Supported signature algorithms and hashing functions for PAdES signatures

[filip_3012]

Hello,

i would like to ask if there is some compatibility matrix for supported signature algorithms and hashing functions for PAdES signatures?

There are two specs ETSI EN 319 142 and mainly ETSI TS 119 312 (which discribes Cryptographic Suites).

Documents contain some "required" (shall support) and some "recommended" (should support) suites. However, it seems that the recommended suites are not implemented.

For example, the combination of EC-DSA (with EC secp384r1) + SHA3-384 seems to not working (we have to use SHA-384 because SHA3 shows "unsupported algorithm").

Is there some comatibility matrix? Or is there a plan to extend support for recommended suites in the near future? Thanks.

[MikelKlink]

There are two specs ETSI EN 319 142 and mainly ETSI TS 119 312 (which discribes Cryptographic Suites).

First of all, ETSI EN 319 142 merely recommends the use of the algorithms and parameters from ETSI TS 119 312, it doesn't require them. Thus, support of PAdES does not imply or forbid the support of any specific cryptographic algorithms (except it does forbid MD5).

Then ETSI EN 319 142 is only one specification of PAdES; on one hand it has been derived from the original PAdES specification in the ETSI TS 102 778 parts; on the other hand it has been adapted for PDF 2.0 in ISO 32000-2 with only the general algorithm list for PDF 2.0. And then there is ISO 14533-3...

Essentially the only algorithms you can somewhat count on being implemented by most PDF signature validators is the list in ISO 32000-1 or maybe even the list in ISO 32000-2, if you are lucky extended by ISO/TS 32001 and ISO/TS 32002. Anything beyond is clearly implementation dependent.

[filip_3012]

I get you point but it would be great if the latest "recommendations" would be supported by Acrobat.

My example with SHA3 is mentioned in ISO/TS 32001 and ISO/TS 32002 extensions (it makes sense as the "core" specs are pretty old), as well as in ETSI EN 319 142 (though only as "should," so it's not mandatory).