Logo des Repositoriums
 
Textdokument

Security Analysis of XAdES Validation in the CEF Digital Signature Services (DSS)

Lade...
Vorschaubild

Volltext URI

Dokumententyp

Zusatzinformation

Datum

2019

Zeitschriftentitel

ISSN der Zeitschrift

Bandtitel

Verlag

Gesellschaft für Informatik, Bonn

Zusammenfassung

Within the European Union (EU), the eIDAS regulation sets legal boundaries for crossborder acceptance of Trust Services (TSs) such as Electronic Signatures. To facilitate compliant implementations, an open source software library to create and validate signed documents is provided by the eSignature building block of the Connecting Europe Facility (CEF). We systematically evaluated the validation logic of this library with regards to XML-based attacks. The discovered vulnerabilities allowed us to read server files and bypass XML Advanced Electronic Signature (XAdES) protections. The seriousness of the vulnerabilities shows that there is an urgent need for security best-practice documents and automatic security evaluation tools to support the development of security-relevant implementations.

Beschreibung

Engelbertz, Nils; Mladenov, Vladislav; Somorovsky, Juraj; Herring, David; Erinola, Nurullah; Schwenk, Jörg (2019): Security Analysis of XAdES Validation in the CEF Digital Signature Services (DSS). Open Identity Summit 2019. Gesellschaft für Informatik, Bonn. PISSN: 1617-5468. ISBN: 978-3-88579-687-9. pp. 95-106. Regular Research Papers. Garmisch-Partenkirchen, Germany. 28.-29. March 2019

Zitierform

DOI

Tags