PDF digital signature

[mangusta60]

Hi everybody,

following on my work, i am trying to digitally sign a PDF document.
using example found in this forum, i am able to create signature
dictionary, insert signature appearance, define the Context field, and
calculate the right Byte Range to obtain a message digest.
my problem is inserting the digital signature in context field. I read
adobe specification, in which they specify that Context field should
contain the public key and the message digest, encrypted with generate
private key.
looking inside some signed document i suppose that data representation
is in DER format. I try to put a x.509 certificate in DER format and
then the encrypted digest. After calculating the digest i transform
the hash code in DER putting the DER preamble and then the hash
Hexadecimal code.
but when i check this signature with a PDF reader, it says that
document is changed after signature.
Is it my procedure correct, or data should be inserted in other
format ?
my project is in .NEt environment, I use C# and openssl-net as
cryptographic library.

thanks for any hint or help.

regards

silvio forno

.

[Vincent Ycasas]

If you are using the adbe.pkcs7.detached SubFilter, the Contents entry
must contain a DER encoded PKCS#7 binary data. The PKCS#7 data must at
least contain the X.509 signing certificate, and the signed digest
data (the actual signature). Putting these information in the Contents
field without following PKCS#7 standard will make conforming readers
report that there is a problem with the signature.

For adbe.x509.rsa_sha1 SubFilter, the X.509 signing certificate goes
to the Cert entry in the Signature Dictionary. The Contents in this
case will contain DER encoded PKCS#1 binary data (which will be the
calculated signature).

You can consult section 12.8.3 of PDF32000_2008.pdf for more
information, or look at RFC 2315 for information about the PKCS#7
standard.

[Silvio Forno - Vertigotech Srl]

thanks for your kind reply
i look at some digital signature in some pdf documents, and find that in
case of detached subfilter, normally the signer info are also contained
into contents fiels, as part of pkcs#7.
in some cases , looking at structure, i find also a message digest
section. as far as i have known, this field is present in pkcs#7 only if
there are some signer attribute. but my question is: in case of this
field it refers to the message digest (calculated with byte range) or
refers to the pkcs#7 ? in this case how i can compute this value ?

thanks in advance

regards

silvio forno

[Vincent Ycasas]

It is most likely the calculated digest over the document's byte range
as this is what it would be when the adbe.pkcs7.sha1 SubFilter is
used.

For adbe.pkcs7.detached SubFilter though, signedData fields (other
than the signature) are not required according to the PDF
specifications.
"adbe.pkcs7.detached: The original signed message digest over the
document's byte range shall be incorporated as the normal PKCS#7
SignedData field. No data shall be encapsulated in the PKCS#7
SignedData field."

Some PDF signers though would still add the message digest even though
adbe.pkcs7.detached SubFilter is used. There are several reasons for
doing so: using different digest algorithm than SHA-1, ease of
verification, etc.

[Silvio Forno - VertigoTech srl]

hi vincent,

how are you ?

i hope fine

I almost finish the digital signature process. now i am able to put a
digital signature in a pdf form field, together with an image of
graphical signature.
I have only a little problem. after i signed the document, if i open the
pdf with pdf-xchange or other reader everything is fine. If I use
acrobat reader, i see that document is signed, but is not verified. when
I try with adobe reader, i obtain the following error "could not verify
signature" "expected a dict object"
i put the document signed by my program.

do you have any hints on this subject ?

thanks again

regards

silvio forno