====== Signature Profiles ======

For the detailed information about signature profiles see ''http://www.tk.gov.tr/bilgi_teknolojileri/elektronik_imza/dosyalar/Elektronik_Imza_Kullanim_Profilleri_Rehberi.pdf'' which is also located in ''config/profiller''.

The sample codes are in the package ''tr.gov.tubitak.uekae.esya.api.xades.example.profiles''.

===== P1- Instantenous - Signature Profile  =====

It used in the applications where the security requirement is low and onl an instantenous validation is needed. The signature time is accepted as the time when the signed document is received by the verifier. 
This profile shoul be preferred when no future verification of the signature is required. The sample code is in ''P1''.

<sxh java>
// create context with working directory
Context context = createContext();

// add resolver to resolve policies
context.addExternalResolver(POLICY_RESOLVER);

// create signature according to context,
// with default type (XADES_BES)
XMLSignature signature = new XMLSignature(context);

// add document as reference, but do not embed it
// into the signature (embed=false)
signature.addDocument("./sample.txt", "text/plain", false);

signature.getSignedInfo().setSignatureMethod(SignatureMethod.RSA_SHA256);

// false-true gets non-qualified certificates while true-false gets qualified ones
X509Certificate cert = JSmartCardManager.getInstance().getSignatureCertificate(true, false);

// add certificate to show who signed the document
signature.addKeyInfo(new ECertificate(cert.getEncoded()));

// set time now
signature.setSigningTime(Calendar.getInstance());

// now sign it by using smart card
signature.sign(JSmartCardManager.getInstance().getSigner(PIN, cert));

signature.write(new FileOutputStream(BASE_DIR + SIGNATURE_FILENAME));
</sxh>

This profile does not refer to any defined signature policy.


===== P2 -Short-term- Signature Profile =====

It should be used when signatures have a short life and no OCSP access is available. When OCSP is available, P4 profile should be used. The code is in ''P2''.

<sxh java>
// create context with working directory
Context context = createContext();

// add resolver to resolve policies
context.addExternalResolver(POLICY_RESOLVER);

// create signature according to context,
// with default type (XADES_BES)
XMLSignature signature = new XMLSignature(context);

// add document as reference, but do not embed it
// into the signature (embed=false)
signature.addDocument("./sample.txt", "text/plain", false);

signature.getSignedInfo().setSignatureMethod(SignatureMethod.RSA_SHA256);

// false-true gets non-qualified certificates while true-false gets qualified ones
X509Certificate cert = JSmartCardManager.getInstance().getSignatureCertificate(true, false);

// add certificate to show who signed the document
signature.addKeyInfo(new ECertificate(cert.getEncoded()));

// set time now
signature.setSigningTime(Calendar.getInstance());

// set policy info defined and required by profile
signature.setPolicyIdentifier(OID_POLICY_P2,
		"Kısa Dönemli ve SİL Kontrollü Güvenli Elektronik İmza Politikası",
		"http://www.tk.gov.tr/bilgi_teknolojileri/elektronik_imza/dosyalar/Elektronik_Imza_Kullanim_Profilleri_Rehberi.pdf"
);

// now sign it by using smart card
signature.sign(JSmartCardManager.getInstance().getSigner(PIN, cert));

// upgrade to T
signature.upgrade(SignatureType.ES_T);

signature.write(new FileOutputStream(BASE_DIR + SIGNATURE_FILENAME));
</sxh>

===== P3 -Long-term - Signature Profile =====

It is used if OCSP is not available. Otherwise using P3 has no advantage over using P4 and sould not be preferred due to large CRL sizes and the grace period requirement. The code is in ''P3''.

<sxh java>
// create context with working directory
Context context = createContext();

// add resolver to resolve policies
context.addExternalResolver(POLICY_RESOLVER);

// create signature according to context,
// with default type (XADES_BES)
XMLSignature signature = new XMLSignature(context);

// add document as reference, but do not embed it
// into the signature (embed=false)
signature.addDocument("./sample.txt", "text/plain", false);

signature.getSignedInfo().setSignatureMethod(SignatureMethod.RSA_SHA256);

// false-true gets non-qualified certificates while true-false gets qualified ones
X509Certificate cert = JSmartCardManager.getInstance().getSignatureCertificate(true, false);

// add certificate to show who signed the document
signature.addKeyInfo(new ECertificate(cert.getEncoded()));

// set time now
signature.setSigningTime(Calendar.getInstance());

// set policy info defined and required by profile
signature.setPolicyIdentifier(OID_POLICY_P3,
		"Uzun Dönemli ve SİL Kontrollü Güvenli Elektronik İmza Politikası",
		"http://www.tk.gov.tr/bilgi_teknolojileri/elektronik_imza/dosyalar/Elektronik_Imza_Kullanim_Profilleri_Rehberi.pdf"
);

// now sign it by using smart card
signature.sign(JSmartCardManager.getInstance().getSigner(PIN, cert));

// upgrade to T
signature.upgrade(SignatureType.ES_T);

signature.write(new FileOutputStream(BASE_DIR + "p3_temp.xml"));
</sxh>

İkinci kod yeni bir SİL yayınlandıktan sonra çalıştırılmalıdır.

<sxh java>
// create context with working directory
Context context = createContext();

// set policy such that it only works with CRL
CertValidationPolicies policies = new CertValidationPolicies();
policies.register(null, PolicyReader.readValidationPolicy(POLICY_FILE_CRL));

context.getConfig().getValidationConfig().setCertValidationPolicies(policies);

// add resolver to resolve policies
context.addExternalResolver(POLICY_RESOLVER);

// read temporary signature
XMLSignature signature = XMLSignature.parse(new FileDocument(new File(BASE_DIR + "p3_temp.xml")),context);

// upgrade to XL
signature.upgrade(SignatureType.ES_XL);

signature.write(new FileOutputStream(BASE_DIR + SIGNATURE_FILENAME));
</sxh>

===== P4 - Long-Term - Signature Profile =====

It is the most secure and smooth signature profile having the longest life. The validation data is included in the signature. The code is in ''P4''.

<sxh java>
// create context with working directory
Context context = createContext();

// add resolver to resolve policies
context.addExternalResolver(POLICY_RESOLVER);

// create signature according to context,
// with default type (XADES_BES)
XMLSignature signature = new XMLSignature(context);

// add document as reference, but do not embed it
// into the signature (embed=false)
signature.addDocument("./sample.txt", "text/plain", false);

signature.getSignedInfo().setSignatureMethod(SignatureMethod.RSA_SHA256);

// false-true gets non-qualified certificates while true-false gets qualified ones
X509Certificate cert = JSmartCardManager.getInstance().getSignatureCertificate(true, false);

// add certificate to show who signed the document
signature.addKeyInfo(new ECertificate(cert.getEncoded()));

// set time now
signature.setSigningTime(Calendar.getInstance());

// set policy info defined and required by profile
signature.setPolicyIdentifier(OID_POLICY_P4,
		"Uzun Dönemli ve ÇİSDuP Kontrollü Güvenli Elektronik İmza Politikası",
		"http://www.tk.gov.tr/bilgi_teknolojileri/elektronik_imza/dosyalar/Elektronik_Imza_Kullanim_Profilleri_Rehberi.pdf"
);

// now sign it by using smart card
signature.sign(JSmartCardManager.getInstance().getSigner(PIN, cert));

// upgrade to XL
signature.upgrade(SignatureType.ES_XL);

signature.write(new FileOutputStream(BASE_DIR + SIGNATURE_FILENAME));
</sxh>

===== Archival Signature =====

Before the certificate of the last timestamp in the signature expires or the algorithm used in the signatures are weakened, an archival signature must be added to the signed document In order to get archival signature the method

<sxh java>
signature.upgradeToXAdES_A();
</sxh>

over X-Long (P4) signature, and in order to update an existing archival signature the method  

<sxh java>
signature.addArchiveTimeStamp();
</sxh>

is used.