JOSENotSupported: Extension Header Parameter "sigT" is not recognized

[lemoustachiste]

Hi,

I'm trying to create a PoC EBSI (EU framework) valid document, and the last piece that's missing is adding the sigT parameter in the crit array, as documented here: https://ec.europa.eu/digital-building-blocks/wikis/display/EBSIDOC/E-signing+and+e-sealing+Verifiable+Credentials+and+Verifiable+Presentations#EsigningandesealingVerifiableCredentialsandVerifiablePresentations-JAdES(eSeal)

While at this time my timestamp is not a qualified one, this page https://ec.europa.eu/digital-building-blocks/DSS/webapp-demo/validation returns on error on the absence of sigT:

NOT OK : The signed qualifying property: 'signing-time' is not present!

Here is my current header:

{
  alg: 'ES384',
  cty: 'json',
  typ: 'jose',
  'x5t#S256': 'nZCgB9UkwucyvDIUj3o0FF5OAiuqK7MhkgAMBUWULyI',
  x5c: [
    'MIICezCCAgACFDRrhuyG7Z4TbeUSoVceNTop1ecoMAoGCCqGSM49BAMCMIGgMQsw\n' +
      'CQYDVQQGEwJGUjETMBEGA1UECAwKU29tZS1TdGF0ZTEQMA4GA1UEBwwHTW9ydGVh\n' +
      'dTEPMA0GA1UECgwGSHlsYW5kMRQwEgYDVQQLDAtDcmVkZW50aWFsczEYMBYGA1UE\n' +
      'AwwPSnVsaWVuIEZyYWljaG90MSkwJwYJKoZIhvcNAQkBFhpqdWxpZW4uZnJhaWNo\n' +
      'b3RAaHlsYW5kLmNvbTAeFw0yMzA5MTUxNDUyNDBaFw0yNDA5MTQxNDUyNDBaMIGg\n' +
      'MQswCQYDVQQGEwJGUjETMBEGA1UECAwKU29tZS1TdGF0ZTEQMA4GA1UEBwwHTW9y\n' +
      'dGVhdTEPMA0GA1UECgwGSHlsYW5kMRQwEgYDVQQLDAtDcmVkZW50aWFsczEYMBYG\n' +
      'A1UEAwwPSnVsaWVuIEZyYWljaG90MSkwJwYJKoZIhvcNAQkBFhpqdWxpZW4uZnJh\n' +
      'aWNob3RAaHlsYW5kLmNvbTB2MBAGByqGSM49AgEGBSuBBAAiA2IABAIPJKgThTo/\n' +
      '9fJDj0Bkn0MEuGRxAUEFK1m6JSq30HgFoiXX+UypEh1S6yXjvKKoc6NSeexYPa9p\n' +
      'qRiLMuT95tcZixLPypAnMTDBfGmN6eWBmKi87otsMJDbyYQ21Uj5xzAKBggqhkjO\n' +
      'PQQDAgNpADBmAjEArxuJRC/lldN8JkHrIN9Y2st6H7YVPGnKBOnWzZDUJPPg6vcP\n' +
      'DzTJke6s4O5GYMpmAjEAnjmH0peqvFOoeQ5QZ3KwiS/o7OpMuZSDisy2HIqtOIqu\n' +
      'V677qMc4CfzRm58JEDgy\n'
  ],
  sigT: '2023-09-19T13:36:11.365Z'
}

So I'm assuming this is because I don't have the crit array set as expected. However, if I do the following:

.setProtectedHeader({
        alg: 'ES384',
        cty: 'json',
        typ: 'jose',
        kid: '[map kid to a dereferencable public key / DID or similar]', // TODO
        // fingerprint value from: openssl x509 -noout -fingerprint -sha256 -inform pem -in ec_p384_x509.pem
        'x5t#S256': toX5t('9D:90:A0:07:D5:24:C2:E7:32:BC:32:14:8F:7A:34:14:5E:4E:02:2B:AA:2B:B3:21:92:00:0C:05:45:94:2F:22'),
        x5c: [pem],
        sigT: currentTime(), 
        // not supported by JOSE:
        crit: [
          'sigT' // based on the above link example
        ]
      })

I get the following error:

JOSENotSupported: Extension Header Parameter "sigT" is not recognized
    at validateCrit (/Users/julien/work/poc-sign-pem/node_modules/jose/dist/node/cjs/lib/validate_crit.js:25:19)
    at FlattenedSign.sign (/Users/julien/work/poc-sign-pem/node_modules/jose/dist/node/cjs/jws/flattened/sign.js:43:59)
    at GeneralSign.sign (/Users/julien/work/poc-sign-pem/node_modules/jose/dist/node/cjs/jws/general/sign.js:59:58)
    at IndividualSignature.sign (/Users/julien/work/poc-sign-pem/node_modules/jose/dist/node/cjs/jws/general/sign.js:30:28)
    at signSecp384r1 (/Users/julien/work/poc-sign-pem/src/signSecp384r1.js:77:8) {
  code: 'ERR_JOSE_NOT_SUPPORTED'

The spec (https://www.rfc-editor.org/rfc/rfc7515#section-4.1.11) does not seem to exclude any word other than the reserved ones, and sigT is present in the header, so I am not sure what's going on?

[panva]

The sign method options argument has a crit option which makes the header "recognized".

[lemoustachiste]

perfect, thank you