ADSS Admin Guide

Source Signature Format

How to Enhance

PDF Signatures (ISO 32000-1)

According to PAdES specification PDF ISO 32000-1 signatures are equivalent to PAdES Part 2 signatures, and this specification allows to convert the existing PDF ISO 32000-1 signatures (PAdES Part 2) / PAdES Part 3 signatures to PAdES Part 4 signature by adding the revocation information for the signer/signature timestamp certificates along with addition of an RFC 3161 compliant document timestamp signature. These enhanced signatures will no more be ISO 32000-1 rather these will become PAdES Part 4 signatures as stated above.

There are two possible ways to send the signature enhancement request to ADSS Verification Service:

• Sending the signed PDF document in the request
  ADSS Verification Service performs the following steps to enhance the existing signatures in the signed PDF document:

1. Extract and verify all existing signatures inside the PDF document e.g. User Signature, Signature Timestamp and Document Timestamp etc
2. Add the revocation information for each certificate chain into the DSS dictionary of the PDF document as per PAdES specifications
3. Adding an RFC 3161 compliant document timestamp signature.

• Sending signatures only
  For this client application must use the ADSS Client API to enhance the existing signatures. The client application must perform the following steps to enhance the existing signatures using multiple ADSS Client API calls:

1. Extract all the embedded CMS/PKCS#7 signature
2. Send the signature value to ADSS Server for verification one by one
3. Receive the signer’s certificate chain revocation information in response and embed it inside the PDF document for each signature as per PAdES specifications
4. Adding an RFC 3161 compliant document timestamp signature.
   
   

Note:
These are the details when different signature types enhanced to PAdES Part 4 signatures

• Standard PDF Signature: (ISO)
  The revocation information for the signer certificate will be added inside the PDF (DSS Dictionary) and a document timestamp signature will be applied.
• PDF signature with embedded timestamp: (ISO)
  The revocation information for the signer and Signature timestamp certificate will be added inside the PDF (DSS Dictionary) and a document timestamp signature will be applied.
• PDF Signature with embedded timestamp and revocation information (equivalent PAdES Part 2): (ISO)
  The revocation information for the Signature timestamp certificate will be added inside the PDF (DSS Dictionary) if missing and a document timestamp signature will be applied.

PAdES

ADSS Server can verify and enhance PAdES signatures to the relevant long-term signature profiles, such as:

For Baseline Signatures (ETSI EN 319 132-1):

• PAdES-B-B
• PAdES-B-T
• PAdES-B-LT
• PAdES-B-LTA
  
  

For Extended Signatures (ETSI EN 319 132-2):

• PAdES-E-BES
• PAdES-E-T
• PAdES-E-LTV

CAdES

ADSS Server can verify and enhance CAdES signatures to the relevant long-term signature profiles, such as:

For Baseline Signatures (ETSI EN 319 132-1):

• CAdES-B-B
• CAdES-B-T
• CAdES-B-LT
• CAdES-B-LTA
  
  

For Extended Signatures (ETSI EN 319 132-2):

• CAdES-E-BES
• CAdES-E-T
• CAdES-E-C
• CAdES-E-X
• CAdES-E-XL
• CAdES-E-A

XAdES

ADSS Server can verify and enhance XAdES signatures to the relevant long-term signature profiles, such as:

For Baseline Signatures (ETSI EN 319 132-1):

• XAdES-B-B
• XAdES-B-T
• XAdES-B-LT
• XAdES-B-LTA
  
  

For Extended Signatures (ETSI EN 319 132-2):

• XAdES-E-BES
• XAdES-E-T
• XAdES-E-C
• XAdES-E-X
• XAdES-E-XL
• XAdES-E-A

PKCS#7/CMS

A PKCS#7/CMS signature can be enhanced to include a timestamp as defined by the ISO 32000-1 PDF specifications (as explained above).

There is no standard specification for enhancing such signatures to other long-term signature profiles (e.g. no standard way for embedding revocation information). If this is required then it is recommended to start with a basic CAdES-BES format signature and then enhance this to the relevant CAdES signature profile as explained above