This post is about digital signatures.
Digital Signature Issues
Digital signature issues:
- Expiration
- Revocation
- Vulnerability
Digital Signature Formats
Digital signature format:s:
- XML DSig
- XAdES
- CAdES
- PAdES
XML Signature
XML Signature, XMLDSig, DSig-XML o XML-SIG is a general framework for digital certificates. It is issued by W3C.
Similar to PCKS 7.
Digital signature by capacity:
- Detached signature
- Enveloped signature
- Enveloping signature
The detached signature contains a signature of an external document.
The enveloped signature references other part in the document.
The enveloping signature contains the signed data within itself.
XAdES
XML Advanced Electronic Signature (XAdES) is a set of extensions to XML Signature recommentation in order to be compliant with eIDAS.
XAdES is used to sign small files (up to 4 MB).
W3C and ETSI maintains XAdES.
XAdES Profiles
XAdES profiles:
- XAdES-BES
- XAdES-EPES
- XAdES-T
- XAdES-C
- XAdES-X
- XAdES-X-L
“FirmaXadesNet” is a .NET library in C# to generate XAdES signatures. You can find it on this external link.
XAdES-BES
XAdES basic electronic signature (XAdES-BES).
XAdES-EPES
Is XAdES EPES is simalar to XaDES-BES but adding the signature policy.
XAdES-T
XAdES XAdES-T
XAdES-C
XAdES complete (XAdES-C) is no
XAdES-X
XAdES extended (XAdES-X) includes a timestamp to the reference included to XAdES (in addition to the XAdES-C timestamp).
XAdES-X-L
XAdES Extended Longterm (XAdES-X-L) includes certificates and revocation lists (OCSP queries or CRLs) to be able to verify the signed document in the future even if the original source is not available.
XAdES-A
XAdES archival (XAdES-A) allows to use timestamps.
XAdES Implementations
“FirmaXadesNet” is a .NET library in C# to generate XAdES signatures. You can find it on this external link.
There are at least the following Java implementations of XAdES:
- Java XML Digital Signature API
- Apache Santuario
- XAdES4j
- eID Digital Signature Service
CAdES
CMS Advanced Electronic Signatures (CAdES) is a set of extensions to Cryptographic Messagin System (CMS) that are compliant with eIDAS.
CAdES is used to sign big files (more than 4 MB).
PAdES
PDF Advanced Electronic Signatures (PAdES) that are compliant with eIDAS.
PAdES is used to check the information of both signature and content within PDFs.
Regulation on Digital Signatures
You can read this post about eIDAS.
You might also be interested…
External references
- Portal de Administración Electrónica del Gobierno de España; “Formatos Firma“; Portal de Administración Electrónica del Gobierno de España (Spanish)