ADSS Server supports ETSI XAdES signature formats, XAdES stands for “XML Advanced Electronic Signatures” and is a set of standards published by ETSI to support European requirements for qualified electronic signatures. ADSS Signing Service partially supports the EN 319 132-1 (baseline) and the EN 319 132-2 (extended) versions.

XML Dsig Signatures:

This format allows XML to be hashed and signed by generating a XML Dsig signature. 

XAdES Signatures

ADSS Server supports these XAdES signatures formats (these are explained in the CAdES formats discussed below):

• XAdES-BES: A XAdES-BES standard compliant basic signature provides requirements for the incorporation of signed and some unsigned qualifying properties when the signature is generated.

• XAdES-T (XAdES-BES with embedded timestamp): A Timestamp is added from existing TSA to XAdES-BES signature to ensure the signature itself existed at a certain date and time. 

• XAdES-C (XAdES-T with Complete Validation Data References): XAdES-C is an extended version of XAdES-T on which qualifying properties containing references to certificates and references to status data value are added. 

• XAdES-X (XAdES-C with Extended Validation Data): XAdES-X is an extended version of XAdES-C which are built by adding one or more qualifying properties containing one or more electronic timestamps.  

• XAdES-X-L (XAdES-X with Long-term Validation Data): XAdES-X-L ia an extended version of XAdES-X which are built on which qualifying properties containing certificates and revocation values are added. 

• XAdES-A (XAdES-X-L with Archive Validation Data): In case of XAdES-A; XAdES-C, XAdES-X and XAdES-X-L are being created first. XAdES-A is created by adding ArchiveTimeStamp in above mentioned signatures. 

ADSS Server also supports the original W3C XML DigSig standard with modes:

• Enveloping: The original XML file is contained inside the signature
• Enveloped: The XML signature is embedded within the original XML file.

XAdES Supported Attributes:

Below are the list of attributes that are currently being supported in XAdES signature for both Baseline and Extended versions. It includes attributes from XAdES-BES, XAdES-EBES, XAdES-T, XAdES-ET, XAdES-LT, XAdES-ELT, XAdES-LTA and XAdES-ELTA:

Attributes	Baseline Level	Extended Level
ds:KeyInfo/X509Data
ds:SignedInfo/ds:CanonicalizationMethod
ds:Reference
ds:Reference/ds:Transforms
SigningTime
SigningCertificateV2
DataObjectFormat
DataObjectFormat/Description
DataObjectFormat/ObjectIdentifier
DataObjectFormat/MimeType
DataObjectFormat/Encoding
DataObjectFormat's ObjectReference attribute
SignerRoleV2
CommitmentTypeIndication
SignatureProductionPlaceV2
CounterSignature
AllDataObjectsTimeStamp
IndividualDataObjectsTimeStamp
SignaturePolicyIdentifier
SignaturePolicyStore
SignatureTimeStamp
CertificateValues
AttrAuthoritiesCertValues
RevocationValues
AttributeRevocationValues
Service: Incorporation of validation data for electric time-stamps
SPO: TimeStampValidationData
SPO: certificate and revocation values embedded in the electronic time-stamp itself
ArchiveTimeStamp
RenewedDigest

File Signing

File Signing is the term used to describe traditional binary-based ASN.1 signature formats. ADSS Server supports the historical signature formats in this category (i.e. PKCS#7 and CMS) and also the latest CAdES formats. It is recommended to use CAdES formats unless the older signature formats are required for backward compatibility. The type of supported signature can be further defined as:

• Enveloping: The original file is contained inside the signature
• Detached: The signature contains just the hash of the original file.

Following signature types are supported for File signing:

PKCS#7 Signatures:

This format allows any type of file to be hashed and signed by generating a PKCS#7 signature. In this category both enveloping signatures (the original file is contained inside the signature) and detached signatures (the signature only contains the hash of the original file) are supported.

CMS Signatures:

This format allows any type of file to be hashed and signed by generating a CMS signature. CMS is essentially a later version of the PKCS#7 signature format. Both enveloping signatures and detached signatures are supported.

CAdES Signatures:

CAdES stands for “CMS Advanced Electronic Signatures” and is a set of standards published by ETSI  to support European requirements for electronic signatures. ADSS Signing Service partially supports the EN 319 122-1 (baseline) and the EN 319 142-2 (extended) versions. CAdES specifies the use of signature formats for signing the file content. So the use of CAdES signatures will allow these signatures to be extended by either the signer or relying parties to ensure that signatures can be verified for as long as is necessary. Following are the different standard CAdES signatures formats:

• CAdES-BES (Basic short-term signatures): This allows any type of file to be hashed and signed by generating a CAdES-BES signature. This is illustrated as follow:
  
  

• CAdES-EPES: As above but the Signature Policy ID information is also added to the signature as a signed attribute. This is illustrated as follow:
  
  

• CAdES-T (CAdES-BES with Signature Timestamp): As above but ADSS Server also adds a timestamp from a trusted TSA - this helps to independently prove the time of signing. The configuration of TSA address(es) is described in this section: Configuring Time Stamp Authorities (TSA).
  
  

• CAdES-C (CAdES-T with Complete Validation Data References): This adds the complete-certificate-references and complete-revocation-references attributes. The complete-certificate-references attribute contains references to all the certificates present in the certification path used for verifying the signature. The complete-revocation-references attribute contains references to the CRLs and/or OCSP responses used for verifying the signature. Storing the references allows the values of the certification path and the CRLs or OCSPs responses to be stored elsewhere, reducing the size of a stored electronic signature.
  
  

• CAdES-X (CAdES-C with Extended Validation Data) Type1: This adds a time-stamp token on the CAdES-C itself to provide trust over all the elements and references. This protects the certificates, CRLs, and OCSP responses in case of a later compromise of a CA key, CRL key, or OCSP issuer key.
  
  

• CAdES-X (CAdES-C with Extended Validation Data) Type2: This adds to the CAdES-C format the CAdES-C-time-stamped-certs-crls-references attribute, whose content is a time-stamp token on the certification path and revocation information references. This provides integrity and trusted time protection over all the references. This may protect the certificates, CRLs and OCSP responses in case of a later compromise of a CA key, CRL key or OCSP issuer key. Note Type 1 and Type 2 are essentially very similar and protect against the same threat.
  
  

• CAdES-X-L (CAdES-X with Long-term Validation Data): This can be based on either Type 1, Type 2. CAdES-X Long adds the certificate-values and revocation-values. Certificate-values contain the whole certificate path required for verifying the signature; the revocation-values contain the CRLs and/or OCSP responses required for the validation of the signature. This provides a known repository of certificate and revocation information required to validate a CAdES-C and prevents such information from getting lost.
  
  
  

• CAdES-A (CAdES-X-L with Archive Validation Data): CAdES-A builds on a CAdES-X Long Type 1 or 2 by adding one or more archive-time-stamp attributes. This form is used for archival of long-term signatures. Successive time-stamps protect the whole material against vulnerable hashing algorithms or the breaking of the cryptographic material or algorithms (i.e. each outer timestamp can use stronger algorithms or key lengths):
  
  

Below are the list of attributes that are currently being supported in CAdES signature for both Baseline and Extended versions. It includes attributes from CAdES-BES, CAdES-EBES, CAdES-T, CAdES-ET, CAdES-LT, CAdES-LTA and CAdES-ELTA: 

Attributes	Baseline Level	Extended Level
SignedData.certificates
content-type
message-digest
Service: protection of signing certificate
SPO: ESS signing-certificate
PO: ESS signing-certificate-v2
commitment-type-indication
signing-time
mime-type
signer-location
signer-attribute-v2
countersignature
content-time-stamp
signer-policy-identifier
signature-policy-store
counter-reference
counter-identifier
signature-time-stamp
Service: revocation values in long-term validation
SPO: SignedData.crls.crl
SPO: SignedData.crls.other
Service: add archive time-stamp
SPO: archive-time-stamp-v3
SPO: long-term-validation
Service: certificate values in long term validation