e-Correspondence Package

e-Correspondence Package (ECP) is a package structure that is designed to carry out the official correspondence between public institutions and organizations in an electronic environment. The information and components of official letters turn into a single electronic file by specific rules with ECP. This package structure enables cover letters and attachments in official writings can be signed as a whole at once. Updates were made to the existing data structure of the e-Correspondence Package and the use of electronic seals was made technically possible with the “ECP 2.0 e-Correspondence Technical Guide” published by the Presidency of the Republic of Turkey Digital Transformation Office on August 28th, 2020.

ECP consists of components related to the document and package structure that are logically connected. The table below lists the ECP components.

M: Mandatory - It is mandatory to include the specified component in the package

O: Optional - It is optional to include the specified component in the package

While ECP must have Electronic Signature and Electronic Seal, the use of Paraph Electronic Signature is optional. P4 CAdES X-Long signature format is used for Paraph Electronic Signature and Electronic Signature. P4 CAdES-A signature format is used for Electronic Seal.

Certificate Control and Time Stamp verification procedures must be performed before creating the Paraph Electronic Signature, Electronic Signature, and Electronic Seal used in ECP. The “Date” field in the Final Metadata component is expected to be the same as the timestamp information of the most recently created Electronic Signature. Information about all signers should be included in the “Document Signatures” field of the Final Metadata component.

Paraph Electronic Signature: It is created by signing the “ParafOzeti.xml” file that exists in the Paraph Hash component in the ECP by using Qualified Electronic Certificate. It must be used only in paraph made with an electronic signature. Cover Letter, Metadata, and Attachments components' hash values exist in the “PaketOzeti.xml” file. The presence of Attachments is optional. The following table specifies the components that must be included and not included in the Paraph Electronic Signature.

Electronic Signature: It is created by signing the “PaketOzeti.xml” file that exists in the Package Hash component of the ECP by using the Qualified Electronic Certificate by the authorized personnel of the institution. Cover Letter, Metadata, Attachments, Paraph Hash, Paraph Electronic Signature components' hash values exist in the “PaketOzeti.xml” file. The presence of Attachments, Paraph Hash, and Paraph Electronic Signature is optional. The Electronic Signature component can include serial or parallel signers. The following table specifies the components that must be included and not included in the Electronic Signature.

Electronic Seal: The purpose of the Electronic Seal is to verify the identity of the institution that created the ECP. Electronic Seal is created by signing the “NihaiOzet.xml” file that exists in the Final Hash component by using the Electronic Seal certificate issued by Kamu SM on behalf of the public institutions and organizations within the scope of Prime Ministry Circular no 2017/21. Cover Letter, Metadata, Final Metadata, Core, Package Hash, Electronic Signature, Attachments, Paraph Hash and Paraph Electronic Signature components' hash values exist in the “NihaiOzet.xml” file. The presence of Attachment, Paraph Hash, and Paraph Electronic Signature components are optional. The Electronic Seal component can not include serial or parallel signers. The following table specifies the components that must be included and not included in the Electronic Seal.

This section has been created to test the compliance of ECP files with various standards. The structural features of the ECP should be conformed with “ECP 2.0 e-Correspondence Technical Guide”. Signatures in the package must comply with the ETSI TS 101 733 standard, in which the CAdES signature type is defined, and the “Long Term and OCSP Controlled Secure Electronic Signature Policies (Profile P4)” in Digital Signature Usage Profiles Guide published by the Information Technologies and Communication Authority. In this context, Paraph Electronic Signature, Electronic Signature, Electronic Seal and package structure controls are specified in the procedure table. In addition, ECP Archiving structure is briefly explained at the end of the section.

You can access ECP Test Package from here.

You can access Test Root Certificates here.

The following table provides the names and properties of the ECP files to be used in the procedures. Packages in the procedure have been prepared according to “ECP 2.0 e-Correspondence Technical Guide”.

ECP files have been created to cover only the scenarios related to Electronic Signature or Electronic Seal components. Paraph Electronic Signature, which is optional, is only available in scenarios specific to the relevant component.

M: Mandatory - The specified items must be provided. In case the item is not provided, ECP evaluation will result in negative.

O: Optional - The specified items must be provided. In case the item is not provided, ECP evaluation will not result in negative.

* One of the following methods must be selected when verifying the signed document if the signer certificate includes a monetary limit:

• “INVALID Signature” message must be displayed. The description of the error should be reported to the user.
• The monetary limit of the certificate is compared with the monetary limit of the signed document and if the monetary limit of the certificate is sufficient for the monetary value of the signed document, “VALID Signature” message must be displayed.
• In the case where the monetary limit of the certificate is not compared with the monetary limit of the signed document, the user should be warned that the signer certificate has a monetary limit and “VALID Signature” message must be displayed.

In ECP applications, the archiving infrastructure should be provided. Comprehensive information about archiving can be found in section Signature Archival.

Since the Electronic Seal component in ECP 2.0 is in the archive signature format, archiving scenarios only cover tests specific to archive signature. Correspondingly, P4_A90 and P4_A94 packages in the procedure table should be archived.

The Electronic Signature component in ECP 1.3 can be in P4 CAdES-X LONG or P4 CAdES-A signature format. If signature is in P4 CAdES-X LONG format, it must be protected with archival. If the signature is in P4 CAdES-A format, archiving scenarios only cover tests specific to archive signature. Archived signature can be added in the package. If there is a Final Hash component in the package, this component also needs to be rebuilt after archival.