能否通过JSON格式实现类XAdES的简易数字签名及带时间戳的文档签章？

1. Simpler JSON-based Alternatives to XAdES #

• First off, JSON Web Signature (JWS) (defined in RFC 7515) is the most straightforward lightweight alternative to XAdES. Unlike XAdES's verbose XML structure, JWS uses compact or JSON serialization formats that are easy to parse, transmit, and integrate with modern web/API workflows.
• If you need features similar to XAdES (like timestamping, signature attributes, or compliance with regulatory standards like eIDAS), look into JAdES (JSON Advanced Electronic Signatures). JAdES extends JWS to map XAdES's security properties into JSON, giving you the simplicity of JSON while retaining the robustness of XAdES-style signatures. It’s designed specifically to align with European eIDAS regulations, just like XAdES, but without the XML overhead.

2. Using JSON to Replace XAdES-T for Signatures + Timestamping #

Absolutely, you can use JSON-based signatures to replicate XAdES-T's core functionality (signatures with trusted timestamps) while simplifying your workflow:

• Basic timestamping with JWS: JWS supports standard claims like iat (issued at time) and exp (expiration time) for embedded timestamps. For most non-regulated use cases, this is sufficient and far simpler than XAdES-T's XML timestamp structures.
• Trusted TSA timestamps (like XAdES-T): If you need timestamps from a trusted Timestamping Authority (TSA), JAdES extends JWS to include TSA-signed timestamp tokens. This works similarly to XAdES-T but wraps the timestamp data in JSON, making validation and processing easier.

Here’s a simplified example of a JWS with an embedded timestamp claim (compact serialization):

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJqb2UiLCJpYXQiOjE2MjAwMDAwMDAsImV4cCI6MTYyMDAwMzYwMCwiYXVkIjoiaHR0cHM6Ly9leGFtcGxlLmNvbSJ9.cC4hiUPoj9Eetdgtv3hF80EGrhuB__dzERat0XF9g2VtQgr9PJbu3XOiZj5RZmh7AAuHIm4Bh-0Qc_lF5YKt_O8W2Fp5jujGbds9uJdbF9CUAr7t1dnZcAcQjbKBYNX4BAynRFdiuB--f_nZLgrnbyTyWzO75vRK5h6xBArLIARNPvkSjtQBMHlb1L07Qe7K0GarZRmB_eSN9383LcOLn6_dO--xi12jzDwusC-eOkHWEsqtFZESc6BfI7noOPqvhJ1phCnvWh6IeYI2w9QOYEUipUTI8np6LbgGY9Fs98rqVt5AXLIhWkWywlVmtVrBp0igcN_IoypGlUPQGe77Rw

Most modern cryptography libraries (like JJWT for Java, PyJWT with JAdES extensions for Python, or Node.js libraries like jose) support adding TSA timestamp attributes directly to the JWS header or payload. The biggest win here is ditching the complex XML parsing and manipulation required for XAdES-T—validation can often be done with a single library call, streamlining your entire workflow.

内容的提问来源于stack exchange，提问作者Miguel Carvalhais Matos