CAdES (computing)
CAdES (CMS Advanced Electronic Signatures) is a set of extensions to Cryptographic Message Syntax(CMS) signed data making it suitable for advanced electronic signature.
Contents |
[edit] Description
While CMS is a general framework for digitally signing documents such as E-Mail(S/MIME) or PDF, CAdES specifies precise profiles of CMS signed data for use with advanced electronic signature in the meaning of European Union Directive 1999/93/EC.
One important benefit from CAdES is that electronically signed documents can remain valid for long periods, even if underlying cryptographic algorithms are broken.
The main document describing the format is ETSI TS 101 733 Electronic Signature and Infrastructure (ESI) – CMS Advanced Electronic Signature (CAdES).
The first issue of this TS is V1.2.2 (2000-12), the latest is V1.8.3 (2011-01). This ETSI TS V.1.7.4 (2008-07) is technically equivalent to RFC 5126.
RFC 5126 document builds on existing standards that are widely adopted. These includes
- RFC 3852 : "Cryptographic Message Syntax (CMS)"
- ISO/IEC 9594-8/ITU-T Recommendation X.509 "Information technology - Open Systems Interconnection - The Directory: Authentication framework"
- RFC 3280 "Internet X.509 Public Key Infrastructure (PKIX) Certificate and Certificate Revocation List (CRL) Profile"
- RFC 3161 "Internet X.509 Public Key Infrastructure Time-Stamp Protocol (TSP)".
[edit] Profiles
CAdES defines six profiles (forms) differing in protection level offered. Each profile includes and extends the previous one:
- CAdES, basic form just satisfying Directive legal requirements for advanced signature;
- CAdES-T (timestamp), adding timestamp field to protect against repudiation;
- CAdES-C (complete), adding references to verification data (certificates and revocation lists) to the signed documents to allow off-line verification and verification in future (but not storing actual verification data);
- CAdES-X (extended), adding timestamps on the references introduced by CAdES-C to protect against possible compromise of certificates in chain in future;
- CAdES-X-L (extended long-term), adding actual certificates and revocation lists to the signed document to allow verification in future even if their original source is not available;
- CAdES-A (archival), adding possibility for periodical timestamping (e.g. each year) of the archived document to prevent compromise caused by weakening signature during long-time storage period.
[edit] See also
- European Telecommunications Standards Institute (ETSI)
- Cryptographic Message Syntax
- XAdES, XML Advanced Electronic Signature
- PAdES, PDF Advanced Electronic Signature
- Trusted timestamping
