In order to authenticate and sign online with an ID card, you need to update ID software!

Home / For developer / Digital signing /

BDOC2.1 – New Estonian digital signature standard format

The new version of the Estonian digital signature standard  EVS 821:2014 can be purchased from the Estonian Centre for Standardisation. The new standard is valid from 5 June 2014.

Changes from the previous digital signature standard

The previous version of the Estonian digital signature standard EVS 821:2009 had to be updated primarily due to ETSI having published a number of relevant standards, namely:

  • ETSI TS 102 918 (ASiC), which was the first to define the container format in order to encapsulate signed files and signatures with additional information.
  • ASiC profile TSI TS 103 174, which significantly reduced the opportunities offered by ASiC.
  • XAdES profile ETSI TS 103 171, which reduced the opportunities offered in XAdES.

Standard changes from version 1.0 (December 2012):

The above profiling standards are essentially similar to DDOC and BDOC specifications but feature small differences in details. The main purpose of BDOC2.0 was to be 100% compatible with ETSI standards. The following changes were made in order to ensure this compatibility:

  • The XAdES element DataObjectFormat and the sub-element MimeType are now mandatory – the MIME type must be specified in the signature for each signed file in the container.
  • The XAdES C-block has been removed. The essentially unnecessary components CompleteCertificateRefs and CompleteRevocationRef have been discarded.
  • The XAdES X-block has been removed. The SigAndRefsTimeStamp element is no longer used.
  • Identification of ASiC media type – the MIME type application/vnd.etsi.asic-e+zip is used; new file extensions .asice and .sce are permitted in addition to .bdoc.
  • The title of the signature file must contain the *signatures* string (previously *signature*).
  • The signature file must have a root element – <asic:XAdESSignatures>
  • Listing signature files in the manifest.xml file is no longer required.

Other changes:

  • All references to base standards that have new versions have been updated with some references added.
  • There is a new separate section on cryptographic algorithms and a description of the use of elliptic curves (ECDSA).
  • The canonicalisation algorithm has been updated (http://www.w3.org/2006/12/xml-c14n11).
  • The new SignaturePolicyIdentifier element has been introduced in order to refer to the document that describes the signature format within the signature (BDOC2.0) and to specify the hash algorithm that is used to calculate the nonce field for OCSP requests.

Changes from version 1.9.9 (December 2012):

Changes from version 2.0 (November 2013):

  • The NonceAlgorithm element has been discarded. Instead, the hash function identifier used for calculating the signature’s hash value is displayed in the OCSP nonce field.
  • The SignaturePolicyIdentifier element is not used with regard to timestamps.
  • The timestamps profile has been changed/specified.
  • The overall text has been specified and improved.
  • BDOC 2.1 format specification.

Changes from version 2.1

Valid as of February 2014, updated in May 2014:

  • Minor improvements, mainly in Annex 1 (sample file).
  • The requirement for the comparison of time values between time-stamp and OCSP response has been discarded (p 6.2).
  • The contents of the CertificateValues element have been specified.
  • BDOC 2.1.2 format specification