Guidance for the verification of qualified digital signatures following Swiss signature law

Transcription

1 Guidance for the verification of qualified digital signatures following Swiss signature law Swiss signature law (ZertES) is the legal basis for qualified digital signatures for details see Index: 1 Reliable signature verification of PDF-documents Signature in invisible signature fields Signature verification without OPENLiMiT Reader plug-in Signature verification with OPENLiMiT erread plug-in Settings to use the OPENLiMiT Reader plug-in with a proxy server Verification of the digital signature with the OPENLiMiT Reader plug-in Necessary settings in Adobe Acrobat Reader 6.x for SOGC PDF documents Trustworthy signers of digital certificates... 12

2 SOGC - Guidance for the verification of qualified digital signatures Page 2 / 12 1 Reliable signature verification of PDF documents In order to verify the signature of SOGC PDF documents thoroughly and error-free, the system configuration requires the following: Requirements for PCs with Microsoft Windows: Current version of the Adobe Acrobat Reader or at least Adobe Acrobat Reader (or higher). This software can be downloaded free of charge under and used for the following operating systems: Windows 2000 SP 2 or higher Windows XP Home Windows XP Professional Windows XP Tablet PC Edition Note: Users of Adobe Acrobat Reader 6.x, please read the configuration guidance in chapter 7. If the Adobe Acrobat Reader version used is not at least 8.0, you will also need the current version of the OPENLiMiT Reader Light for Switzerland (SignCube PDF plug-in) for Adobe Acrobat Reader as the specific signature requirements of Swiss signature law (ZertES) have not yet been fully complied with by the Adobe Acrobat Reader. This OPENLiMiT Reader plug-in can be downloaded free of charge under Note: Please install the Adobe Acrobat Reader before the OPENLiMiT Reader plug-in! Requirements for systems with Mac OS X (Apple): Current version of the Adobe Acrobat Reader version 8.0 or Adobe Acrobat version 7.0 Professional (or higher). This software can be downloaded free of charge under and be used for the following operating systems: Mac OS X version to 10.9 or higher Note: The OPENLiMiT viewer Plug-in for Mac OS X does not yet have any signature-specific plug-in. Details of the qualified digital signature on Apple computers are therefore for the time being only visible in general form through Standard- Browser Safari or in the corresponding Adobe Acrobat Reader.

3 SOGC - Guidance for the verification of qualified digital signatures Page 3 / 12 2 Signature in invisible signature fields The PDF documents of the Swiss Official Gazette of Commerce (SOGC) use the "invisible" signature, which does not limit the legibility of the digitally marked publications at the first attempt, but is hidden for the time being in a deposited signature field as hidden additional information. In the opened PDF document this signature information is accessible within the special tab "Signatures": Tab displaying invisible signature in the PDF document. Symbol in status bar with general information on digital signatures In addition the following symbol in the status bar is visible; as soon as the cursor (mouse pointer) hovers over the symbol, the following text appears:

4 SOGC - Guidance for the verification of qualified digital signatures Page 4 / 12 If you click on the Signatures tab, the following screen appears: Positive result for signature verification (hook symbol) This tab displays hidden signature information Notice: If a green hook symbol appears in front of the text "Signed by", the signature is valid. The integrity of an opened PDF document can be proved by the signature verification. If a signature is verified as being valid, then it is guaranteed that the data was not changed since the time of signature. If a question mark appears in front of the text Signed by, the security certificate has not yet been recognised by the internet browser you are using. You can either eliminate this restriction yourself with the installation authorisation available or have it eliminated by the network administrator. You just need to right click on Signed by and then select Check signature. You can then view the relevant certificate information under Signature properties ( Show certificate ). If the certificate information of the Swiss service provider Swisscom Solutions AG is not shown, you can integrate the necessary CA certificates in your internet browser: if this is the case, install the following components one after the other (see information in paragraph 8.): Root CA certificate, Diamant (qualified) CA certificate and TimeStamp CA.

5 SOGC - Guidance for the verification of qualified digital signatures Page 5 / 12 3 Successfully detailed signature verification without OPENLiMiT Reader plug-in If a qualified signed PDF document is opened with Adobe Acrobat Reader 7 without the OPENLiMiT Reader plug-in, the following screen appears by selecting the Signatures side tab: The signed document was not changed or manipulated The identity of the signature cannot be correctly verified (yet) due to Swiss extensions By right clicking you can select "Validate signature" If you do not have an OPENLiMiT Reader plug-in, the following information is shown:

6 SOGC - Guidance for the verification of qualified digital signatures Page 6 / 12 After selecting Signature properties, the following screen and information appears: German Version only : translation error in Adobe Acrobat Reader 7.x. Note : The German version of some Adobe Acrobat Reader versions still has the following translation errors : «The document was changed or damaged after attachment of certification» Despite this, the green hook symbol shows that the signature is technically correct and valid due to full identification and an error-free certificate chain. After selecting the "Show certificate" key, the following screen and information appears: 2. Warning Reiter öffnen from und Adobe Unterschriften Acrobat prüfen Reader anwählen 7.x. For complete verification of the certificate, the Adobe Acrobat Reader needs all certificates of the issuing chain - in order to authentically/ build up the required privacy. The alert shown on the left appears because the Adobe Acrobat Reader 7 cannot correctly interpret the extension of the specific certificate required by Swiss law, and therefore still highlights this extension as "critical". In accordance with the RFC 3280 guideline, the application must show a warning if a critical extension cannot be interpreted.

7 SOGC - Guidance for the verification of qualified digital signatures Page 7 / 12 4 Extended signature verification with OPENLiMiT Reader Light for Switzerland The OPENLiMiT Reader plug-in is required for the complete verification of a qualified signed SOGC PDF document.. This software can be downloaded free of charge under The OPENLiMiT Reader plug-in can be installed through the network or workplace pc. This takes approximately five minutes to download. Further verification of the document proceeds as shown below: 2. Open tab and examine signature 1. Select this line 3. The following dialogue box is Selecting "Show data" opens the OPENLiMiT SignCube Reader 1. Select this symbol to display details of PDF contents 2. The following dialogue box is 3. The All texts tab displays the deposited data.

8 SOGC - Guidance for the verification of qualified digital signatures Page 8 / The "Show data" button displays the publication contents in text form.

9 SOGC - Guidance for the verification of qualified digital signatures Page 9 / 12 5 Settings to use the OPENLiMiT Reader plug-in with a proxy server If your PC communicates over a network via a proxy server, you have to configure the networkspecific proxy settings before you can successfully and completely verify the digital signature of the PDF document. To use the OPENLiMiT Reader plug-in the appropriate proxy server has to be defined. The necessary information can be received by the network administrator. The following entries are necessary: In Internet Explorer: Tools -> Internet options -> Connections -> LAN settings -> Activate proxy server -> [Address] and [Port] of your proxy server if necessarily check with the network administrator. In Adobe Acrobat Reader: Edit -> Preferences <CTRL-K> -> Internet -> Internet settings -> LAN settings -> Proxy server -> [Address] and [Port] of your proxy server if necessarily check with the network administrator.

10 SOGC - Guidance for the verification of qualified digital signatures Page 10 / 12 6 Verification of the digital signature with the OPENLiMiT Reader plug-in Verify, as follows, whether the OPENLiMiT Reader plug-in is configured in the Adobe Acrobat Reader 7.x as a standard viewer for the verification of digital signatures: In Adobe Acrobat Reader (7.x or higher) Tools -> Preferences <CTRL-K>-> Security -> Advanced preferences -> OPENLiMiT SignCubes PDF plug-in

11 SOGC - Guidance for the verification of qualified digital signatures Page 11 / 12 7 Necessary settings in Adobe Acrobat Reader 6.x for SOGC PDF documents If you wish to open qualified signed SOGC PDF documents with Adobe Acrobat Reader 6.x, you will first have to make the following configuration adjustments: Adjustment of the configuration Start the Adobe Acrobat Reader (Edit -> Preferences <Crtl-k> -> Digital signatures: Do not select the option "Verify signatures when the document is opened"! Do not select this option! Notice: This functionality must be deactivated before opening a qualified signed PDF document. The digital signatures of the documents cannot be verified afterwards online. If the option "Verify signatures when the document is opened" is selected, qualified signed PDF documents cannot be opened with the Adobe Acrobat Reader 6.x without errors. The Adobe Acrobat Reader version 6.x is not able to successfully verify the signature and the certificate path.

12 SOGC - Guidance for the verification of qualified digital signatures Page 12 / 12 8 Trustworthy signers of digital certificates A digital certificate is only trustworthy if it is issued by a trustworthy organisation. In accordance with Swiss signature law only accredited organisations that can offer the service of providing qualified signatures, certified by the acknowledgment organisation and listed on the homepage of Swiss -accreditation Service (SAS) are trustworthy. The list of certified service providers of a qualified digital signature service can be viewed at the following address: Accredited organisations for a service providing qualified signatures from Switzerland are trustworthy. For other service providers the provider-specific CP (Certification Policy) has to be verified carefully so that a statement can be made about the processes for the identification of a person and any liability.the certificate should contain a reference to the CP of the certificate issuer. The SOGC produces the qualified digital signature of the daily SOGC PDF publications in cooperation with the accredited service provider - Swisscom Solutions AG. The appropriate CP can be found on the following address: