Advanced Electronic Signature Profiles of the OASIS Digital Signature Service Version 1.0

Transcription

1 Advanced Electrnic Signature Prfiles f the OASIS Digital Signature Service Versin 1.0 OASIS Standard 11 April 2007 Specificatin URIs: This Versin: Latest Versin: Technical Cmmittee: OASIS Digital Signature Services TC Chair(s): Nick Ppe, Thales esecurity Juan Carls Cruellas, Centre d'aplicacins avançades d Internet (UPC) Editr(s): Juan Carls Cruellas, Centre d'aplicacins avançades d Internet (UPC) Related wrk: This specificatin is related t: asis-dss-cre-spec-v1.0-s Abstract: This dcument defines ne abstract prfile f the OASIS DSS prtcls fr the purpse f creating and verifying XML r CMS based Advanced Electrnic Signatures. It als defines tw cncrete sub-prfiles: ne fr creating and verifying XML Advanced Electrnic Signatures and the ther fr creating and verifying CMS based Advanced Electrnic Signatures. Status: This dcument was last revised r apprved by the membership f OASIS n the abve date. The level f apprval is als listed abve. Check the current lcatin nted abve fr pssible later revisins f this dcument. This dcument is updated peridically n n particular schedule. Technical Cmmittee members shuld send cmments n this specificatin t the Technical Cmmittee s list. Others shuld send cmments t the Technical asis-dss-prfiles-ades-spec-v1.0-s 11 April 2007 Cpyright OASIS Open All Rights Reserved. Page 1 f 36

2 Cmmittee by using the Send A Cmment buttn n the Technical Cmmittee s web page at Fr infrmatin n whether any patents have been disclsed that may be essential t implementing this specificatin, and any ffers f patent licensing terms, please refer t the Intellectual Prperty Rights sectin f the Technical Cmmittee web page ( The nn-nrmative errata page fr this specificatin is lcated at asis-dss-prfiles-ades-spec-v1.0-s 11 April 2007 Cpyright OASIS Open All Rights Reserved. Page 2 f 36

3 Ntices OASIS takes n psitin regarding the validity r scpe f any intellectual prperty r ther rights that might be claimed t pertain t the implementatin r use f the technlgy described in this dcument r the extent t which any license under such rights might r might nt be available; neither des it represent that it has made any effrt t identify any such rights. Infrmatin n OASIS's prcedures with respect t rights in OASIS specificatins can be fund at the OASIS website. Cpies f claims f rights made available fr publicatin and any assurances f licenses t be made available, r the result f an attempt made t btain a general license r permissin fr the use f such prprietary rights by implementrs r users f this specificatin, can be btained frm the OASIS Executive Directr. OASIS invites any interested party t bring t its attentin any cpyrights, patents r patent applicatins, r ther prprietary rights which may cver technlgy that may be required t implement this specificatin. Please address the infrmatin t the OASIS Executive Directr. Cpyright OASIS All Rights Reserved. This dcument and translatins f it may be cpied and furnished t thers, and derivative wrks that cmment n r therwise explain it r assist in its implementatin may be prepared, cpied, published and distributed, in whle r in part, withut restrictin f any kind, prvided that the abve cpyright ntice and this paragraph are included n all such cpies and derivative wrks. Hwever, this dcument itself may nt be mdified in any way, such as by remving the cpyright ntice r references t OASIS, except as needed fr the purpse f develping OASIS specificatins, in which case the prcedures fr cpyrights defined in the OASIS Intellectual Prperty Rights dcument must be fllwed, r as required t translate it int languages ther than English. The limited permissins granted abve are perpetual and will nt be revked by OASIS r its successrs r assigns. This dcument and the infrmatin cntained herein is prvided n an "AS IS" basis and OASIS DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. The names "OASIS" are trademarks f OASIS, the wner and develper f this specificatin, and shuld be used nly t refer t the rganizatin and its fficial utputs. OASIS welcmes reference t, and implementatin and use f, specificatins, while reserving the right t enfrce its marks against misleading uses. Please see fr abve guidance. asis-dss-prfiles-ades-spec-v1.0-s 11 April 2007 Cpyright OASIS Open All Rights Reserved. Page 3 f 36

4 Table f Cntents 1 Intrductin Terminlgy Nrmative References Nn-Nrmative References Namespaces Overview Advanced Electrnic Signature abstract prfile Overview Prfile Features Scpe Relatinship T Other Prfiles Signature Object Prfile f Signing Prtcl Element <SignRequest> Element <OptinalInputs> New Optinal Inputs Optinal Input <SignatureFrm> Optinal Inputs already defined in the Cre Optinal Input <SignatureType> Optinal inputs <ClaimedIdentity> and <KeySelectr> Optinal Input <SignedPrperties> Requesting SigningTime Requesting CmmitmentTypeIndicatin Requesting SignaturePrductinPlace Requesting SignerRle Requesting AllDataObjectsTimeStamp Requesting DataObjectFrmat Element <SignRespnse> Element <SignatureObject> Optinal Outputs Prfile f Verifying Prtcl Element <VerifyRequest> Attribute Prfile Element <SignatureObject> Element <OptinalInputs> Element <ReturnUpdatedSignature> Element <VerifyRespnse> Element <OptinalOutputs> Optinal Output <UpdatedSignature> XML Advanced Electrnic Signatures cncrete Prfile Overview Prfile features Identifier Scpe Relatinship T Other Prfiles Signature Object Transprt Binding Security Binding Prfile f Signing Prtcl Attribute Prfile Element <SignRequest> Element <OptinalInputs> New Optinal Inputs asis-dss-prfiles-ades-spec-v1.0-s 11 April 2007 Cpyright OASIS Open All Rights Reserved. Page 4 f 36

5 Element <SignatureFrm> Optinal Inputs already defined in the Cre Optinal Input <SignatureType> Optinal inputs < ClaimedIdentity> and <KeySelectr> Optinal Input <SignedPrperties> Requesting SigningTime Requesting CmmitmentTypeIndicatin Requesting SignaturePrductinPlace Requesting SignerRle Requesting AllDataObjectTimeStamp Requesting DataObjectFrmat Requesting <xades:individualdataobjecttimestamp> Element <SignRespnse> Element <SignatureObject> Prfile f Verifying Prtcl Element <VerifyRequest> Attribute Prfile Element <SignatureObject> Element <OptinalInputs> Optinal Output <ReturnUpdatedSignature> Element <VerifyRespnse> Element <OptinalOutputs> Optinal Output <UpdatedSignature> Prfile Bindings Transprt Bindings Security Bindings Security Requirements TLS X.509 Mutual Authenticatin CMS-based Advanced Electrnic Signature prfile Overview Prfile features Identifier Scpe Relatinship T Other Prfiles Signature Object Transprt Binding Security Binding Prfile f Signing Prtcl Element <SignRequest> Attribute Prfile Element <OptinalInputs> New Optinal Inputs Element <SignatureFrm> Optinal Inputs already defined in the Cre Element <SignatureType> Optinal inputs < ClaimedIdentity> / <KeySelectr> Element <SignedPrperties> Requesting signing-time Requesting cmmitment-type-indicatin Requesting signer-lcatin Requesting signer-attributes Requesting cntent-time-stamp Requesting cntent-hints Element <SignRespnse> Element <SignatureObject> Prfile f Verifying Prtcl Element <VerifyRequest> Attribute Prfile Element <OptinalInputs> asis-dss-prfiles-ades-spec-v1.0-s 11 April 2007 Cpyright OASIS Open All Rights Reserved. Page 5 f 36

6 Element <ReturnUpdatedSignature> Element <SignatureObject> Element <VerifyRespnse> Element <OptinalOutputs> Element <UpdatedSignature> Prfile Bindings Transprt Bindings Security Bindings Security Requirements TLS X.509 Mutual Authenticatin XML timestamps in XAdES signatures Generatin and inclusin f XML timestamps Prfile fr XAdES timestamp cntainers XML timestamp within xades:individualdataobjectstimestamp XML timestamp within xades:alldataobjectstimestamp XML timestamp within xades:sigandrefstimestamp XML timestamp within xades:refsonlytimestamp XML timestamp within xades:archivetimestamp Verificatin f XML timestamps Verificatin f f xades:individualldataobjectstimestamp including a XML timestamp Verificatin f xades:alldataobjectstimestamp including a XML timestamp Verificatin f xades:sigandrefstimestamp including a XML timestamp Verificatin f xades:refsonlytimestamp including a XML timestamp Verificatin f xades:archivetimestamp including a XML timestamp Identifiers defined in this specificatin Predefined advanced electrnic signature frms identifiers Result Identifiers A. Acknwledgements asis-dss-prfiles-ades-spec-v1.0-s 11 April 2007 Cpyright OASIS Open All Rights Reserved. Page 6 f 36

7 Intrductin The DSS signing and verifying prtcls are defined in [DSSCre]. As defined in that dcument, the DSS prtcls have a fair degree f flexibility and extensibility. This dcument defines an abstract prfile fr the use f the DSS prtcls fr creating and verifying XML and CMS-based Advanced Electrnic Signatures as defined in [XAdES] and [CAdES]. This dcument als defines tw cncrete prfiles derived frm the abstract ne: ne fr creating and verifying XAdES signatures and the ther fr creating and verifying CAdES signatures. 1.1 Terminlgy The key wrds "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this specificatin are t be interpreted as described in IETF RFC 2119 [RFC 2119]. These keywrds are capitalized when used t unambiguusly specify requirements ver prtcl features and behavir that affect the interperability and security f implementatins. When these wrds are nt capitalized, they are meant in their natural-language sense. This specificatin uses the fllwing typgraphical cnventins in text: <ns:element>, Attribute, Datatype, OtherCde. 1.2 Nrmative References [AdES-XSD] J. C. Cruellas et al. AdES Prfile Schema, OASIS, February [CAdES] CMS Advanced Electrnic Signatures. ETSI TS , January [Cre-XSD] S. Drees et al. DSS Schema. OASIS, February 2007). [DSSCre] S. Drees et al. Digital Signature Service Cre Prtcls and Elements. OASIS, February [RFC2119] S. Bradner, Key wrds fr use in RFCs t Indicate Requirement Levels, IETF RFC 2119, March [RFC 2634]. Hffman (ed.). Enhanced Security Services fr S/MIME IETF RFC 2634 June 1999 [RFC 3852] R. Husley. Cryptgraphic Message Syntax (CMS), IETF RFC 3852, July [XAdES] Advanced Electrnic Signatures. ETSI TS March [XML-ns] T. Bray, D. Hllander, A. Layman. Namespaces in XML. W3C Recmmendatin, January [XMLSig] D. Eastlake et al. XML-Signature Syntax and Prcessing. W3C Recmmendatin, February asis-dss-prfiles-ades-spec-v1.0-s 11 April 2007 Cpyright OASIS Open All Rights Reserved. Page 7 f 36

8 Nn-Nrmative References 1.4 Namespaces The structures described in this specificatin are cntained in the schema file [AdES-XSD]. All schema listings in the current dcument are excerpts frm the schema file. In the case f a disagreement between the schema file and this dcument, the schema file takes precedence. This schema is assciated with the fllwing XML namespace: urn:asis:names:tc:dss:1.0:prfiles:ades:schema# Cnventinal XML namespace prefixes are used in this dcument: The prefix dss: (r n prefix) stands fr the DSS cre namespace [Cre-XSD]. The prefix ds: stands fr the W3C XML Signature namespace [XMLSig]. The prefix xades: stands fr ETSI XML Advanced Electrnic Signatures (XAdES) dcument [XAdES]. Applicatins MAY use different namespace prefixes, and MAY use whatever namespace defaulting/scping cnventins they desire, as lng as they are cmpliant with the Namespaces in XML specificatin [XML-ns]. asis-dss-prfiles-ades-spec-v1.0-s 11 April 2007 Cpyright OASIS Open All Rights Reserved. Page 8 f 36

9 Overview This dcument defines three prfiles f the prtcls specified in: Digital Signature Services Cre Prtcl and Elements [DSSCre]. The first ne is an abstract prfile defining messages fr supprting the lifecycle f advanced electrnic signatures. Bth, XML and CMS-based advanced electrnic signatures are supprted by this prfile. One cncrete prfile, derived frm the afrementined abstract prfile, gives supprt t the lifecycle f XML advanced electrnic signatures as specified in [XAdES]. A secnd cncrete prfile, als derived frm the abstract ne, gives supprt t the lifecycle f CMS-based advanced electrnic signatures as specified in [CAdES]. Implementatins shuld implement ne f the cncrete prfiles (r bth) in rder t request generatin r validatin f advanced electrnic signatures in ne f the tw frmats (r bth). asis-dss-prfiles-ades-spec-v1.0-s 11 April 2007 Cpyright OASIS Open All Rights Reserved. Page 9 f 36

10 Advanced Electrnic Signature abstract prfile 3.1 Overview This abstract prfile supprts peratins within each phase f the lifecycle f tw types f advanced electrnic signature: XML encded signatures based n [XMLSig] such as specified in [XAdES]. Binary encded signatures based n [RFC 3852] such as specified in [CAdES]. Hencefrward, the dcument will use the term advanced signature when dealing with issues that affect t bth types f signatures. The dcument will use XAdES r CAdES signatures when dealing with issues that affect ne r the ther but nt bth f them. Fr the generatin f advanced signatures, the fllwing peratins apply: SignRequest. This peratin supprts requests fr: Generating predefined advanced signature frms as defined in [XAdES] and [CAdES]. Generating XML signatures incrprating specific signed/unsigned prperties whse cmbinatin des nt fit any predefined XAdES signature frm. In such cases, the frm MUST have been defined in a prprietary specificatin and MUST be identified by ne URI. Generating CMS signatures incrprating specific signed/unsigned attributes whse cmbinatin des nt fit any predefined [CAdES] signature frm. In such cases, the frm MUST have been defined in a prprietary specificatin and MUST be identified by ne URI. SignRespnse. This peratin supprts delivery f: Predefined advanced signature frms as defined in [XAdES] and [CAdES]. XML signatures with specific prperties whse cmbinatin des nt fit any predefined XAdES signature frm. In such cases, the frm MUST have been defined in sme ther specificatin and MUST be identified by ne URI. CMS signatures incrprating specific signed attributes whse cmbinatin des nt fit any predefined [CAdES] signature frm. In such cases, the frm MUST have been defined in sme ther specificatin and MUST be identified by ne URI. Fr advanced signature verificatin (and updating) the fllwing peratins apply: VerifyRequest. This peratin supprts requests fr: Verifying a predefined advanced signature frm. Verifying XML signatures incrprating specific prperties whse cmbinatin des nt fit any predefined XAdES signature frm. Verifying any f the signatures mentined abve PLUS updating them by additin f additinal prperties (time-stamps, validatin data, etc) leading t a predefined XAdES frm. Verifying CMS signatures incrprating specific attributes whse cmbinatin des nt fit any predefined [CAdES] signature frm. Verifying any f the signatures mentined abve PLUS updating them by additin f additinal attributes (time-stamps, validatin data, etc) leading t a predefined [CAdES] frm. asis-dss-prfiles-ades-spec-v1.0-s 11 April 2007 Cpyright OASIS Open All Rights Reserved. Page 10 f 36

11 Verifying a lng-term advanced signature in a certain pint f time. VerifyRespnse. This peratin supprts delivery f: Advanced signature verificatin result f signatures mentined abve. Advanced signature verificatin result PLUS the updated signatures as requested. The material fr each peratin will clearly indicate the lifecycle phase it pertains t. 3.2 Prfile Features Scpe This dcument prfiles the DSS signing and verifying prtcls defined in [DSSCre] Relatinship T Other Prfiles The prfile in this dcument is based n the [DSSCre]. The prfile in this dcument may nt be directly implemented. It is further prfiled by the tw cncrete prfiles als defined in sectins 4 and Signature Object This prfile supprts the creatin and verificatin f advanced signatures as defined in [XAdES] and [CAdES]. This prfile als supprts update f advanced signatures by additin f unsigned prperties (time-stamps and different types f validatin data), as specified in [XAdES] and [CAdES]. 3.3 Prfile f Signing Prtcl The present prfile allws requesting: Predefined frms f advanced electrnic signatures as defined in [XAdES] and [CAdES]. Other frms f signatures based in [XMLSig] r [RFC 3852] defined in ther specificatins, In bth cases, the specific requested frm will be identified by an URI. Accrding t this prfile, the fllwing predefined advanced signature frms defined in [XAdES] and [CAdES] MAY be requested (thse frms whse name begin by XAdES- are frms names fr XAdES signatures; thse nes whse name begin by CAdES are names fr CAdES signatures): CAdES-BES and XAdES-BES. In this frm, the signing certificate is secured by the signature itself. CAdES-EPES and XAdES-EPES. This frm incrprates an explicit identifier f the signature plicy that will gvern the signature generatin and verificatin. CAdES-ES-T and XAdES-T. This frm incrprates a trusted time, by means f a time-stamp tken r a time-mark. CAdES-ES-C and XAdES-C. CAdES-ES-X and XAdES-X. CAdES-ES-X-L and XAdES-X-L. CAdES-ES-A and XAdES-A. In additin, the present prfile prvides means fr requesting incrpratin in any f the afrementined frms any f the signed prperties defined in [XAdES] and signed attributes defined in [CAdES]. asis-dss-prfiles-ades-spec-v1.0-s 11 April 2007 Cpyright OASIS Open All Rights Reserved. Page 11 f 36

12 Other electrnic signature frms based in [XMLSig] r [RFC 3852], defined elsewhere, MAY als be requested using the mechanisms defined in this prfile Element <SignRequest> This clause prfiles the dss:signrequest element Element <OptinalInputs> New Optinal Inputs Optinal Input <SignatureFrm> The frm f signature required MAY be indicated using the fllwing new ptinal input <xs:element name="signaturefrm" type= xs:anyuri /> If nt present the signature frm SHALL be implied by the selected <SignaturePlicy> r the signature plicy applied by the server. Sectin 7.1 f this abstract prfile defines a set f URIs identifying the predefined advanced electrnic signature frms specified in [CAdES] and [XAdES]. Shuld ther standard r prprietary specificatin define new signature frms and their crrespnding URIs, cncrete sub-prfiles f this abstract prfile culd be defined fr giving supprt t their verificatin and update. Shuld a frm identified by an URI, admit different prperties cmbinatins, the server will prduce a specific cmbinatin depending n its plicy r cnfiguratin settings Optinal Inputs already defined in the Cre Nne f the ptinal inputs specified in the [DSS Cre] are precluded in this abstract prfile. It nly cnstrains sme f them and specifies additinal ptinal inputs Optinal Input <SignatureType> This element is OPTIONAL. If present, <SignatureType> SHALL be either: urn:ietf:rfc: fr requesting XML-based signatures, r 408 urn:ietf:rfc: fr requesting CMS-based signatures, as defined in 7.1 f [DSS Cre]. If nt present the signature type SHALL be implied by the selected <SignaturePlicy> r the signature plicy applied by the server Optinal inputs <ClaimedIdentity> and <KeySelectr> As frms defined in [XAdES] and [CAdES] require that the signing certificate is prtected by the signature, the server MUST gain access t that certificate. <dss:claimedidentity> r <dss:keyselectr> ptinal inputs MAY be present. If they are nt present, the server may use means nt specified in this prfile t identify the signer s key and gain access t its certificate Optinal Input <SignedPrperties> The requester MAY request t the server the additin f ptinal signed prperties using the <dss:signedprperties> element s <dss:prperty> child prfiled as indicated in clauses belw. First names crrespnd t the ne given by XAdES t the signed prperties. Secnd nes crrespnd t the names given by CAdES t the signed attributes. Signed prperties that MAY be requested are: asis-dss-prfiles-ades-spec-v1.0-s 11 April 2007 Cpyright OASIS Open All Rights Reserved. Page 12 f 36

13 XAdES SigningTime CmmitmentTypeIndicatin SignerRle SignaturePrductinPlace DataObjectFrmat AllDataObjectsTimeStamp IndividualDataObjectsTimeStamp CAdES signing-time cmmitment-type-indicatin signer-attributes signer-lcatin cntent-hints cntent-time-stamp N equivalent signed attribute Next sub-sectins shw hw a client shuld request each f the afrementined prpertiesattributes. The type f signature requested (XAdES r CAdES) will determine whether a XAdES prperty r a CAdES attribute is generated by the server Requesting SigningTime Value fr <Identifier> element: urn:asis:names:tc:dss:1.0:prfiles:ades:signingtime If the client des nt request such prperty, the server still MAY generate and include this prperty depending n its plicy. N cntent is required fr Value element, since the actual cntents f the prperty will be generated by the server when required Requesting CmmitmentTypeIndicatin Value fr <Identifier> element: urn:asis:names:tc:dss:1.0:prfiles:ades:cmmitmenttypeindicatin If the client des nt request such prperty, the server still MAY generate and include it with values that depend n server s plicy. The client MAY request the generatin and inclusin f this signed prperty. In such cases the <Value> element MUST have the fllwing cntent: 442 <xs:element name="requestedcmmitment"> 443 <xs:cmplextype> 444 <xs:chice> 445 <xs:element ref="xades:cmmitmenttypeindicatin"/> 446 <xs:element name="binaryvalue" type="xs:base64binary"/> 447 </xs:chice> 448 </xs:cmplextype> 449 </xs:element> Element <xades:cmmitmenttypeindicatin> will be present when requesting a XML signature. Element <BinaryValue> will be present when requesting an ASN.1 signature. Its cntents MUST be the base64 encding f cmmitment-type-indicatin ASN.1 attribute defined in [CAdES], DER-encded Requesting SignaturePrductinPlace Value fr <Identifier> element: asis-dss-prfiles-ades-spec-v1.0-s 11 April 2007 Cpyright OASIS Open All Rights Reserved. Page 13 f 36

14 urn:asis:names:tc:dss:1.0:prfiles:ades:signatureprductinplace The client MAY request a certain value fr this prperty. Nevertheless, this value MAY be ignred by the server depending n its wn plicy, and the prperty be set t anther value. Fr requesting a value fr this prperty, the <Value> element MUST have the fllwing cntent: 462 <xs:element name="requestedsignatureprductinplace"> 463 <xs:cmplextype> 464 <xs:chice> 465 <xs:element ref="xades:signatureprductinplace"/> 466 <xs:element name="binaryvalue" type="xs:base64binary"/> 467 </xs:chice> 468 </xs:cmplextype> 469 </xs:element> Element <xades:signatureprductinplace> will be present when requesting a XML signature. Element <BinaryValue> will be present when requesting an ASN.1 signature. Its cntents MUST be the base64 encding f SignerLcatin ASN.1 attribute defined in [CAdES], DER-encded Requesting SignerRle Value fr <Identifier> element: urn:asis:names:tc:dss:1.0:prfiles:ades:signerrle When the client requests the generatin and inclusin f this signed prperty the <Value> element MUST have the fllwing cntent: 480 <xs:element name="requestedsignerrle"> 481 <xs:cmplextype> 482 <xs:chice> 483 <xs:element ref="xades:signerrle"/> 484 <xs:element name="binaryvalue" type="xs:base64binary"/> 485 </xs:chice> 486 </xs:cmplextype> 487 </xs:element> Element <xades:signerrle> will be present when requesting a XML signature. Element <BinaryValue> will be present when requesting a ASN.1 signature. Its cntents MUST be the base64 encding f signer-attributes ASN.1 attribute defined in [CAdES], DER-encded Requesting AllDataObjectsTimeStamp This element will be added fr requesting the generatin and inclusin f a time-stamp tken n (all) the data bject(s) t be signed. Value fr <Identifier> element: urn:asis:names:tc:dss:1.0:prfiles:ades:alldataobjectstimestamp N cntent is required fr <Value> element, since the actual cntents f the prperty will be generated by the server when required Requesting DataObjectFrmat Value fr Identifier element: urn:asis:names:tc:dss:1.0:prfiles:ades:dataobjectfrmat When the client requests the generatin and inclusin f this signed prperty the <Value> element MUST have the fllwing cntent. asis-dss-prfiles-ades-spec-v1.0-s 11 April 2007 Cpyright OASIS Open All Rights Reserved. Page 14 f 36

15 505 <xs:element name="requesteddcsfrmat" type="dcsfrmattype"/> <xs:cmplextype name="dcsfrmattype"> 508 <xs:sequence> 509 <xs:chice> 510 <xs:element name="dcfrmat" type="dcfrmattype" 511 maxoccurs="unbunded"/> 512 <xs:element name="binaryvalue" type="xs:base64binary"/> 513 </xs:chice> 514 </xs:sequence> 515 </xs:cmplextype> <xs:cmplextype name="dcfrmattype"> 518 <xs:cmplexcntent> 519 <xs:extensin base="dcreferencetype"> 520 <xs:sequence> 521 <xs:element ref="xades:dataobjectfrmat"/> 522 </xs: sequence > 523 </xs:extensin> 524 </xs:cmplexcntent> </xs:cmplextype> Elements <DcFrmat> will be present when requesting an XML based signature Element <BinaryValue> will be present when requesting a CMS based signature. Its cntents MUST be the base64 encding f cntent-hints ASN.1 attribute defined in [RFC 2634] DER-encded Element <SignRespnse> This clause prfiles the dss:signrespnse element Element <SignatureObject> This element SHALL NOT cntain a dss:timestamp element as a child Optinal Outputs Nne f the ptinal utputs specified in the [DSS Cre] are neither precluded nr further prfiled in this abstract prfile. 3.4 Prfile f Verifying Prtcl Element <VerifyRequest> This clause specifies the prfile fr the cntents f the dss:verifyrequest when used fr: Requesting verificatin f advanced signatures. Requesting verificatin f advanced signatures AND update f signatures t ther predefined frms Attribute Prfile The value fr the Prfile attribute, indicating the cncrete sub-prfile f this abstract prfile, MUST be present Element <SignatureObject> This element SHALL NOT cntain a dss:timestamp element as a child. asis-dss-prfiles-ades-spec-v1.0-s 11 April 2007 Cpyright OASIS Open All Rights Reserved. Page 15 f 36

16 Element <OptinalInputs> Nne f the ptinal inputs specified in the [DSS Cre] are precluded in this abstract prfile. It nly cnstrains sme f them and specifies additinal ptinal inputs Element <ReturnUpdatedSignature> This element MUST be present when the client requests verificatin f a signature and update t a predefined frm f advanced signature. The Type attribute identifies the advanced signature frm requested. Acceptable predefined values fr this attribute are the URIs specified in table 1 crrespnding t the fllwing frms predefined in [CAdES] and [XAdES]: XAdES-T/CAdES -T, XAdES- C/CAdES-C, XAdES-X/CAdES-X,XAdES-X-L/CAdES-X-L, XAdES-A/CAdES-A. Shuld ther standard r prprietary specificatin define new signature frms and their crrespnding URIs, cncrete sub-prfiles f this abstract prfile culd be defined fr giving supprt t their verificatin and update. When the requested frm allws fr different cntents, the server MUST decide the specific cntents f the updated signature delivered, accrding t its cnfiguratin and settings. 3.5 Element <VerifyRespnse> This clause prfiles the dss:verifyrespnse element Element <OptinalOutputs> Nne f the ptinal inputs specified in the [DSS Cre] are precluded in this abstract prfile. It nly cnstrains sme f them Optinal Output <UpdatedSignature> This element SHALL cntain a dss:signatureobject element that SHALL NOT cntain a dss:timestamp element as a child. asis-dss-prfiles-ades-spec-v1.0-s 11 April 2007 Cpyright OASIS Open All Rights Reserved. Page 16 f 36

17 XML Advanced Electrnic Signatures cncrete Prfile 4.1 Overview This cncrete prfile supprts peratins within each phase f the lifecycle f XML Advanced Electrnic Signature based n [XMLSig] such as specified in [XAdES]. It will then prvide all the features related t XAdES signatures that are specified in the abstract prfile defined in sectin 3. Fr the generatin f XAdES signatures, the fllwing peratins apply: SignRequest. This peratin supprts requests fr: Generating predefined advanced signature frms as defined in [XAdES]. Generating XML signatures incrprating specific signed/unsigned prperties whse cmbinatin des nt fit any predefined XAdES signature frm. In such cases, the frm MUST have been defined in a prprietary specificatin and MUST be identified by ne URI. SignRespnse. This peratin supprts delivery f: Predefined advanced signature frms as defined in [XAdES]. XML signatures with specific prperties whse cmbinatin des nt fit any predefined XAdES signature frm. In such cases, the frm MUST have been defined in a prprietary specificatin and MUST be identified by ne URI. Fr verificatin [and updating] f XAdES signatures the fllwing peratins apply: VerifyRequest. This peratin supprts requests fr: Verifying a predefined XAdES signature frm. Verifying XML signatures incrprating specific prperties whse cmbinatin des nt fit any predefined XAdES signature frm. Verifying any f the signatures mentined abve PLUS updating them by adding unsigned prperties (time-stamps, validatin data, etc) leading t a predefined XAdES frm. Verifying a lng-term advanced signature in a certain pint f time. VerifyRespnse. This peratin supprts delivery f: 4.2 Prfile features Identifier Advanced signature verificatin result f signatures mentined abve. Advanced signature verificatin result PLUS the updated signatures as requested. urn:asis:names:tc:dss:1.0:prfiles:xades Scpe This dcument prfiles the DSS abstract prfile defined in sectin 3 f the present dcument. asis-dss-prfiles-ades-spec-v1.0-s 11 April 2007 Cpyright OASIS Open All Rights Reserved. Page 17 f 36

18 Relatinship T Other Prfiles The prfile in this sectin is based n the abstract prfile fr Advanced Electrnic Signatures defined in sectin Signature Object This prfile supprts the creatin and verificatin f XML advanced signatures as defined in [XAdES]. This prfile als supprts verificatin and update f advanced signatures by additin f unsigned prperties (time-stamps and different types f validatin data), as specified in [XAdES] Transprt Binding This prfile des nt specify r cnstrain the transprt binding Security Binding This prfile des nt specify r cnstrain the security binding. 4.3 Prfile f Signing Prtcl The present prfile allws requesting: Predefined frms f advanced electrnic signatures as defined in [XAdES]. A server aligned with this prfile SHALL generate XAdES signatures with direct incrpratin f qualifying prperties as defined in [XAdES] sectin 6.3. Other frms f signatures based in [XMLSig] defined in ther specificatins, In bth cases, the specific requested frm will be identified by an URI. Accrding t this prfile, the fllwing predefined advanced signature frms defined in [XAdES] MAY be requested: XAdES-BES, XAdES-EPES, XAdES-T, XAdES-C, XAdES-X, XAdES-X-L., and XAdES-A. In additin, the present prfile prvides means fr requesting incrpratin in any f the afrementined frms any f the fllwing prperties: SigningTime, CmmitmentTypeIndicatin, SignaturePrductinPlace, SignerRle, IndividualDataObjectTimeStamp, AllDataObjectTimeStamp and DataObjectFrmat. Other electrnic signature frms based in [XMLSig] defined elsewhere MAY als be requested using the mechanisms defined in this prfile Attribute Prfile urn:asis:names:tc:dss:1.0:prfiles:xades Element <SignRequest> This clause prfiles the dss:signrequest element Element <OptinalInputs> New Optinal Inputs Element <SignatureFrm> Usage f these elements is accrding t what is stated in sectin asis-dss-prfiles-ades-spec-v1.0-s 11 April 2007 Cpyright OASIS Open All Rights Reserved. Page 18 f 36

19 Optinal Inputs already defined in the Cre Nne f the ptinal inputs specified in the [DSS Cre] are precluded in this abstract prfile. It nly cnstrains sme f them and specifies additinal ptinal inputs Optinal Input <SignatureType> This element is MANDATORY. Its vaule MUST be: urn:ietf:rfc: Optinal inputs < ClaimedIdentity> and <KeySelectr> Usage f these elements is accrding t what is stated in sectin Optinal Input <SignedPrperties> Requesting SigningTime Clients MAY use the URI defined in r alternatively they MAY als use the fllwing ne: urn:asis:names:tc:dss:1.0:prfiles:xades:signingtime Usage f these elements is accrding t what is stated in sectin Requesting CmmitmentTypeIndicatin Clients MAY use the URI defined in r alternatively they MAY als use the fllwing ne: urn:asis:names:tc:dss:1.0:prfiles:xades:cmmitmenttypeindicati n When this ptinal input is present, the <Value> element MUST cntain a <RequestedCmmitment> element as defined in sectin in with the <xades:cmmitmenttypeindicatin> Requesting SignaturePrductinPlace Clients MAY use the URI defined in r alternatively they MAY als use the fllwing ne: urn:asis:names:tc:dss:1.0:prfiles:xades:signatureprductinplac e When this ptinal input is present, the <Value> element MUST cntain a <RequestedSignaturePrductinPlace> element as defined in sectin with the <xades:signatureprductinplace> Requesting SignerRle Clients MAY use the URI defined in r alternatively they MAY als use the fllwing ne: urn:asis:names:tc:dss:1.0:prfiles:xades:signerrle When this ptinal input is present, the <Value> element MUST cntain a <RequestedSignerRle> element as defined in sectin with the <xades:signerrle> child Requesting AllDataObjectTimeStamp Clients MAY use the URI defined in r alternatively they MAY als use the fllwing ne: urn:asis:names:tc:dss:1.0:prfiles:xades:alldataobjectstimestamp asis-dss-prfiles-ades-spec-v1.0-s 11 April 2007 Cpyright OASIS Open All Rights Reserved. Page 19 f 36

20 Usage f these elements is accrding t what is stated in sectin Requesting DataObjectFrmat Clients MAY use the URI defined in r alternatively they MAY als use the fllwing ne: urn:asis:names:tc:dss:1.0:prfiles:xades:alldataobjectstimestamp When this ptinal input is present, the <Value> element MUST cntain a <RequestedDcsFrmat> element as defined in sectin with ne r mre <DcFrmat> children Requesting <xades:individualdataobjecttimestamp> Value fr <Identifier> element: urn:asis:names:tc:dss:1.0:prfiles:xades:individualdataobjecttimesta mp In this case, the cntent f <Value> element will be the element <DcsTBeTimeStamped>, defined as shwn belw. 701 <xs:element name="dcstbetimestamped" type="dcreferencestype"/> <xs:cmplextype name="dcreferencestype"> 704 <xs:sequence> 705 <xs:element name="dcreference" maxoccurs="unbunded" 706 type="dcreferencetype"/> 707 </xs:sequence> 708 </xs:cmplextype> <xs:cmplextype name="dcreferencetype"> 711 <xs:attribute name="whichdcument" type="xs:idref" 712 use="required"/> 713 <xs:attribute name="refid" type="xs:string" use="ptinal"/> 714 </xs:cmplextype> WhichDcument attribute cntains the reference t the dcument whse time-stamp is requested (see attribute ID in [CreDSS] sectin 2.4.1). Shuld the client request the generatin f several ds:reference element fr this dcument (using dss:signedreferences ptinal input), the server SHALL timestamp all the data bjects referenced by these ds:reference elements. Under these cnditins, each dss:signedreference element MUST have its RefId attribute set t a nt empty value. [XAdES] mandates that <ds:reference> elements crrespnding t signed data bjects that have been individually time-stamped befre being signed, must include an Id attribute. [XAdES] als mandates <xades:individualdataobjectstimestamp> element t use this Id attribute t indicate what signed dcuments have actually been time-stamped befre signing. See [XAdES] <xades:timestamptype> and <xades:individualdataobjectstimestamp> definitins fr mre details. The client MAY request a value fr the <ds:reference> element s Id attribute using the RefId ptinal attribute if a <dss:signedreference> frcing a value fr such an attribute is nt present in the request. If the request des nt specify a value fr this attribute, then the server will autmatically generate it Element <SignRespnse> This sectin prfiles the dss:signrespnse element Element <SignatureObject> The cntent f this element MUST be ne f the fllwing: A ds:signature element cntaining a XMLSig based signature. asis-dss-prfiles-ades-spec-v1.0-s 11 April 2007 Cpyright OASIS Open All Rights Reserved. Page 20 f 36

21 A dss:signatureptr pinting t the XMLSig based signature embedded in an utput dcument. 4.4 Prfile f Verifying Prtcl A server verifying XAdES signatures SHOULD fllw the recmmendatins made by the XAdES standard it aligns t with respect n hw t verify the signed and unsigned prperties (versin XAdES v1.3.2 includes an infrmative annex n this tpic) Element <VerifyRequest> This clause prfiles the dss:verifyrequest element Attribute Prfile urn:asis:names:tc:dss:1.0:prfiles:xades Element <SignatureObject> This element SHALL NOT cntain a dss:timestamp element as a child Element <OptinalInputs> Optinal Output <ReturnUpdatedSignature> Usage f these elements is accrding t what is stated in sectin Element <VerifyRespnse> This clause prfiles the dss:verifyrespnse element Element <OptinalOutputs> Nne f the ptinal inputs specified in the [DSS Cre] are precluded in this prfile. It nly cnstrains sme f them Optinal Output <UpdatedSignature> The cntent f the dss:updatedsignature will be a dss:signatureobject element with ne f the fllwing cntents: A ds:signature cntaining a XMLSig based signature. A dss:signatureptr pinting t the XMLSig based signature embedded in ne f the inputdcuments. 4.5 Prfile Bindings Transprt Bindings Messages transprted in this prfile MAY be transprted by the HTTP POST Transprt Binding and the SOAP 1.2 Transprt Binding defined in [DSSCre] Security Bindings Security Requirements This prfile MUST use security bindings that: Authenticates the requester t the DSS server asis-dss-prfiles-ades-spec-v1.0-s 11 April 2007 Cpyright OASIS Open All Rights Reserved. Page 21 f 36

22 Authenticates the DSS server t the DSS client Prtects the integrity r a request, respnse and the assciatin f respnse t the request. Optinally, prtects the cnfidentiality f a request and respnse. The fllwing MAY be used t meet these requirements TLS X.509 Mutual Authenticatin This prfile is secured using the TLS X.509 Mutual Authenticatin Binding defined in [DSSCre]. asis-dss-prfiles-ades-spec-v1.0-s 11 April 2007 Cpyright OASIS Open All Rights Reserved. Page 22 f 36

23 CMS-based Advanced Electrnic Signature prfile 5.1 Overview This cncrete prfile supprts peratins within each phase f the lifecycle f CMS based Advanced Electrnic Signature based n [RFC 3852] such as specified in [CAdES]. It will then prvide all the features related t CAdES signatures that are specified in the abstract prfile defined in sectin 3. Fr the generatin f CAdES signatures, the fllwing peratins apply: SignRequest. This peratin supprts requests fr: Generating predefined advanced signature frms as defined in [CAdES]. Generating CMS signatures incrprating specific signed/unsigned attributes whse cmbinatin des nt fit any predefined [CAdES] signature frms. In such cases, the frm MUST have been defined in a prprietary specificatin and MUST be identified by ne URI. SignRespnse. This peratin supprts delivery f: Predefined advanced signature frms as defined in [CAdES]. CMS signatures incrprating specific signed attributes whse cmbinatin des nt fit any predefined [CAdES] signature frms. In such cases, the frm MUST have been defined in a prprietary specificatin and MUST be identified by ne URI. Fr verificatin [and updating] f signatures as specified in [CAdES] the fllwing peratins apply: VerifyRequest. This peratin supprts requests fr: Verifying a predefined [CAdES] signature frm. Verifying CMS signatures incrprating specific attributes whse cmbinatin des nt fit any predefined [CAdES] signature frm. Verifying any f the signatures mentined abve PLUS updating them by additin f additinal attributes (time-stamps, validatin data, etc) leading t a predefined [CAdES] frm. Verifying a lng-term advanced signature in a certain pint f time. VerifyRespnse. This peratin supprts delivery f: 5.2 Prfile features Identifier Advanced signature verificatin result f signatures mentined abve. Advanced signature verificatin result PLUS the updated signatures as requested. urn:asis:names:tc:dss:1.0:prfiles:cades Scpe This dcument prfiles the DSS abstract prfile defined in sectin 3 f the present dcument. asis-dss-prfiles-ades-spec-v1.0-s 11 April 2007 Cpyright OASIS Open All Rights Reserved. Page 23 f 36

24 Relatinship T Other Prfiles The prfile in this dcument is based n the abstract prfile fr Advanced Electrnic Signatures defined in sectin Signature Object This prfile supprts the creatin and verificatin f CMS based advanced signatures as defined in [CAdES]. This prfile als supprts verificatin and update f advanced signatures by additin f unsigned prperties (time-stamps and different types f validatin data), as specified in [CAdES] Transprt Binding This prfile des nt specify r cnstrain the transprt binding Security Binding This prfile des nt specify r cnstrain the security binding. 5.3 Prfile f Signing Prtcl The present prfile allws requesting: Predefined frms f advanced electrnic signatures as defined in [CAdES]. Other frms f signatures based in [RFC 3852] defined in ther specificatins, In bth cases, the specific requested frm will be identified by an URI. Accrding t this prfile, the fllwing predefined advanced signature frms defined in [CAdES] MAY be requested: CAdES-BES, CAdES-EPES, CAdES-T, CAdES-C, CAdES-X, CAdES-X-L, and CAdES-A In additin, the present prfile prvides means fr requesting incrpratin in any f the afrementined frms any f the fllwing attributes: signing-time, cmmitment-typeindicatin, signer-attributes, signer-lcatin, cntent-hints, and cntent-time-stamp Other electrnic signature frms based in [RFC 3852], defined elsewhere, MAY als be requested using the mechanisms defined in this prfile Element <SignRequest> This clause prfiles the dss:signrequest element Attribute Prfile urn:asis:names:tc:dss:1.0:prfiles:cades Element <OptinalInputs> New Optinal Inputs Element <SignatureFrm> Usage f these elements is accrding t what is stated in Optinal Inputs already defined in the Cre Nne f the ptinal inputs specified in the [DSS Cre] are precluded in this abstract prfile. It nly cnstrains sme f them and specifies additinal ptinal inputs. asis-dss-prfiles-ades-spec-v1.0-s 11 April 2007 Cpyright OASIS Open All Rights Reserved. Page 24 f 36

25 Element <SignatureType> 857 This element is MANDATORY. Its value MUST be: 858 urn:ietf:rfc: Optinal inputs < ClaimedIdentity> / <KeySelectr> Usage f these elements is accrding t what is stated in sectin Element <SignedPrperties> This sectin prfiles sectin Requesting signing-time Clients MAY use the URI defined in r alternatively they MAY als use the fllwing ne: urn:asis:names:tc:dss:1.0:prfiles:cades:signing-time Usage f these elements is accrding t what is stated in sectin Requesting cmmitment-type-indicatin Clients MAY use the URI defined in r alternatively they MAY als use the fllwing ne: urn:asis:names:tc:dss:1.0:prfiles:cades:cmmitment-typeindicatin When this ptinal input is present, the <Value> element MUST cntain a <RequestedCmmitment> element as defined in sectin with the <BinaryValue> child cntaining the base64encding f cmmitment-type-indicatin ASN.1 attribute as specified in [CAdES], DER-encded Requesting signer-lcatin Clients MAY use the URI defined in r alternatively they MAY als use the fllwing ne: urn:asis:names:tc:dss:1.0:prfiles:cades:signer-lcatin When this ptinal input is present, the <Value> element MUST cntain a <RequestedSignaturePrductinPlace> element as defined in sectin with the <BinaryValue> child cntaining the base64encding f signer-lcatin ASN.1 attribute as specified in [CAdES], DER-encded Requesting signer-attributes Clients MAY use the URI defined in r alternatively they MAY als use the fllwing ne: urn:asis:names:tc:dss:1.0:prfiles:cades:signer-attributes When this ptinal input is present, the <Value> element MUST cntain a <RequestedSignerRle> element as defined in sectin with the <BinaryValue> child cntaining the base64encding f signer-attributes ASN.1 attribute as specified in [CAdES], DER-encded Requesting cntent-time-stamp Clients MAY use the URI defined in r alternatively they MAY als use the fllwing ne: urn:asis:names:tc:dss:1.0:prfiles:cades:cntent-time-stamp 897 Usage f these elements is accrding t what is stated in sectin asis-dss-prfiles-ades-spec-v1.0-s 11 April 2007 Cpyright OASIS Open All Rights Reserved. Page 25 f 36