{"action":"created","issue":{"url":"https://api.github.com/repos/esig/dss/issues/1","labels_url":"https://api.github.com/repos/esig/dss/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/esig/dss/issues/1/comments","events_url":"https://api.github.com/repos/esig/dss/issues/1/events","html_url":"https://github.com/esig/dss/pull/1","id":60259389,"number":1,"title":"Use public key instead of certificate to verify CAdES signature integrity","user":{"login":"pkoziol","id":3846677,"avatar_url":"https://avatars.githubusercontent.com/u/3846677?v=3","gravatar_id":"","url":"https://api.github.com/users/pkoziol","html_url":"https://github.com/pkoziol","followers_url":"https://api.github.com/users/pkoziol/followers","following_url":"https://api.github.com/users/pkoziol/following{/other_user}","gists_url":"https://api.github.com/users/pkoziol/gists{/gist_id}","starred_url":"https://api.github.com/users/pkoziol/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pkoziol/subscriptions","organizations_url":"https://api.github.com/users/pkoziol/orgs","repos_url":"https://api.github.com/users/pkoziol/repos","events_url":"https://api.github.com/users/pkoziol/events{/privacy}","received_events_url":"https://api.github.com/users/pkoziol/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-03-08T14:42:03Z","updated_at":"2015-03-09T07:50:25Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/esig/dss/pulls/1","html_url":"https://github.com/esig/dss/pull/1","diff_url":"https://github.com/esig/dss/pull/1.diff","patch_url":"https://github.com/esig/dss/pull/1.patch"},"body":"Validating XAdES signature created with expired certificate results in indication INDETERMINATE and subindication OUT_OF_BOUNDS_NO_POE.\r\nSimple report contains:\r\n\r\n```\r\n<Indication>INDETERMINATE</Indication>\r\n<SubIndication>OUT_OF_BOUNDS_NO_POE</SubIndication>\r\n<Error NameId=\"BBB_XCV_ICTIVRSC_ANS\" NotAfter=\"2014-07-04T11:02:03Z\" NotBefore=\"2013-07-04T11:02:03Z\">The current time is not in the validity range of the signer's certificate.</Error>\r\n<Warning NameId=\"LABEL_TINTWS\">Additional assurance on the signing time may be needed to prove the validity of the signature.</Warning>\r\n```\r\n\r\nThis is completely clear, because there was no timestamp. But...\r\n\r\nUsing the same file and certificate to create CAdES signature and then validating it results in indication INVALID and subindication HASH_FAILURE.\r\n```\r\n<Indication>INVALID</Indication>\r\n<SubIndication>HASH_FAILURE</SubIndication>\r\n<Error NameId=\"BBB_CV_IRDOI_ANS\">The reference data object(s) is not intact!</Error>\r\n<Info>verifier not valid at signingTime</Info>\r\n```\r\n\r\nThis is caused by Bouncy Castle which checks [if certificate is valid on signing time](https://github.com/bcgit/bc-java/blob/r1rv51/pkix/src/main/java/org/bouncycastle/cms/SignerInformation.java#L531). DSS will check certificate validity later, so there is no need to do it in signature integrity verification.\r\n\r\nSollution to this problem is to use public key instead of certificate to build JcaSimpleSignerInfoVerifierBuilder. (According to [Martijn Brinkers' post from mailing list dev-crypto@bouncycastle.org](http://bouncy-castle.1462172.n4.nabble.com/Accepting-CMS-with-signing-time-outside-of-signing-certificate-validity-time-tp4655414p4655415.html)).\r\n\r\nThis is the same as arhs/sd-dss#14"},"comment":{"url":"https://api.github.com/repos/esig/dss/issues/comments/77812104","html_url":"https://github.com/esig/dss/pull/1#issuecomment-77812104","issue_url":"https://api.github.com/repos/esig/dss/issues/1","id":77812104,"user":{"login":"pvandenbroucke","id":10741105,"avatar_url":"https://avatars.githubusercontent.com/u/10741105?v=3","gravatar_id":"","url":"https://api.github.com/users/pvandenbroucke","html_url":"https://github.com/pvandenbroucke","followers_url":"https://api.github.com/users/pvandenbroucke/followers","following_url":"https://api.github.com/users/pvandenbroucke/following{/other_user}","gists_url":"https://api.github.com/users/pvandenbroucke/gists{/gist_id}","starred_url":"https://api.github.com/users/pvandenbroucke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pvandenbroucke/subscriptions","organizations_url":"https://api.github.com/users/pvandenbroucke/orgs","repos_url":"https://api.github.com/users/pvandenbroucke/repos","events_url":"https://api.github.com/users/pvandenbroucke/events{/privacy}","received_events_url":"https://api.github.com/users/pvandenbroucke/received_events","type":"User","site_admin":false},"created_at":"2015-03-09T07:50:25Z","updated_at":"2015-03-09T07:50:25Z","body":"Hello,\r\n\r\nI added an unit test and confirm the bug.\r\n\r\nThanks for the solution. We will integrate it in the release 4.4.0.\r\n\r\nPierrick"}}