Logo des Repositoriums

P293 - Open Identity Summit 2019

https://dl.gi.de/handle/20.500.12116/20979
Auflistung nach:

Auflistung P293 - Open Identity Summit 2019 nach Autor:in "Erinola, Nurullah"

1 - 1 von 1
  • Textdokument
    Security Analysis of XAdES Validation in the CEF Digital Signature Services (DSS)
    (Open Identity Summit 2019, 2019) Engelbertz, Nils; Mladenov, Vladislav; Somorovsky, Juraj; Herring, David; Erinola, Nurullah; Schwenk, Jörg
    Within the European Union (EU), the eIDAS regulation sets legal boundaries for crossborder acceptance of Trust Services (TSs) such as Electronic Signatures. To facilitate compliant implementations, an open source software library to create and validate signed documents is provided by the eSignature building block of the Connecting Europe Facility (CEF). We systematically evaluated the validation logic of this library with regards to XML-based attacks. The discovered vulnerabilities allowed us to read server files and bypass XML Advanced Electronic Signature (XAdES) protections. The seriousness of the vulnerabilities shows that there is an urgent need for security best-practice documents and automatic security evaluation tools to support the development of security-relevant implementations.