BDoc specific modifications

Overview of the BDOC specific modifications

BDOC is basically ASIC-E containing XAdES LT TimeMark (not TimeStamp) signatures. Time Mark means that our OCSP responses also contain TimeStamping information. OCSP requests contain signature hash and responses are signed by the OCSP responder. OCSP responses are always added to the signature during signature creation and signatures without OCSP responses are not valid. This means that a separate TimeStamp element is not necessary, because OCSP response contains all the necessary data. OCSP “ProducedAt” time is trusted time.

1. This means that BDOC signature is without TimeStamp element, but still has BASELINE_LT signature level. This commit here makes sure that the correct signature level would be used https://github.com/open-eid/sd-dss/commit/e865f734886dc5987109d1a7e2fbbbc1770a4ad3

2. When creating XAdES LT level signatures, then TimeStamp should not be taken, only OCSP This commit stops TimeStamp from being taken https://github.com/open-eid/sd-dss/commit/5bd5e78dad00fbe35debc8ae5fe1b274eeab1477 (also includes change 3) Perhaps this functionality should be somewhere else and not in XAdESLevelBaselineT.java?

3. BDOC signatures contain Policy ID with Qualifier attribute (also included in the previous commit) Policy ID value is “urn:oid:1.3.6.1.4.1.10015.1000.3.2.1” and Qualifier attribute value is “OIDAsURN”. Perhaps it would make sense to have Qualifier attribute included in the Policy.java file instead? It would make it configurable for us. (https://github.com/esig/dss/blob/master/dss-model/src/main/java/eu/europa/esig/dss/Policy.java)

4. BDOC signature Policy also contains URL to the BDOC specification: https://www.sk.ee/repository/bdoc-spec21.pdf This is just a PDF document written in English, so it should not be downloaded during validation process. This exclusion has been added to SignedDocumentValidator class. https://github.com/open-eid/sd-dss/commit/e5d89e20d16571f7516f61c3faf489d9c9919335

5. BDOC OCSP responder certificate element should have RESPONDER_CERT id (for legacy backward compatibility reasons) https://github.com/open-eid/sd-dss/commit/b6ed135267d4eced710998f1f6d10882f1405105 I’m not sure how to include that without forking DSS.

6. BDOC XAdES data file reference URI-s with special symbols (like + ! ‘ ( ) ~) must be encoded slightly differently (for legacy backward compatibility reasons) https://github.com/open-eid/sd-dss/commit/558ab7a0a785d84e99ff83974d457282d6859165 https://github.com/open-eid/sd-dss/commit/2032aa2b459146ffaf007be32d4f76dda04c0d32 Perhaps it would be possible to set custom OfflineResolver and encoder classes through DSS API?

7. Support for setting signature (deterministic) id. This is not part of the BDOC standard, but our library uses that. I tried to make a pull request out of it, but I discovered, that it would break CADES and PADES signatures, so I didn’t do it. https://github.com/open-eid/sd-dss/commit/f66363e0ae8cd26683f41a3571847cad750b319d

Changes introduced for BDoc support after merging with DSS version 4.6RC1 (and 4.7.RC1)

These changes listed here are too Estonian BDoc standard specific and are not included in the main DSS repository.

BDoc container must contain manifest.xml (obsolete)

• Storing manifest.xml file in asic container: https://github.com/open-eid/sd-dss/commit/a12da46d3de0cbfc2f605e83690884d07dd3e9d6
• Manifest has been added to the main repository, so keeping it in our own fork is redundant: https://github.com/open-eid/sd-dss/commit/cbc5b31f11ee7de6e2f05db9471aae3aefc6147e

Do not add a timestamp for BDoc-TM (timemark) signatures

• #74204488 BDoc-TM support - adding TM Policy ID and Qualifier: https://github.com/open-eid/sd-dss/commit/5bd5e78dad00fbe35debc8ae5fe1b274eeab1477

BDoc-TM should contain Policy ID and Qualifier

• #74204488 BDoc-TM support - adding TM Policy ID and Qualifier: https://github.com/open-eid/sd-dss/commit/5bd5e78dad00fbe35debc8ae5fe1b274eeab1477

BDoc-TM policy pdf specification should not be downloaded

• BDoc-TM specification mandates xades signatures to include policy URI containing a link to BDoc-TM specification
• That BDoc-TM specification is written in plain English and stored as a PDF document - hopeless case for any automated verification attempts
• DSS should not try to download and verify that PDF
• #74204488 do not try to downoad and verify bdoc-tm policy pdf specification: https://github.com/open-eid/sd-dss/commit/a22780989572f19480ecaaca1ab5561f06185474
• BDoc-TM support - handle policy id with whitespace and line break characters: https://github.com/open-eid/sd-dss/commit/e5d89e20d16571f7516f61c3faf489d9c9919335

BDoc-TM OCSP responder certificate element should have RESPONDER_CERT id

• This is very jDigidoc specific. Not part of the standard
• Needed for jDigidoc compatibility
• BDoc-TM OCSP responder certificate element should have RESPONDER_CERT id that is needed by jDigiDoc: https://github.com/open-eid/sd-dss/commit/eeb4a951eba3bda62cba3ef0ce47c31d61b82c68
• https://github.com/open-eid/sd-dss/commit/b6ed135267d4eced710998f1f6d10882f1405105

Support for setting signature id

• Possibility to set signature id
• Could be part of the main DSS library, but not all the signature forms would support it out of the box (would need more work)
• Added support for setting signature id: https://github.com/open-eid/sd-dss/commit/f66363e0ae8cd26683f41a3571847cad750b319d

Encoding data file reference URIs

• BDoc data file reference URIs must be encoded in xades signatures: https://github.com/open-eid/sd-dss/commit/558ab7a0a785d84e99ff83974d457282d6859165
• Support for jDigidoc legacy URI encodings: https://github.com/open-eid/sd-dss/commit/2032aa2b459146ffaf007be32d4f76dda04c0d32 and https://github.com/open-eid/sd-dss/commit/9173c8ded2dc9395d723a0d427f72e29afd85ca1

BDoc-TM signatures should be considered to have XAdES_BASELINE_LT level

• BDoc-TM does not have a timestamp so technically it should not be considered as 'T' level - containing Trusted Time
• But BDoc-TM has a timeMark which is embedded in OCSP response - Trusted Time is hidden in OCSP response
• Therefore we say f... it, it's still XAdES_BASELINE_LT
• #74204488 BDoc-TM signatures without timestamp are also considered to have XAdES_BASELINE_LT level: https://github.com/open-eid/sd-dss/commit/669b06191d9bdc84df59a76bba1f33e54c706b54
• https://github.com/open-eid/sd-dss/commit/d83f9f73d25d1bc75c052e4d6acb93f083198f36
• If EPES profile, then it's not T level: https://github.com/open-eid/sd-dss/commit/e865f734886dc5987109d1a7e2fbbbc1770a4ad3

Use user-agent Zip comment in asic containers (obsolete)

• We want to know what created a container: which library, version etc
• #74203294 support for adding zip comments to bdoc containers: https://github.com/open-eid/sd-dss/commit/eaef6c1ce80c92a82c46044bb0529632f85e1bd7
• This is now obsolete. ASIC is manipulated directly in D4J.

Made DSS buildASiCContainer method public (obsolete)

• Technical commit so DigiDoc4j could manipulate the contents of asic containers
• Made buildASiCContainer method public so it would be possible to remove BDoc signatures in Digidoc4j: https://github.com/open-eid/sd-dss/commit/be54d3af0fba54ab012b13d01d518a092ab0a8cc
• This is now obsolete.

Default signing certificate digest method is SHA-256 (obsolete)

• The new DSS API doesn't allow setting xades signature signing certificate digest method through asic parameters and that xades parameter is not accessible
• DigiDoc4j set it to SHA-256 before
• When DigiDoc4j starts manipulating asic containers without DSS, then it's possible to specify this parameter in the xades parameters property when Xades signature service is used directly
• #100649370 setting default signing certificate digest method to sha256 (temporarily): https://github.com/open-eid/sd-dss/commit/fa47665de4b8e49af46739847184b81c330d9a9a
• This is now obsolete. This parameter can be set through D4J.