e-İmza Teknolojileri Test Suit _{e-Signature Technologies Test Suite}

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== CAdES-BES ======
===== General Information =====


BES (Basic Electronic Signature) signature is the most basic signature type. There is no trusted time information that guarantees the date of signature creation.


{{https://yazilim.kamusm.gov.tr/eit-wiki/data/media/en/cades_bes_en.png?350|CAdES BES}}


The lifetime of the BES signature is up to the lifetime of the end entity certificate. The signature cannot be verified after the certificate has expired or the certificate has been revoked. For this reason, timestamping of the BES signature is extremely important. Time information in the BES signature can be added as a signing time attribute. However, there is no legal obligation or no certainty of the time added.

The cryptographic signature value in the BES signature is obtained by signing the cryptographic hash value of the Signed Attributes field. The "Message Digest" field where the hash value of the content to be signed is kept is also found under Signed Attributes.

The mandatory signed attributes for BES signature are as follows:


**Content Type**: It contains the type of the signed content.

**Message Digest**: It contains the hash value of the content to be signed.

**Enhanced Security Services - Signing Certificate**: It is an attribute that references the signer certificate and restricts the set of certificates to be used in signature validation. In addition, it must be added to eliminate possible security attacks from malevolent individuals such as changing the signer certificate.

Apart from these, a number of signed features can be added, which are not mandatory but will enrich the BES signature. The sample signed attributes are given in the following.


**Signing Time:** Indicates the time at which the signature was created in the manner declared by the signer. 

**Signer-location:** The location information where the signature was created can be added to the signature.

**Content-time-stamp:** This is the time stamp which covers the content before it is signed.


The following table specifies the signature properties that must be included in the signature file for CAdES-BES signature format:

^** Signature Properties  **                   ^                           ^ **CAdES-BES **          ^
| Signed Attributes | Content-type               |  M  |
| :::                                | Message-digest             |  M  |
| :::                                | ESS signing-certificate v2 |  M  |        
| :::                                | Signing-time               |  O  |
| :::                                | Content-hints              |  O  |
| :::                                | Mime-type              |  M  |
| :::                                | Content-reference          |  O  |
| :::                                | Content-identifier         |  O  |      
| :::                                | Commitment-type-indication |  O  |
|:::                                | Signer-location            |  O  |
| :::                                | Content-time-stamp         |  O  |
| :::                                | Signature-policy-identifier|  O  |
| Unsigned Attributes |CounterSignature          |  O  |       
| :::                                  | Signature-time-stamp        |  -  |
| :::                                  | Complete-certificate-references         |  -   |
| :::                                  |Complete-revocation-references|  -  |
| :::                                  | Certificate-values|  -  |
| :::                                  | Revocation-values|  -  |
| :::                                  | CAdES-C-time-stamp|  -  |
| :::                                  | CAdES-C-time-stamped-certs-crls-references|  -  |
| :::                                  | Archive-time-stamp|  -  |

**M:** Must - It is mandatory to include the specified attribute. If the attribute is not included, the e-signature conformity assessment will result in negative.

**O:** Optional – It is optional to include the specified attribute. If the attribute is not included, the e-signature conformity assessment will not result in negative.

**- :** This means the attribute is not supposed to be included in the related signature type.

It is recommended not to use the optional attributes unless needed.

The time info received from the signer's computer or the related server does not assure the accuracy of the signing time because it is not signed by a trusted authority. For this reason, it is not recommended to use the signing time attribute as a legal evidence. If it is used, it must be adjusted so that it is left behind from the timestamp.
 

===== Procedure =====

You can access **CAdES-BES Detached Test Package** from [[https://yazilim.kamusm.gov.tr/?q=tr/system/files/private/cades_bes_ayrik.rar|here]].

You can access **CAdES-BES Attached Test Package ** from [[https://yazilim.kamusm.gov.tr/?q=tr/system/files/private/cades_bes_butunlesik.rar|here]].

You can access **test root certificates** from [[https://yazilim.kamusm.gov.tr/?q=tr/system/files/private/rootcerts.rar|here]].

The following table provides the names and the properties of the signature files to be used in the procedures:

^**  M/O  **^**  Signed Document Name  **^**  Signed Document Property  **^** Validation Result**^**Explanation**^
|  M  | BES_1 | Valid (Revocation check is available only via CRL and all signed attributes are added)|  VALID  | All signed attributes must be displayed in the validation result. |
|  O  | BES_2.doc | Signature file with a macro inserted content |  INVALID  | The signature should not be verified. |
|  M  | BES_3 | Contradictory signature file including “mime-type” attribute with "image/jpeg" value although the actual content type is "Application/pdf" |  INVALID  | Signature verification details must be shown. |
|  M  |BES_4|Signature file with a forged "ESS Signing-Certificate-v2" attribute |  INVALID  |Signature verification details must be shown.|
|  M  |BES_5| Signature file with a forged ”message-digest” attribute |  INVALID  |Signature verification details must be shown.|
|  M  |BES_6|Signature file in which SHA-1 digest algorithm is used|  VALID  |The signature must be archived.|
|  M  |BES_7|Signature file with a forged signature |  INVALID  |Signature verification details must be shown.|
|  M  |BES_8| Valid (Revocation check is available only via OCSP) |  VALID  |
|  M  |BES_9|Signature file signed by a certificate with an omitted "non-repudiation" field in the key usage extension|  INVALID  |Signature verification details must be shown.|
|  M  |BES_10|Signer certificate with an omitted "UserNotice" text field in the "CertificatePolicies" extension |  INVALID  |Signature verification details must be shown.|
|  M  |BES_11|Signer certificate with an omitted ETSI OID in "QualifiedCertificateStatements" extension|  INVALID  |Signature verification details must be shown.|
|  M  |BES_12|Signer certificate with an omitted ICTA OID in "QualifiedCertificateStatements" extension|  INVALID  |Signature verification details must be shown.|
|  O  |BES_13|Signature file which has a PDF/A-3 content with attachment|  INVALID  |The signature must not be verified.| 
|  M  |BES_14|Signer certificate has expired |  INVALID  |Signature verification details must be shown.|
|  M  |BES_15|Signer certificate has a forged signature|  INVALID  |Signature verification details must be shown.|
|  M  |BES_16_1|Signature file signed by a revoked certificate (Revocation check is available only via CRL)|  INVALID  |Signature verification details must be shown.|
|  M  |BES_16_2|Signer certificate has revoked after claimed signing time (Revocation check is available only via CRL)|  INVALID  |
|  M  |BES_17_1|Signer certificate has revoked (Revocation check is available only via OCSP) |  INVALID  |Signature verification details must be shown.|
|  M  |BES_18|The validity of signer certificate has to be checked via an expired CRL  |  INVALID  |Signature verification details must be shown.|
|  M  |BES_19|The validity of signer certificate has to be checked via a signature forged CRL|  INVALID  |Signature verification details must be shown.|
|  M  |BES_20|The validity of signer certificate has to be checked via an expired OCSP response|  INVALID  |Signature verification details must be shown.|
|  M  |BES_21|The validity of signer certificate has to be checked via an OCSP response having forged signature |  INVALID  |Signature verification details must be shown.|
|  M  |BES_22|The validity of signer certificate has to be checked via an OCSP response which is signed by an expired OCSP certificate |  INVALID  |Signature verification details must be shown.|
|  M  |BES_23|The validity of signer certificate has to be checked via an OCSP response which is signed by a signature forged OCSP certificate|  INVALID  |Signature verification details must be shown.|
|  M  | BES_24_1 |The validity of signer certificate has to be checked via an OCSP response which is signed by a revoked OCSP certificate |  INVALID  | Signature verification details must be shown. |
|  M  |BES_25	 |Signer certificate has a monetary limit which is equal to "0"|  CHOICE*  |
|  O  |BES_26	 |Signer certificate has a usage restriction defined in “QC Statements” extension|  INVALID  |The signature should not be verified.|
|  M  |BES_27	 |The validity of signer certificate has to be checked via an OCSP response which is generated for a different certificate |  INVALID  |Signature verification details must be shown.|
|  M  |BES_28	 |Signer certificate is issued by an intermediate CA certificate having a forged signature|  INVALID  |Signature verification details must be shown.|
|  M  |BES_29_1 |Signer certificate is issued by an intermediate CA certificate which is revoked in CRL|  INVALID  |Signature verification details must be shown.|
|  M  |BES_30	 |Signer certificate is issued by an intermediate CA certificate whose validity has to be checked via an expired CRL |  INVALID  |Signature verification details must be shown.|
|  M  |BES_31	 |Signer certificate is issued by an intermediate CA certificate whose validity has to be checked via a forged signature CRL |  INVALID  |Signature verification details must be shown.|
|  M  |BES_32_1 |Signer certificate is issued by an intermediate CA certificate which is revoked in OCSP|  INVALID  |Signature verification details must be shown.|
|  M  |BES_33	 |Signer certificate is issued by an intermediate CA certificate whose validity has to be checked via an expired OCSP response  |  INVALID  |Signature verification details must be shown.|
|  M  |BES_34	 |The validity of intermediate CA certificate has to be checked via an OCSP response which has a forged signature |  INVALID  |Signature verification details must be shown.|
|  M  |BES_35	 |The validity of intermediate CA certificate has to be checked via an OCSP response which is signed by an expired OCSP certificate |  INVALID  |Signature verification details must be shown.|
|  M  |BES_36	 |The validity of intermediate CA certificate has to be checked via an OCSP response which is signed by a signature forged OCSP certificate |  INVALID  |Signature verification details must be shown.|
|  M  | BES_37_1 |The validity of intermediate CA certificate has to be checked via an OCSP response which is signed by a revoked OCSP certificate  |  INVALID  | Signature verification details must be shown. |
|  M  |BES_38	 | The root certificate has a forged signature |  INVALID  |Signature verification details must be shown.|
|  M  |BES_39_s | Counter signature file signed by two signers. Second signer has a valid certificate, but the first signer is configured with the required intermediate CA certificate which is revoked |  INVALID  |Validation result of the each signer must be shown in a hierarchical order similar to the tree structure. Signature verification details must be shown.|
|  M  | BES_39_p | Parallel signature file signed by two signers. Second signer has a valid certificate, but the first signer is configured with the required intermediate CA certificate which is revoked |  INVALID  | Each signature validation result must be shown in a hierarchical order similar to the tree structure. The details of the error should be reported to the user. |
|  O  | BES_110 | Signature file without a “mime-type” attribute |  INVALID  | The signature should not be verified.|


* One of the following methods must be selected when verifying the signed document if the signer certificate includes a monetary limit:
  * “INVALID Signature” message must be displayed. The description of the error should be reported to the user.
  * The monetary limit of the certificate is compared with the monetary limit of the signed document and if the monetary limit of the certificate is sufficient for the monetary value of the signed document, “VALID Signature” message must be displayed.  
  * In the case where the monetary limit of the certificate is not compared with the monetary limit of the signed document, the user should be warned that the signer certificate has a monetary limit and “VALID Signature” message must be displayed.
e-İmza Teknolojileri Test Suit e-Signature Technologies Test Suite

User Tools

Site Tools

Page Tools

e-İmza Teknolojileri Test Suit _{e-Signature Technologies Test Suite}
