hanko_xml 0.1.0-aarch64-linux → 0.2.0-aarch64-linux

data/lib/hanko_xml/xades/long_term.rb

@@ -0,0 +1,252 @@
+# frozen_string_literal: true
+
+require "openssl"
+
+module HankoXml
+  module Xades
+    # The revocation evidence one certificate of the chain passed with (#168),
+    # on LongTermValidation#revocation.
+    # +source+ is :ocsp or :crl; +issued_at+ its thisUpdate; +status+ :good, or
+    # :revoked_later when it was revoked after the validation time.
+    RevocationStatus = Struct.new(:certificate, :source, :issued_at, :status, keyword_init: true) do
+      def initialize(**)
+        super
+        freeze
+      end
+    end
+
+    # A passed XAdES-LT validation (#168), on
+    # Xades::Verification#long_term_validation: the validation +time+ (the
+    # earliest verified SignatureTimeStamp), the signing +certificate_chain+
+    # (leaf first, ending at the caller's trust anchor), and the +revocation+
+    # evidence for each certificate below the anchor.
+    LongTermValidation = Struct.new(:time, :certificate_chain, :revocation, keyword_init: true) do
+      def initialize(**)
+        super
+        freeze
+      end
+    end
+
+    # The embedded <xades:CertificateValues> and <xades:RevocationValues> of
+    # one signature, parsed. Attacker-supplied until LongTermCheck uses them
+    # (S-22, S-23).
+    #
+    # @api private
+    class LongTermValues
+      attr_reader :certificates, :crls, :ocsp_responses
+
+      PATHS = {
+        certificates: "xades:CertificateValues/xades:EncapsulatedX509Certificate",
+        crls: "xades:RevocationValues/xades:CRLValues/xades:EncapsulatedCRLValue",
+        ocsp_responses: "xades:RevocationValues/xades:OCSPValues/xades:EncapsulatedOCSPValue"
+      }.freeze
+
+      # The values in +properties+ (an UnsignedSignatureProperties), or nil
+      # when it holds no CertificateValues or RevocationValues.
+      def self.read(properties, ns)
+        return nil unless properties
+        return nil if properties.xpath("xades:CertificateValues | xades:RevocationValues", ns).empty?
+
+        Locator.fail!("XAdES-LT values are verified only in the XAdES 1.3.2 namespace") unless ns["xades"] == NS
+        new(**PATHS.to_h { |kind, path| [kind, properties.xpath(path, ns).map { |node| parse(kind, node.text) }] })
+      end
+
+      def self.parse(kind, base64)
+        der = base64.gsub(/\s/, "").unpack1("m0")
+        case kind
+        when :certificates then OpenSSL::X509::Certificate.new(der)
+        when :crls then OpenSSL::X509::CRL.new(der)
+        else
+          OpenSSL::OCSP::Response.new(der).tap do |response|
+            unless response.status == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL && response.basic
+              Locator.fail!("an <xades:EncapsulatedOCSPValue> is not a successful OCSP response")
+            end
+          end
+        end
+      rescue ArgumentError, OpenSSL::X509::CertificateError, OpenSSL::X509::CRLError, OpenSSL::OCSP::OCSPError
+        Locator.fail!("an embedded XAdES-LT value is not Base64 DER of its type (#{kind})")
+      end
+      private_class_method :parse
+
+      def initialize(certificates:, crls:, ocsp_responses:)
+        @certificates = certificates.freeze
+        @crls = crls.freeze
+        @ocsp_responses = ocsp_responses.freeze
+        freeze
+      end
+    end
+
+    # Validates the signing certificate chain at the time of the earliest
+    # verified SignatureTimeStamp, with the embedded revocation data (#168).
+    #
+    # The chain itself has already been built and verified at that time by
+    # {HankoXml::Verifier} (store:, StoreContext with time=). Here, each
+    # certificate below the trust anchor needs revocation evidence that:
+    #
+    # - verifies: an OCSP response through OpenSSL::OCSP::BasicResponse#verify
+    #   (the responder's signature, its chain to the same anchor, and its
+    #   authorization for that certificate), with the responder's chain then
+    #   checked at the response's producedAt; or a CRL signed by the
+    #   certificate's issuer (CRL#verify), an issuer allowed to sign CRLs;
+    # - is fresh: issued (thisUpdate) no earlier than the validation time
+    #   minus +grace+, and not in the future;
+    # - does not show the certificate revoked at or before the validation
+    #   time. Revoked later is accepted: the timestamp proves the signature
+    #   existed before.
+    #
+    # Evidence that does not verify or is stale is not used; a certificate
+    # left without usable evidence fails, and so does any usable evidence of
+    # an earlier revocation (fail closed, S-23).
+    #
+    # @api private
+    class LongTermCheck
+      CRL_SIGN_BIT = 6
+
+      def initialize(grace:, clock_skew:)
+        @grace = grace
+        @clock_skew = clock_skew
+      end
+
+      # @return [LongTermValidation]
+      # @raise [XadesError]
+      def verify(time:, chain:, values:)
+        @time = time
+        @anchor = chain.last
+        @pool = (chain + values.certificates).uniq(&:to_der)
+        @values = values
+        revocation = chain.each_cons(2).with_index.map { |(certificate, issuer), i| status(certificate, issuer, i) }
+        LongTermValidation.new(time: time, certificate_chain: chain.freeze, revocation: revocation.freeze)
+      end
+
+      private
+
+      # +position+ names the certificate in messages: its subject comes from
+      # the document, so it goes to #xmlsec_errors, not the message (S-13).
+      def status(certificate, issuer, position)
+        evidence = ocsp_evidence(certificate, issuer) + crl_evidence(certificate, issuer)
+        revoked = evidence.find { |item| item.status == :revoked }
+        if revoked
+          fail!("the embedded #{revoked.source.upcase} shows #{name(position)} revoked at or before the " \
+                "validation time", certificate)
+        end
+        found = evidence.min_by { |item| item.status == :good ? 0 : 1 }
+        fail!("no embedded revocation data verifies and is fresh for #{name(position)}", certificate) unless found
+
+        found
+      end
+
+      def name(position)
+        position.zero? ? "the signing certificate" : "chain certificate #{position}"
+      end
+
+      def ocsp_evidence(certificate, issuer)
+        @values.ocsp_responses.flat_map do |response|
+          basic = response.basic
+          singles = basic.responses.select { |single| about?(single.certid, certificate, issuer) }
+          next [] if singles.empty? || !responder_verified?(basic)
+
+          singles.filter_map { |single| ocsp_status(certificate, single) }
+        end
+      end
+
+      def about?(certid, certificate, issuer)
+        return false unless certid.serial == certificate.serial
+
+        OpenSSL::OCSP::CertificateId.new(certificate, issuer, OpenSSL::Digest.new(certid.hash_algorithm)).cmp(certid)
+      rescue OpenSSL::OCSP::OCSPError, RuntimeError
+        false
+      end
+
+      def ocsp_status(certificate, single)
+        return nil unless fresh?(single.this_update)
+
+        status = case single.cert_status
+                 when OpenSSL::OCSP::V_CERTSTATUS_GOOD then :good
+                 when OpenSSL::OCSP::V_CERTSTATUS_REVOKED then revoked_status(single.revocation_time)
+                 end
+        status && RevocationStatus.new(certificate: certificate, source: :ocsp, issued_at: single.this_update,
+                                       status: status)
+      end
+
+      def revoked_status(revoked_at)
+        revoked_at > @time ? :revoked_later : :revoked
+      end
+
+      # OpenSSL checks the signature, the responder's chain to the anchor and
+      # its authorization; it cannot take a verification time, so it runs
+      # without time checks and the responder's chain is then verified at
+      # producedAt.
+      def responder_verified?(basic)
+        response_certificates, responder_id, produced_at = ocsp_fields(basic)
+        pool = (@pool + response_certificates).uniq(&:to_der)
+        return false unless basic.verify(pool, anchor_store(OpenSSL::X509::V_FLAG_NO_CHECK_TIME))
+
+        signer = pool.find { |candidate| responder?(candidate, responder_id) }
+        return false unless signer
+
+        context = OpenSSL::X509::StoreContext.new(anchor_store, signer, pool)
+        context.time = produced_at
+        context.verify
+      end
+
+      # BasicOCSPResponse (RFC 6960 §4.2.1): its certs, ResponderID and
+      # producedAt, which OpenSSL::OCSP::BasicResponse does not expose.
+      def ocsp_fields(basic)
+        sequence = OpenSSL::ASN1.decode(basic.to_der).value
+        fields = sequence[0].value
+        fields = fields.drop(1) if fields.first.tag_class == :CONTEXT_SPECIFIC && fields.first.tag.zero?
+        certificates = sequence[3]&.value&.first&.value.to_a.map { |cert| OpenSSL::X509::Certificate.new(cert.to_der) }
+        [certificates, fields[0], fields[1].value]
+      end
+
+      # ResponderID: byName [1] or byKey [2] (SHA-1 of the public key bits).
+      def responder?(certificate, responder_id)
+        value = responder_id.value.first
+        if responder_id.tag == 1
+          certificate.subject.to_der == value.to_der
+        else
+          key_bits = OpenSSL::ASN1.decode(certificate.public_key.to_der).value[1].value
+          OpenSSL::Digest.digest("SHA1", key_bits) == value.value
+        end
+      end
+
+      def crl_evidence(certificate, issuer)
+        return [] unless crl_signer?(issuer)
+
+        @values.crls.filter_map do |crl|
+          next unless crl.issuer.to_der == issuer.subject.to_der && crl.verify(issuer.public_key)
+          next unless fresh?(crl.last_update)
+
+          entry = crl.revoked.find { |revoked| revoked.serial == certificate.serial }
+          status = entry ? revoked_status(entry.time) : :good
+          RevocationStatus.new(certificate: certificate, source: :crl, issued_at: crl.last_update, status: status)
+        end
+      end
+
+      # No KeyUsage means no restriction (RFC 5280); otherwise cRLSign.
+      def crl_signer?(issuer)
+        extension = issuer.extensions.find { |ext| ext.oid == "keyUsage" }
+        return true if extension.nil?
+
+        OpenSSL::ASN1.decode(extension.value_der).value.to_s.unpack1("B*").to_s[CRL_SIGN_BIT] == "1"
+      rescue OpenSSL::ASN1::ASN1Error
+        false
+      end
+
+      def fresh?(issued_at)
+        issued_at >= @time - @grace && issued_at <= Time.now + @clock_skew
+      end
+
+      def anchor_store(flags = nil)
+        OpenSSL::X509::Store.new.tap do |store|
+          store.add_cert(@anchor)
+          store.flags = flags if flags
+        end
+      end
+
+      def fail!(message, certificate)
+        raise HankoXml::XadesError.new(message, xmlsec_errors: ["subject: #{certificate.subject}"])
+      end
+    end
+  end
+end

data/lib/hanko_xml/xades/timestamp.rb

@@ -0,0 +1,386 @@
+# frozen_string_literal: true
+
+require "openssl"
+
+module HankoXml
+  module Xades
+    # Obtains the RFC 3161 token for a XAdES-T <xades:SignatureTimeStamp>
+    # (#162). The imprint is a digest of the signature's <ds:SignatureValue>,
+    # canonicalized by xmlsec (#161) with the CanonicalizationMethod the
+    # SignatureTimeStamp skeleton already declares. OpenSSL::Timestamp builds
+    # the request and parses the response; the Signer's timestamper: performs
+    # the exchange.
+    #
+    # The response is checked against the request before it is used: status
+    # granted, the same imprint and digest, the same nonce. Its TSA signature
+    # is not checked here: that needs the TSA's trust anchors, which the
+    # verifier holds (#163).
+    #
+    # @api private
+    class SignatureTimeStamper
+      # The skeleton's CanonicalizationMethod and EncapsulatedTimeStamp, from
+      # the <ds:Signature>.
+      TIMESTAMP_PATH = [
+        [HankoXml::NS["ds"], "Object", nil], [NS, "QualifyingProperties", nil], [NS, "UnsignedProperties", nil],
+        [NS, "UnsignedSignatureProperties", nil], [NS, "SignatureTimeStamp", nil]
+      ].freeze
+      METHOD_PATH = [*TIMESTAMP_PATH, [HankoXml::NS["ds"], "CanonicalizationMethod", nil]].freeze
+      ENCAPSULATED_XPATH = "./ds:Object/xades:QualifyingProperties/xades:UnsignedProperties/" \
+                           "xades:UnsignedSignatureProperties/xades:SignatureTimeStamp/xades:EncapsulatedTimeStamp"
+
+      # PKIStatus granted and grantedWithMods (RFC 3161 §2.4.2).
+      GRANTED = [0, 1].freeze
+
+      def initialize(signer)
+        @signer = signer
+        @digest = HankoXml::Algorithms.name_for(
+          :digest, HankoXml::Algorithms.uri_for(:digest, signer.timestamp_digest_method)
+        ).to_s.tr("_", "-")
+      end
+
+      def self.check_timestamper!(timestamper)
+        return if timestamper.nil? || timestamper.respond_to?(:call)
+
+        raise HankoXml::ConfigurationError, "timestamper: must respond to #call (TimeStampReq DER -> TimeStampResp DER)"
+      end
+
+      # The imprint algorithms go through the registry and +policy+, like
+      # every algorithm the signature itself uses.
+      def self.check_algorithms!(policy, digest:, canonicalization:)
+        { digest: digest, canonicalization: canonicalization }.each do |slot, name|
+          unless HankoXml::Algorithms.uri_for(slot, name)
+            raise HankoXml::ConfigurationError,
+                  "timestamp_#{slot}_method: #{name.inspect} is not a registered #{slot} algorithm"
+          end
+
+          policy.enforce_algorithm!(slot, name)
+        end
+      end
+
+      # The DER TimeStampToken for the nth signature in +signed_bytes+.
+      # +method_path+ leads from the <ds:Signature> to the skeleton's
+      # CanonicalizationMethod.
+      def token(signed_bytes, index, method_path = METHOD_PATH)
+        token_for(Native.canonicalize(signed_bytes, index, [[HankoXml::NS["ds"], "SignatureValue", nil]],
+                                      method_path))
+      end
+
+      # The DER TimeStampToken over the digest of +input+ (an ArchiveTimeStamp's
+      # input, #169).
+      def token_for(input)
+        request = build_request(OpenSSL::Digest.digest(@digest, input))
+        response = exchange(request)
+        check_response!(request, response)
+        response.token.to_der
+      end
+
+      private
+
+      def build_request(imprint)
+        OpenSSL::Timestamp::Request.new.tap do |request|
+          request.algorithm = @digest
+          request.message_imprint = imprint
+          request.nonce = OpenSSL::BN.rand(64)
+          request.cert_requested = true
+        end
+      end
+
+      def exchange(request)
+        der = @signer.timestamper.call(request.to_der)
+        unless der.is_a?(String)
+          raise HankoXml::SigningError, "timestamper: returned #{der.class}, not a DER TimeStampResp"
+        end
+
+        OpenSSL::Timestamp::Response.new(der)
+      rescue OpenSSL::Timestamp::TimestampError
+        raise HankoXml::SigningError, "timestamper: returned bytes that are not a DER TimeStampResp"
+      end
+
+      def check_response!(request, response)
+        unless GRANTED.include?(response.status.to_i) && response.token
+          raise HankoXml::SigningError,
+                "the TSA did not grant the timestamp (status #{response.status.to_i}#{status_text(response)})"
+        end
+
+        info = response.token_info
+        unless info.message_imprint == request.message_imprint && digest_name(info.algorithm) == @digest
+          raise HankoXml::SigningError, "the TSA's token does not cover this signature's SignatureValue imprint"
+        end
+        return if info.nonce == request.nonce
+
+        raise HankoXml::SigningError, "the TSA's token does not carry the request's nonce"
+      end
+
+      def digest_name(algorithm)
+        OpenSSL::Digest.new(algorithm).name.downcase
+      rescue RuntimeError, OpenSSL::Digest::DigestError
+        nil
+      end
+
+      def status_text(response)
+        text = Array(response.status_text).join("; ")
+        text.empty? ? "" : ": #{text}"
+      end
+    end
+  end
+end
+
+module HankoXml
+  module Xades
+    # A verified <xades:SignatureTimeStamp> (#163), on
+    # Xades::Verification#signature_timestamps, or <xades141:ArchiveTimeStamp>
+    # (#169), on Xades::Verification#archive_timestamps.
+    SignatureTimeStamp = Struct.new(:id, :time, :serial_number, :tsa_certificate, :digest_method, :policy_id,
+                                    keyword_init: true) do
+      def initialize(**)
+        super
+        freeze
+      end
+    end
+
+    # Verifies one <xades:SignatureTimeStamp> of a signature whose XML-DSig
+    # and signed properties already verified (#163).
+    #
+    # OpenSSL does the RFC 3161 work: OpenSSL::Timestamp::Response#verify
+    # checks the TSA's signature, its chain to the caller's TSA trust and the
+    # timeStamping purpose, and that the token's imprint is the digest of the
+    # bytes this class hands it. Those bytes are the <ds:SignatureValue>,
+    # canonicalized by xmlsec (#161) with the CanonicalizationMethod the
+    # SignatureTimeStamp declares. Both algorithms go through the policy.
+    #
+    # The element is attacker-controlled until this passes: it lies outside
+    # everything the signature covers.
+    #
+    # @api private
+    class SignatureTimeStampCheck
+      SIGNATURE_VALUE_PATH = [[HankoXml::NS["ds"], "SignatureValue", nil]].freeze
+      # The children a SignatureTimeStamp may have. Include and ReferenceInfo
+      # belong to other timestamp kinds, XMLTimeStamp has no defined format.
+      ALLOWED_CHILDREN = [[HankoXml::NS["ds"], "CanonicalizationMethod"], [:xades, "EncapsulatedTimeStamp"]].freeze
+
+      # +path+ is the native path from the <ds:Signature> to this
+      # SignatureTimeStamp.
+      def initialize(node, path, ns:, policy:, tsa_store:)
+        @node = node
+        @path = path
+        @ns = ns
+        @policy = policy
+        @tsa_store = tsa_store
+      end
+
+      # @return [SignatureTimeStamp]
+      # @raise [XadesError, PolicyError]
+      def verify(xml_bytes, signature_index)
+        check_children!
+        check_canonicalization_method!
+        canonical = imprint_input(xml_bytes, signature_index)
+        response = wrap(token_der)
+        digest = digest_method(response.token_info.algorithm)
+        verify_token!(response, digest, canonical)
+        result(response, digest)
+      rescue HankoXml::NativeError, HankoXml::ParseError
+        fail!("the #{covered} could not be canonicalized for the #{kind}")
+      end
+
+      private
+
+      def kind
+        "SignatureTimeStamp"
+      end
+
+      def element
+        "xades:SignatureTimeStamp"
+      end
+
+      def covered
+        "SignatureValue"
+      end
+
+      def method_path
+        [*@path, [HankoXml::NS["ds"], "CanonicalizationMethod", nil]]
+      end
+
+      # The bytes the token's imprint must be the digest of.
+      def imprint_input(xml_bytes, signature_index)
+        Native.canonicalize(xml_bytes, signature_index, SIGNATURE_VALUE_PATH, method_path)
+      end
+
+      def check_children!
+        children = @node.element_children
+        unless children.all? { |child| allowed_child?(child) }
+          fail!("a <#{element}> holds only CanonicalizationMethod and EncapsulatedTimeStamp")
+        end
+        return if children.count { |child| child.name == "EncapsulatedTimeStamp" } == 1
+
+        fail!("a <#{element}> needs exactly one <xades:EncapsulatedTimeStamp>")
+      end
+
+      def allowed_child?(child)
+        ALLOWED_CHILDREN.any? do |ns, name|
+          child.name == name && child.namespace&.href == (ns == :xades ? @ns["xades"] : ns)
+        end
+      end
+
+      def check_canonicalization_method!
+        methods = @node.xpath("ds:CanonicalizationMethod", @ns)
+        unless methods.size == 1 && methods.first["Algorithm"]
+          fail!("a <#{element}> without a CanonicalizationMethod is not supported")
+        end
+
+        @policy.enforce_algorithm!(:canonicalization, methods.first["Algorithm"])
+      end
+
+      def token_der
+        @node.at_xpath("xades:EncapsulatedTimeStamp", @ns).text.gsub(/\s/, "").unpack1("m0")
+      rescue ArgumentError
+        fail!("<xades:EncapsulatedTimeStamp> is not Base64")
+      end
+
+      # A TimeStampToken is a ContentInfo; OpenSSL verifies it as the token of
+      # a granted TimeStampResp, so it is wrapped in one.
+      def wrap(token)
+        status = OpenSSL::ASN1::Sequence([OpenSSL::ASN1::Integer(0)])
+        OpenSSL::Timestamp::Response.new(OpenSSL::ASN1::Sequence([status, OpenSSL::ASN1.decode(token)]).to_der)
+      rescue OpenSSL::ASN1::ASN1Error, OpenSSL::Timestamp::TimestampError
+        fail!("<xades:EncapsulatedTimeStamp> is not an RFC 3161 TimeStampToken OpenSSL can read")
+      end
+
+      # The token's imprint digest, as a registry URI the policy allows.
+      def digest_method(openssl_name)
+        name = OpenSSL::Digest.new(openssl_name.to_s).name.downcase.tr("-", "_").to_sym
+        uri = HankoXml::Algorithms.uri_for(:digest, name)
+        fail!("the #{kind} imprint digest is not a registered digest") unless uri
+
+        @policy.enforce_algorithm!(:digest, uri)
+        [name, uri]
+      rescue RuntimeError, OpenSSL::Digest::DigestError
+        fail!("the #{kind} imprint digest is not a registered digest")
+      end
+
+      def verify_token!(response, digest, canonical)
+        request = OpenSSL::Timestamp::Request.new
+        request.algorithm = digest.first.to_s.tr("_", "-")
+        request.message_imprint = OpenSSL::Digest.digest(request.algorithm, canonical)
+        response.verify(request, @tsa_store)
+      rescue OpenSSL::Timestamp::TimestampError
+        fail!("the #{kind} does not verify: its TSA is not trusted, its signature is invalid, " \
+              "or it does not cover this signature's #{covered}")
+      end
+
+      def result(response, digest)
+        info = response.token_info
+        SignatureTimeStamp.new(
+          id: @node["Id"]&.dup&.freeze,
+          time: info.gen_time.utc.freeze,
+          serial_number: info.serial_number.to_i,
+          tsa_certificate: response.tsa_certificate,
+          digest_method: digest.last,
+          policy_id: info.policy_id
+        )
+      end
+
+      def fail!(message)
+        raise HankoXml::XadesError, message
+      end
+    end
+
+    # Verifies one <xades141:ArchiveTimeStamp> (XAdES-LTA, #169) as
+    # SignatureTimeStampCheck does a SignatureTimeStamp, over the input EN 319
+    # 132-1 §5.5.2.2 defines, concatenated in this order:
+    #
+    # 1. each SignedInfo Reference's data, as xmlsec digested it
+    #    (Native.reference_data);
+    # 2. ds:SignedInfo, ds:SignatureValue and ds:KeyInfo (if present);
+    # 3. every UnsignedSignatureProperties child before this ArchiveTimeStamp;
+    # 4. every ds:Object except the one holding QualifyingProperties;
+    #
+    # 2 to 4 each canonicalized by xmlsec (#161) with the ArchiveTimeStamp's
+    # CanonicalizationMethod. A Reference whose data is a node set was
+    # canonicalized by xmlsec with inclusive c14n, so it is only accepted when
+    # that is the ArchiveTimeStamp's method too.
+    #
+    # @api private
+    class ArchiveTimeStampCheck < SignatureTimeStampCheck
+      INCLUSIVE_C14N = "http://www.w3.org/TR/2001/REC-xml-c14n-20010315"
+      BASE64_TRANSFORM = "http://www.w3.org/2000/09/xmldsig#base64"
+
+      # Whether any SignedInfo Reference leaves a node set: its transforms do
+      # not end in a canonicalization or base64, so xmlsec canonicalized it
+      # with inclusive c14n before digesting.
+      def self.node_set_references?(signature_info)
+        signature_info.references.any? do |reference|
+          last = reference.transforms.last
+          last.nil? || !(HankoXml::Algorithms.name_for(:canonicalization, last) || last == BASE64_TRANSFORM)
+        end
+      end
+
+      # The native paths of EN 319 132-1 §5.5.2.2 steps 2 to 4 for the
+      # ArchiveTimeStamp +node+ in +properties+ (an UnsignedSignatureProperties
+      # at native +path+).
+      def self.element_paths(signature, qualifying, properties, node, path)
+        ds = HankoXml::NS["ds"]
+        paths = [[[ds, "SignedInfo", nil]], [[ds, "SignatureValue", nil]]]
+        paths << [[ds, "KeyInfo", nil]] if signature.at_xpath("ds:KeyInfo", "ds" => ds)
+        properties.element_children.take_while { |child| !child.equal?(node) }.each do |child|
+          paths << [*path, sibling_step(child)]
+        end
+        signature.xpath("ds:Object", "ds" => ds).each_with_index do |object, i|
+          paths << [[ds, "Object", i]] unless object.equal?(qualifying.parent)
+        end
+        paths
+      end
+
+      def self.sibling_step(child)
+        href = child.namespace&.href
+        Locator.fail!("an unsigned signature property has no namespace") unless href
+
+        same = child.parent.element_children.select do |other|
+          other.name == child.name && other.namespace&.href == href
+        end
+        [href, child.name, same.index(child)]
+      end
+      private_class_method :sibling_step
+
+      # The concatenated input: the References' data, then each element at
+      # +element_paths+ canonicalized with the method at +method_path+.
+      def self.input(xml_bytes, signature_index, references, element_paths, method_path)
+        element_paths.inject(references.map(&:b).join.b) do |bytes, path|
+          bytes << Native.canonicalize(xml_bytes, signature_index, path, method_path).b
+        end
+      end
+
+      # +references+: the octets of step 1; +node_set_references+: whether any
+      # of them was a node set; +element_paths+: the native paths of 2 to 4.
+      def initialize(node, path, references:, node_set_references:, element_paths:, **options)
+        super(node, path, **options)
+        @references = references
+        @node_set_references = node_set_references
+        @element_paths = element_paths
+      end
+
+      private
+
+      def kind
+        "ArchiveTimeStamp"
+      end
+
+      def element
+        "xades141:ArchiveTimeStamp"
+      end
+
+      def covered
+        "signed data, signature and validation data"
+      end
+
+      def imprint_input(xml_bytes, signature_index)
+        method = @node.at_xpath("ds:CanonicalizationMethod", @ns)["Algorithm"]
+        if @node_set_references && method != INCLUSIVE_C14N
+          fail!("an ArchiveTimeStamp over a Reference whose data is a node set needs inclusive c14n " \
+                "as its CanonicalizationMethod")
+        end
+
+        self.class.input(xml_bytes, signature_index, @references, @element_paths, method_path)
+      end
+    end
+  end
+end