SIST-TS ETSI/TS 119 172-1 V1.1.1:2016
(Main)Electronic Signatures and Infrastructures (ESI) - Signature Policies - Part 1: Building blocks and table of contents for human readable signature policy documents
Electronic Signatures and Infrastructures (ESI) - Signature Policies - Part 1: Building blocks and table of contents for human readable signature policy documents
The present document defines the building blocks of signature policy and specifies a table of contents for human
readable signature policy documents.
Elektronski podpisi in infrastruktura (ESI) - Podpisna politika - 1. del: Gradniki in kazalo vsebine dokumentov o podpisni politiki, ki jih lahko bere človek
Ta dokument določa gradnike podpisne politike in kazalo vsebine dokumentov o predpisni politiki v čitljivi obliki.
General Information
Buy Standard
Standards Content (Sample)
ETSI TS 119 172-1 V1.1.1 (2015-07)
TECHNICAL SPECIFICATION
Electronic Signatures and Infrastructures (ESI);
Signature Policies;
Part 1: Building blocks and table of contents for human
readable signature policy documents
---------------------- Page: 1 ----------------------
2 ETSI TS 119 172-1 V1.1.1 (2015-07)
Reference
DTS/ESI-0019172-1
Keywords
electronic signature, e-commerce,
trust services
ETSI
650 Route des Lucioles
F-06921 Sophia Antipolis Cedex - FRANCE
Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16
Siret N° 348 623 562 00017 - NAF 742 C
Association à but non lucratif enregistrée à la
Sous-Préfecture de Grasse (06) N° 7803/88
Important notice
The present document can be downloaded from:
http://www.etsi.org/standards-search
The present document may be made available in electronic versions and/or in print. The content of any electronic and/or
print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any
existing or perceived difference in contents between such versions and/or in print, the only prevailing document is the
print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat.
Users of the present document should be aware that the document may be subject to revision or change of status.
Information on the current status of this and other ETSI documents is available at
http://portal.etsi.org/tb/status/status.asp
If you find errors in the present document, please send your comment to one of the following services:
https://portal.etsi.org/People/CommiteeSupportStaff.aspx
Copyright Notification
No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying
and microfilm except as authorized by written permission of ETSI.
The content of the PDF version shall not be modified without the written authorization of ETSI.
The copyright and the foregoing restriction extend to reproduction in all media.
© European Telecommunications Standards Institute 2015.
All rights reserved.
TM TM TM
DECT , PLUGTESTS , UMTS and the ETSI logo are Trade Marks of ETSI registered for the benefit of its Members.
TM
3GPP and LTE™ are Trade Marks of ETSI registered for the benefit of its Members and
of the 3GPP Organizational Partners.
GSM® and the GSM logo are Trade Marks registered and owned by the GSM Association.
ETSI
---------------------- Page: 2 ----------------------
3 ETSI TS 119 172-1 V1.1.1 (2015-07)
Contents
Intellectual Property Rights . 5
Foreword . 5
Modal verbs terminology . 5
Introduction . 5
1 Scope . 7
2 References . 7
2.1 Normative references . 7
2.2 Informative references . 7
3 Definitions and abbreviations . 9
3.1 Definitions . 9
3.2 Abbreviations . 11
4 Signature policies and signature policy document . 12
Annex A (normative): Table of contents for signature policies expressed as human readable
documents . 14
A.1 Introduction . 14
A.1.1 Overview . 14
A.1.2 Business or Application Domain . 14
A.1.2.1 Scope and boundaries of signature policy . 14
A.1.2.2 Domain of applications . 14
A.1.2.3 Transactional context . 14
A.1.3 Document and policy(ies) names, identification and conformance rules . 15
A.1.3.1 Signature policy document and signature policy(ies) names . 15
A.1.3.2 Signature policy document and signature policy(ies) identifier(s) . 15
A.1.3.3 Conformance rules . 15
A.1.3.4 Distribution points . 15
A.1.4 Signature policy document administration . 15
A.1.4.1 Signature policy authority . 15
A.1.4.2 Contact person . 16
A.1.4.3 Approval procedures . 16
A.1.5 Definitions and Acronyms . 16
A.2. Signature application practices statements . 16
A.3 Business scoping parameters . 16
A.3.1 BSPs mainly related to the concerned application/business process . 16
A.3.1.1 BSP (a): Workflow (sequencing and timing) of signatures . 16
A.3.1.2 BSP (b): Data to be signed . 17
A.3.1.3 BSP (c): The relationship between signed data and signature(s) . 18
A.3.1.4 BSP (d): Targeted community . 18
A.3.1.5 BSP (e): Allocation of responsibility for signature validation and augmentation . 18
A.3.2 BSPs mainly influenced by the legal/regulatory provisions associated to the concerned
application/business process . 19
A.3.2.1 BSP (f): Legal type of the signatures . 19
A.3.2.2 BSP (g): Commitment assumed by the signer . 19
A.3.2.3 BSP (h): Level of assurance on timing evidences . 20
A.3.2.4 BSP (i): Formalities of signing . 20
A.3.2.5 BSP (j): Longevity and resilience to change . 21
A.3.2.6 BSP (k): Archival . 21
A.3.3 BSPs mainly related to the actors involved in creating/augmenting/validating signatures . 21
A.3.3.1 BSP (l): Identity (and roles/attributes) of the signers . 21
A.3.3.2 BSP (m): Level of assurance required for the authentication of the signer. 22
A.3.3.3 BSP (n): Signature creation devices. 22
A.3.4 Other BSPs . 22
ETSI
---------------------- Page: 3 ----------------------
4 ETSI TS 119 172-1 V1.1.1 (2015-07)
A.3.4.1 BSP (o): Other information to be associated with the signature . 22
A.3.4.2 BSP (p): Cryptographic suites . 22
A.3.4.3 BSP (q): Technological environment . 23
A.4 Requirements / statements on technical mechanisms and standards implementation . 23
A.4.1 Technical counterparts of BSPs - Statement summary . 23
A.4.2 Input and output constraints for signature creation, augmentation and validation procedures . 25
A.4.2.1 Input constraints to be used when generating, augmenting and/or validating signatures in the context
of the identified signature policy . 25
A.4.2.2 Output constraints to be used when validating signatures in the context of the identified signature
policy . 36
A.4.2.3 Output constraints to be used for generating/augmenting signatures in the context of the identified
signature policy . 36
A.5 Other business and legal matters . 38
A.6 Compliance audit and other assessments . 39
Annex B (normative): Commitment types . 40
Annex C (normative): Constraints in the context of EU legislation . 41
Annex D (normative): Signature application practices statements . 42
D.1 General requirements . 42
D.2 Signature application practices statements . 42
D.2.1 Legal driven policy requirements . 42
D.2.2 Information security (management system) requirements . 42
D.2.3 Signature Creation and Signature Validation processes requirements . 43
D.2.4 Development & coding policy requirements . 43
D.2.5 General requirements . 44
History . 45
ETSI
---------------------- Page: 4 ----------------------
5 ETSI TS 119 172-1 V1.1.1 (2015-07)
Intellectual Property Rights
IPRs essential or potentially essential to the present document may have been declared to ETSI. The information
pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found
in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in
respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web
server (http://ipr.etsi.org).
Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee
can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web
server) which are, or may be, or may become, essential to the present document.
Foreword
This Technical Specification (TS) has been produced by ETSI Technical Committee Electronic Signatures and
Infrastructures (ESI).
The present document is part 1 of a multi-part deliverable specifying Signature Policies as identified below:
Part 1: "Building blocks and table of contents for human readable signature policy documents";
Part 2: "XML Format for signature policies";
Part 3: "ASN.1 Format for signature policies";
Part 4: "Signature validation policy for European qualified electronic signatures/seals using trusted lists".
Modal verbs terminology
In the present document "shall", "shall not", "should", "should not", "may", "need not", "will", "will not", "can" and
"cannot" are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of
provisions).
"must" and "must not" are NOT allowed in ETSI deliverables except when used in direct citation.
Introduction
A digital signature is always used in a context, either implicit or explicit, e.g. as part of a business process.
That context can impose various types of requirements such as requirements related to the application and/or the
business process for which implementation of a digital signature is required (e.g. which document(s)/data, in which
steps of the business process one would need to sign and how):
• requirements influenced by legal provisions associated to the application and/or business context in which the
business process takes place (e.g. the level of assurance on evidences and the longevity of such evidences);
• requirements on the actors involved in the creation/validation of signatures; and/or
• requirements linked to the technological environment in which the process takes place.
NOTE 1: Regulation (EU) No 910/2014 [i.1] defines the terms electronic signature, advanced electronic signature,
qualified electronic signature, electronic seal, advanced electronic seal and qualified electronic seal.
These electronic signatures and seals can be created using digital signature technology.
NOTE 2: When not stated otherwise in the present document, "signature" denotes "digital signature".
ETSI
---------------------- Page: 5 ----------------------
6 ETSI TS 119 172-1 V1.1.1 (2015-07)
Implementing digital signatures into a business process very often implies considering more than one signature to make
a transaction effective or to give legal validity to one or several documents. Those signatures can be parallel and
independent over the content (e.g. such as those of a buyer and seller on a contract); or enveloping countersignatures
where each countersignature covers both content and all previous signature(s); or not-enveloping countersignatures
where each countersignature covers previous signature(s) but not the previously signed content; or a mix of such
signatures. Since very complex situations can arise when considering multiple signatures, specific requirements on their
sequencing and respective scope in terms of data to be signed needs to be considered to ensure their correct
implementation into the concerned work-flow.
There needs to be some way of expressing all applicable requirements into rules for creating, augmenting, and
validating a single signature or a set of signatures in the context in which that(these) signature(s) have been applied so
that the concerned parties, signers and relying parties, can abide by the applicable rules.
The purpose of a signature policy is to describe the requirements imposed on or committing the involved actors
(signers, verifiers, relying parties and/or potentially one or more trust service providers) with respect to the application
of signatures to documents and data that will be signed in a particular context, transaction, process, business or
application domain, in order for these signatures to be considered as valid or conformant signatures under this signature
policy.
The establishment of such rules into a signature policy results from the need:
• to document the decisions resulting from an analysis driven by a business or application context on how the
concerned signature(s) needs to be implemented to meet the needs of the specific business application or
electronic process it(they) support; and
• to specify the means for the creation, augmentation or long term management and verification of all the
features of the concerned signature(s).
ETSI
---------------------- Page: 6 ----------------------
7 ETSI TS 119 172-1 V1.1.1 (2015-07)
1 Scope
The present document defines the building blocks of signature policy and specifies a table of contents for human
readable signature policy documents.
2 References
2.1 Normative references
References are either specific (identified by date of publication and/or edition number or version number) or
non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the
reference document (including any amendments) applies.
Referenced documents which are not found to be publicly available in the expected location might be found at
http://docbox.etsi.org/Reference.
NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee
their long term validity.
The following referenced documents are necessary for the application of the present document.
[1] ETSI EN 319 142-1: "Electronic Signatures and Infrastructures (ESI); PAdES digital signatures;
Part 1: Building blocks and PAdES baseline signatures".
[2] ISO 19005-2:2011: "Document management - Electronic document file format for long-term
preservation - Part 2: Use of ISO 32000-1 (PDF/A-2)".
[3] ETSI TS 103 172: "Electronic Signatures and Infrastructures (ESI); PAdES Baseline Profile".
2.2 Informative references
References are either specific (identified by date of publication and/or edition number or version number) or
non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the
reference document (including any amendments) applies.
NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee
their long term validity.
The following referenced documents are not necessary for the application of the present document but they assist the
user with regard to a particular subject area.
[i.1] Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic
identification and trust services for electronic transactions in the internal market and repealing
Directive 1999/93/EC.
[i.2] ETSI TR 119 001: "Electronic Signatures and Infrastructures (ESI); The framework for
standardisation of signatures; Definitions and abbreviations".
[i.3] ETSI TR 119 100: "Electronic Signatures and Infrastructures (ESI); Business Driven Guidance for
Signature Creation and Validation".
[i.4] ETSI EN 319 102-1: "Electronic Signatures and Infrastructures (ESI); Procedures for Signature
Creation and Validation of AdES Digital Signatures; Part 1: Creation and Validation".
[i.5] ETSI TS 119 312: "Electronic Signatures and Infrastructures (ESI); Cryptographic Suites".
[i.6] ISO/IEC 27001: "Information technology -- Security techniques -- Information security
management systems -- Requirements".
[i.7] ISO/IEC 27002: "Information technology -- Security techniques -- Code of practice for
information security management".
[i.8] ETSI TS 103 173: "Electronic Signatures and Infrastructures (ESI); CAdES Baseline Profile".
ETSI
---------------------- Page: 7 ----------------------
8 ETSI TS 119 172-1 V1.1.1 (2015-07)
[i.9] ETSI TS 103 171: "Electronic Signatures and Infrastructures (ESI); XAdES Baseline Profile".
[i.10] Unified Modelling Language.
NOTE: Available at http://www.uml.org/#UML2.0.
[i.11] ETSI TS 102 231: "Electronic Signatures and Infrastructures (ESI); Provision of harmonized
Trust-service status information".
[i.12] ETSI TS 119 612 (V1.1.1): "Electronic Signatures and Infrastructures (ESI); Trusted Lists".
[i.13] IETF RFC 5280: "internet X.509 Public Key Infrastructure Certificate and Certificate Revocation
List (CRL) Profile".
[i.14] IETF RFC 6960: "X.509 Internet Public Key Infrastructure Online Certificate Status Protocol -
OCSP".
[i.15] Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a
Community framework for electronic signatures.
[i.16] Commission Decision 2009/767/EC of 16 October 2009 setting out measures facilitating the use of
procedures by electronic means through the 'points of single contact' under Directive 2006/123/EC
of the European Parliament and of the Council on services in the internal market.
[i.17] Commission Decision 2013/662/EU of 14 October 2013 amending Decision 2009/767/EC as
regards the establishment, maintenance and publication of trusted lists of certification service
providers supervised/accredited by Member States.
[i.18] Commission Decision 2011/130/EU of 25 February 2011 establishing minimum requirements for
the cross-border processing of documents signed electronically by competent authorities under
Directive 2006/123/EC of the European Parliament and of the Council on services in the internal
market.
[i.19] Business Process Modelling Notation: "A standard for modelling business processes and web
service processes, as put forth by the Business Process Management Initiative".
NOTE: Available at www.bpmi.org.
[i.20] ETSI EN 319 122-1: "Electronic Signatures and Infrastructures (ESI); CAdES digital signatures;
Part 1: Building blocks and CAdES baseline signatures".
[i.21] ETSI EN 319 132-1: "Electronic Signatures and Infrastructures (ESI); XAdES digital signatures;
Part 1: Building blocks and XAdES baseline signatures".
[i.22] ETSI EN 319 122-2: "Electronic Signatures and Infrastructures (ESI); CAdES digital signatures;
Part 2: Extended CAdES signatures".
[i.23] ETSI EN 319 132-2: "Electronic Signatures and Infrastructures (ESI); XAdES digital signatures;
Part 2: Extended XAdES signatures".
[i.24] IETF RFC 3647: "Internet X.509 Public Key Infrastructure Certificate Policy and Certification
Practices Framework".
[i.25] ETSI EN 319 142-2: "Electronic Signatures and Infrastructures (ESI); PAdES digital signatures;
Part 2: Additional PAdES signatures profiles".
[i.26] ETSI EN 319 162-1: "Electronic Signatures and Infrastructures (ESI); Associated Signature
Containers (ASiC); Part 1: Building blocks and ASiC Baseline containers".
[i.27] ETSI EN 319 162-2: "Electronic Signatures and Infrastructures (ESI); Associated Signature
Containers (ASiC); Part 2: Extended Containers".
[i.28] ETSI TS 102 918: "Electronic Signatures and Infrastructures (ESI); Associated Signature
Containers (ASiC)".
ETSI
---------------------- Page: 8 ----------------------
9 ETSI TS 119 172-1 V1.1.1 (2015-07)
[i.29] Commission Implementing Decision 2014/148/EU of 17 March 2014 amending Decision
2011/130/EU establishing minimum requirements for the cross-border processing of documents
signed electronically by competent authorities under Directive 2006/123/EC of the European
Parliament and of the Council on services in the internal market.
[i.30] ETSI TS 119 172-2: "Electronic Signature Infrastructure; Signature Policies; Part 2: XML format
for signature policies".
[i.31] ETSI TS 119 172-3: "Electronic Signature Infrastructure; Signature Policies; Part 3: ASN.1 format
for signature policies".
[i.32] Commission Decision 2010/425/EU of 28 July 2010 amending Decision 2009/767/EC as regards
the establishment, maintenance and publication of trusted lists of certification service providers
supervised/accredited by Member States.
[i.33] ETSI TS 101 733: "Electronic Signatures and Infrastructures (ESI); CMS Advanced Electronic
Signatures (CAdES)".
[i.34] ETSI TS 101 903: "Electronic Signatures and Infrastructures (ESI); XML Advanced Electronic
Signatures (XAdES)".
[i.35] ETSI TS 102 778: "Electronic Signatures and Infrastructures (ESI); PDF Advanced Electronic
Signature Profiles; CMS Profile based on ISO 32000-1".
[i.36] Recommendation CCITT X.800 (1991): "Security Architecture for Open Systems Interconnection
for CCITT applications. ISO 7498-2:1989, Information processing systems - Open Systems
Interconnection - Basic Reference Model - Part 2: Security Architecture".
[i.37] Recommendation ITU-T X.1252 (2010): "Cyberspace security - Identity management - Baseline
identity management terms and definitions".
[i.38] Recommendation ITU-T X.509 | ISO/IEC 9594-8: "Information technology - Open systems
interconnection - The Directory: Public-key and attribute certificate frameworks".
3 Definitions and abbreviations
3.1 Definitions
For the purposes of the present document, the following terms and definitions apply:
CA-certificate: public-key certificate for one CA issued by another CA or by the same CA
NOTE: As defined in Recommendation ITU-T X.509 | ISO/IEC 9594-8 [i.38].
certification authority (CA): authority trusted by one or more users to create and assign public-key certificates.
Optionally the certification authority may create the subjects' keys
NOTE: As defined in Recommendation ITU-T X.509 | ISO/IEC 9594-8 [i.38].
certification path: ordered list of one or more public-key certificates, starting with a public-key certificate signed by
the trust anchor, and ending with the public key certificate to be validated
NOTE 1: All intermediate public-key certificates, if any, are CA-certificates in which the subject of the preceding
certificate is the issuer of the following certificate.
NOTE 2: As defined in Recommendation ITU-T X.509 | ISO/IEC 9594-8 [i.38].
certificate validation: process of verifying and confirming that a certificate is valid
cryptographic system: collection of transformations, normally defined by a mathematical algorithm, from plain text
into cipher text and vice versa, the particular transformation(s) to be used being selected by (private or public) keys
NOTE: As defined in Recommendation ITU-T X.509 | ISO/IEC 9594-8 [i.38].
ETSI
---------------------- Page: 9 ----------------------
10 ETSI TS 119 172-1 V1.1.1 (2015-07)
data integrity: property that data has not been altered or destroyed in an unauthorized manner
NOTE: As defined in ITU-TRecommendation X.800 | ISO 7498-2 [i.36].
data origin authentication: corroboration that the source of data received is as claimed
NOTE: As defined in ITU-TRecommendation X.800 | ISO 7498-2 [i.36].
digital signature: data appended to, or a cryptographic transformation (see cryptography) of a data unit that allows a
recipient of the data unit to prove the source and integrity of the data unit and protect against forgery e.g. by the
recipient.
NOTE: As defined in ITU-TRecommendation X.800 | ISO 7498-2 [i.36].
private key: in a public key cryptographic system, that key of an entity's key pair which is known only by that entity
NOTE: As defined in Recommendation ITU-T X.509 | ISO/IEC 9594-8 [i.38].
public key: in a public key cryptographic system, that key of an entity's key pair which is publicly known.
NOTE: As defined in Recommendation ITU-T X.509 | ISO/IEC 9594-8 [i.38].
public key certificate: public key of an entity, together with some other information, rendered unforgeable by digital
signature with the private key of the certification authority which issued it
NOTE: As defined in Recommendation ITU-T X.509 | ISO/IEC 9594-8 [i.38].
public key infrastructure: infrastructure able to su
...
SLOVENSKI STANDARD
SIST-TS ETSI/TS 119 172-1 V1.1.1:2016
01-junij-2016
(OHNWURQVNLSRGSLVLLQLQIUDVWUXNWXUD (6, 3RGSLVQDSROLWLNDGHO *UDGQLNLLQ
ND]DORYVHELQHGRNXPHQWRYRSRGSLVQLSROLWLNLNLMLKODKNREHUHþORYHN
Electronic Signatures and Infrastructures (ESI) - Signature Policies - Part 1: Building
blocks and table of contents for human readable signature policy documents
Ta slovenski standard je istoveten z: ETSI TS 119 172-1 V1.1.1 (2015-07)
ICS:
35.040.01 Kodiranje informacij na Information coding in general
splošno
SIST-TS ETSI/TS 119 172-1 V1.1.1:2016 en
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.
---------------------- Page: 1 ----------------------
SIST-TS ETSI/TS 119 172-1 V1.1.1:2016
---------------------- Page: 2 ----------------------
SIST-TS ETSI/TS 119 172-1 V1.1.1:2016
ETSI TS 119 172-1 V1.1.1 (2015-07)
TECHNICAL SPECIFICATION
Electronic Signatures and Infrastructures (ESI);
Signature Policies;
Part 1: Building blocks and table of contents for human
readable signature policy documents
---------------------- Page: 3 ----------------------
SIST-TS ETSI/TS 119 172-1 V1.1.1:2016
2 ETSI TS 119 172-1 V1.1.1 (2015-07)
Reference
DTS/ESI-0019172-1
Keywords
electronic signature, e-commerce,
trust services
ETSI
650 Route des Lucioles
F-06921 Sophia Antipolis Cedex - FRANCE
Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16
Siret N° 348 623 562 00017 - NAF 742 C
Association à but non lucratif enregistrée à la
Sous-Préfecture de Grasse (06) N° 7803/88
Important notice
The present document can be downloaded from:
http://www.etsi.org/standards-search
The present document may be made available in electronic versions and/or in print. The content of any electronic and/or
print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any
existing or perceived difference in contents between such versions and/or in print, the only prevailing document is the
print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat.
Users of the present document should be aware that the document may be subject to revision or change of status.
Information on the current status of this and other ETSI documents is available at
http://portal.etsi.org/tb/status/status.asp
If you find errors in the present document, please send your comment to one of the following services:
https://portal.etsi.org/People/CommiteeSupportStaff.aspx
Copyright Notification
No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying
and microfilm except as authorized by written permission of ETSI.
The content of the PDF version shall not be modified without the written authorization of ETSI.
The copyright and the foregoing restriction extend to reproduction in all media.
© European Telecommunications Standards Institute 2015.
All rights reserved.
TM TM TM
DECT , PLUGTESTS , UMTS and the ETSI logo are Trade Marks of ETSI registered for the benefit of its Members.
TM
3GPP and LTE™ are Trade Marks of ETSI registered for the benefit of its Members and
of the 3GPP Organizational Partners.
GSM® and the GSM logo are Trade Marks registered and owned by the GSM Association.
ETSI
---------------------- Page: 4 ----------------------
SIST-TS ETSI/TS 119 172-1 V1.1.1:2016
3 ETSI TS 119 172-1 V1.1.1 (2015-07)
Contents
Intellectual Property Rights . 5
Foreword . 5
Modal verbs terminology . 5
Introduction . 5
1 Scope . 7
2 References . 7
2.1 Normative references . 7
2.2 Informative references . 7
3 Definitions and abbreviations . 9
3.1 Definitions . 9
3.2 Abbreviations . 11
4 Signature policies and signature policy document . 12
Annex A (normative): Table of contents for signature policies expressed as human readable
documents . 14
A.1 Introduction . 14
A.1.1 Overview . 14
A.1.2 Business or Application Domain . 14
A.1.2.1 Scope and boundaries of signature policy . 14
A.1.2.2 Domain of applications . 14
A.1.2.3 Transactional context . 14
A.1.3 Document and policy(ies) names, identification and conformance rules . 15
A.1.3.1 Signature policy document and signature policy(ies) names . 15
A.1.3.2 Signature policy document and signature policy(ies) identifier(s) . 15
A.1.3.3 Conformance rules . 15
A.1.3.4 Distribution points . 15
A.1.4 Signature policy document administration . 15
A.1.4.1 Signature policy authority . 15
A.1.4.2 Contact person . 16
A.1.4.3 Approval procedures . 16
A.1.5 Definitions and Acronyms . 16
A.2. Signature application practices statements . 16
A.3 Business scoping parameters . 16
A.3.1 BSPs mainly related to the concerned application/business process . 16
A.3.1.1 BSP (a): Workflow (sequencing and timing) of signatures . 16
A.3.1.2 BSP (b): Data to be signed . 17
A.3.1.3 BSP (c): The relationship between signed data and signature(s) . 18
A.3.1.4 BSP (d): Targeted community . 18
A.3.1.5 BSP (e): Allocation of responsibility for signature validation and augmentation . 18
A.3.2 BSPs mainly influenced by the legal/regulatory provisions associated to the concerned
application/business process . 19
A.3.2.1 BSP (f): Legal type of the signatures . 19
A.3.2.2 BSP (g): Commitment assumed by the signer . 19
A.3.2.3 BSP (h): Level of assurance on timing evidences . 20
A.3.2.4 BSP (i): Formalities of signing . 20
A.3.2.5 BSP (j): Longevity and resilience to change . 21
A.3.2.6 BSP (k): Archival . 21
A.3.3 BSPs mainly related to the actors involved in creating/augmenting/validating signatures . 21
A.3.3.1 BSP (l): Identity (and roles/attributes) of the signers . 21
A.3.3.2 BSP (m): Level of assurance required for the authentication of the signer. 22
A.3.3.3 BSP (n): Signature creation devices. 22
A.3.4 Other BSPs . 22
ETSI
---------------------- Page: 5 ----------------------
SIST-TS ETSI/TS 119 172-1 V1.1.1:2016
4 ETSI TS 119 172-1 V1.1.1 (2015-07)
A.3.4.1 BSP (o): Other information to be associated with the signature . 22
A.3.4.2 BSP (p): Cryptographic suites . 22
A.3.4.3 BSP (q): Technological environment . 23
A.4 Requirements / statements on technical mechanisms and standards implementation . 23
A.4.1 Technical counterparts of BSPs - Statement summary . 23
A.4.2 Input and output constraints for signature creation, augmentation and validation procedures . 25
A.4.2.1 Input constraints to be used when generating, augmenting and/or validating signatures in the context
of the identified signature policy . 25
A.4.2.2 Output constraints to be used when validating signatures in the context of the identified signature
policy . 36
A.4.2.3 Output constraints to be used for generating/augmenting signatures in the context of the identified
signature policy . 36
A.5 Other business and legal matters . 38
A.6 Compliance audit and other assessments . 39
Annex B (normative): Commitment types . 40
Annex C (normative): Constraints in the context of EU legislation . 41
Annex D (normative): Signature application practices statements . 42
D.1 General requirements . 42
D.2 Signature application practices statements . 42
D.2.1 Legal driven policy requirements . 42
D.2.2 Information security (management system) requirements . 42
D.2.3 Signature Creation and Signature Validation processes requirements . 43
D.2.4 Development & coding policy requirements . 43
D.2.5 General requirements . 44
History . 45
ETSI
---------------------- Page: 6 ----------------------
SIST-TS ETSI/TS 119 172-1 V1.1.1:2016
5 ETSI TS 119 172-1 V1.1.1 (2015-07)
Intellectual Property Rights
IPRs essential or potentially essential to the present document may have been declared to ETSI. The information
pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found
in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in
respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web
server (http://ipr.etsi.org).
Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee
can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web
server) which are, or may be, or may become, essential to the present document.
Foreword
This Technical Specification (TS) has been produced by ETSI Technical Committee Electronic Signatures and
Infrastructures (ESI).
The present document is part 1 of a multi-part deliverable specifying Signature Policies as identified below:
Part 1: "Building blocks and table of contents for human readable signature policy documents";
Part 2: "XML Format for signature policies";
Part 3: "ASN.1 Format for signature policies";
Part 4: "Signature validation policy for European qualified electronic signatures/seals using trusted lists".
Modal verbs terminology
In the present document "shall", "shall not", "should", "should not", "may", "need not", "will", "will not", "can" and
"cannot" are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of
provisions).
"must" and "must not" are NOT allowed in ETSI deliverables except when used in direct citation.
Introduction
A digital signature is always used in a context, either implicit or explicit, e.g. as part of a business process.
That context can impose various types of requirements such as requirements related to the application and/or the
business process for which implementation of a digital signature is required (e.g. which document(s)/data, in which
steps of the business process one would need to sign and how):
• requirements influenced by legal provisions associated to the application and/or business context in which the
business process takes place (e.g. the level of assurance on evidences and the longevity of such evidences);
• requirements on the actors involved in the creation/validation of signatures; and/or
• requirements linked to the technological environment in which the process takes place.
NOTE 1: Regulation (EU) No 910/2014 [i.1] defines the terms electronic signature, advanced electronic signature,
qualified electronic signature, electronic seal, advanced electronic seal and qualified electronic seal.
These electronic signatures and seals can be created using digital signature technology.
NOTE 2: When not stated otherwise in the present document, "signature" denotes "digital signature".
ETSI
---------------------- Page: 7 ----------------------
SIST-TS ETSI/TS 119 172-1 V1.1.1:2016
6 ETSI TS 119 172-1 V1.1.1 (2015-07)
Implementing digital signatures into a business process very often implies considering more than one signature to make
a transaction effective or to give legal validity to one or several documents. Those signatures can be parallel and
independent over the content (e.g. such as those of a buyer and seller on a contract); or enveloping countersignatures
where each countersignature covers both content and all previous signature(s); or not-enveloping countersignatures
where each countersignature covers previous signature(s) but not the previously signed content; or a mix of such
signatures. Since very complex situations can arise when considering multiple signatures, specific requirements on their
sequencing and respective scope in terms of data to be signed needs to be considered to ensure their correct
implementation into the concerned work-flow.
There needs to be some way of expressing all applicable requirements into rules for creating, augmenting, and
validating a single signature or a set of signatures in the context in which that(these) signature(s) have been applied so
that the concerned parties, signers and relying parties, can abide by the applicable rules.
The purpose of a signature policy is to describe the requirements imposed on or committing the involved actors
(signers, verifiers, relying parties and/or potentially one or more trust service providers) with respect to the application
of signatures to documents and data that will be signed in a particular context, transaction, process, business or
application domain, in order for these signatures to be considered as valid or conformant signatures under this signature
policy.
The establishment of such rules into a signature policy results from the need:
• to document the decisions resulting from an analysis driven by a business or application context on how the
concerned signature(s) needs to be implemented to meet the needs of the specific business application or
electronic process it(they) support; and
• to specify the means for the creation, augmentation or long term management and verification of all the
features of the concerned signature(s).
ETSI
---------------------- Page: 8 ----------------------
SIST-TS ETSI/TS 119 172-1 V1.1.1:2016
7 ETSI TS 119 172-1 V1.1.1 (2015-07)
1 Scope
The present document defines the building blocks of signature policy and specifies a table of contents for human
readable signature policy documents.
2 References
2.1 Normative references
References are either specific (identified by date of publication and/or edition number or version number) or
non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the
reference document (including any amendments) applies.
Referenced documents which are not found to be publicly available in the expected location might be found at
http://docbox.etsi.org/Reference.
NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee
their long term validity.
The following referenced documents are necessary for the application of the present document.
[1] ETSI EN 319 142-1: "Electronic Signatures and Infrastructures (ESI); PAdES digital signatures;
Part 1: Building blocks and PAdES baseline signatures".
[2] ISO 19005-2:2011: "Document management - Electronic document file format for long-term
preservation - Part 2: Use of ISO 32000-1 (PDF/A-2)".
[3] ETSI TS 103 172: "Electronic Signatures and Infrastructures (ESI); PAdES Baseline Profile".
2.2 Informative references
References are either specific (identified by date of publication and/or edition number or version number) or
non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the
reference document (including any amendments) applies.
NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee
their long term validity.
The following referenced documents are not necessary for the application of the present document but they assist the
user with regard to a particular subject area.
[i.1] Regulation (EU) No 910/2014 of the European Parliament and of the Council on electronic
identification and trust services for electronic transactions in the internal market and repealing
Directive 1999/93/EC.
[i.2] ETSI TR 119 001: "Electronic Signatures and Infrastructures (ESI); The framework for
standardisation of signatures; Definitions and abbreviations".
[i.3] ETSI TR 119 100: "Electronic Signatures and Infrastructures (ESI); Business Driven Guidance for
Signature Creation and Validation".
[i.4] ETSI EN 319 102-1: "Electronic Signatures and Infrastructures (ESI); Procedures for Signature
Creation and Validation of AdES Digital Signatures; Part 1: Creation and Validation".
[i.5] ETSI TS 119 312: "Electronic Signatures and Infrastructures (ESI); Cryptographic Suites".
[i.6] ISO/IEC 27001: "Information technology -- Security techniques -- Information security
management systems -- Requirements".
[i.7] ISO/IEC 27002: "Information technology -- Security techniques -- Code of practice for
information security management".
[i.8] ETSI TS 103 173: "Electronic Signatures and Infrastructures (ESI); CAdES Baseline Profile".
ETSI
---------------------- Page: 9 ----------------------
SIST-TS ETSI/TS 119 172-1 V1.1.1:2016
8 ETSI TS 119 172-1 V1.1.1 (2015-07)
[i.9] ETSI TS 103 171: "Electronic Signatures and Infrastructures (ESI); XAdES Baseline Profile".
[i.10] Unified Modelling Language.
NOTE: Available at http://www.uml.org/#UML2.0.
[i.11] ETSI TS 102 231: "Electronic Signatures and Infrastructures (ESI); Provision of harmonized
Trust-service status information".
[i.12] ETSI TS 119 612 (V1.1.1): "Electronic Signatures and Infrastructures (ESI); Trusted Lists".
[i.13] IETF RFC 5280: "internet X.509 Public Key Infrastructure Certificate and Certificate Revocation
List (CRL) Profile".
[i.14] IETF RFC 6960: "X.509 Internet Public Key Infrastructure Online Certificate Status Protocol -
OCSP".
[i.15] Directive 1999/93/EC of the European Parliament and of the Council of 13 December 1999 on a
Community framework for electronic signatures.
[i.16] Commission Decision 2009/767/EC of 16 October 2009 setting out measures facilitating the use of
procedures by electronic means through the 'points of single contact' under Directive 2006/123/EC
of the European Parliament and of the Council on services in the internal market.
[i.17] Commission Decision 2013/662/EU of 14 October 2013 amending Decision 2009/767/EC as
regards the establishment, maintenance and publication of trusted lists of certification service
providers supervised/accredited by Member States.
[i.18] Commission Decision 2011/130/EU of 25 February 2011 establishing minimum requirements for
the cross-border processing of documents signed electronically by competent authorities under
Directive 2006/123/EC of the European Parliament and of the Council on services in the internal
market.
[i.19] Business Process Modelling Notation: "A standard for modelling business processes and web
service processes, as put forth by the Business Process Management Initiative".
NOTE: Available at www.bpmi.org.
[i.20] ETSI EN 319 122-1: "Electronic Signatures and Infrastructures (ESI); CAdES digital signatures;
Part 1: Building blocks and CAdES baseline signatures".
[i.21] ETSI EN 319 132-1: "Electronic Signatures and Infrastructures (ESI); XAdES digital signatures;
Part 1: Building blocks and XAdES baseline signatures".
[i.22] ETSI EN 319 122-2: "Electronic Signatures and Infrastructures (ESI); CAdES digital signatures;
Part 2: Extended CAdES signatures".
[i.23] ETSI EN 319 132-2: "Electronic Signatures and Infrastructures (ESI); XAdES digital signatures;
Part 2: Extended XAdES signatures".
[i.24] IETF RFC 3647: "Internet X.509 Public Key Infrastructure Certificate Policy and Certification
Practices Framework".
[i.25] ETSI EN 319 142-2: "Electronic Signatures and Infrastructures (ESI); PAdES digital signatures;
Part 2: Additional PAdES signatures profiles".
[i.26] ETSI EN 319 162-1: "Electronic Signatures and Infrastructures (ESI); Associated Signature
Containers (ASiC); Part 1: Building blocks and ASiC Baseline containers".
[i.27] ETSI EN 319 162-2: "Electronic Signatures and Infrastructures (ESI); Associated Signature
Containers (ASiC); Part 2: Extended Containers".
[i.28] ETSI TS 102 918: "Electronic Signatures and Infrastructures (ESI); Associated Signature
Containers (ASiC)".
ETSI
---------------------- Page: 10 ----------------------
SIST-TS ETSI/TS 119 172-1 V1.1.1:2016
9 ETSI TS 119 172-1 V1.1.1 (2015-07)
[i.29] Commission Implementing Decision 2014/148/EU of 17 March 2014 amending Decision
2011/130/EU establishing minimum requirements for the cross-border processing of documents
signed electronically by competent authorities under Directive 2006/123/EC of the European
Parliament and of the Council on services in the internal market.
[i.30] ETSI TS 119 172-2: "Electronic Signature Infrastructure; Signature Policies; Part 2: XML format
for signature policies".
[i.31] ETSI TS 119 172-3: "Electronic Signature Infrastructure; Signature Policies; Part 3: ASN.1 format
for signature policies".
[i.32] Commission Decision 2010/425/EU of 28 July 2010 amending Decision 2009/767/EC as regards
the establishment, maintenance and publication of trusted lists of certification service providers
supervised/accredited by Member States.
[i.33] ETSI TS 101 733: "Electronic Signatures and Infrastructures (ESI); CMS Advanced Electronic
Signatures (CAdES)".
[i.34] ETSI TS 101 903: "Electronic Signatures and Infrastructures (ESI); XML Advanced Electronic
Signatures (XAdES)".
[i.35] ETSI TS 102 778: "Electronic Signatures and Infrastructures (ESI); PDF Advanced Electronic
Signature Profiles; CMS Profile based on ISO 32000-1".
[i.36] Recommendation CCITT X.800 (1991): "Security Architecture for Open Systems Interconnection
for CCITT applications. ISO 7498-2:1989, Information processing systems - Open Systems
Interconnection - Basic Reference Model - Part 2: Security Architecture".
[i.37] Recommendation ITU-T X.1252 (2010): "Cyberspace security - Identity management - Baseline
identity management terms and definitions".
[i.38] Recommendation ITU-T X.509 | ISO/IEC 9594-8: "Information technology - Open systems
interconnection - The Directory: Public-key and attribute certificate frameworks".
3 Definitions and abbreviations
3.1 Definitions
For the purposes of the present document, the following terms and definitions apply:
CA-certificate: public-key certificate for one CA issued by another CA or by the same CA
NOTE: As defined in Recommendation ITU-T X.509 | ISO/IEC 9594-8 [i.38].
certification authority (CA): authority trusted by one or more users to create and assign public-key certificates.
Optionally the certification authority may create the subjects' keys
NOTE: As defined in Recommendation ITU-T X.509 | ISO/IEC 9594-8 [i.38].
certification path: ordered list of one or more public-key certificates, starting with a public-key certificate signed by
the trust anchor, and ending with the public key certificate to be validated
NOTE 1: All intermediate public-key certificates, if any, are CA-certificates in which the subject of the preceding
certificate is the issuer of the following certificate.
NOTE 2: As defined in Recommendation ITU-T X.509 | ISO/IEC 9594-8 [i.38].
certificate validation: process of verifying and confirming that a certificate is valid
cryptographic system: collection of transformations, normally defined by a mathematical algorithm, from plain text
into cipher text and vice versa, the particular transformation(s) to be used being selected by (private or public) keys
NOTE: As defined in Recommendation ITU-T X.509 | ISO/IEC 9594-8 [i.38].
ETSI
---------------------- Page: 11 ----------------------
SIST-TS ETSI/TS 119 172-1 V1.1.1:2016
10 ETSI TS 119 172-1 V1.1.1 (2015-07)
data integrity: property that data has not been altered or destroyed in
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.