---
title: "Policies with references but no values"
description: "Signatures with a timestamp over revocation references but without the values (CAdES-C, CAdES-X Type 1, AD-RV): validating them with IReferencedCrlStore."
canonical: "https://docs.lacunasoftware.com/en-us/articles/pki-sdk/signatures/policies/revocation-refs-without-values"
locale: "en"
product: "PKI SDK"
last_updated: "2026-10-12"
---

# Policies with references but no values

Some signature policies require a timestamp over the revocation references but don't include the full revocation values. In
other words, the policy says the signature must have a timestamp over the digest of the revocation data used to validate the
signer's certificate, but that data need not be stored in the signature package. This is the case of the CAdES-C, CAdES-X
Type 1 and ICP-Brasil AD-RV policies.

To validate a signature in this scenario, an application must be able to retrieve the exact revocation data matching the digest
timestamped in the signature. The SDK's solution is to use an @Lacuna.Pki.Stores.IReferencedCrlStore at signing time: it keeps the
revocation data used to validate the certificates, indexed by its digest, which makes signature validation efficient and
consistent.

The example below uses this solution.

```cs
// An IReferencedCrlStore implementation
IReferencedCrlStore refStore = ...

// Creating the signature
var signer = new CadesSigner();
signer.SetSigningCertificate(signingCert);
signer.SetDataToSign(toSign);
signer.SetPolicy(policy);                   // Policy with references but no values
signer.SetCrlStore(refStore);               // Sets the store that keeps the referenced values for validation
signer.SetTimestampRequester(tsRequester);
signer.ComputeSignature();
byte[] sig = signer.GetSignature();

// Validating the signature
var cadesSig = CadesSignature.Open(sig);
var vrs = cadesSig.ValidateAllSignatures(policy, crlStore: refStore);
```

If you already use an @Lacuna.Pki.Stores.ISimpleStore implementation, for instance for
[signature compression](https://docs.lacunasoftware.com/en-us/articles/pki-sdk/signatures/cades/compression), you can easily create an @Lacuna.Pki.Stores.IReferencedCrlStore from it with the
@Lacuna.Pki.Stores.ReferencedCrlStoreFromSimpleStore implementation, as in the example below.

```cs
// An existing ISimpleStore implementation
ISimpleStore simpleStore = ...

// Creating the IReferencedCrlStore
IReferencedCrlStore refStore = new ReferencedCrlStoreFromSimpleStore(simpleStore);
```

> **Note**
>
> This strategy pays off when the revocation data checked are CRLs, which can be large files of a few megabytes. When the revocation
> data are small, such as OCSP responses, it is better to include their full values in the signature package too, which makes
> validation more efficient and less complex.

## See also

* [Signature compression](https://docs.lacunasoftware.com/en-us/articles/pki-sdk/signatures/cades/compression)
* @Lacuna.Pki.Stores.IReferencedCrlStore
* @Lacuna.Pki.Stores.ISimpleStore
* @Lacuna.Pki.Stores.ReferencedCrlStoreFromSimpleStore