Sign in Open validatorValidator

XV-SA-01

The invoice hash in the signature (DigestValue of the invoiceSignedData reference, …) is not the hash of the invoice (…): the invoice changed after it was signed, or the hash was made over another form of it.

error: the document is invalid

Why it fails

  • The invoice was edited after it was signed: an amount, a note, the issue time or the PIH.
  • The hash was taken over the invoice as written, not without ext:UBLExtensions, cac:Signature and the QR code's cac:AdditionalDocumentReference, or not canonicalized with C14N 1.1.
  • The signature block was copied from a sample, with the sample's hash.

How to fix it

Sign as the last step: remove the three parts, canonicalize the rest with C14N 1.1, take its SHA-256 in Base64, put it in the invoiceSignedData reference and in tag 6 of the QR code, then sign it.

What the rule checks

As the rule set's publisher wrote it. The rule runs on every element the context matches, and fails where the test is false; the validator reports the line of that element.

ZATCA cryptographic stamp and QR code checks Security Features Implementation Standards 1.1, SDK 3.4.6
Context
/*[ext:UBLExtensions//ds:Signature]
Test
not($reference) or $stated = $hash

Checked with Saudi Arabia ZATCA Tax Invoice (UBL), Saudi Arabia ZATCA Simplified Tax Invoice (UBL)