DigiDoc security model

The general security model of the DigiDoc and OpenXAdES ideology works by obtaining
proof of validity of the signer’s X.509 digital certificate issued by a certificate authority (CA) at
the time of signature creation.

This proof is obtained in the format of Online Certificate Status Protocol (OCSP) response
and stored within the signed document. Furthermore, (hash of the) created signature is sent
within the OCSP request and received back within the response. This allows interpreting of
the positive OCSP response as “at the time I saw this digitally signed file, corresponding
certificate was valid”.

The OCSP service is acting as a digital e-notary confirming signatures created locally with a
smart card. From infrastructure side, this security model requires a standard OCSP
responder. Hash of the signature is placed on the “nonce” field of the OCSP request
structure. In order to achieve the freshest certificate validity information, it is recommended
to run the OCSP responder in “real-time” mode meaning that:

  • certificate validity information is obtained from live database rather than from
    CRL (Certificate Revocation List)
  • the time value in the OCSP response is actual (as precise as possible)

To achieve long-time validity of digital signatures, a secure log system is employed within the
model. All OCSP responses and changes in certificate validity are securely logged to
preserve digital signature validity even after private key compromise of CA or OCSP
responder. It is important to notice that additional time-stamps are not necessary when
employing the security model described:

  • time of signing and time of obtaining validity information is indicated in the OCSP
  • the secure log provides for long-time validity without need for archival

, , , , , , , ,

  1. Leave a comment

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: