Layer 1: integrity
Each signature stores a digest of every signed file. Recompute the digests and compare. If they match, the files are byte-for-byte what was signed. This catches edited documents and missing attachments.
Layer 2: the signature value
The digests sit in a block that the signer's private key has signed. Verifying the signature value with the public key from the certificate proves that the holder of that key produced this exact block. For XML signatures this requires canonicalisation, a strict normalisation of the XML before hashing.
Layer 3: certificate trust
A certificate says "this key belongs to this person". That statement is only as good as its issuer. Verification walks from the signer's certificate up to a root listed in the EU trusted lists, checking each link.
Layer 4: revocation and time
A certificate can be suspended or revoked, for instance when a card is lost. The validator needs proof that it was valid at the signing moment: an OCSP response from the issuer, tied to a trusted time stamp.
Who checks what
| Layer | ASiCE Viewer (web) | ASiC-E Viewer app | DigiDoc4 |
|---|---|---|---|
| 1. File integrity | Yes | Yes | Yes |
| 2. Signature value | No | PKCS#7/CAdES yes, XAdES no | Yes |
| 3. Certificate trust chain | No | No | Yes |
| 4. Revocation and time | Shows the data, no verdict | Shows the data, no verdict | Yes |
Both ASiCE Viewer tools also show whether the certificate's validity period covered the signing time, which is a useful sanity check but not a substitute for layers 3 and 4.
How to use this in practice
- Everyday reading: layer 1 plus the signer's details answer "is this the document they signed?". ASiCE Viewer does that in seconds.
- Decisions with consequences: run the file through DigiDoc4 or a qualified validation service and keep the report.
Why honesty about layers matters
A tool that shows a green tick after checking only layer 1 gives false comfort. A tool that names what it checked lets you decide whether that is enough. The step-by-step procedure is in verify an ASiC-E signature; the Android app lists its checks in the same way.
Frequently asked questions
Does integrity OK mean the signature is valid?
It means the files match the signature's digests. Legal validity additionally needs the signature value, the certificate chain and revocation status to be checked.
Why can't a browser viewer do all four layers?
The last layers require EU trust lists and contact with certificate authorities' services, which a purely local page does not have.