Skip to content

Improve TSL parsing #759

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
metsma wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Improve TSL parsing #759

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
159 changes: 159 additions & 0 deletions doc/references.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,159 @@
# Standards and references {#references}

This page collects the specifications, standards, and additional resources
referenced by the Programmer's Guide and API documentation.

<table><tr><td>\anchor BDOC BDOC2.1:2013</td><td>
BDOC – Format for Digital Signatures. Version 2.1:2013

https://www.skidsolutions.eu/repository/bdoc-spec21.pdf<br />
Other releases:<br />
https://www.skidsolutions.eu/repository/bdoc-spec20.pdf<br />
https://www.skidsolutions.eu/repository/bdoc-spec212.pdf<br />
https://www.id.ee/wp-content/uploads/2020/08/bdoc-spec21-est.pdf<br />
https://www.id.ee/wp-content/uploads/2020/01/bdoc-spec212-est.pdf
</td></tr><tr><td>\anchor DDOC DigiDoc format</td><td>
DigiDoc file format

https://www.id.ee/wp-content/uploads/2020/08/digidoc_format_1.3.pdf
</td></tr><tr><td>\anchor XML-DSIG XML-DSIG</td><td>
IETF RFC 3275: "XML-Signature Syntax and Processing"

https://www.rfc-editor.org/rfc/rfc3275.html
</td></tr><tr><td>\anchor XML-DSIG-1-1 XML-DSIG 1.1</td><td>
XML Signature Syntax and Processing. Version 1.1

https://www.w3.org/TR/xmldsig-core1/
</td></tr><tr><td>\anchor XAdES XAdES</td><td>
ETSI EN 319 132-1 V1.3.1 (2024-07) - Building blocks and XAdES baseline signatures<br />
ETSI TS 101 903 V1.4.2 (2010-12) – XML Advanced Electronic Signatures<br />
ETSI TS 103 171 V2.1.1 (2012-03) - XAdES Baseline Profile

https://www.etsi.org/deliver/etsi_en/319100_319199/31913201/01.03.01_60/en_31913201v010301p.pdf<br />
https://www.etsi.org/deliver/etsi_ts/101900_101999/101903/01.04.02_60/ts_101903v010402p.pdf<br />
https://www.etsi.org/deliver/etsi_ts/103100_103199/103171/02.01.01_60/ts_103171v020101p.pdf
</td></tr><tr><td>\anchor XAdES-Validation XAdES Validation</td><td>
ETSI TS 102 853 V1.1.2 (2012-10) – Signature validation procedures and policies

https://www.etsi.org/deliver/etsi_ts/102800_102899/102853/01.01.02_60/ts_102853v010102p.pdf
</td></tr><tr><td>\anchor CAdES CAdES EN</td><td>
ETSI EN 319 122-1 V1.2.1 (2021-10) - Building blocks and CAdES baseline signatures

https://www.etsi.org/deliver/etsi_en/319100_319199/31912201/01.02.01_60/en_31912201v010201p.pdf
</td></tr><tr><td>\anchor ZIP PKWARE ZIP</td><td>
ZIP File Format Specification

https://www.pkware.com/documents/casestudies/APPNOTE.TXT
</td></tr><tr><td>\anchor OpenDocument OpenDocument</td><td>
OASIS "Open Document Format for Office Applications. Version 1.2 Part 3: Packages"

https://docs.oasis-open.org/office/v1.2/cs01/OpenDocument-v1.2-cs01-part3.html#__RefHeading__752803_826425813<br />
Other versions:<br />
https://docs.oasis-open.org/office/v1.0/OpenDocument-v1.0-os.pdf
</td></tr><tr><td>\anchor ASiC ASiC</td><td>
ETSI EN 319 162-1 V1.1.1 (2016-04) - Associated Signature Containers<br />
ETSI TS 102 918 V1.3.1 (2013-06) - Associated Signature Containers<br />
ETSI TS 103 174 V2.1.1 (2012-03) - ASiC Baseline Profile

https://www.etsi.org/deliver/etsi_en/319100_319199/31916201/01.01.01_60/en_31916201v010101p.pdf<br />
https://www.etsi.org/deliver/etsi_ts/102900_102999/102918/01.03.01_60/ts_102918v010301p.pdf<br />
https://www.etsi.org/deliver/etsi_ts/103100_103199/103174/02.02.01_60/ts_103174v020201p.pdf
</td></tr><tr><td>\anchor PDF PDF (\anchor PAdES PAdES)</td><td>
ETSI EN 319 142-1 V1.1.1 (2016-04) - PAdES digital signatures

https://www.etsi.org/deliver/etsi_en/319100_319199/31914201/01.01.01_60/en_31914201v010101p.pdf<br />
</td></tr><tr><td>\anchor RFC2045 RFC 2045</td><td>
Multipurpose Internet Mail Extensions (MIME) Part One: Format of Internet Message Bodies

https://www.rfc-editor.org/rfc/rfc2045.html
</td></tr><tr><td>\anchor RFC2253 RFC 2253</td><td>
Lightweight Directory Access Protocol (v3): UTF-8 String Representation of Distinguished Names. Obsoleted by RFC 4514.

https://www.rfc-editor.org/rfc/rfc2253.html
</td></tr><tr><td>\anchor RFC4514 RFC 4514</td><td>
Lightweight Directory Access Protocol: String Representation of Distinguished Names

https://www.rfc-editor.org/rfc/rfc4514.html
</td></tr><tr><td>\anchor RFC3161 RFC 3161</td><td>
Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)

The TSTInfo <code>genTime</code> field records the UTC time at which the time-stamp token was created by the Time-Stamping Authority (TSA).

https://www.rfc-editor.org/rfc/rfc3161.html
</td></tr><tr><td>\anchor RFC3739 RFC 3739</td><td>
Internet X.509 Public Key Infrastructure: Qualified Certificates Profile

https://www.rfc-editor.org/rfc/rfc3739.html
</td></tr><tr><td>\anchor RFC3986 RFC 3986</td><td>
Uniform Resource Identifier (URI): Generic Syntax

https://www.rfc-editor.org/rfc/rfc3986.html
</td></tr><tr><td>\anchor RFC4051 RFC 4051</td><td>
Additional XML Security Uniform Resource Identifiers. Obsoleted by RFC 6931.

https://www.rfc-editor.org/rfc/rfc4051.html
</td></tr><tr><td>\anchor RFC6931 RFC 6931</td><td>
Additional XML Security Uniform Resource Identifiers. Obsoletes RFC 4051 and is obsoleted by RFC 9231.

https://www.rfc-editor.org/rfc/rfc6931.html
</td></tr><tr><td>\anchor RFC9231 RFC 9231</td><td>
Additional XML Security Uniform Resource Identifiers

https://www.rfc-editor.org/rfc/rfc9231.html
</td></tr><tr><td>\anchor RFC4519 RFC 4519</td><td>
Lightweight Directory Access Protocol: Schema for User Applications

https://www.rfc-editor.org/rfc/rfc4519.html
</td></tr><tr><td>\anchor RFC5035 RFC 5035</td><td>
Enhanced Security Services (ESS) Update: Adding CertID Algorithm Agility

https://www.rfc-editor.org/rfc/rfc5035.html
</td></tr><tr><td>\anchor RFC5280 RFC 5280</td><td>
Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile

https://www.rfc-editor.org/rfc/rfc5280.html
</td></tr><tr><td>\anchor RFC6960 RFC 6960</td><td>
X.509 Internet Public Key Infrastructure Online Certificate Status Protocol (OCSP)

https://www.rfc-editor.org/rfc/rfc6960.html
</td></tr><tr><td>\anchor RFC8954 RFC 8954</td><td>
Online Certificate Status Protocol (OCSP) Nonce Extension

https://www.rfc-editor.org/rfc/rfc8954.html
</td></tr><tr><td>\anchor TSL Trusted Lists</td><td>
ETSI TS 119 612 V2.4.1 (2025-08) – Electronic Signatures and Trust Infrastructures (ESI); Trusted Lists<br />
ETSI TS 119 612 V2.2.1 (2016-04) – Electronic Signatures and Infrastructures (ESI); Trusted Lists

https://www.etsi.org/deliver/etsi_ts/119600_119699/119612/02.04.01_60/ts_119612v020401p.pdf<br />
https://www.etsi.org/deliver/etsi_ts/119600_119699/119612/02.02.01_60/ts_119612v020201p.pdf
</td></tr><tr><td>\anchor SiVa SiVa</td><td>
Digital signature validation web service that provides SOAP and JSON API to validate files

https://open-eid.github.io/SiVa/
</td></tr><tr><td>\anchor rel-notes Release notes</td><td>
Libdigidocpp library’s release notes
</td></tr><tr><td>\anchor nat-cert ETSI EN 319 412-2 V2.4.1</td><td>
ETSI EN 319 412-2 V2.4.1 – Certificate Profiles; Part 2: Certificate profile for certificates issued to natural persons<br />
ETSI TS 102 280 V1.1.1 – X.509 V3 Certificate Profile for Certificates Issued to Natural Persons

https://www.etsi.org/deliver/etsi_en/319400_319499/31941202/02.04.01_60/en_31941202v020401p.pdf<br />
https://www.etsi.org/deliver/etsi_ts/102200_102299/102280/01.01.01_60/ts_102280v010101p.pdf
</td></tr><tr><td>\anchor QC-cert QC Certificate Profiles</td><td>
ETSI EN 319 412-1 V1.7.1 – Certificate Profiles; Part 1: Overview and common data structures<br />
ETSI EN 319 412-5 V2.6.1 – Certificate Profiles; Part 5: QCStatements

https://www.etsi.org/deliver/etsi_en/319400_319499/31941201/01.07.01_60/en_31941201v010701p.pdf<br />
https://www.etsi.org/deliver/etsi_en/319400_319499/31941205/02.06.01_60/en_31941205v020601p.pdf
</td></tr><tr><td>\anchor QC-policy QC Certificate Policy</td><td>
ETSI EN 319 411-2 V2.6.1 – Policy requirements for Trust Service Providers issuing EU qualified certificates<br />
ETSI TS 101 456 V1.4.3 (2007-05) – Policy requirements for certification authorities issuing qualified certificates

https://www.etsi.org/deliver/etsi_en/319400_319499/31941102/02.06.01_60/en_31941102v020601p.pdf<br />
https://www.etsi.org/deliver/etsi_ts/101400_101499/101456/01.04.03_60/ts_101456v010403p.pdf
</td></tr><tr><td>\anchor DD-libs DigiDoc libraries</td><td>
https://www.id.ee/en/rubriik/digidoc-libraries/
</td></tr><tr><td>\anchor openeid-github ID-software GitHub project</td><td>
https://github.com/open-eid
</td></tr><tr><td>\anchor cpp-github Libdigidocpp GitHub project</td><td>
https://github.com/open-eid/libdigidocpp
</td></tr></table>
42 changes: 42 additions & 0 deletions doc/terms.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
# Terms and acronyms {#terms}

<table><tr><td>ASiC</td><td>
Associated Signature Containers
</td></tr><tr><td>ASiC-E</td><td>
Extended Associated Signature Containers. A type of ASiC container.
</td></tr><tr><td>ASiC-S</td><td>
Associated Signature Container Simple form. A type of ASiC container.
</td></tr><tr><td>BDOC 2.1 (.bdoc)</td><td>
Term is used to denote a digitally signed file format which is a profile of XAdES and follows container packaging rules based on OpenDocument and ASiC standards. The document format has been defined in \ref BDOC "BDOC2.1:2013"; an overview is provided on the \ref format "Format of digitally signed file" page.
</td></tr><tr><td>CRL</td><td>
Certificate Revocation List, a list of certificates (or more specifically, a list of serial numbers for certificates) that have been revoked, and therefore should not be relied upon.
</td></tr><tr><td>DIGIDOC-XML (.ddoc)</td><td>
The term is used to denote a DigiDoc document format that is based on the XAdES standard and is a profile of that standard. The current version is 1.3 which has been described in \ref DDOC "DigiDoc format".
</td></tr><tr><td>ECDSA</td><td>
Elliptic Curve Digital Signature Algorithm. Digital Signature Algorithm (DSA) which uses elliptic curve cryptography. Used as an alternative to RSA algorithm.
</td></tr><tr><td>OCSP</td><td>
Online Certificate Status Protocol, an Internet protocol used for obtaining the revocation status of an X.509 digital certificate
</td></tr><tr><td>OCSP Responder</td><td>
OCSP Server, maintains a store of CA-published CRLs and an up-to-date list of valid and invalid certificates. After the OCSP responder receives a validation request (typically an HTTP or HTTPS transmission), the OCSP responder either validates the status of the certificate using its own authentication database or calls upon the OCSP responder that originally issued the certificate to validate the request. After formulating a response, the OCSP responder returns the signed response, and the original certificate is either approved or rejected, based on whether or not the OCSP responder validates the certificate.
</td></tr><tr><td>PAdES (.pdf)</td><td>
Term is used to denote a digitally signed PDF file format which is based on \ref PAdES standards.
</td></tr><tr><td>SK</td><td>
SK ID Solutions AS. Certificate Authority in Estonia
</td></tr><tr><td>time-mark</td><td>
Mechanism used for adding certificate validity and signing time information with the signature.
The information is provided with a special OCSP confirmation (also referred to as time-mark) - hash value of the binary value of the signature (along with hash algorithm identifier in case of BDOC 2.1 document format) must be present in the "nonce" field of the OCSP confirmation. In this case, signature creation time is the issuance time of the OCSP confirmation (producedAt value in the confirmation), additional time-stamp service is not required. The respective signature profile is TM profile (supported in case of DIGIDOC-XML 1.3 and BDOC 2.1 document formats).
</td></tr><tr><td>time-stamp</td><td>
Mechanism used for adding certificate validity and signing time information with the signature. The certificate validity information is added to the signature with an OCSP confirmation; the signing time information is added with a time-stamp token retrieved form a time-stamping service. In this case, signature creation time is the issuance time (\ref RFC3161 "RFC 3161 TSTInfo.genTime") of the time-stamp token. The respective signature profile is TS profile.
</td></tr><tr><td>archive time-stamp</td><td>
Mechanism used for providing long term validity of a XAdES signature. The signature and validation data values are time-stamped. The respective signature profile is TSA profile.
</td></tr><tr><td>TSA</td><td>
Time-Stamping Authority. Time-stamping service provider.
</td></tr><tr><td>TSL</td><td>
Trust Service status List. Signed list that provides information about the status and the status history of the trust services (including certification, OCSP confirmation and time-stamping services). Used as a trust anchor in case of signature creation and validation to check the trustworthiness of the certificates that are included in the signature. See also \ref TSL "Trusted Lists"
</td></tr><tr><td>X.509</td><td>
an ITU-T standard for a public key infrastructure (PKI) and Privilege Management Infrastructure (PMI) which specifies standard formats for public key certificates, certificate revocation lists, attribute certificates, and a certification path validation algorithm
</td></tr><tr><td>XAdES</td><td>
XML Advanced Electronic Signatures, a set of extensions to XML-DSIG recommendation making it suitable for advanced electronic signature. Specifies precise profiles of XML-DSIG for use with advanced electronic signature in the meaning of European Union Directive 1999/93/EC.
</td></tr><tr><td>XML-DSIG</td><td>
a general framework for digitally signing documents, defines an XML syntax for digital signatures and is defined in the W3C recommendation XML Signature Syntax and Processing
</td></tr></table>
2 changes: 2 additions & 0 deletions etc/Doxyfile.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1029,6 +1029,8 @@ WARN_LOGFILE =
INPUT = @PROJECT_SOURCE_DIR@/src \
@PROJECT_SOURCE_DIR@/libdigidocpp.dox \
@PROJECT_SOURCE_DIR@/doc/digidoc-tool.md \
@PROJECT_SOURCE_DIR@/doc/references.md \
@PROJECT_SOURCE_DIR@/doc/terms.md
@PROJECT_SOURCE_DIR@/RELEASE-NOTES.md

# This tag can be used to specify the character encoding of the source files
Expand Down
Loading