crypto/cms: Add support for CAdES Basic Electronic Signatures (CAdES-BES)

[openssl.git] / doc / man1 / cms.pod

diff --git a/doc/man1/cms.pod b/doc/man1/cms.pod
index 3d360e4262d9ab06d520bd0ab7e4004370812fd4..b2031c6a7a7a2d2883e4d8069768a12a83f5aca3 100644 (file)
--- a/doc/man1/cms.pod
+++ b/doc/man1/cms.pod
@@ -15,6 +15,7 @@ B<openssl> B<cms>
 [B<-verify>]
 [B<-cmsout>]
 [B<-resign>]
+[B<-cades>]
 [B<-data_create>]
 [B<-data_out>]
 [B<-digest_create>]
@@ -158,6 +159,12 @@ Takes an input message and writes out a PEM encoded CMS structure.
 
 Resign a message: take an existing message and one or more new signers.
 
+=item B<-cades>
+
+Add an ESS signing-certificate or ESS signing-certificate-v2 signed-attribute to the SignerInfo, in order to make
+the signature comply with the requirements for a CAdES Basic Electronic Signature (CAdES-BES). See the NOTES
+section for more details.
+
 =item B<-data_create>
 
 Create a CMS B<Data> type.
@@ -553,6 +560,40 @@ The B<-debug_decrypt> option can be used to disable the MMA attack protection
 and return an error if no recipient can be found: this option should be used
 with caution. For a fuller description see L<CMS_decrypt(3)>).
 
+=head1 CAdES Basic Electronic Signature (CAdES-BES)
+
+A CAdES Basic Electronic Signature (CAdES-BES), as defined in the European Standard ETSI EN 319 122-1 V1.1.1, contains:
+
+=over 4
+
+=item *
+
+The signed user data as defined in CMS (RFC 3852);
+
+=item *
+
+Content-type of the EncapsulatedContentInfo value being signed;
+
+=item *
+
+Message-digest of the eContent OCTET STRING within encapContentInfo being signed;
+
+=item *
+
+An ESS signing-certificate or ESS signing-certificate-v2 attribute, as defined in Enhanced Security Services (ESS), RFC 2634 and RFC 5035.
+An ESS signing-certificate attribute only allows for the use of SHA-1 as a digest algorithm.
+An ESS signing-certificate-v2 attribute allows for the use of any digest algorithm.
+
+=item *
+
+The digital signature value computed on the user data and, when present, on the signed attributes.
+
+Note that currently the B<-cades> option applies only to the B<-sign> operation and is ignored during
+the B<-verify> operation, i.e. the signing certification is not checked during the verification process.
+This feature might be added in a future version.
+
+=back
+
 =head1 EXIT CODES
 
 =over 4