anchor.diff:  
   
   [[Topology]]
  -=== Examples of SCA and SCDev Topology and Workflows.
  +=== Examples of SCA and SCDev Topology and Workflows
   
   ==== Hash computation
   In order to avoid transfer of original or sensitive information, and also to reduce the amount of data by online protocols, a hash of a document or data to be signed can be computed.
  
positive.code: 
  * The validation process for Basic signature is executed against the first time which is the (current) validation time;
  * The validation process for Signatures with Time and Signatures with Long-Term Validation Material is executed against a second time which is the "best signature time" that is determined using the signature timestamp;
  * The validation process for Signatures with Archival Data is executed aginst a third time which is the "best signature time" determined using all time assertions present in the signature.
  
  Additionally, each process has an associated indication, here:
  
  . REVOKED_NO_POE for the validation process for basic signatures;
  . PASSED for the timestamp validation block;
  . PASSED for the validation process for Signatures with Time and Signatures with Long-Term Validation Material;
  . PASSED for the validation process for Signatures with Archival Data.
  
  Each of those indications is determined using the result of the associated building blocks, and applying additional checks.
  
  Here we can see that the REVOKED_NO_POE indication arises from the fact that the result of the "X.509 Certificate Validation" building block is not conclusive.
  
  Now delving into the building blocks themselves, we can see in the figure below that the building blocks are grouped by the signed objects to which they relate:
  
  * BBB SIG are the building blocks used for the validation of the signature itself;
  * BBB TIMESTAMP are the building blocks used for the validation of the timestamp;
  * BBB REVOCATION DATA are the building blocks used for the validation of the OCSP responses taken as CMS objects.
  
  image::DetailedReport-Illustration-BB.png[width="100%", height="100%", align="center"]
  
  
negative.code: 
  We see there that the check "Is the certificate validation conclusive?" has failed. Therefore, we now need to look at the "Certificate" sub-block of BBB SIG.
  
  In the "Certificate" sub-block we can see that all checks succeeded except for "Is the certificate not revoked?". We can thus conclude that the validation process for basic signature resulted in the indication `REVOKED_NO_POE` because the signing certificate is revoked at validation time.
  
  That being said, we saw before that although the validation process for basic signature failed with `REVOKED_NO_POE`, the other validation processes resulted in the `PASSED` indication. And in fact, the overall result of the validation process is `TOTAL_PASSED`.
  
  To understand why that is so, we need to look back at the signature validation processes. There we can see in the "validation process for Signatures with Time and Signatures with Long-Term Validation Material" that specific checks differing from the building blocks are executed. Which checks are executed depends on the indication determined during the "validation process for basic signatures". In the present case, because the indication was `REVOKED_NO_POE` the specific check "Is the revocation time after best-signature-time" is executed.
  
  As mentioned before, _best-signature-time_ is determined, for that validation process, using the signature timestamp. Because here the validation of the signature timestamp succeeded, the time indicated in the timestamp is used as _best-signature-time_, and because this time is indeed before the time of revocation of the signing certificate, the check succeeds, and the whole "validation process for Signatures with Time and Signatures with Long-Term Validation Material" succeeds.
  
  Now to understand why the overall result of the validation is `TOTAL_PASSED`, we need to go back to the procedures specified in ETSI EN 319 102-1 (cf. <<R09>>). The three validation processes specified in that standard are in fact not independent:
  
  * The "validation process for Signatures providing Long Term Availability and Integrity of Validation Material" calls the "validation process for Signatures with Time and Signatures with Long-Term Validation Material"; and
  * The "validation process for Signatures with Time and Signatures with Long-Term Validation Material" itself calls the "validation process for basic signatures".
  