ASiC-E LTA Signature in C#: Long-Term Archival Containers

An ASiC-E container (.asice, ETSI EN 319 162) keeps several signed files together. With XAdES-B-LTA signatures, the container can be verified for decades: every signature has a time-stamp, the validation data (certificates, CRL and OCSP responses) and an archive time-stamp. Before the certificate of the time-stamping authority expires, a new archive time-stamp is added to the signatures of the container, without the certificate of the signer.

How to create and maintain an ASiC-E LTA container in C#

1. Set AsicSignature.SignatureStandard = XadesSignatureStandard.XadesLTA and a time-stamping server in TimeStamping.ServerUrl.
2. Create the container from the files with CreateContainer; every signature covers all the files of the container.
3. Periodically, decide whether the container must be renewed (the certificate of the time-stamping authority of the last time-stamp expires soon) and call AddArchiveTimestamp. LtvLevel selects the revocation data of the previous time-stamps that is added with the new one.

C# code: create an ASiC-E container with XAdES-LTA signatures

static void CreateAsicLongTermArchival(string containerFile)
{
    AsicSignature asicSignature = new AsicSignature(LibrarySerialNumber);

    asicSignature.DigitalSignatureCertificate = LoadSigningCertificate();
    asicSignature.SignatureStandard = XadesSignatureStandard.XadesLTA;
    asicSignature.TimeStamping.ServerUrl = TimestampServerUrl;

    asicSignature.CreateContainer(new[] { SampleFile("test.txt"), SampleFile("source.pdf") }, containerFile);
}

C# code: renew the archive time-stamp

/// <summary>
/// Adds a new archive time-stamp to the XAdES-LTA signatures of an ASiC-E container.
/// </summary>
static void RenewAsicTimestamp(string containerFile, string renewedContainerFile)
{
    AsicSignature asicSignature = new AsicSignature(LibrarySerialNumber);

    asicSignature.TimeStamping.ServerUrl = TimestampServerUrl;

    // The revocation data of the previous time-stamps is added with the new time-stamp (LtvLevel selects it).
    asicSignature.LtvLevel = XadesLtvLevel.IncludeCrlAndOcsp;

    asicSignature.AddArchiveTimestamp(containerFile, renewedContainerFile);
}

C# code: when to renew

A simple renewal policy, to run in a scheduled task on every archived container: renew when the certificate of the time-stamping authority of the last time-stamp expires soon.

/// <summary>
/// Decides if a document must be renewed: the certificate of the TSA of the last time-stamp expires soon. In a real application
/// this check runs periodically (a scheduled task, a service) on every archived document.
/// </summary>
static bool MustRenew(X509Certificate2 lastTsaCertificate)
{
    TimeSpan remaining = lastTsaCertificate.NotAfter - DateTime.Now;

    Console.WriteLine("  The certificate of the TSA expires on " + lastTsaCertificate.NotAfter.ToShortDateString() + " (" + (int)remaining.TotalDays + " days left)");

    // The policy can also use the age of the last time-stamp, the strength of its hash algorithm (SHA-1 time-stamps must be renewed
    // at once) or the revocation of the TSA certificate (DigitalCertificate.VerifyDigitalCertificate).
    return remaining < RenewalMargin;
}

The project Timestamp Renewal PDF ASiC XAdES renews PDF, ASiC-E and XAdES archives together. To create, co-sign, read and verify containers, see ASiC-E container digital signature; the same long-term archival exists for PAdES-LTA, CAdES-LTA and XAdES-LTA. For legal effect in the European Union, use a qualified time-stamping service, such as the eIDAS qualified timestamps of qtsa.eu.

Frequently asked questions