CAdES (computing)

From Wikipedia, the free encyclopedia
Jump to: navigation, search
For other uses, see Cades.

CAdES (CMS Advanced Electronic Signatures) is a set of extensions to Cryptographic Message Syntax (CMS) signed data making it suitable for advanced electronic signature.

Description[edit]

While CMS is a general framework for digitally signing documents such as E-Mail(S/MIME) or PDF, CAdES specifies precise profiles of CMS signed data for use with advanced electronic signature in the meaning of European Union Directive 1999/93/EC.

One important benefit of CAdES is that electronically signed documents can remain valid for long periods, even if underlying cryptographic algorithms are broken.


The main document describing the format is ETSI TS 101 733 Electronic Signature and Infrastructure (ESI) – CMS Advanced Electronic Signature (CAdES).

The first issue of this TS is V1.2.2 (2000-12), the latest is V2.2.1 (2013-04). At the moment (April 2014th) there are ativities on creating new CAdES standard. All documents could be found at [1]. The ETSI TS V.1.7.4 (2008-07) is technically equivalent to RFC 5126.

RFC 5126 document builds on existing standards that are widely adopted. These includes

  • RFC 3852 : "Cryptographic Message Syntax (CMS)"
  • ISO/IEC 9594-8/ITU-T Recommendation X.509 "Information technology - Open Systems Interconnection - The Directory: Authentication framework"
  • RFC 3280 "Internet X.509 Public Key Infrastructure (PKIX) Certificate and Certificate Revocation List (CRL) Profile"
  • RFC 3161 "Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)".

Profiles[edit]

CAdES defines eight profiles (forms) differing in protection level offered. Each profile includes and extends the previous one:

  • CAdES-BES, basic form just satisfying Directive legal requirements for advanced signature;
  • CAdES-T (timestamp), adding timestamp field to protect against repudiation;
  • CAdES-C (complete), adding references to verification data (certificates and revocation lists) to the signed documents to allow off-line verification and verification in future (but not storing actual verification data);
  • CAdES-X (extended), adding timestamps on the references introduced by CAdES-C to protect against possible compromise of certificates in chain in future;
  • CAdES-X-L (extended long-term), adding actual certificates and revocation lists to the signed document to allow verification in future even if their original source is not available;
  • CAdES-A v2 (archival, version 2), adding possibility for periodical timestamping (e.g. each year) of the archived document to prevent compromise caused by weakening signature during long-time storage period. In latest CAdES standard the profile in fact considered "deprecated".
  • CAdES-LT (long term), adding usage of "tree-hashing" algorithm and "evidence records" (RFC 4998). In latest CAdES standard the profile in fact considered "deprecated".
  • CAdES-A v3 (archival, version 3). Most flexible profile, introduced fixes for almost all CAdES problems.

See also[edit]

External links[edit]