Jump to content

CAdES (computing)

From Wikipedia, the free encyclopedia
This is an old revision of this page, as edited by 37.247.91.205 (talk) at 07:53, 1 March 2016 (the reference section was missing. I added it.). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.
For other uses, see Cades.

CAdES (CMS Advanced Electronic Signatures) is a set of extensions to Cryptographic Message Syntax (CMS) signed data making it suitable for advanced electronic signature.

Description

While CMS is a general framework for digitally signing documents such as email (S/MIME) or PDF, CAdES specifies precise profiles of CMS signed data for use with the legally binding EU regulation on electronic identification and trust services for electronic transactions in the internal market (eIDAS), a regulation that enhances and expands the Electronic Signatures Directive 1999/93/EC.[1][2]

An important property of CAdES is that electronically signed documents can remain valid for long periods, even if the signer or verifying party later attempts to deny the validity of the signature.

The main document describing the format is ETSI TS 101 733 Electronic Signature and Infrastructure (ESI) – CMS Advanced Electronic Signature (CAdES).

The first issue of this TS is V1.2.2 (2000-12), the latest is V2.2.1 (2013-04). At the moment (April 2014th) there are activities on creating new CAdES standard. All documents could be found at [1]. The ETSI TS V.1.7.4 (2008-07) is technically equivalent to RFC 5126.

RFC 5126 document builds on existing standards that are widely adopted. These includes

  • RFC 3852 : "Cryptographic Message Syntax (CMS)"
  • ISO/IEC 9594-8/ITU-T Recommendation X.509 "Information technology - Open Systems Interconnection - The Directory: Authentication framework"
  • RFC 3280 "Internet X.509 Public Key Infrastructure (PKIX) Certificate and Certificate Revocation List (CRL) Profile"
  • RFC 3161 "Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)".

Profiles

CAdES defines eight profiles (forms) differing in protection level offered. Each profile includes and extends the previous one:

  • CAdES-BES, basic form just satisfying Directive legal requirements for advanced signature;
  • CAdES-T (timestamp), adding timestamp field to protect against repudiation;
  • CAdES-C (complete), adding references to verification data (certificates and revocation lists) to the signed documents to allow off-line verification and verification in future (but not storing actual verification data);
  • CAdES-X (extended), adding timestamps on the references introduced by CAdES-C to protect against possible compromise of certificates in chain in future;
  • CAdES-X-L (extended long-term), adding actual certificates and revocation lists to the signed document to allow verification in future even if their original source is not available;
  • CAdES-A v2 (archival, version 2), adding possibility for periodical timestamping (e.g. each year) of the archived document to prevent compromise caused by weakening signature during long-time storage period. In latest CAdES standard the profile in fact considered "deprecated".
  • CAdES-LT (long term), adding usage of "tree-hashing" algorithm and "evidence records" (RFC 4998). In latest CAdES standard the profile in fact considered "deprecated".
  • CAdES-A v3 (archival, version 3). Most flexible profile, introduced fixes for almost all CAdES problems.

See also

References

  1. ^ THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION. "REGULATION (EU) No 910/2014 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 23 July 2014". Official Journal of the European Union. Retrieved 1 March 2016.
Retrieved from "https://en.wikipedia.org/w/index.php?title=CAdES_(computing)&oldid=707697273"