PdfNetStack.Signing namespace
Package: PdfNetStack
Classes
Section titled “Classes”The checks made on one certificate of a chain.
The certificate checks for a signer or a time stamp authority: a chain to a trust anchor, then validity, usage, name constraints and revocation of each certificate at the validation time, certificate policies along the chain, and the qualified status the certificate claims.
Where a PKI disclosure statement can be read (QcPDS), and its language.
A transaction limit (QcLimitValue): the amount and the ISO 4217 currency, alphabetic or numeric.
The qualified certificate statements of a certificate (RFC 3739 and ETSI EN 319 412-5), as the certificate states them.
A certificate whose revocation status is needed, with what the application needs to fetch it.
DER encoded revocation data: OCSP responses (RFC 6960 OCSPResponse, or a BasicOCSPResponse) and CRLs (RFC 5280 CertificateList). As a source it offers all of them for every certificate; the library keeps only those that match and verify.
One element of a service’s Qualifications extension (ETSI TS 119 612, 5.5.9.2): qualifiers, such as QCWithQSCD or QCForESeal, that apply to the certificates its criteria select.
A visible signature: a box on a page with the signer’s name and the date.
What Verify found about one signature or document timestamp.
How to sign.
PAdES baseline signatures (ETSI EN 319 142-1): B-B with a CAdES detached CMS signature, B-T with an RFC 3161 signature timestamp, B-LT with validation data in the document security store, and B-LTA with a document timestamp over it all. Every step is an incremental update, so earlier signatures stay valid.
An RFC 3161 time stamp authority. The library builds the request and checks the reply; the application supplies the transport, usually an HTTP POST of the request with content type application/timestamp-query that returns the application/timestamp-reply body. The library itself never opens a connection.
An RFC 3161 timestamp found in a signature or forming a document timestamp.
A trust service of a trusted list, with its current information and its history.
What a trusted list says about a service at one period: its current information or one entry of its history.
A trust service provider of a trusted list.
The service type identifiers of ETSI TS 119 612 (5.5.1.1) that qualification uses.
A trusted list of ETSI TS 119 612: the EU list of trusted lists or a national list, read from XML the application supplies, with its signature checked against certificates the application supplies. The library never downloads a list.
A pointer to another trusted list (ETSI TS 119 612, 5.3.13), as the EU list of trusted lists points to each national list.
The qualification of a signature confirmed against the trusted lists in TrustedLists, as ETSI TS 119 615 describes: the CA/QC service that issued the certificate, its status at the certificate’s issuance and at the signing time, the qualifiers that apply, and the certificate’s QCStatements.
What Verify checks certificates against.
Interfaces
Section titled “Interfaces”Supplies revocation data: OCSP responses and CRLs. The library asks for each certificate it needs; the application fetches them however it likes (HTTP, a cache, files) or returns none. The library never opens a connection itself.
The outcome of one check.
The hash a signature uses.
What a qualified certificate is issued for (ETSI EN 319 412-5, QcType).
The qualification of a signature, named as ETSI TS 119 102-2 names signature qualifications. Qualification reads it from the certificate’s QCStatements alone; Qualification confirms it against the EU trusted lists the application supplies, which the library never downloads.
The status of a trust service in a trusted list (ETSI TS 119 612, 5.5.4), current or past.
Where the time certificates were checked at comes from.