ZATCA cryptographic stamp and QR code checks
16 rules, version Security Features Implementation Standards 1.1, SDK 3.4.6, published by xmlvalid, after ZATCA's Electronic Invoice Security Features Implementation Standards and the stamps of its SDK (MIT, source). Checked with Saudi Arabia ZATCA Tax Invoice (UBL), Saudi Arabia ZATCA Simplified Tax Invoice (UBL) .
- XV-SA-01 how to fixThe invoice hash in the signature (DigestValue of the invoiceSignedData reference, …) is not the hash of the invoice (…): the invoice changed after it was signed, or the hash was made over another form of it.
- XV-SA-02 The signature (ds:SignatureValue) does not verify with the public key of the certificate in the signature over the invoice hash it states.
- XV-SA-03 The certificate digest in the signed properties (xades:CertDigest, …) is not that of the certificate in the signature (…).
- XV-SA-04 The digest of the signed properties in the signature (…) is not that of xades:SignedProperties (…).
- XV-SA-05 The QR code can't be read: ….
- XV-SA-06 warning The QR code is … characters long; ZATCA's standard allows up to 700.
- XV-SA-07 The QR code lacks tag …: it must carry tags 1 to 8….
- XV-SA-08 The seller's name in the QR code (tag 1, …) is not the seller's RegistrationName (…).
- XV-SA-09 The VAT number in the QR code (tag 2, …) is not the seller's (…).
- XV-SA-10 The time stamp in the QR code (tag 3, …) is not the invoice's issue date and time (…).
- XV-SA-11 The total with VAT in the QR code (tag 4, …) is neither the invoice's TaxInclusiveAmount (…) nor, after prepayments, its PayableAmount (…).
- XV-SA-12 The VAT total in the QR code (tag 5, …) is not the invoice's VAT total (…).
- XV-SA-13 The invoice hash in the QR code (tag 6, …) is not the hash of the invoice (…).
- XV-SA-14 The signature in the QR code (tag 7) is not the invoice's ds:SignatureValue.
- XV-SA-15 The public key in the QR code (tag 8) is not that of the certificate in the signature.
- XV-SA-16 The certificate signature in the QR code (tag 9) is not that of the certificate in the signature.