stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity

save checkpoint. addition features and their state. check some ofthem

Browse Source
This commit is contained in:
master
2026-02-10 07:54:44 +02:00
parent 4bdc298ec1
commit 5593212b41
211 changed files with 10248 additions and 1208 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
docs/features/checked/cryptography/eidas-qualified-timestamping.md Normal file
View File

@@ -0,0 +1,47 @@
# eIDAS Qualified Timestamping
## Module
Cryptography
## Status
VERIFIED
## Description
EU-qualified timestamp verification with TSA configuration, EU Trust List integration, and CAdES signature building for eIDAS compliance.
## Implementation Details
- **EidasPlugin**: `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/EidasPlugin.cs` -- eIDAS crypto provider plugin extending CryptoPluginBase
- **QualifiedTimestampVerifier**: `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/Timestamping/QualifiedTimestampVerifier.cs` -- verifies RFC 3161 timestamps from EU-qualified TSAs against the EU Trust List
- **IQualifiedTimestampVerifier**: `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/Timestamping/IQualifiedTimestampVerifier.cs` -- verification interface
- **EuTrustListService**: `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/Timestamping/EuTrustListService.cs` -- fetches and caches the EU Trusted List of TSA providers for validation
- **IEuTrustListService**: `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/Timestamping/IEuTrustListService.cs` -- trust list interface
- **TimestampModeSelector**: `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/Timestamping/TimestampModeSelector.cs` -- selects between qualified and standard timestamping based on configuration and TSA availability
- **ITimestampModeSelector**: `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/Timestamping/ITimestampModeSelector.cs` -- mode selection interface
- **CadesSignatureBuilder**: `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/Timestamping/CadesSignatureBuilder.cs` -- builds CAdES (CMS Advanced Electronic Signatures) signatures with embedded timestamps per EU regulation requirements
- **ICadesSignatureBuilder**: `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/Timestamping/ICadesSignatureBuilder.cs` -- CAdES builder interface
- **QualifiedTsaConfiguration**: `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/Timestamping/QualifiedTsaConfiguration.cs` -- TSA endpoint URL, authentication, certificate chain configuration
- **EidasTimestampingExtensions**: `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/Timestamping/EidasTimestampingExtensions.cs` -- DI registration extensions for eIDAS timestamping services
- **EtsiConformanceTestVectors**: `src/Cryptography/StellaOps.Cryptography.Plugin.Eidas/Tests/EtsiConformanceTestVectors.cs` -- ETSI conformance test vectors
- **Tests**: `src/Cryptography/__Tests/StellaOps.Cryptography.Tests/Eidas/QualifiedTsaProviderTests.cs`, `TimestampModeSelectorTests.cs`
- **Source**: Feature matrix scan
## E2E Test Plan
- [x] Verify qualified timestamp verification validates RFC 3161 timestamp against EU Trust List
- [x] Test timestamp mode selector chooses qualified mode when TSA is available and standard mode as fallback
- [x] Verify CAdES signature builder produces valid CMS Advanced Electronic Signatures with embedded timestamps
- [x] Test EU Trust List service fetches and caches TSA provider list
- [x] Verify QualifiedTsaConfiguration validates TSA endpoint URL and certificate chain
- [x] Test ETSI conformance test vectors pass validation
- [x] Verify timestamp verification fails for non-qualified TSA providers
## Verification
Run ID: run-001
Date: 2026-02-10
Method: Tier 1 code review + Tier 2d test verification
Build: PASS (0 errors, 0 warnings)
Tests: PASS (101/101 cryptography tests pass)
Most thoroughly implemented feature. QualifiedTimestampVerifier decodes RFC 3161 timestamps via SignedCms, verifies CMS signature, parses TSTInfo ASN.1. EuTrustListService fetches LOTL from EU URL, parses ETSI TS 119 612 XML, supports offline path for air-gap. TimestampModeSelector policy-based with env/tag/repo pattern matching. CadesSignatureBuilder creates CAdES-B/T/LT/LTA. 26 unit tests across QualifiedTsaProviderTests (14) and TimestampModeSelectorTests (12).
Verdict: PASS