The concept of electronic dossier (e-dossier) refers to a file format developed by Microsec Ltd. for the Hungarian Ministry of Public Administration and Justice in connection with electronic firm registration, containing documents and digital signatures and timestamps on them. The signatures on the documents are standard XAdES signatures according to the ETSI TS 101 903 (XAdES) specification.
The present specification doesn’t define constraints on the XAdES signatures. It describes the rules how to insert documents in an XML file ( the so called e-dossier ), how to put XAdES signatures on these documents and on the signatures already present on the documents. In practical applications it is usually not sufficient to sign the documents themselves, but different metadata should be attached to them. The e-dossier specification supports the attachment of standard format metadata specified by the Dublin Core Metadata Initiative, but the attachment of other metadata is allowed as well.
In Hungary the e-dossier format has become a de facto standard, several user communities and applications are using digitally signed documents in e-dossier format.
Identifier | 1.3.6.1.4.1.21528.2.1.1.28 |
Version | 1.2 |
Classification | nyilvános |
Date | 2011. 02. 04. |
Version | Change | Date | Created by |
1.0 | First version | 2008. 07. 01. | Dr. István Zsolt BERTA, Szilveszter TÓTH |
1.1 | XML schema reference corrected | 2009. 07. 22. | Dr. István Zsolt BERTA, Szilveszter TÓTH |
1.2 | XAdES version change, removal of obsolete elements, corrections | 2011. 02. 04. | Csilla ENDRŐDI |
The e-dossier is an XML file containing base64 encoded binary elements (e.g. documents, certificates) . An e-dossier may contain documents, Dublin Core standard metadata attached to them, and XAdES signatures or timestamps or the documents. A signature or a timestamp belongs either to a single document or to all documents in the dossier (in the latter case it is called a frame signature or frame timestamp resp.) The frame signatures and frame timestamps apply to all the documents in the dossier as well as to all the (non-frame) signatures and timestamps on the documents.
An example of an e-dossier structure:
<es:Dossier ... > <es:DossierProfile>...</es:DossierProfile> <es:Documents> <es:Document> <!-- inserted document --> <es:DocumentProfile>...</es:DocumentProfile> <ds:Object>...</ds:Object> <!-- base64 encoded document --> <ds:Signature>...</ds:Signature> <!-- signature on the document --> <es:TimeStamp>...</es:TimeStamp> <!-- timestamp on the document --> </es:Document> <ds:Signature>...</ds:Signature> <!-- frame signature --> <es:TimeStamp>...</es:TimeStamp> <!-- frame timestamp --> </es:Documents> |
To facilitate automated processing, each e-dossier has some schema that may contain restrictions on the data in the e-dossier. The default schema determines only the order and structure of the documents, signatures, time stamps and descriptive data. An arbitrary schema may fix the number of documents in an e-dossier complying with it, or may contain constraints on the title, on the format of the documents or on the data connected to them. The schema of the e-dossier (an XML schema at the same time) allows an automatism to easily check whether an e-dossier meets these requirements. For instance it can be checked if a submission contains the necessary appendices, an automatism can easily distinguish the individual documents attached to the submission . (E.g. it can tell which document is the submission and which is the annex attached to it.)
The file extension of an e-dossier is .es3, for a recorded delivery .et3 (legacy applications used .eak and .etv which are now deprecated).
In the following sections the format specification of an e-dossier is presented in verbal form. An XML schema definition is also available. We emphasize that it is always the verbal description that should be considered as authoritative. The xsd file represents weaker restrictions compared to the text of the specification. On one hand because not every requirement can be described formally, on the other hand, to sustain backward compatibility the xsd file optionally contains the earlier used and no more supported, as well as the actually used, previously not existing elements.
In the text to follow every statement formulates a mandatory requirement as a default. If not, then it will be explicitly mentioned as an optional requirement.
The e-dossier is an XML file, its root is an es:Dossier element, that also defines the namespaces referred by the e-dossier (the namespaces referring to metadata are not necessarily defined here). The e-dossier refers to the following namespaces:
The individual namespaces will be labeled with the above prefixes. The e-szigno namespace - labeled with the es prefix - has a distinguished role, it determines the schema of the e-dossier. The schema of the e-dossier can be the above „default” schema with the above namespace. If the e-dossier has a different schema , then that schema has a different namespace. Here we present e-dossiers with the default schema, but e-dossiers may have different schemas as well. Every e-dossier schema must be compliant with the above default schema, but furthermore it may contain restrictions on the number and name of the documents in the dossier and it may define additional elements under /es:Dossier/es:DossierProfile and /es:Dossier/es:Documents/es:Document/es:DocumentProfile. (These may contain additional metadata of the e-dossier or the document, not defined in Dublin Core specification.)
The es:Dossier must contain a reference to the location of the XML schema describing the e-szigno namespace. (URL):
xsi:schemaLocation="https://www.microsec.hu/ds/e-szigno30# https://www.microsec.hu/ds/e-szigno30.xsd" |
The root element may contain the following elements: es:DossierProfile, es:Documents, ds:Signature, es:TimeStamp. (The AckEmail and Location attributes are not used any more.)
The sections of the present chapter define the structure of additional elements in an e-dossier. Explanation of symbols at the end of section titles:
It may contain the data of the e-dossier. If there is a frame signature or frame timestamp on the e-dossier, they protect the integrity of the es:DossierProfile element as well. The es:DossierProfile has an OBJREF attribute referring to the Id attribute of the //es:Documents element. At the same time it has its own Id attribute.
It may contain the Dublin Core metadata of the e-dossier. It may contain additional metadata as well (with constraints defined for them in the schema). The necessary namespaces must be defined here in the es:Metadata element.
The es:Metadata element has a mandatory attribute „Custom” with value „true”.
The Id attribute contains the profile identifier of the document ( e.g. the signatures use it as a reference ) and has an OBJREF attribute to refer to the document (../ds:Object) (Requirements must be met both for the location of ds:Object and for the reference.)
The use of this descriptor has become practically obsolete. At the present - in case of automatic input - it always gets the value "electronic data”.)
The categories electronic data, document and record originate from the Act on Electronic Signature, but this distinction has become obsolete by the 2004. modification of the Act.
The Hungarian denominations are no more in use, the schema contains them for compatibility with the earlier versions of the specification. The "electronic profile" and "electronic adatlap" values are also out of use, the schema contains them for compatibility with the earlier versions of the specification.
Note: According to e-dossier format the base64 encoding is obligatory even if the inserted document is a TXT or XML file.
Notes:
Moreover, the e-dossier format also fixes the location of ds:Signature elements in the XML file, and the location of the ds:Signature element defines what the signature applies to. (The //es:Document/ds:Signature means that the signature applies to the given document, while the //es:Dossier/ds:Signature means that the signature is a frame signature, i.e. it applies to the e-dossier – and as such, it applies among others to all documents contained in it.) These restrictions of the e-dossier format significantly facilitate the task of the signature checking application processing the dossier.
According to the e-dossier format the location of the ds:Signature element and the references in the //ds:Signature/ds:SignedInfo element define together what the signature applies to, both requirement sets must be fulfilled. (Furthermore the e-dossier format restricts what the references of //ds:Signature/ds:SignedInfo may apply to in different cases.)
Example:
<es:Program name="e-Szigno" type="3.1.28.0"/> |
The name and type of the signature-creation device. name is a mandatory attribute, it contains the name of the device. type is optional. Both are of data typa string.
Example:
<es:Device name="OpenSSL 0.9.8c" type=""/> |
The second value in each row is the Hungarian equivalent of the first one.
Note: This constraint is not present in the XML schema.
Notes made for the ds:Signature element apply here as well.
The frame signatures on the dossier. Their structure is identical to that of the //es:Document/ds:Signature element, the only difference is that in case of a frame signature the references concern different locations. In the es:Dossier/ds:Signature/ds:SignedInfo element references may exist to the following elements:
Notes made for the ds:Signature element at the signatures on the document apply here as well.
This element contains a frame timestamp on the e-dossier. Its data type is xades:TimeStampType. The timestamp refers to the following elements:
Notes made for the ds:Signature element at the signatures on the document apply here as well.
<?xml version="1.0" encoding="ISO-8859-2"?> <schema targetNamespace="https://www.microsec.hu/ds/e-szigno30#" xmlns:es="https://www.microsec.hu/ds/e-szigno30#" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:xades="http://uri.etsi.org/01903/v1.2.2#" xmlns:mireg="http://mireg.org/schema/1.0/" xmlns="http://www.w3.org/2001/XMLSchema" elementFormDefault="qualified"> <import namespace="http://www.w3.org/2000/09/xmldsig#" schemaLocation="xmldsig-core-schema.xsd"/> <import namespace="http://uri.etsi.org/01903/v1.2.2#" schemaLocation="XAdES.xsd"/> <import namespace="http://uri.etsi.org/01903/v1.3.2#" schemaLocation="XAdES-1.3.2.xsd"/> <import namespace="http://mireg.org/schema/1.0/" schemaLocation="metadata.xsd"/> <element name="Dossier"> <complexType> <sequence> <element name="DossierProfile"> <complexType> <sequence> <element name="Title" type="string"/> <element name="E-category" minOccurs="0"> <simpleType> <restriction base="string"> <enumeration value="electronic dossier"/> <enumeration value="electronic acknowledgement"/> <enumeration value="elektronikus akta"/> <enumeration value="elektronikus átvételi elismervény"/> </restriction> </simpleType> </element> <element name="CreationDate" type="dateTime"/> <any namespace="##any" processContents="lax" minOccurs="0" maxOccurs="unbounded"/> </sequence> <attribute name="Id" type="ID" use="required"/> <attribute name="OBJREF" type="string"/> </complexType> </element> <element name="Documents"> <complexType> <sequence> <element ref="es:Document" minOccurs="0" maxOccurs="unbounded"/> </sequence> <attribute name="Id" use="required"> <simpleType> <restriction base="ID"> <enumeration value="Object0"/> </restriction> </simpleType> </attribute> </complexType> </element> <choice minOccurs="0" maxOccurs="unbounded"> <element ref="ds:Signature"/> <element name="TimeStamp" type="xades:TimeStampType"/> </choice> </sequence> <attribute name="AckEmail"> <simpleType> <restriction base="string"> <pattern value="([^@]+@[^\.]+\..+)?"/> </restriction> </simpleType> </attribute> <attribute name="Location" type="string"/> </complexType> </element> <element name="Document"> <complexType> <sequence> <element name="DocumentProfile"> <complexType> <sequence> <element name="Title" type="string"/> <element name="E-category" minOccurs="0"> <simpleType> <restriction base="string"> <enumeration value="electronic data"/> <enumeration value="electronic document"/> <enumeration value="electronic record"/> <enumeration value="elektronikus adat"/> <enumeration value="elektronikus dokumentum"/> <enumeration value="elektronikus irat"/> <enumeration value="electronic profile"/> <enumeration value="elektronikus adatlap"/> </restriction> </simpleType> </element> <element name="CreationDate" type="dateTime"/> <element name="Format"> <complexType> <sequence> <element name="MIME-Type"> <complexType> <attribute name="type"/> <attribute name="subtype"/> <attribute name="extension"/> <attribute name="charSet"/> </complexType> </element> </sequence> </complexType> </element> <element name="UsedDispApplication" minOccurs="0"> <complexType> <attribute name="name"/> <attribute name="version"/> </complexType> </element> <element name="MimeChecked" minOccurs="0"> <complexType> <simpleContent> <extension base="boolean"> <attribute name="executed" type="boolean"/> </extension> </simpleContent> </complexType> </element> <element name="SourceLocation" type="string" minOccurs="0"/> <element name="SourceSize"> <complexType> <attribute name="sizeValue" type="integer"/> <attribute name="sizeUnit" fixed="B"/> </complexType> </element> <element name="BaseTransform"> <complexType> <sequence maxOccurs="unbounded"> <element name="Transform"> <complexType> <attribute name="Algorithm"> <simpleType> <restriction base="string"> <enumeration value="zip"/> <enumeration value="encrypt"/> <enumeration value="base64"/> </restriction> </simpleType> </attribute> </complexType> </element> </sequence> </complexType> </element> <element name="RecipientCertificateList" minOccurs="0"> <complexType> <sequence> <element name="RecipientCertificate" maxOccurs="unbounded"/> </sequence> </complexType> </element> <element name="Metadata" minOccurs="0"> <complexType> <sequence> <element ref="mireg:metadata"/> </sequence> <attribute name="Custom" type="boolean" fixed="true"/> </complexType> </element> </sequence> <attribute name="Id" type="ID" use="required"/> <attribute name="OBJREF" type="string"/> </complexType> </element> <element ref="ds:Object"/> <choice minOccurs="0" maxOccurs="unbounded"> <element ref="ds:Signature"/> <element name="TimeStamp" type="xades:TimeStampType"/> </choice> </sequence> </complexType> </element> <element name="SignatureProfile"> <complexType> <sequence> <element name="SignerName" type="string"/> <element name="SDPresented" minOccurs="0"> <complexType> <simpleContent> <extension base="boolean"> <attribute name="server" type="boolean"/> </extension> </simpleContent> </complexType> </element> <element name="Type"> <simpleType> <restriction base="string"> <enumeration value="signature"/> <enumeration value="countersignature"/> <enumeration value="aláírás"/> <enumeration value="ellenjegyzés"/> </restriction> </simpleType> </element> <element name="Generator"> <complexType> <sequence> <element name="Program"> <complexType> <attribute name="name"/> <attribute name="version"/> </complexType> </element> <element name="Device" minOccurs="0"> <complexType> <attribute name="name"/> <attribute name="type"/> </complexType> </element> </sequence> </complexType> </element> <element name="Comment" minOccurs="0"> <complexType mixed="true"> <sequence> <element ref="es:Document" minOccurs="0"/> </sequence> <attribute name="Type"> <simpleType> <restriction base="string"> <enumeration value="clause"/> <enumeration value="gloss"/> <enumeration value="comment"/> <enumeration value="opinion"/> <enumeration value="záradék"/> <enumeration value="széljegyzet"/> <enumeration value="megjegyzés"/> <enumeration value="vélemény"/> </restriction> </simpleType> </attribute> </complexType> </element> <element name="SigPolChecked" type="boolean" minOccurs="0"/> <element name="CustomData" minOccurs="0"> <complexType> <sequence> <any namespace="##any" minOccurs="0" maxOccurs="unbounded" processContents="lax"/> </sequence> </complexType> </element> </sequence> <attribute name="Id" type="ID" use="required"/> <attribute name="OBJREF" type="string"/> <attribute name="SIGREF" type="string"/> <attribute name="SIGREFLIST" type="string"/> </complexType> </element> <element name="Metadata"> <complexType> <sequence> <element ref="mireg:metadata"/> </sequence> <attribute name="Custom" type="boolean" fixed="true"/> </complexType> </element> </schema> |