Türkçe
EnglishSidebar
en:pades_lta-type
Table of Contents
PAdES LTA-Level
General Information
LTA-Level signature is the signature format that should be used in cases where signed documents need to be stored longer than the validity period of the certificate authority's root/sub-root, OCSP and timestamp certificates.
Archiving is done when the CA’s certificate is near to the end of the validity period or the certificates are revoked or if announced that the used algorithms become invalid or is changed. There is no inconvenience in making archival before the above situations occur. Archival should be repeated by entering timestamp settings published by a new hierarchy by TSP if the validity of the last archive timestamp in the currently signed archive documents is compromised. On the application side, the relevant infrastructure should be provided.
The following table specifies the signature properties that must be included in the signature file for PAdES LTA-Level signature format:
| Signature Properties | PAdES LTA-Level | |
|---|---|---|
| Signed Attributes | Content-type | M |
| Message-digest | M | |
| ESS signing-certificate v2 | M | |
| /Signature Dictionary/M Entry | M | |
| /Signature Dictionary/Reason Entry | O | |
| /Signature Dictionary/Location Entry | O | |
| Content-time-stamp | O | |
| Signature-policy-identifier | O | |
| Unsigned Attributes | PDF Serial Signature | O |
| /Type/DocTimeStamp /SubFilter/ETSI.RFC3161 | M | |
| /DSS/Certs Array | M | |
| /DSS/VRI/Cert Array | M | |
| /DSS/CRLs Array | M | |
| /DSS/OCSPs Array | M | |
| /DSS/VRI CRL Array | M | |
| /DSS/VRI OCSP Array | M | |
| /Type/DocTimeStamp /SubFilter/ETSI.RFC3161 | M |
M: Must - It is mandatory to provide the specified substance. If the substance is not provided, the e-signature conformity assessment will result in a negative.
O: Optional – It is optional to provide the specified substance. If the substance is not provided, the e-signature conformity assessment will not result in a negative.
- : This means that the attribute is not in the signature format.
It is recommended not to use optional attributes unless needed.
Procedure
You can access the PAdES LTA-Level Test Package from here.
You can access test root certificates from here.
The following table provides the names and properties of the signature files to be used in the procedures:
| M/O | Signed Document Name | Signed Document Property | Validation Result | Explanation |
|---|---|---|---|---|
| M | LTA_1 | Valid (Revocation check is available only via CRL and all signed attributes are added) | VALID | All signed attributes must be displayed in the validation result |
| M | LTA_4 | Signature file with a forged “ESS Signing-Certificate-v2” attribute | INVALID | Signature verification details must be shown. |
| M | LTA_5 | Signature file with a forged ”message-digest” attribute | INVALID | Signature verification details must be shown. |
| M | LTA_6 | Signature file in which SHA-1 digest algorithm is used | VALID | The signature must be archived. |
| M | LTA_7 | Signature file with a forged signature | INVALID | Signature verification details must be shown. |
| M | LTA_8 | Valid (Revocation check is available only via OCSP) | VALID | |
| M | LTA_9 | Signature file signed by a certificate with an omitted “non-repudiation” field in the key usage extension | INVALID | Signature verification details must be shown. |
| M | LTA_10 | Signer certificate with an omitted “UserNotice” text field in the “CertificatePolicies” extension | INVALID | Signature verification details must be shown. |
| M | LTA_11 | Signer certificate with an omitted ETSI OID in “QualifiedCertificateStatements” extension | INVALID | Signature verification details must be shown. |
| M | LTA_12 | Signer certificate with an omitted ICTA OID in “QualifiedCertificateStatements” extension | INVALID | Signature verification details must be shown. |
| O | LTA_13 | Signature file which has a PDF/A-3 content with attachment | INVALID | The signature must not be verified. |
| M | LTA_14 | Signer certificate has expired before signature timestamp | INVALID | Signature verification details must be shown. |
| M | LTA_15 | Signer certificate has a forged signature | INVALID | Signature verification details must be shown. |
| M | LTA_16_1 | Signature file signed by a revoked certificate before signature timestamp (Revocation check is available only via CRL) | INVALID | Signature verification details must be shown. |
| M | LTA_16_2 | Signer certificate has revoked after signature timestamp (Revocation check is available only via CRL) | VALID | |
| M | LTA_17_1 | Signer certificate has revoked before signature timestamp (Revocation check is available only via OCSP) | INVALID | Signature verification details must be shown. |
| M | LTA_17_2 | Signer certificate revoked in OCSP after signature timestamp (Revocation check is available only via OCSP) | VALID | |
| M | LTA_18 | The validity of signer certificate has to be checked via an expired CRL | INVALID | Signature verification details must be shown. |
| M | LTA_19 | The validity of signer certificate has to be checked via a signature forged CRL | INVALID | Signature verification details must be shown. |
| M | LTA_20 | The validity of signer certificate has to be checked via an expired OCSP response | INVALID | Signature verification details must be shown. |
| M | LTA_21 | The validity of signer certificate has to be checked via an OCSP response having forged signature | INVALID | Signature verification details must be shown. |
| M | LTA_22 | The validity of signer certificate has to be checked via an OCSP response which is signed by an expired OCSP certificate | INVALID | Signature verification details must be shown. |
| M | LTA_23 | The validity of signer certificate has to be checked via an OCSP response which is signed by a signature forged OCSP certificate | INVALID | Signature verification details must be shown. |
| M | LTA_24_2 | The validity of signer certificate has to be checked via an OCSP response which is signed by a revoked OCSP certificate. The OCSP certificate is revoked after signature timestamp | VALID | |
| M | LTA_25 | Signer certificate has a monetary limit which is equal to “0” | CHOICE* | |
| O | LTA_26 | Signer certificate has a usage restriction defined in “QC Statements” extension | INVALID | The signature should not be verified. |
| M | LTA_27 | The validity of signer certificate has to be checked via an OCSP response which is generated for a different certificate | INVALID | Signature verification details must be shown. |
| M | LTA_28 | Signer certificate is issued by an intermediate CA certificate having a forged signature | INVALID | Signature verification details must be shown. |
| M | LTA_29_1 | Signer certificate is issued by an intermediate CA certificate which is revoked in CRL before signature timestamp | INVALID | Signature verification details must be shown. |
| M | LTA_29_2 | Signer certificate is issued by an intermediate CA certificate which is revoked in CRL after signature timestamp | VALID | |
| M | LTA_30 | Signer certificate is issued by an intermediate CA certificate whose validity has to be checked via an expired CRL | INVALID | Signature verification details must be shown. |
| M | LTA_31 | Signer certificate is issued by an intermediate CA certificate whose validity has to be checked via a forged signature CRL | INVALID | Signature verification details must be shown. |
| M | LTA_32_1 | Signer certificate is issued by an intermediate CA certificate which is revoked in OCSP before signature timestamp | INVALID | Signature verification details must be shown. |
| M | LTA_32_2 | Signer certificate is issued by an intermediate CA certificate which is revoked in OCSP after signature timestamp | VALID | |
| M | LTA_33 | Signer certificate is issued by an intermediate CA certificate whose validity has to be checked via an expired OCSP response | INVALID | Signature verification details must be shown. |
| M | LTA_34 | The validity of intermediate CA certificate has to be checked via an OCSP response which has a forged signature | INVALID | Signature verification details must be shown. |
| M | LTA_35 | The validity of intermediate CA certificate has to be checked via an OCSP response which is signed by an expired OCSP certificate | INVALID | Signature verification details must be shown. |
| M | LTA_36 | The validity of intermediate CA certificate has to be checked via an OCSP response which is signed by a signature forged OCSP certificate | INVALID | Signature verification details must be shown. |
| M | LTA_37_2 | The validity of intermediate CA certificate has to be checked via an OCSP response which is signed by a revoked OCSP certificate. The revocation time is after signature timestamp | VALID | |
| M | LTA_38 | The root certificate has a forged signature | INVALID | Signature verification details must be shown. |
| M | LTA_39_s | Counter signature file signed by two signers. Second signer has a valid certificate, but the first signer is configured with the required intermediate CA certificate which is revoked | INVALID | Validation result of the each signer must be shown in a hierarchical order similar to the tree structure. Signature verification details must be shown. |
| M | LTA_40 | Signature timestamp has a “TSTInfo” with a forged “messageImprint” field (TS server is TSA1) | INVALID | Signature verification details must be shown. |
| M | LTA_41 | Signature timestamp has a forged signature (TS server is TSA2) | INVALID | Signature verification details must be shown. |
| M | LTA_42 | Signature timestamp is signed by an expired certificate (TS server is TSA3) | INVALID | Signature verification details must be shown. |
| M | LTA_43 | Signature timestamp is signed by a certificate with a forged signature (TS server is TSA4) | INVALID | Signature verification details must be shown. |
| M | LTA_44 | Signature timestamp is signed by a revoked certificate. The revocation time is before the signature timestamp (TS server is TSA5) | INVALID | Signature verification details must be shown. |
| M | LTA_45 | Signature timestamp is signed by a revoked certificate. The revocation time is after the signature timestamp (TS server is TSA5) | VALID | |
| M | LTA_46 | Signature timestamp is signed by a certificate whose issuer certificate is forged (TS server is TSB) | INVALID | Signature verification details must be shown. |
| M | LTA_47 | Signature timestamp is signed by a valid certificate (TS server is TSC1) | VALID | |
| M | LTA_48 | Signature timestamp is signed by a certificate which references an expired CRL (TS server is TSC2) | INVALID | Signature verification details must be shown. |
| M | LTA_49 | Signature timestamp is signed by a certificate which references a CRL with a forged signature (TS server is TSC3) | INVALID | Signature verification details must be shown. |
| M | LTA_84 | “archiveTimeStamp” has a “TSTInfo” with a forged “messageImprint” field (TS server is TSA1) | INVALID | Signature verification details must be shown. |
| M | LTA_85 | “archiveTimeStamp” has a forged signature (TS server is TSA2) | INVALID | Signature verification details must be shown. |
| M | LTA_86 | “archiveTimeStamp” is signed by an expired certificate (TS server is TSA3) | INVALID | Signature verification details must be shown. |
| M | LTA_87 | “archiveTimeStamp” is signed by an forged certificate (TS server is TSA4) | INVALID | Signature verification details must be shown. |
| M | LTA_88 | “archiveTimeStamp” is signed by a revoked certificate. The revocation time is before the signing time (TS server is TSA5) | INVALID | Signature verification details must be shown. |
| M | LTA_89 | “archiveTimeStamp” is signed by a revoked certificate. The revocation time is after the signature timestamp (TS server is TSA5) | VALID | |
| M | LTA_90 | “archiveTimeStamp” is signed by a certificate whose issuer certificate is forged (TS server is TSB) | INVALID | Signature verification details must be shown. |
| M | LTA_91 | “archiveTimeStamp” is signed by a valid certificate (TS server is TSC1) | VALID | |
| M | LTA_92 | “archiveTimeStamp” is signed by a certificate which references an expired CRL (TS server is TSC2) | INVALID | Signature verification details must be shown. |
| M | LTA_93 | “archiveTimeStamp” is signed by a certificate which references a CRL with a forged signature (TS server is TSC3) | INVALID | Signature verification details must be shown. |
| M | LTA_106 | Signature file whose “archiveTimeStamp” certificate is expired after the signature timestamp | VALID | The signature must be archived. |
| M | LTA_109 | SHA-1 digest algorithm is used in the “archiveTimeStamp” | VALID | The signature must be archived. |
* One of the following methods must be selected when verifying the signed document if the signer certificate includes a monetary limit:
- “INVALID Signature” message must be displayed. The description of the error should be reported to the user.
- The monetary limit of the certificate is compared with the monetary limit of the signed document and if the monetary limit of the certificate is sufficient for the monetary value of the signed document, “VALID Signature” message must be displayed.
- In the case where the monetary limit of the certificate is not compared with the monetary limit of the signed document, the user should be warned that the signer certificate has a monetary limit and “VALID Signature” message must be displayed.
en/pades_lta-type.txt · Last modified: 2023/07/14 13:20
Page Tools
This wiki has been created by TÜBİTAK BİLGEM KAMU SM. All Rights Reserved. Kamu Sertifikasyon Merkezi
