2

I'm having troubles understanding, how a PDF that has been signed - let's say years ago - with a Long Term Validation digital signature, can be verified today, when the certificate issuer has gone bankrupt and it's CRL responder is no longer online?

How do I see whether or not this documents signature has been revoked any time since?

0

An LTV signature embeds all the element needed to verify it along time:

  • (B) signature and signing certificate

  • (T) a timestamp on the signature

  • (LT) used certificates and revocation evidences (ocsp & crl responses)

  • (LTA) an archive timestamp on the previous content

The archive timestamp protects the complete content and stablish the date in which was issued

If the timestamp is valid, you can trust in the revocation evidences and check that the signing certificate and certification chain was valid and not revoked at the time that the document was signed

The global expiration time is limited by the timestamp certificate validity. When timestamp is close to expire, it is needed to add other

Finally the B,T,LT and LTA identifiers represent the level of the signature as defined in AdES ETSI standards for long term signatures ( PAdES, XAdES, CAdES)

| improve this answer | |
1

For checking the signature on a document it does not matter if the certificate is revoked now. It is instead relevant that the certificate was not revoked at the time the document was signed.

That's why a long-term validation signature involves also the certificate revocation status at the time of signing (which contains a time when this status is valid) and ideally also a secure timestamp so that it cannot be signed later while including an old revocation status. See Establish long-term signature validation for the details.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.