XAdES-LTA Signature in C#: Long-Term Archival XML Signatures

A XAdES-B-LTA signature (long-term archival, ETSI EN 319 132) keeps an XML signature verifiable for decades. It contains a time-stamp of the signature, the validation data (the certificate chain and the CRL and OCSP responses) and an archive time-stamp that protects all of them. Before the certificate of the time-stamping authority expires, or before its algorithms become weak, a new archive time-stamp is added.

How to create a XAdES-LTA signature in C#

1. Set SignatureStandard = XadesSignatureStandard.XadesLTA and a time-stamping server in TimeStamping.ServerUrl.
2. Optionally choose the revocation data with LtvLevel: IncludeCrlAndOcsp, IncludeOcspOnly, IncludeCrl or None.
3. Sign with ApplyDigitalSignature. The library collects the validation data from the addresses written in the certificates.
4. Periodically, call AddArchiveTimestamp: it adds a new archive time-stamp and the revocation data of the previous time-stamps. The signing certificate is not needed.

C# code: sign with XAdES-B-LTA

/// <summary>
/// Signs an XML document with a XAdES-B-LTA signature: time-stamp, validation data and archive time-stamp.
/// </summary>
static void SignXmlWithXadesLongTermArchival(string unsignedXmlFile, string signedXmlFile)
{
    XadesSignature xadesSignature = new XadesSignature(LibrarySerialNumber);

    xadesSignature.DigitalSignatureCertificate = LoadSigningCertificate();
    xadesSignature.SignatureStandard = XadesSignatureStandard.XadesLTA;
    xadesSignature.TimeStamping.ServerUrl = TimestampServerUrl;

    xadesSignature.ApplyDigitalSignature(unsignedXmlFile, signedXmlFile);

    Console.WriteLine("The XAdES-LTA signature was created." + Environment.NewLine);
}

C# code: renew the archive time-stamp

/// <summary>
/// Adds a new archive time-stamp to the XAdES-LTA signatures of an XML document. Call it periodically, before the certificate of the
/// time-stamping authority of the last archive time-stamp expires. The signing certificate is not needed.
/// </summary>
static void RenewArchiveTimestamp(string signedXmlFile, string renewedXmlFile)
{
    XadesSignature xadesSignature = new XadesSignature(LibrarySerialNumber);

    xadesSignature.TimeStamping.ServerUrl = TimestampServerUrl;

    // The revocation data that is needed to validate the previous time-stamps is added with the new time-stamp.
    xadesSignature.LtvLevel = XadesLtvLevel.IncludeCrlAndOcsp;

    // For a detached signature file the signed file is also given: AddArchiveTimestamp(signatureFile, outputFile, signedFile).
    xadesSignature.AddArchiveTimestamp(signedXmlFile, renewedXmlFile);

    Console.WriteLine("The archive time-stamp was renewed." + Environment.NewLine);
}

For a detached signature the signed file is also given: AddArchiveTimestamp(signatureFile, outputFile, signedFile). The same long-term levels exist for PDF (PAdES-LTA) and for ASiC-E containers.

For signatures with legal effect in the European Union, use a qualified time-stamping service, such as the eIDAS qualified timestamps of qtsa.eu.

XAdES-LTA from PowerShell

powershell -ExecutionPolicy Bypass -File signXades.ps1 invoice.xml -Level XadesLTA -TimestampUrl https://ca.signfiles.com/TSAServer.aspx

See XAdES digital signature in PowerShell.

Frequently asked questions