Security Analysis of XAdES Validation in the CEF Digital Signature Services (DSS)

Nils Engelbertz, Vladislav Mladenov, Juraj Somorovsky, Nurullah Erinnola, David Herring, Jörg Schwenk

Abstract

Within the European Union (EU), the eIDAS regulation sets legal boundaries for cross- border acceptance of Trust Services (TSs) such as Electronic Signatures. To facilitate compliant implementations, an open source software library to create and validate signed documents is provided bythe eSignature buildingblockoftheConnectingEuropeFacility(CEF).Wesystematicallyevaluated the validation logic of this library with regards to XML-based attacks. The discovered vulnerabilities allowed us to read server files and bypass XML Advanced Electronic Signature (XAdES) protections. The seriousness of the vulnerabilities shows that there is an urgent need for security best-practice documents and automatic security evaluation tools to support the development of security-relevant implementations.

Tags: digital, DTD;, Service;, Services, signature, Signature;, trust, xml, XSLT;