Introduction into CAdES for Trust Service Providers

The term CAdES stands for CMS Advanced Electronic Signatures. The Cryptographic Message Syntax (CMS) provides a framework for digitally signed documents, including PDF or emails. This article introduces the relevant signature policies associated with CAdES and takes a deeper look at main formats and validation data. 

 CAdES defines eight profiles that offer different levels of protection to be used with CMS signed data in accordance to the eIDAS regulation / European Union Electronic Signatures Directive. With CAdES, electronically signed documents are able to remain valid for years, even if the signer or verifier of the document attempts to contest its validity in the future.

Other eIDAS-compliant signature designs are PAdES and XAdES.

Signature Policies

Signature policies associated with CAdES can be used to establish the consistency of validated electronic signatures. When the verifier uses the comprehensive signature policy that the signer has specified or as has been implied by the signed data, they will receive a consistent result when attempting to validate an electronic signature.

However, if the signer or the signed data do not specify which signature policy has been used, or if the signature policy appears incomplete, the results achieved by the verifiers may be inconsistent. It is recommended that in order to maintain consistency, both the signer and verifier agree upon the same comprehensive signature policy.

Two Main Formats 

In conformance with ETSI TS 101 733 V2.2.1 (2013-04) TS 101 733 V2.2.1 (2013-04) specifications, the signer must create their signature in one of two formats CAdES Basic Electronic Signature (CAdES-BES) or CAdES Explicit Policy Electronic Signature (CAdES-EPES).

A signature created under CAdES Basic Electronic Signature will contain:

• Signed user data (document being sent)
• A collection of mandatory signed attributes
  • Content-type
  • Message-digest
  • ESS signing-certificate or ESS signing-certificate-v2
• Additional mandatory signed attributes (as defined in sent document)
• Digital signature value that has been computed on the user data and signed attributes

Additionally, a CAdES Basic Electronic Signature may contain optional signed attributes, including:

• Signing-time
• Content-hints
• Content-reference
• Content-identifier
• Commitment-type-indication
• Signer-location
• Signer-attributes
• Content-time-stamp
• Mime-type

A CAdES Explicit Policy Electronic Signature uses a signed attribute (sigPolicyID) to further extend the electronic signature’s definition to have it conform to an identified signature policy.

Formats with Validation Data

Additional validation data can be added to both CAdES-BES and CAdES-EPES formats to further validate an electronic signature. This data may be collected by the signer or the verifier, or both. This additional data may include:

• Public Key Certificates (PKCs)
• Revocation status information for individual PKCs
• Trusted time-stamp in addition to default time-mark
• If applicable, information regarding signature policy used to verify electronic signature

Dependent upon the above validation data chosen, the following specified CAdES formats will apply when using either the CAdES-BES or CAdES-EPES formats to create the electronic signature:

• CAdES-T – Electronic Signature with Time. This format applies when a trusted time is associated with the electronic signature either by adding an unsigned time-stamp attribute or the Trusted Service Provider provides a time-mark.
• CAdES-C – Electronic Signature with Complete Validation Data References. This format adds both complete-certificate-references and complete-revocation-references attributes to CAdES-T.
• CAdES-C – Extended Electronic Signature Formats. Formats under this category extend CAdES-C validation by adding unsigned attributes to the electronic signature that are used when verification of the signed document is required for a very long period.
  • CAdES-X Long – Extended Long Electronic Signature. This option adds certificate-values and revocation-values attributes that provide certificate and revocation information for validation and a means to prevent this information from being lost.
  • CAdES-X Type 1 – Extended Electronic Signature with Time Type 1. This option adds a time-stamp attribute that is based on the time-stamp token created with CAdES-C and can protect keys from being compromised.
  • CAdES-X Type 2 – Extended Electronic Signature with Time Type 2. This option adds the CAdES-C-time-stamped-cert-crls-reference attribute, which provides a time-stamp token in reference to certification path and revocation information to protect keys from future compromise.
  • CAdES-X Long Type 1 or 2 – Extended Electronic Signature with Time. This option combines CAdES-X Long with either CAdES-X Type 1 or CAdES-X Type 2.
• CAdES-A – Archival Electronic Signature. Formats under this category allow for backward compatibility and preservation of long-term signature validation for archived documents.
  • CAdES-A – Archival Electronic Signature with archive-time-stamp (ATSv2) attribute. This option adds one or more archive-time-stamp attributes to CAdES-X Long or a CAdES-X Long Type 1 or 2.
  • CAdES-A – Archival Electronic Signature with archive-time-stamp (ATSv2) attribute. This option can be added to CAdES-BES, CAdES-EPES, CAdES-T, CAdES-C, CAdES-X, CAdES-XL or CAdES-A for long-term archiving of signatures.
• CAdES-LT – Long-Term Electronic Signature. This format adds one or more long-term-validation attributes to CAdES-T, CAdES-C, CAdES-X Long, CAdES-X Long Type 1 or 2 or a CAdES-A to allow for archiving long-term signatures. It can be used to protect the entire document and signature before sending it to a preservation service.

For a complete technical description of CMS Advanced Electronic Signatures, refer to
ETSI TS 101 733 Electronic Signature and Infrastructure (ESI) – CMS Advanced Electronic Signature (CAdES). 

For signature solutions for Trust Service Providers by Cryptomathic refer to the "Signer".

 References and Further Reading

• Selected articles on Digital Signatures (2014-16), by Ashiq JA, Dawn M. Turner, Guillaume Forget, Peter Landrock and Torben Pedersen  
• Trust Services and eID (retrieved 11.01.2016) by the European Commission
• REGULATION (EU) No 910/2014  on electronic identification and trust services for electronic transactions in the internal market and repealing Directive 1999/93/EC(2014) by the European Parliament and the European Commission
• Electronic Signatures and Infrastructures (ESI) - CMS Advanced Electronic Signature (CAdES). (2013) by the European Telecommunications Standards Institute

Cover image: courtesy of Steve Wilson, Flickr