1
$\begingroup$

I'm trying to determine if our digital signature generation code will work without change using a European Qualified Digital Certificate in place of the RSA signing certificate that we normally use.

It seems like the structure of the qualified certificate is the same as any other signing certificate, but has special rules around how it is generated. If this is the case, then I suppose existing certificate handling code should continue to work. But I haven't found actual confirmation of this theory, and I don't have a QDC in hand to try it.

The code in question is a Windows-based C++ application using the Microsoft Cryptography API functions. I also asked the question with code example on stackoverflow.com.

Anybody have experience with this?

$\endgroup$
7
  • $\begingroup$ The certificate will probably work as expected. An RSA key is an RSA key after all. If the resulting signature is accepted as qualified signature is another matter. Why do you need confirmation, you can just try can't you? And that's not a similar question, it is the same question. $\endgroup$
    – Maarten Bodewes
    Apr 21 '20 at 0:22
  • $\begingroup$ @MaartenBodewes Thanks. Fine, it's the same question :-) I included code on the stackoverflow version though, as it's programming-centric. We have to give an answer in a proposal tomorrow, and it seems like it's a least a week to get a qualified cert to play with. $\endgroup$ Apr 21 '20 at 1:00
  • $\begingroup$ I'd rather check the requirements to create a valid signature for that specific proposal than to indicate that you are likely able to sign with it. Qualified signatures come with a bit of baggage. Signing may be the easy part. If you have to ask this now, I wonder... $\endgroup$
    – Maarten Bodewes
    Apr 21 '20 at 1:15
  • $\begingroup$ @MaartenBodewes This application will most definitely not generate a qualified digital signature, even with a qualified certificate. The requirement is just to be able to use a qualified certificate to generate the digital signature. I'm almost certain it will work, but just reluctant to commit without confirmation, or at least some "yeah that should work" votes. Thanks for yours. $\endgroup$ Apr 21 '20 at 1:19
  • 1
    $\begingroup$ OK, final remark from me as it is way way too late in CET time: you should be aware of this section of the X.509 spec: tools.ietf.org/html/rfc5280#section-4.2.1.12. $\endgroup$
    – Maarten Bodewes
    Apr 21 '20 at 1:29
1
$\begingroup$

TLDR: yes.

Qualified Digital Certificate is not a specification aiming at insuring interoperability. It purposely does not even specify a precise cryptosystem (see comment). Thus in principle there is no sure answer to that question.

However Qualified Digital Certificate only requires common X.509 features, modern Microsoft Cryptography API is flexible in what it accepts, and because it is common certificate issuers typically take care of going by whatever requirement it sets. Thus my bets are on: likely yes, and I'd be surprised if a little care in parametrization at key generation and procurement of the certificate did not make it possible.

Note: Qualified Digital Certificates does not imply Qualified Digital Signature, and there is a long way from the former to the later.

$\endgroup$
1
  • 1
    $\begingroup$ eIDAS recital 27 notes that eIDAS is intended to be technology-neutral (cf. 16, 26). It intentionally does not specify a precise cryptosystem. $\endgroup$
    – xorhash
    Apr 21 '20 at 14:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.