SIST EN 319 162-1 V1.1.1:2016
(Main)Electronic Signatures and Infrastructures (ESI) - Associated Signature Containers (ASiC) - Part 1: Building blocks and ASiC baseline containers
Electronic Signatures and Infrastructures (ESI) - Associated Signature Containers (ASiC) - Part 1: Building blocks and ASiC baseline containers
The present document specifies Associated Signature Containers (ASiC) which bind together into one single digital
container based on ZIP [5] either detached digital signatures or time assertions, with a number of file objects
(e.g. documents, XML structured data, spreadsheet, multimedia content) to which they apply.
The present document specifies general purpose ASiC containers building blocks and a limited set of baseline
containers.
ASiC supports the following signature and time assertion formats:
• CAdES object incorporating CAdES signatures (ETSI EN 319 122-1 [1] and ETSI EN 319 122-2 [11]);
• XAdES signatures (ETSI EN 319 132-1 [2] and ETSI EN 319 132-2 [12]);
• IETF RFC 3161 [3] and updated by IETF RFC 5816 [13] time-stamp tokens; and
• IETF RFC 4998 [8] or IETF RFC 6283 [9] evidence records.
NOTE 1: No restriction is placed on time assertions eventually used within CAdES signatures or XAdES
signatures.
The building blocks defined in the present document support additional features not supported by the aforementioned
formats, such as time-stamping and CAdES signing of multiple content and XAdES parallel signatures, that can be used
in other contexts.
The present document defines baseline containers which provide the basic features necessary for a wide range of
business and governmental use cases for electronic procedures and communications to be applicable to a wide range of
communities when there is a clear need for interoperability.
The present document aims at supporting associated signature containers in different regulatory frameworks.
NOTE 2: Specifically, but not exclusively, ASiC Associated Signature Containers specified in the present
document aim at supporting electronic signature and electronic seal as per Regulation (EU)
No 910/2014 [i.3].
The present document defines four levels of ASiC baseline containers addressing incremental requirements to maintain
the availability and integrity of the containers over the long term, suitably profiled for reducing the optionality as much
as possible, in a way that a certain level always addresses all the requirements already addressed at levels that are below
it.
The present document does not address the identification of the validation policy to be used for verifying a container
that contains time assertions.
Elektronski podpisi in infrastruktura (ESI) - Pripadajoči vsebniki podpisov (ASiC) - 1. del: Gradniki in izhodiščni vsebniki ASiC
Ta dokument določa pripadajoče vsebnike podpisov (ASiC), ki se povezujejo v en sam digitalni vsebnik na podlagi ZIP [5] (samostojni digitalni podpisi ali časovne izjave) s številom datotečnih objektov (npr. dokumenti, strukturirani podatki XML, preglednica, večpredstavnostna vsebina), za katere se uporabljajo.
Ta dokument določa gradnike vsebnikov ASiC za splošno uporabo in omejen nabor izhodiščnih vsebnikov.
Vsebnik ASiC podpira naslednje formate podpisov in časovnih izjav:
• objekt CAdES, ki vsebuje podpise CAdES (ETSI EN 319 122-1 [1] in ETSI EN 319 122-2 [11]);
• podpisi XAdES (ETSI EN 319 132-1 [2] in ETSI EN 319 132-2 [12]);
• standard IETF RFC 3161 [3] in posodobitev z žetoni časovnega žiga IETF RFC 5816 [13] ter
• evidenčni podatki IETF RFC 4998 [8] ali IETF RFC 6283 [9].
OPOMBA 1: časovne izjave, ki so uporabljene v podpisih CAdES ali XAdES, nimajo omejitev.
Gradniki, opredeljeni v tem dokumentu, podpirajo dodatne funkcije, ki jih navedeni formati ne podpirajo, kot so časovno žigosanje, podpisovanje več vsebin CAdES in vzporedni podpisi XAdES, ki jih je mogoče uporabiti v drugih kontekstih.
Ta dokument opredeljuje izhodiščne vsebnike, ki zagotavljajo osnovne funkcije, zaradi katerih se lahko različni poslovni in vladni primeri uporabe za elektronske postopke in komunikacijo uporabijo za širok nabor skupnosti, kadar obstaja jasna potreba po interoperabilnosti.
Namen tega dokumenta je zagotavljanje podpore za pripadajoče vsebnike podpisov v različnih regulativnih okvirjih.
OPOMBA 2: Namen pripadajočih vsebnikov podpisov ESiC, določenih v tem dokumentu, je zlasti (vendar ne izključno) zagotavljanje podpore za elektronske podpise in elektronske žige skladno z Uredbo (EU) št. 910/2014 [i.3].
V tem dokumentu so opredeljene štiri ravni izhodiščnih vsebnikov ASiC, ki obravnavajo naraščajoče zahteve po dolgoročnem ohranjanju razpoložljivosti in celovitosti vsebnikov ter ustrezno zmanjšujejo možnost izbire, pri čemer določena raven vedno obravnava vse zahteve, že obravnavane na njenih podravneh.
Ta dokument ne obravnava opredelitve politike potrjevanja za preverjanje vsebnika, ki vključuje časovne izjave.
General Information
Buy Standard
Standards Content (Sample)
2003-01.Slovenski inštitut za standardizacijo. Razmnoževanje celote ali delov tega standarda ni dovoljeno.Electronic Signatures and Infrastructures (ESI) - Associated Signature Containers (ASiC) - Part 1: Building blocks and ASiC baseline containers35.040.01Kodiranje informacij na splošnoInformation coding in generalICS:Ta slovenski standard je istoveten z:ETSI EN 319 162-1 V1.1.1 (2016-04)SIST EN 319 162-1 V1.1.1:2016en01-julij-2016SIST EN 319 162-1 V1.1.1:2016SLOVENSKI
STANDARD
SIST EN 319 162-1 V1.1.1:2016
ETSI EN 319 162-1 V1.1.1 (2016-04) Electronic Signatures and Infrastructures (ESI); Associated Signature Containers (ASiC); Part 1: Building blocks and ASiC baseline containers
EUROPEAN STANDARD SIST EN 319 162-1 V1.1.1:2016
ETSI ETSI EN 319 162-1 V1.1.1 (2016-04) 2
Reference DEN/ESI-0019162-1 Keywords ASiC, e-commerce, electronic signature, security ETSI 650 Route des Lucioles F-06921 Sophia Antipolis Cedex - FRANCE
Tel.: +33 4 92 94 42 00
Fax: +33 4 93 65 47 16
Siret N° 348 623 562 00017 - NAF 742 C Association à but non lucratif enregistrée à la Sous-Préfecture de Grasse (06) N° 7803/88
Important notice The present document can be downloaded from: http://www.etsi.org/standards-search The present document may be made available in electronic versions and/or in print. The content of any electronic and/or print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any existing or perceived difference in contents between such versions and/or in print, the only prevailing document is the print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat. Users of the present document should be aware that the document may be subject to revision or change of status. Information on the current status of this and other ETSI documents is available at https://portal.etsi.org/TB/ETSIDeliverableStatus.aspx If you find errors in the present document, please send your comment to one of the following services: https://portal.etsi.org/People/CommiteeSupportStaff.aspx Copyright Notification No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm except as authorized by written permission of ETSI. The content of the PDF version shall not be modified without the written authorization of ETSI. The copyright and the foregoing restriction extend to reproduction in all media.
© European Telecommunications Standards Institute 2016. All rights reserved.
DECTTM, PLUGTESTSTM, UMTSTM and the ETSI logo are Trade Marks of ETSI registered for the benefit of its Members. 3GPPTM and LTE™ are Trade Marks of ETSI registered for the benefit of its Members and of the 3GPP Organizational Partners. GSM® and the GSM logo are Trade Marks registered and owned by the GSM Association. SIST EN 319 162-1 V1.1.1:2016
ETSI ETSI EN 319 162-1 V1.1.1 (2016-04) 3 Contents Intellectual Property Rights . 5 Foreword . 5 Modal verbs terminology . 5 Introduction . 5 1 Scope . 7 2 References . 7 2.1 Normative references . 7 2.2 Informative references . 8 3 Definitions and abbreviations . 9 3.1 Definitions . 9 3.2 Abbreviations . 9 4 General Syntax . 10 4.1 Description of main features of Associated Signature Containers . 10 4.1.1 Basic container structure . 10 4.1.2 Container types . 10 4.2 General requirements . 11 4.3 Associated Signature Container Simple (ASiC-S) . 11 4.3.1 Introduction. 11 4.3.2 General requirements for ASiC-S . 11 4.3.3 Detailed format for ASiC-S . 12 4.3.3.1 Media type identification . 12 4.3.3.2 Contents of the container . 12 4.3.4 Long term availability and integrity of ASiC-S . 14 4.4 Associated Signature Container Extended (ASiC-E) . 15 4.4.1 Introduction. 15 4.4.2 General requirements of ASiC-E . 16 4.4.3 Detailed format for ASiC-E with XAdES . 16 4.4.3.1 Media type identification . 16 4.4.3.2 Contents of Container . 16 4.4.3.3 ASiC-E with XAdES example (informative) . 18 4.4.4 Detailed format for ASiC-E with CAdES - time assertions . 18 4.4.4.1 Media type identification . 18 4.4.4.2 Contents of Container . 18 4.4.5 Long term availability and integrity of ASiC-E . 21 5 ASiC baseline containers. 21 5.1 ASiC levels . 21 5.2 General requirements . 22 5.2.1 Algorithm requirements . 22 5.2.2 Notation for requirements . 22 5.3 Requirements for ASiC baseline containers . 23 5.3.1 ASiC conformance . 23 5.3.2 Requirements for ASiC-S . 23 5.3.2.1 General requirements for ASiC-S . 23 5.3.2.2 Requirements for ASiC-S with CAdES signature . 23 5.3.2.3 Requirements for ASiC-S with XAdES signature . 24 5.3.3 Requirements for ASiC-E with XAdES signature . 24 Annex A (normative): ASiC metadata specification, data naming and referencing . 25 A.1 The mimetype file . 25 A.2 Media type registrations . 25 A.3 ASiC XML Schema . 26 SIST EN 319 162-1 V1.1.1:2016
ETSI ETSI EN 319 162-1 V1.1.1 (2016-04) 4 A.4 ASiCManifest element . 26 A.4.1 Semantics . 26 A.4.2 Syntax . 26 A.5 XAdESSignatures element . 27 A.5.1 Semantics . 27 A.5.2 Syntax . 28 A.6 Naming and referencing data within ASiC . 28 A.7 ASiCArchiveManifest file content and rules . 29 Annex B (informative): ASiC examples. 30 B.1 Examples of ASiC-S . 30 B.1.1 PDF document associated with CAdES Signature . 30 B.1.2 Simple document time stamp . 30 B.1.3 Signature of a ZIP file with an ASiC-S container . 30 B.2 Example of ASiC-E with XAdES . 31 History . 32
SIST EN 319 162-1 V1.1.1:2016
ETSI ETSI EN 319 162-1 V1.1.1 (2016-04) 5 Intellectual Property Rights IPRs essential or potentially essential to the present document may have been declared to ETSI. The information pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web server (https://ipr.etsi.org/). Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web server) which are, or may be, or may become, essential to the present document. Foreword This European Standard (EN) has been produced by ETSI Technical Committee Electronic Signatures and Infrastructures (ESI). The present document is part 1 of a multi-part deliverable specifying Associated Signature Containers (ASiC), as identified below: Part 1: "Building blocks and ASiC baseline containers"; Part 2: "Additional ASiC containers".
National transposition dates Date of adoption of this EN: 25 April 2016 Date of latest announcement of this EN (doa): 31 July 2016 Date of latest publication of new National Standard or endorsement of this EN (dop/e):
31 January 2017 Date of withdrawal of any conflicting National Standard (dow): 31 January 2017
Modal verbs terminology In the present document "shall", "shall not", "should", "should not", "may", "need not", "will", "will not", "can" and "cannot" are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of provisions). "must" and "must not" are NOT allowed in ETSI deliverables except when used in direct citation. Introduction When signing data, the resultant signature needs to be associated with the data to which it applies. This can be achieved either by creating a data set which combines the signature and the data that was signed (e.g. by enveloping the data with the signature or including a signature element in the data set) or placing the (detached) signature in a separate resource and have some external means for associating the signature with the data to which it applies. While there are some advantages to the use of detached signatures, most significantly their non-modification of the original data objects, there remains a risk that the signature becomes separated from the data to which it applies and so losing the association. Therefore, many application systems have developed their own technique for combining a detached signature with the signed object in some form of container so that they can be more easily distributed and guarantee that the correct signature and any relevant metadata is used when validating. The same requirements apply to associate time assertions (i.e. time-stamp tokens or evidence records) to their associated data. SIST EN 319 162-1 V1.1.1:2016
ETSI ETSI EN 319 162-1 V1.1.1 (2016-04) 6 The present document defines a standardized use of container types to establish a common way for associating files containing data objects with files containing digital signatures and/or time assertions. Using a common container form and associated information will facilitate data interchange and interoperability among various signing and validation services. Whilst ZIP [5] provides a basic container structure that can associate files containing data objects (file objects) and the signature(s) that apply to them, there is a recognized need for additional structure and metadata about the association, for example to link a particular signature with the file object to which it is applied. Other formats have already been specified for the use of ZIP based structures to bind together a number of file objects with related metadata. This includes OCF [4] which was originally designed for use by eBooks but has been adopted as the basis for other containers, for example ODF [6]. The present document builds on this work specifically addressing the requirements of associating a digital signature with any type of data, independent of the needs of any particular document or data type. The present document is intended to cover containers including digital signatures and time assertions supported by PKI and public key certificates, and aims to meet the general requirements of the international community to provide trust and confidence in electronic transactions, including, amongst other, applicable requirements from Regulation (EU) No 910/2014 [i.3]. The present document is part of a rationalized framework of standards (see ETSI TR 119 000 [i.9]). ETSI TR 119 100 [i.1] provides guidance on how to use the present document within the aforementioned framework. SIST EN 319 162-1 V1.1.1:2016
ETSI ETSI EN 319 162-1 V1.1.1 (2016-04) 7 1 Scope The present document specifies Associated Signature Containers (ASiC) which bind together into one single digital container based on ZIP [5] either detached digital signatures or time assertions, with a number of file objects (e.g. documents, XML structured data, spreadsheet, multimedia content) to which they apply. The present document specifies general purpose ASiC containers building blocks and a limited set of baseline containers. ASiC supports the following signature and time assertion formats: • CAdES object incorporating CAdES signatures (ETSI EN 319 122-1 [1] and ETSI EN 319 122-2 [11]); • XAdES signatures (ETSI EN 319 132-1 [2] and ETSI EN 319 132-2 [12]); • IETF RFC 3161 [3] and updated by IETF RFC 5816 [13] time-stamp tokens; and
• IETF RFC 4998 [8] or IETF RFC 6283 [9] evidence records. NOTE 1: No restriction is placed on time assertions eventually used within CAdES signatures or XAdES signatures. The building blocks defined in the present document support additional features not supported by the aforementioned formats, such as time-stamping and CAdES signing of multiple content and XAdES parallel signatures, that can be used in other contexts. The present document defines baseline containers which provide the basic features necessary for a wide range of business and governmental use cases for electronic procedures and communications to be applicable to a wide range of communities when there is a clear need for interoperability. The present document aims at supporting associated signature containers in different regulatory frameworks. NOTE 2: Specifically, but not exclusively, ASiC Associated Signature Containers specified in the present document aim at supporting electronic signature and electronic seal as per Regulation (EU) No 910/2014 [i.3]. The present document defines four levels of ASiC baseline containers addressing incremental requirements to maintain the availability and integrity of the containers over the long term, suitably profiled for reducing the optionality as much as possible, in a way that a certain level always addresses all the requirements already addressed at levels that are below it. The present document does not address the identification of the validation policy to be used for verifying a container that contains time assertions. 2 References 2.1 Normative references References are either specific (identified by date of publication and/or edition number or version number) or non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the referenced document (including any amendments) applies. Referenced documents which are not found to be publicly available in the expected location might be found at http://docbox.etsi.org/Reference. NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee their long term validity. The following referenced documents are necessary for the application of the present document. [1] ETSI EN 319 122-1: "Electronic Signatures and Infrastructures (ESI); CAdES digital signatures; Part 1: Building blocks and CAdES baseline signatures". SIST EN 319 162-1 V1.1.1:2016
ETSI ETSI EN 319 162-1 V1.1.1 (2016-04) 8 [2] ETSI EN 319 132-1: "Electronic Signatures and Infrastructures (ESI); XAdES digital signatures; Part 1: Building blocks and XAdES baseline signatures". [3] IETF RFC 3161: "Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)". [4] ISO/IEC TS 30135 (all parts): "Information technology -- Digital publishing -- EPUB3". NOTE: Available at http://idpf.org/epub/30/spec/epub30-ocf.html. [5] Application Note: "APPNOTE.TXT - .ZIP File Format Specification", PKWARE® Inc., September 2012. NOTE: Available at http://www.pkware.com/documents/APPNOTE/APPNOTE-6.3.3.TXT. [6] OASIS: "Open Document Format for Office Applications (OpenDocument) Version 1.2; Part 3: Packages" 29 September 2011. [7] IETF RFC 3986: "Uniform Resource Identifier (URI): Generic Syntax". [8] IETF RFC 4998: "Evidence Record Syntax (ERS)". [9] IETF RFC 6283: "Extensible Markup Language Evidence Record Syntax (XMLERS)". [10] ISO/IEC 21320-1: "Information technology -- Document Container File -- Part 1: Core". [11] ETSI EN 319 122-2: "Electronic Signatures and Infrastructures (ESI); CAdES digital signatures; Part 2: Extended CAdES signatures". [12] ETSI EN 319 132-2: "Electronic Signatures and Infrastructures (ESI); XAdES digital signatures; Part 2: Extended XAdES signatures". [13] IETF RFC 5816: "ESSCertIDv2 Update for RFC 3161". [14] W3C recommendation: "XML Signature Syntax and Processing". [15] ISO/IEC 10646: "Information technology - Universal Coded Character Set (UCS)". 2.2 Informative references References are either specific (identified by date of publication and/or edition number or version number) or non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the referenced document (including any amendments) applies. NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee their long term validity. The following referenced documents are not necessary for the application of the present document but they assist the user with regard to a particular subject area. [i.1] ETSI TR 119 100: "Electronic Signatures and Infrastructures (ESI); Business Driven Guidance for Signature Creation and Validation". [i.2] ISO 15489-1: "Information and documentation - Records management - Part 1: General". [i.3] Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC. [i.4] ETSI TS 119 312: "Electronic Signatures and Infrastructures (ESI); Cryptographic Suites". [i.5] IETF RFC 6838: "Media Type Specifications and Registration Procedures". [i.6] IETF RFC 2045: "Multipurpose Internet Mail Extensions (MIME) Part One: Format of Internet Message Bodies". [i.7] ETSI EN 319 422: "Electronic Signatures and Infrastructures (ESI); Time-stamping protocol and time-stamp token profiles". SIST EN 319 162-1 V1.1.1:2016
ETSI ETSI EN 319 162-1 V1.1.1 (2016-04) 9 [i.8] ETSI TS 101 533-1: "Electronic Signatures and Infrastructures (ESI); Data Preservation Systems Security; Part 1: Requirements for Implementation and Management". [i.9] ETSI TR 119 000: "Electronic Signatures and Infrastructures (ESI); The framework for standardization of signatures: overview". [i.10] ETSI TR 119 001: "Electronic Signatures and Infrastructures (ESI); The framework for standardization of signatures; Definitions and abbreviations". [i.11] IETF RFC 1951: "DEFLATE Compressed Data Format Specification version 1.3". 3 Definitions and abbreviations 3.1 Definitions For the purposes of the present document, the terms and definitions given in ETSI TR 119 001 [i.10] and the following apply: ASiCArchiveManifest file: container file whose name matches "*ASiCArchiveManifest*.xml" containing one ASiCManifest element instance conforming to clause A.7 of the present document ASiCEvidenceRecordManifest file: container file used in ASiC-E to reference a set of files to which an ER applies whose name matches "META-INF/ASiCEvidenceRecordManifest*.xml" and containing one ASiCManifest element instance conformant to clause A.4 of the present document ASiCManifest file: file whose name matches "*ASiCManifest*.xml" containing one ASiCManifest element instance conformant to clause A.4 of the present document CAdES signature: digital signature that satisfies the requirements specified within ETSI EN 319 122-1 [1] or ETSI EN 319 122-2 [11] CAdES object: instance of ContentInfo with Signed-data Content as specified in CAdES [1] clause 4 including one or more CAdES signatures covering the same content container: file created according to ZIP holding as internal elements files with related manifest, metadata and associated signature(s), under a folder hierarchy media type: method to label arbitrary content, carried by MIME [i.6] or other protocols NOTE: Refer to IETF RFC 6838 [i.5], clause 1. metadata: data describing context, content and structure of data objects and their management over time NOTE: Refer to ISO 15489-1:2001 [i.2], definition 3.12 with modifications. time assertion: time-stamp token or evidence record NOTE: A time assertion can be used as a proof of existence and integrity in signature validation. XAdES signature: digital signature that satisfies the requirements specified within ETSI EN 319 132-1 [2] or ETSI EN 319 132-2 [12] 3.2 Abbreviations For the purposes of the present document, the abbreviations given in CAdES [1], XAdES [2] and the following apply: ASiC Associated Signature Container ER Evidence Record NOTE: Refer to IETF RFC 4998 [8] and IETF RFC 6283 [9]. OCF Open Container Format NOTE: As specified in ISO/IEC TS 30135 [4]. SIST EN 319 162-1 V1.1.1:2016
ETSI ETSI EN 319 162-1 V1.1.1 (2016-04) 10 ODF Open Document Format NOTE: Refer to [6]. 4 General Syntax 4.1 Description of main features of Associated Signature Containers 4.1.1 Basic container structure The ASiC is a data container holding a set of file objects and associated digital signatures and/or time assertions using the ZIP [5] format. Any ASiC container has an internal structure including: • a root folder, for all the container content possibly including folders reflecting the content structure; and • a "META-INF" folder, in the root folder, for files containing metadata about the content, including associated signature or time assertion files. NOTE: The detached signatures or time assertions are applied in such a way that the integrity of the data is not broken when the files are extracted from the ZIP container. Hence, the signatures and time assertions used in ASiC can be verified against the file objects to which they apply when outside the container structure (for example when placed in local storage). 4.1.2 Container types Signatures and time assertions within ASiC containers are present within signature or time assertion files. A signature file can contain either: • one CAdES object; or • one or more XAdES signatures. A time assertion file can contain either: • one time-stamp token conformant to IETF RFC 3161 [3] (which can be profiled as specified in ETSI EN 319 422 [i.7]); or • one Evidence Record conformant to IETF RFC 4998 [8] or IETF RFC 6283 [9]. The present document defines two types of containers. The first type is ASiC Simple (ASiC-S) that associates one single file object with either: • one signature file; or • one time assertion file. This type of container can also include a file named "mimetype" specifying the media type. This type of container allows to add at a later time additional signatures signing the aforementioned file object and additional ASiCArchiveManifest files to protect long term time-stamp tokens. The second type is ASiC Extended (ASiC-E), a container that associates one or more file objects with either: • one or more XAdES signatures present within one or more signature files and optionally one or more ERS within one or more time assertion files; or • one or more CAdES signatures present within one or more CAdES object files and/or one or more time assertions within one or more time assertion files. SIST EN 319 162-1 V1.1.1:2016
ETSI ETSI EN 319 162-1 V1.1.1 (2016-04) 11 Each signature and/or time assertion is associated with all or part of the file objects in the container.
It is possible to add signature files, time assertion files and data files to an ASiC-E container. The additional signature and time assertion files can apply to the same set of files or a different set, without invalidating previously applied signatures or time a
...
ETSI EN 319 162-1 V1.1.1 (2016-04)
EUROPEAN STANDARD
Electronic Signatures and Infrastructures (ESI);
Associated Signature Containers (ASiC);
Part 1: Building blocks and ASiC baseline containers
�
---------------------- Page: 1 ----------------------
2 ETSI EN 319 162-1 V1.1.1 (2016-04)
Reference
DEN/ESI-0019162-1
Keywords
ASiC, e-commerce, electronic signature, security
ETSI
650 Route des Lucioles
F-06921 Sophia Antipolis Cedex - FRANCE
Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16
Siret N° 348 623 562 00017 - NAF 742 C
Association à but non lucratif enregistrée à la
Sous-Préfecture de Grasse (06) N° 7803/88
Important notice
The present document can be downloaded from:
http://www.etsi.org/standards-search
The present document may be made available in electronic versions and/or in print. The content of any electronic and/or
print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any
existing or perceived difference in contents between such versions and/or in print, the only prevailing document is the
print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat.
Users of the present document should be aware that the document may be subject to revision or change of status.
Information on the current status of this and other ETSI documents is available at
https://portal.etsi.org/TB/ETSIDeliverableStatus.aspx
If you find errors in the present document, please send your comment to one of the following services:
https://portal.etsi.org/People/CommiteeSupportStaff.aspx
Copyright Notification
No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying
and microfilm except as authorized by written permission of ETSI.
The content of the PDF version shall not be modified without the written authorization of ETSI.
The copyright and the foregoing restriction extend to reproduction in all media.
© European Telecommunications Standards Institute 2016.
All rights reserved.
TM TM TM
DECT , PLUGTESTS , UMTS and the ETSI logo are Trade Marks of ETSI registered for the benefit of its Members.
TM
3GPP and LTE™ are Trade Marks of ETSI registered for the benefit of its Members and
of the 3GPP Organizational Partners.
GSM® and the GSM logo are Trade Marks registered and owned by the GSM Association.
ETSI
---------------------- Page: 2 ----------------------
3 ETSI EN 319 162-1 V1.1.1 (2016-04)
Contents
Intellectual Property Rights . 5
Foreword . 5
Modal verbs terminology . 5
Introduction . 5
1 Scope . 7
2 References . 7
2.1 Normative references . 7
2.2 Informative references . 8
3 Definitions and abbreviations . 9
3.1 Definitions . 9
3.2 Abbreviations . 9
4 General Syntax . 10
4.1 Description of main features of Associated Signature Containers . 10
4.1.1 Basic container structure . 10
4.1.2 Container types . 10
4.2 General requirements . 11
4.3 Associated Signature Container Simple (ASiC-S) . 11
4.3.1 Introduction. 11
4.3.2 General requirements for ASiC-S . 11
4.3.3 Detailed format for ASiC-S . 12
4.3.3.1 Media type identification . 12
4.3.3.2 Contents of the container . 12
4.3.4 Long term availability and integrity of ASiC-S . 14
4.4 Associated Signature Container Extended (ASiC-E) . 15
4.4.1 Introduction. 15
4.4.2 General requirements of ASiC-E . 16
4.4.3 Detailed format for ASiC-E with XAdES . 16
4.4.3.1 Media type identification . 16
4.4.3.2 Contents of Container . 16
4.4.3.3 ASiC-E with XAdES example (informative) . 18
4.4.4 Detailed format for ASiC-E with CAdES - time assertions . 18
4.4.4.1 Media type identification . 18
4.4.4.2 Contents of Container . 18
4.4.5 Long term availability and integrity of ASiC-E . 21
5 ASiC baseline containers. 21
5.1 ASiC le vels . 21
5.2 General requirements . 22
5.2.1 Algorithm requirements . 22
5.2.2 Notation for requirements . 22
5.3 Requirements for ASiC baseline containers . 23
5.3.1 ASiC conformance . 23
5.3.2 Requirements for ASiC-S . 23
5.3.2.1 General requirements for ASiC-S . 23
5.3.2.2 Requirements for ASiC-S with CAdES signature . 23
5.3.2.3 Requirements for ASiC-S with XAdES signature . 24
5.3.3 Requirements for ASiC-E with XAdES signature . 24
Annex A (normative): ASiC metadata specification, data naming and referencing . 25
A.1 The mimetype file . 25
A.2 Media type registrations . 25
A.3 ASiC XML Schema . 26
ETSI
---------------------- Page: 3 ----------------------
4 ETSI EN 319 162-1 V1.1.1 (2016-04)
A.4 ASiCManifest element . 26
A.4.1 Semantics . 26
A.4.2 Syntax . 26
A.5 XAdESSignatures element . 27
A.5.1 Semantics . 27
A.5.2 Syntax . 28
A.6 Naming and referencing data within ASiC . 28
A.7 ASiCArchiveManifest file content and rules . 29
Annex B (informative): ASiC examples. 30
B.1 Examples of ASiC-S . 30
B.1.1 PDF document associated with CAdES Signature . 30
B.1.2 Simple document time stamp . 30
B.1.3 Signature of a ZIP file with an ASiC-S container . 30
B.2 Example of ASiC-E with XAdES . 31
History . 32
ETSI
---------------------- Page: 4 ----------------------
5 ETSI EN 319 162-1 V1.1.1 (2016-04)
Intellectual Property Rights
IPRs essential or potentially essential to the present document may have been declared to ETSI. The information
pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found
in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in
respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web
server (https://ipr.etsi.org/).
Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee
can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web
server) which are, or may be, or may become, essential to the present document.
Foreword
This European Standard (EN) has been produced by ETSI Technical Committee Electronic Signatures and
Infrastructures (ESI).
The present document is part 1 of a multi-part deliverable specifying Associated Signature Containers (ASiC), as
identified below:
Part 1: "Building blocks and ASiC baseline containers";
Part 2: "Additional ASiC containers".
National transposition dates
Date of adoption of this EN: 25 April 2016
Date of latest announcement of this EN (doa): 31 July 2016
Date of latest publication of new National Standard
or endorsement of this EN (dop/e): 31 January 2017
Date of withdrawal of any conflicting National Standard (dow): 31 January 2017
Modal verbs terminology
In the present document "shall", "shall not", "should", "should not", "may", "need not", "will", "will not", "can" and
"cannot" are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of
provisions).
"must" and "must not" are NOT allowed in ETSI deliverables except when used in direct citation.
Introduction
When signing data, the resultant signature needs to be associated with the data to which it applies. This can be achieved
either by creating a data set which combines the signature and the data that was signed (e.g. by enveloping the data with
the signature or including a signature element in the data set) or placing the (detached) signature in a separate resource
and have some external means for associating the signature with the data to which it applies. While there are some
advantages to the use of detached signatures, most significantly their non-modification of the original data objects, there
remains a risk that the signature becomes separated from the data to which it applies and so losing the association.
Therefore, many application systems have developed their own technique for combining a detached signature with the
signed object in some form of container so that they can be more easily distributed and guarantee that the correct
signature and any relevant metadata is used when validating. The same requirements apply to associate time assertions
(i.e. time-stamp tokens or evidence records) to their associated data.
ETSI
---------------------- Page: 5 ----------------------
6 ETSI EN 319 162-1 V1.1.1 (2016-04)
The present document defines a standardized use of container types to establish a common way for associating files
containing data objects with files containing digital signatures and/or time assertions. Using a common container form
and associated information will facilitate data interchange and interoperability among various signing and validation
services.
Whilst ZIP [5] provides a basic container structure that can associate files containing data objects (file objects) and the
signature(s) that apply to them, there is a recognized need for additional structure and metadata about the association,
for example to link a particular signature with the file object to which it is applied. Other formats have already been
specified for the use of ZIP based structures to bind together a number of file objects with related metadata. This
includes OCF [4] which was originally designed for use by eBooks but has been adopted as the basis for other
containers, for example ODF [6]. The present document builds on this work specifically addressing the requirements of
associating a digital signature with any type of data, independent of the needs of any particular document or data type.
The present document is intended to cover containers including digital signatures and time assertions supported by PKI
and public key certificates, and aims to meet the general requirements of the international community to provide trust
and confidence in electronic transactions, including, amongst other, applicable requirements from Regulation (EU)
No 910/2014 [i.3].
The present document is part of a rationalized framework of standards (see ETSI TR 119 000 [i.9]). ETSI
TR 119 100 [i.1] provides guidance on how to use the present document within the aforementioned framework.
ETSI
---------------------- Page: 6 ----------------------
7 ETSI EN 319 162-1 V1.1.1 (2016-04)
1 Scope
The present document specifies Associated Signature Containers (ASiC) which bind together into one single digital
container based on ZIP [5] either detached digital signatures or time assertions, with a number of file objects
(e.g. documents, XML structured data, spreadsheet, multimedia content) to which they apply.
The present document specifies general purpose ASiC containers building blocks and a limited set of baseline
containers.
ASiC supports the following signature and time assertion formats:
• CAdES object incorporating CAdES signatures (ETSI EN 319 122-1 [1] and ETSI EN 319 122-2 [11]);
• XAdES signatures (ETSI EN 319 132-1 [2] and ETSI EN 319 132-2 [12]);
• IETF RFC 3161 [3] and updated by IETF RFC 5816 [13] time-stamp tokens; and
• IETF RFC 4998 [8] or IETF RFC 6283 [9] evidence records.
NOTE 1: No restriction is placed on time assertions eventually used within CAdES signatures or XAdES
signatures.
The building blocks defined in the present document support additional features not supported by the aforementioned
formats, such as time-stamping and CAdES signing of multiple content and XAdES parallel signatures, that can be used
in other contexts.
The present document defines baseline containers which provide the basic features necessary for a wide range of
business and governmental use cases for electronic procedures and communications to be applicable to a wide range of
communities when there is a clear need for interoperability.
The present document aims at supporting associated signature containers in different regulatory frameworks.
NOTE 2: Specifically, but not exclusively, ASiC Associated Signature Containers specified in the present
document aim at supporting electronic signature and electronic seal as per Regulation (EU)
No 910/2014 [i.3].
The present document defines four levels of ASiC baseline containers addressing incremental requirements to maintain
the availability and integrity of the containers over the long term, suitably profiled for reducing the optionality as much
as possible, in a way that a certain level always addresses all the requirements already addressed at levels that are below
it.
The present document does not address the identification of the validation policy to be used for verifying a container
that contains time assertions.
2 References
2.1 Normative references
References are either specific (identified by date of publication and/or edition number or version number) or
non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the
referenced document (including any amendments) applies.
Referenced documents which are not found to be publicly available in the expected location might be found at
http://docbox.etsi.org/Reference.
NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee
their long term validity.
The following referenced documents are necessary for the application of the present document.
[1] ETSI EN 319 122-1: "Electronic Signatures and Infrastructures (ESI); CAdES digital signatures;
Part 1: Building blocks and CAdES baseline signatures".
ETSI
---------------------- Page: 7 ----------------------
8 ETSI EN 319 162-1 V1.1.1 (2016-04)
[2] ETSI EN 319 132-1: "Electronic Signatures and Infrastructures (ESI); XAdES digital signatures;
Part 1: Building blocks and XAdES baseline signatures".
[3] IETF RFC 3161: "Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)".
[4] ISO/IEC TS 30135 (all parts): "Information technology -- Digital publishing -- EPUB3".
NOTE: Available at http://idpf.org/epub/30/spec/epub30-ocf.html.
[5] Application Note: "APPNOTE.TXT - .ZIP File Format Specification", PKWARE® Inc.,
September 2012.
NOTE: Available at http://www.pkware.com/documents/APPNOTE/APPNOTE-6.3.3.TXT.
[6] OASIS: "Open Document Format for Office Applications (OpenDocument) Version 1.2;
Part 3: Packages" 29 September 2011.
[7] IETF RFC 3986: "Uniform Resource Identifier (URI): Generic Syntax".
[8] IETF RFC 4998: "Evidence Record Syntax (ERS)".
[9] IETF RFC 6283: "Extensible Markup Language Evidence Record Syntax (XMLERS)".
[10] ISO/IEC 21320-1: "Information technology -- Document Container File -- Part 1: Core".
[11] ETSI EN 319 122-2: "Electronic Signatures and Infrastructures (ESI); CAdES digital signatures;
Part 2: Extended CAdES signatures".
[12] ETSI EN 319 132-2: "Electronic Signatures and Infrastructures (ESI); XAdES digital signatures;
Part 2: Extended XAdES signatures".
[13] IETF RFC 5816: "ESSCertIDv2 Update for RFC 3161".
[14] W3C recommendation: "XML Signature Syntax and Processing".
[15] ISO/IEC 10646: "Information technology - Universal Coded Character Set (UCS)".
2.2 Informative references
References are either specific (identified by date of publication and/or edition number or version number) or
non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the
referenced document (including any amendments) applies.
NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee
their long term validity.
The following referenced documents are not necessary for the application of the present document but they assist the
user with regard to a particular subject area.
[i.1] ETSI TR 119 100: "Electronic Signatures and Infrastructures (ESI); Business Driven Guidance for
Signature Creation and Validation".
[i.2] ISO 15489-1: "Information and documentation - Records management - Part 1: General".
[i.3] Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on
electronic identification and trust services for electronic transactions in the internal market and
repealing Directive 1999/93/EC.
[i.4] ETSI TS 119 312: "Electronic Signatures and Infrastructures (ESI); Cryptographic Suites".
[i.5] IETF RFC 6838: "Media Type Specifications and Registration Procedures".
[i.6] IETF RFC 2045: "Multipurpose Internet Mail Extensions (MIME) Part One: Format of Internet
Message Bodies".
[i.7] ETSI EN 319 422: "Electronic Signatures and Infrastructures (ESI); Time-stamping protocol and
time-stamp token profiles".
ETSI
---------------------- Page: 8 ----------------------
9 ETSI EN 319 162-1 V1.1.1 (2016-04)
[i.8] ETSI TS 101 533-1: "Electronic Signatures and Infrastructures (ESI); Data Preservation Systems
Security; Part 1: Requirements for Implementation and Management".
[i.9] ETSI TR 119 000: "Electronic Signatures and Infrastructures (ESI); The framework for
standardization of signatures: overview".
[i.10] ETSI TR 119 001: "Electronic Signatures and Infrastructures (ESI); The framework for
standardization of signatures; Definitions and abbreviations".
[i.11] IETF RFC 1951: "DEFLATE Compressed Data Format Specification version 1.3".
3 Definitions and abbreviations
3.1 Definitions
For the purposes of the present document, the terms and definitions given in ETSI TR 119 001 [i.10] and the following
apply:
ASiCArchiveManifest file: container file whose name matches "*ASiCArchiveManifest*.xml" containing one
ASiCManifest element instance conforming to clause A.7 of the present document
ASiCEvidenceRecordManifest file: container file used in ASiC-E to reference a set of files to which an ER applies
whose name matches "META-INF/ASiCEvidenceRecordManifest*.xml" and containing one ASiCManifest element
instance conformant to clause A.4 of the present document
ASiCManifest file: file whose name matches "*ASiCManifest*.xml" containing one ASiCManifest element instance
conformant to clause A.4 of the present document
CAdES signature: digital signature that satisfies the requirements specified within ETSI EN 319 122-1 [1] or ETSI
EN 319 122-2 [11]
CAdES object: instance of ContentInfo with Signed-data Content as specified in CAdES [1] clause 4
including one or more CAdES signatures covering the same content
container: file created according to ZIP holding as internal elements files with related manifest, metadata and
associated signature(s), under a folder hierarchy
media type: method to label arbitrary content, carried by MIME [i.6] or other protocols
NOTE: Refer to IETF RFC 6838 [i.5], clause 1.
metadata: data describing context, content and structure of data objects and their management over time
NOTE: Refer to ISO 15489-1:2001 [i.2], definition 3.12 with modifications.
time assertion: time-stamp token or evidence record
NOTE: A time assertion can be used as a proof of existence and integrity in signature validation.
XAdES signature: digital signature that satisfies the requirements specified within ETSI EN 319 132-1 [2] or ETSI
EN 319 132-2 [12]
3.2 Abbreviations
For the purposes of the present document, the abbreviations given in CAdES [1], XAdES [2] and the following apply:
ASiC Associated Signature Container
ER Evidence Record
NOTE: Refer to IETF RFC 4998 [8] and IETF RFC 6283 [9].
OCF Open Container Format
NOTE: As specified in ISO/IEC TS 30135 [4].
ETSI
---------------------- Page: 9 ----------------------
10 ETSI EN 319 162-1 V1.1.1 (2016-04)
ODF Open Document Format
NOTE: Refer to [6].
4 General Syntax
4.1 Description of main features of Associated Signature
Containers
4.1.1 Basic container structure
The ASiC is a data container holding a set of file objects and associated digital signatures and/or time assertions using
the ZIP [5] format.
Any ASiC container has an internal structure including:
• a root folder, for all the container content possibly including folders reflecting the content structure; and
• a "META-INF" folder, in the root folder, for files containing metadata about the content, including associated
signature or time assertion files.
NOTE: The detached signatures or time assertions are applied in such a way that the integrity of the data is not
broken when the files are extracted from the ZIP container. Hence, the signatures and time assertions used
in ASiC can be verified against the file objects to which they apply when outside the container structure
(for example when placed in local storage).
4.1.2 Container types
Signatures and time assertions within ASiC containers are present within signature or time assertion files.
A signature file can contain either:
• one CAdES object; or
• one or more XAdES signatures.
A time assertion file can contain either:
• one time-stamp token conformant to IETF RFC 3161 [3] (which can be profiled as specified in ETSI
EN 319 422 [i.7]); or
• one Evidence Record conformant to IETF RFC 4998 [8] or IETF RFC 6283 [9].
The present document defines two types of containers.
The first type is ASiC Simple (ASiC-S) that associates one single file object with either:
• one signature file; or
• one time assertion file.
This type of container can also include a file named "mimetype" specifying the media type.
This type of container allows to add at a later time additional signatures signing the aforementioned file object and
additional ASiCArchiveManifest files to protect long term time-stamp tokens.
The second type is ASiC Extended (ASiC-E), a container that associates one or more file objects with either:
• one or more XAdES signatures present within one or more signature files and optionally one or more ERS
within one or more time assertion files; or
• one or more CAdES signatures present within one or more CAdES object files and/or one or more time
assertions within one or more time assertion files.
ETSI
---------------------- Page: 10 ----------------------
11 ETSI EN 319 162-1 V1.1.1 (2016-04)
Each signature and/or time assertion is associated with all or part of the file objects in the container.
It is possible to add signature files, time assertion files and data files to an ASiC-E container. The additional signature
and time assertion files can appl
...
Draft ETSI EN 319 162-1 V1.0.0 (2015-08)
EUROPEAN STANDARD
Electronic Signatures and Infrastructures (ESI);
Associated Signature Containers (ASiC);
Part 1: Building blocks and ASiC baseline containers
�
---------------------- Page: 1 ----------------------
2 Draft ETSI EN 319 162-1 V1.0.0 (2015-08)
Reference
DEN/ESI-0019162-1
Keywords
ASiC, e-commerce, electronic signature, security
ETSI
650 Route des Lucioles
F-06921 Sophia Antipolis Cedex - FRANCE
Tel.: +33 4 92 94 42 00 Fax: +33 4 93 65 47 16
Siret N° 348 623 562 00017 - NAF 742 C
Association à but non lucratif enregistrée à la
Sous-Préfecture de Grasse (06) N° 7803/88
Important notice
The present document can be downloaded from:
http://www.etsi.org/standards-search
The present document may be made available in electronic versions and/or in print. The content of any electronic and/or
print versions of the present document shall not be modified without the prior written authorization of ETSI. In case of any
existing or perceived difference in contents between such versions and/or in print, the only prevailing document is the
print of the Portable Document Format (PDF) version kept on a specific network drive within ETSI Secretariat.
Users of the present document should be aware that the document may be subject to revision or change of status.
Information on the current status of this and other ETSI documents is available at
http://portal.etsi.org/tb/status/status.asp
If you find errors in the present document, please send your comment to one of the following services:
https://portal.etsi.org/People/CommiteeSupportStaff.aspx
Copyright Notification
No part may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying
and microfilm except as authorized by written permission of ETSI.
The content of the PDF version shall not be modified without the written authorization of ETSI.
The copyright and the foregoing restriction extend to reproduction in all media.
© European Telecommunications Standards Institute 2015.
All rights reserved.
TM TM TM
DECT , PLUGTESTS , UMTS and the ETSI logo are Trade Marks of ETSI registered for the benefit of its Members.
TM
3GPP and LTE™ are Trade Marks of ETSI registered for the benefit of its Members and
of the 3GPP Organizational Partners.
GSM® and the GSM logo are Trade Marks registered and owned by the GSM Association.
ETSI
---------------------- Page: 2 ----------------------
3 Draft ETSI EN 319 162-1 V1.0.0 (2015-08)
Contents
Intellectual Property Rights . 5
Foreword . 5
Modal verbs terminology . 5
Introduction . 5
1 Scope . 7
2 References . 7
2.1 Normative references . 7
2.2 Informative references . 8
3 Definitions and abbreviations . 9
3.1 Definitions . 9
3.2 Abbreviations . 9
4 General Syntax . 9
4.1 Description of main features of Associated Signature Containers . 9
4.1.1 Basic container structure . 9
4.1.2 Container types . 10
4.2 General requirements . 11
4.3 Associated Signature Container Simple (ASiC-S) . 11
4.3.1 Introduction. 11
4.3.2 General Requirements for ASiC-S . 11
4.3.3 Detailed format for ASiC-S . 11
4.3.3.1 Media type identification . 11
4.3.3.2 Contents of the container . 12
4.3.4 Long term validity of ASiC-S . 13
4.4 Associated Signature Container Extended (ASiC-E) . 15
4.4.1 Introduction. 15
4.4.2 General Requirements of ASiC-E . 15
4.4.3 Detailed format for ASiC-E with XAdES . 16
4.4.3.1 Media type identification . 16
4.4.3.2 Contents of Container . 16
4.4.3.3 ASiC-E with XAdES example (informative) . 17
4.4.3.4 XAdES use in ASiC-E with XAdES . 18
4.4.4 Detailed format for ASiC-E with CAdES - time assertions . 18
4.4.4.1 Media type identification . 18
4.4.4.2 Contents of Container . 19
4.4.5 Long term validity of ASiC-E. 21
5 ASiC Baseline containers . 21
5.1 ASiC Levels . 21
5.2 General requirements . 22
5.2.1 Algorithm requirements . 22
5.2.2 Notation for requirements . 22
5.3 Requirements for ASiC baseline containers . 23
5.3.1 ASiC conformance . 23
5.3.2 Requirements for ASiC-S . 24
5.3.2.1 General requirements for ASiC-S . 24
5.3.2.2 Requirements for ASiC-S with CAdES signature . 24
5.3.2.3 Requirements for ASiC-S with XAdES signature . 24
5.3.3 Requirements for ASiC-E with XAdES signature . 25
Annex A (normative): ASiC metadata specification, data naming and referencing . 26
A.1 The mimetype file . 26
A.2 Media type registrations . 26
A.3 ASiC XML Schema . 27
ETSI
---------------------- Page: 3 ----------------------
4 Draft ETSI EN 319 162-1 V1.0.0 (2015-08)
A.4 ASiCManifest element . 27
A.4.1 Semantics . 27
A.4.2 Syntax . 28
A.5 XAdESSignatures element . 29
A.5.1 Semantics . 29
A.5.2 Syntax . 29
A.6 Naming and referencing data within ASiC . 29
A.7 ASiCArchiveManifest file content and rules . 30
Annex B (informative): ASiC Examples . 32
B.1 Examples of ASiC-S . 32
B.1.1 PDF document Associated with CAdES Signature . 32
B.1.2 Simple document time stamp . 32
B.1.3 Signature of a ZIP file with an ASiC-S container . 32
B.2 Example of ASiC-E with XAdES . 32
B.3 Example of ASiC-E with CAdES and time-stamp token . 33
History . 35
ETSI
---------------------- Page: 4 ----------------------
5 Draft ETSI EN 319 162-1 V1.0.0 (2015-08)
Intellectual Property Rights
IPRs essential or potentially essential to the present document may have been declared to ETSI. The information
pertaining to these essential IPRs, if any, is publicly available for ETSI members and non-members, and can be found
in ETSI SR 000 314: "Intellectual Property Rights (IPRs); Essential, or potentially Essential, IPRs notified to ETSI in
respect of ETSI standards", which is available from the ETSI Secretariat. Latest updates are available on the ETSI Web
server (http://ipr.etsi.org).
Pursuant to the ETSI IPR Policy, no investigation, including IPR searches, has been carried out by ETSI. No guarantee
can be given as to the existence of other IPRs not referenced in ETSI SR 000 314 (or the updates on the ETSI Web
server) which are, or may be, or may become, essential to the present document.
Foreword
This draft European Standard (EN) has been produced by ETSI Technical Committee Electronic Signatures and
Infrastructures (ESI), and is now submitted for the combined Public Enquiry and Vote phase of the ETSI standards EN
Approval Procedure.
The present document is part 1 of a multi-part deliverable specifying Associated Signature Containers (ASiC), as
identified below:
Part 1: "Building blocks and ASiC baseline containers";
Part 2: "Additional ASiC containers".
Proposed national transposition dates
Date of latest announcement of this EN (doa): 3 months after ETSI publication
Date of latest publication of new National Standard
or endorsement of this EN (dop/e): 6 months after doa
Date of withdrawal of any conflicting National Standard (dow): 6 months after doa
Modal verbs terminology
In the present document "shall", "shall not", "should", "should not", "may", "need not", "will", "will not", "can" and
"cannot" are to be interpreted as described in clause 3.2 of the ETSI Drafting Rules (Verbal forms for the expression of
provisions).
"must" and "must not" are NOT allowed in ETSI deliverables except when used in direct citation.
Introduction
When signing data, the resultant signature needs to be associated with the data to which it applies. This can be achieved
either by creating a data set which combines the signature and the data that was signed (e.g. by enveloping the data with
the signature or including a signature element in the data set) or placing the (detached) signature in a separate resource
and have some external means for associating the signature with the data to which it applies. While there are some
advantages to the use of detached signatures, most significantly their non-modification of the original data objects, there
remains a risk that the signature becomes separated from the data to which it applies and so losing the association.
Therefore, many application systems have developed their own technique for combining a detached signature with the
signed object in some form of container so that they can be more easily distributed and guarantee that the correct
signature and any relevant metadata is used when validating. The same requirements apply to associate time assertions
(i.e. time-stamp tokens or evidence records) to their associated data.
ETSI
---------------------- Page: 5 ----------------------
6 Draft ETSI EN 319 162-1 V1.0.0 (2015-08)
The present document defines a standardized use of container types to establish a common way for associating files
containing data objects with files containing digital signatures and/or time-assertions. Using a common container form
and associated information will facilitate data interchange and interoperability among various signing and validation
services.
Whilst ZIP [5] provides a basic container structure that can associate files containing data objects (file objects) and the
signature(s) that apply to them, there is a recognized need for additional structure and metadata about the association,
for example to link a particular signature with the file object to which it is applied. Other formats have already been
specified for the use of ZIP based structures to bind together a number of file objects with related metadata. This
includes OCF [4] which was originally designed for use by eBooks but has been adopted as the basis for other
containers, for example ODF [6]. The present document builds on this work specifically addressing the requirements of
associating a digital signature with any type of data, independent of the needs of any particular document or data type.
The present document is intended to cover containers including digital signatures and time-assertions supported by PKI
and public key certificates, and aims to meet the general requirements of the international community to provide trust
and confidence in electronic transactions, including, amongst other, applicable requirements from Regulation (EU)
No 910/2014 [i.3].
The present document is part of a rationalized framework of standards (see ETSI TR 119 000 [i.9]). ETSI
TR 119 100 [i.1] provides guidance on how to use the present document within the aforementioned framework.
ETSI
---------------------- Page: 6 ----------------------
7 Draft ETSI EN 319 162-1 V1.0.0 (2015-08)
1 Scope
The present document specifies Associated Signature Containers (ASiC) which bind together into one single digital
container based on ZIP [5] either detached digital signatures or time-assertions, with a number of file objects
(e.g. documents, XML structured data, spreadsheet, multimedia content) to which they apply.
The present document specifies general purpose ASiC containers building blocks and a limited set of baseline
containers.
ASiC supports the following signature and time assertion formats:
• CAdES digital signatures (ETSI EN 319 122-1 [1] and ETSI EN 319 122-2 [11]);
• XAdES digital signatures (ETSI EN 319 132-1 [2] and ETSI EN 319 132-2 [12]);
• IETF RFC 3161 [3] and updated by IETF RFC 5816 [13] time-stamp tokens; and
• IETF RFC 4998 [8] or IETF RFC 6283 [9] evidence records.
NOTE: No restriction is placed on time assertions eventually used within CAdES/XAdES.
The building blocks defined in the present document support additional features not supported by the aforementioned
formats, such as time-stamping and CAdES signing of multiple content and XAdES parallel signatures, that can be used
in other contexts.
The present document defines baseline containers which provide the basic features necessary for a wide range of
business and governmental use cases for electronic procedures and communications to be applicable to a wide range of
communities when there is a clear need for interoperability.
The present document defines four levels of ASiC baseline containres addressing incremental requirements to maintain
the validity of the containers over the long term, suitably profiled for reducing the optionality as much as possible, in a
way that a certain level always addresses all the requirements addressed at levels that are below it.
ASiC containers specified in the two parts of this multipart deliverable aim at supporting containers in different
regulatory frameworks.
The present document does not address the identification of the validation policy to be used for verifying a container
that contains time-stamp assertions.
2 References
2.1 Normative references
References are either specific (identified by date of publication and/or edition number or version number) or
non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the
referenced document (including any amendments) applies.
Referenced documents which are not found to be publicly available in the expected location might be found at
http://docbox.etsi.org/Reference.
NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee
their long term validity.
The following referenced documents are necessary for the application of the present document.
[1] ETSI EN 319 122-1: "Electronic Signatures and Infrastructures (ESI); CAdES digital signatures;
Part 1: Building blocks and CAdES baseline signatures".
[2] ETSI EN 319 132-1: "Electronic Signatures and Infrastructures (ESI); XAdES digital signatures;
Part 1: Building blocks and XAdES baseline signatures".
[3] IETF RFC 3161: "Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)".
ETSI
---------------------- Page: 7 ----------------------
8 Draft ETSI EN 319 162-1 V1.0.0 (2015-08)
[4] ISO/IEC TS 30135 (all parts): "Information technology -- Digital publishing -- EPUB3".
NOTE: Available at http://idpf.org/epub/30/spec/epub30-ocf.html.
®
[5] PKWARE ".ZIP Application Note".
NOTE 1: If available in time a reference to ISO/IEC 21320-1 (now under development) will possibly be added.
NOTE 2: Available at http://www.pkware.com/support/zip-application-note.
[6] OASIS: "Open Document Format for Office Applications (OpenDocument) Version 1.2;
Part 3: Packages" 29 September 2011.
[7] IETF RFC 3986: "Uniform Resource Identifier (URI): Generic Syntax".
[8] IETF RFC 4998: "Evidence Record Syntax (ERS)".
[9] IETF RFC 6283: "Extensible Markup Language Evidence Record Syntax (XMLERS)".
[10] IETF RFC 1951: "DEFLATE Compressed Data Format Specification version 1.3".
[11] ETSI EN 319 122-2: "Electronic Signatures and Infrastructures (ESI); CAdES digital signatures;
Part 2: Extended CAdES signatures".
[12] ETSI EN 319 132-2: "Electronic Signatures and Infrastructures (ESI); XAdES digital signatures;
Part 2: Extended XAdES signatures".
[13] IETF RFC 5816: "ESSCertIDv2 Update for RFC 3161".
[14] W3C recommendation: "XML Signature Syntax and Processing".
2.2 Informative references
References are either specific (identified by date of publication and/or edition number or version number) or
non-specific. For specific references, only the cited version applies. For non-specific references, the latest version of the
referenced document (including any amendments) applies.
NOTE: While any hyperlinks included in this clause were valid at the time of publication, ETSI cannot guarantee
their long term validity.
The following referenced documents are not necessary for the application of the present document but they assist the
user with regard to a particular subject area.
[i.1] ETSI TR 119 100: "Electronic Signatures and Infrastructures (ESI); Business Driven Guidance for
Signature Creation and Validation".
[i.2] ISO 15489-1: "Information and documentation - Records management - Part 1: General".
[i.3] Regulation (EU) No 910/2014 of the European Parliament and of the Council of 23 July 2014 on
electronic identification and trust services for electronic transactions in the internal market and
repealing Directive 1999/93/EC.
[i.4] ETSI TS 119 312: "Electronic Signatures and Infrastructures (ESI); Cryptographic Suites".
[i.5] IETF RFC 6838: "Media Type Specifications and Registration Procedures".
[i.6] IETF RFC 2045: "Multipurpose Internet Mail Extensions (MIME) Part One: Format of Internet
Message Bodies".
[i.7] ETSI EN 319 422: "Electronic Signatures and Infrastructures (ESI); Time-stamping protocol and
time-stamp profiles".
[i.8] ETSI TS 101 533-1: "Electronic Signatures and Infrastructures (ESI); Data Preservation Systems
Security; Part 1: Requirements for Implementation and Management".
[i.9] ETSI TR 119 000: "Electronic Signatures and Infrastructures (ESI); Rationalized structure for
Electronic Signature Standardization".
ETSI
---------------------- Page: 8 ----------------------
9 Draft ETSI EN 319 162-1 V1.0.0 (2015-08)
[i.10] ETSI TR 119 001: "Electronic Signatures and Infrastructures (ESI); The framework for
standardization of signatures; Definitions and abbreviations".
3 Definitions and abbreviations
3.1 Definitions
For the purposes of the present document, the terms and definitions given in ETSI TR 119 001 [i.10] and the following
apply:
ASiCArchiveManifest file: container file whose name matches "*ASiCArchiveManifest*.xml" containing one
ASiCManifest element instance conforming to clause A.7
ASiCEvidenceRecordManifest file: container file used in ASiC-E to reference a set of files to which an ER applies
whose name matches "META-INF/ASiCEvidenceRecordManifest*.xml" and containing one ASiCManifest element
instance conformant to clause A.4
ASiCManifest file: file whose name matches "*ASiCManifest*.xml" containing one ASiCManifest element instance
conformant to clause A.4
container: file created according to ZIP holding as internal elements files with related manifest, metadata and
associated signature(s), under a folder hierarchy
media type: method to label arbitrary content, carried by MIME [i.6] or other protocols
NOTE: Refer to IETF RFC 6838 [i.5] clause 1.
metadata: data describing context, content and structure of data objects and their management over time
NOTE: Refer to ISO 15489-1: 2001, definition 3.12 with modifications [i.2].
time assertion: time-stamp token or evidence record
3.2 Abbreviations
For the purposes of the present document, the abbreviations given in CAdES [1], XAdES [2] and the following apply:
ASiC Associated Signature Container
ER Evidence Record
NOTE: Refer to [8] and [9].
OCF Open Container Format, as specified in [4].
ODF Open Document Format
NOTE: Refer to [6].
OEBPS Open eBook Publication Structure
TST Time Stamp Token
ZIP Format specified in [5].
4 General Syntax
4.1 Description of main features of Associated Signature
Containers
4.1.1 Basic container structure
The ASiC is a data container holding a set of file objects and associated digital signatures and/or time assertions using
the ZIP [5] format.
ETSI
---------------------- Page: 9 ----------------------
10 Draft ETSI EN 319 162-1 V1.0.0 (2015-08)
Any ASiC container has an internal structure including:
• a root folder, for all the container content possibly including folders reflecting the content structure; and
• a "META-INF" folder, in the root folder, for files containing metadata about the content, including associated
signature or time assertion files.
NOTE: The detached signatures or time assertions are applied in such a way that the integrity of the data is not
broken when the files are extracted from the ZIP container. Hence, the signatures and time assertions used
in ASiC can be verified against the file objects to which they apply when outside the container structure
(for example when placed in local storage).
4.1.2 Container types
Signatures and time assertions within ASiC containers are present within signature or time assertion files.
A signature file can contain either:
• a detached CAdES signature instance, which contains one or more parallel signatures. Each CAdES signature
can be individually counter-signed; or
• one or more XAdES signatures. Each XAdES signatures can be individually counter-signed.
A time assertion file can contain either:
• one time-stamp token conformant to IETF RFC 3161 [3] (which can be profiled as specified in ETSI
EN 319 422 [i.7]); or
• one Evidence Record.
The present document defines two types of containers.
The first type is ASiC Simple (ASiC-S) that associates one single file object with either:
• one signature file; or
• one time assertion file.
This type of container can also include a file named "mimetype" specifying the media type.
This type of container allows to add at a later time additional signatures signing the aforementioned file object and
additional ASiCArchiveManifest files to protect long term time-stamp tokens.
The second type is ASiC Extended (ASiC-E), a container that associates one or more file objects with either:
• one or more XAdES signatures present within one or more signature files and optionally one or more ERS
within one or more time assertion files; or
• one or more CAdES signatures present within one or more signature files and/or one or more time assertions
within one or more time assertion files.
Each signature is associated with all or part of the files in the container.
It is possible to add signature files, time assertion files and data files to an ASiC-E container. The additional signature
and time assertion files can apply to the same set of files or a different set, without invalidating previously applied
signatures or time assertions. Later signatures can also sign signatures applied previously.
NOTE: CAdES and XAdES Archive Time-stamp attributes do not guarantee long term validation of signer files
referenced using ASiCManifest and ds:Manifest.
ETSI
---------------------- Page: 10 ----------------------
11 Draft ETSI EN 319 162-1 V1.0.0 (2015-08)
4.2 General requirements
1) The container format shall comply wi
...
Questions, Comments and Discussion
Ask us and Technical Secretary will try to provide an answer. You can facilitate discussion about the standard in here.