Signature

Introduction

This page provides guidance on the methods and approach that can be used to create digital signature for a document. This follows UBL 2.1 published standards as document here (Universal Business Language Version 2.1) for XML and here (UBL 2.1 JSON Alternative Representation Version 2.0) for JSON.
The methods described in this page apply only to the documents that are submitted using the APIs described in this SDK as per the description here Submit Documents

The submitter of the documents will have to use a valid digital certificate that is issued by a certificate authority (CA) in Malaysia as documented here List of Certification Authorities and Recognition.

Digital Signing Certificate Profile

The digital certificate used to digitally sign the submitted documents should be a valid X.509 certificate that should follow the below certificate profile.

Certificate Distinguished Name

Certificate distinguished name must have elements listed in the table below:

Key Usage and Enhanced Key Usage (aka Extended Key Usage)

To ensure digital signature level, following certificate extensions must be set:

• Key Usage - “Non-Repudiation (40)”. Note that additional key usages can also be specified, but “Non-Repudiation (40)” must be present.
• Enhanced Key Usage (aka Extended Key Usage) - “Document Signing (1.3.6.1.4.1.311.10.3.12)”. Note that additional enhanced key usages (e.g., “Secure Email (1.3.6.1.5.5.7.3.4)”) can also be specified, but “Document Signing (1.3.6.1.4.1.311.10.3.12)” must be present.

Digital Signature Creation Requirements and Considerations

The list below provides the requirements for the digital signature creation along with additional considerations.

• The digital signature algorithm to be used must be XAdES (XML Advanced Electronic Signature). (Digital signature timestamp will still be required to be added as part of the signed properties section as listed below). This envelope allows ascertaining the validity of a signature in case the signer certificate is later revoked.
• The hashing algorithm must be SHA 256.
• The signature algorithm must be RSA.
• UBL 2.1 XML standard includes by definition the required digital signature standard that would be used as described here UBL Digital Signature Profiles 1.0
• The Enveloped digital signature profile, where the signature applies to the XML content that contains <ds:Signature> as an element. Implementations of enveloped signature must make sure not to include <ds:Signature> element and any of it’s sub-elements in the calculation of the digest and signature values as per the algorithm that will be described later.
• UBL 2.1 JSON Alternative Representation Version 2.0 doesn’t define a specification for the use of digital signatures in JSON documents for UBL, this is supported using a foreign extension which is a transliteration of the UBL extension for digital signatures.
• Although UBL 2.1 supports multiple signatures to be included in the document, the requirement is to include only a single signature element which will be described later.

Digital Signature Structure

Please note that the ExtensionURI should be set as per the value below:

<ext:ExtensionURI>urn:oasis:names:specification:ubl:dsig:enveloped:xades</ext:ExtensionURI>

Signature Element

Signed Information

Document Signed Data

XAdES Signed Properties

Signed Properties

Signature Creation

Signed content is entire Document structure except for the following sections:

• UBLExtension (XPath: [local-name()=׳Invoice׳]//[local-name()=׳UBLExtensions׳]).
• Signature (XPath: [local-name()=׳Invoice׳]//[local-name()=׳Signature׳]). SHA256 hashing used for creating hash of the elements to sign.

The signature creation steps would mainly target to construct the enveloped XAdES signature structure, by computing the required values for the properties referenced above.

More details on how to define structure of the document to hash, create canonical version, apply hashing, sign the hash and then embed the signature are provided in section Signature Creation.

Signature Validation

The validation rules for signatures are:

• Base64 encoded value that is a valid XAdES structure.
• Signing certificate is valid at the date of submission of document for validation.
• Signing certificate is issued to:
  • issuer of the document, i.e., taxpayer tax identification number and business registration number matches in certificate and document,
  • service provider (intermediary organization) who is active representative of taxpayer at the document issuance date and time and have the required permissions assigned to them to submit documents on behalf of the taxpayer. The intermediary tax identification number and business registration number matches in certificate but they will not match the document details.
• XAdES signature is valid RSA signature created using one of the approved certificate authorities in Malaysia (as described before).

Signature Sample

UBL 2.1 Invoice Sample XML with Signature

UBL 2.1 Invoice Sample JSON with Signature

Disclaimer: The sample JSON file is for digital signature illustration purposes only. Taxpayers are advised to consult local laws and regulations for guidance on digital signature implementation.