present annex specifies a possible way to support the extraction from an archival system of one or more signed data object protected with one or m
48、ore ERs. B.2 Extraction of one single signed data from the archive When one single signed data object protected with an ER is extracted from the archive, an ASiC-S container should be created. It should comply with ASiC part 1 2, clauses 4.3.2, 4.3.3 and 4.3.4, according to the signed data format, a
49、nd should include: a file containing the signed data object extracted from the archive in the root folder; and the extracted ER that applies to the signed data as a file that should be named according to ASiC part 1 2, clause 4.3.3.2 item 4) d) in case the ER complies with IETF RFC 4998 i.5 or item 4) e) in case the ER complies wit
