Embed a CRL or OCSP response to a signature that already exists in the PDF

I have documents that were signed with Adobe CDS certificates using iText, including a secure timestamp. It seems that for long-term validation we also need to add the OCSP response or CRL (depending on the certificate we use, since each one supports a different method). Is it possible to modify the PKCS 7 structure just to add one of these without invalidating the signature itself? I read this is something that Acrobat offers, to enable end-users to sign documents while they are offline, adding the online portions (secure timestamp, CRL and OCSP response) to the signatures later.

Thank you,

Daniel Uribe

Thank you Paulo and Leonard for your quick response and help, I really appreciate it. I am reading the PAdES LTV Profile (ETSI TS 102-778-4) document, but if only Adobe Reader/Acrobat 9.1 and above support it, it may not work for me, since the system is supposed to support 7.0 and above. If this is the only option, I may have to go with the difficult choice of resigning every document that is missing the revocation information. Do any of you know if this method to read long term validation information from a DSS dictionary works in older versions of Adobe Reader/Acrobat?

Do you have any examples or information on how to add the CRL or OCSP responses to the DSS dictionary? The signing with timestamp is currently just using something similar to what’s provided at http://itextpdf.sourceforge.net/howtosign.html and I am not sure if that uses the DSS dictionary, if it doesn’t, I am not sure the Long Term Validation information could be added this way.

Thanks again,

Daniel Uribe

No, Acrobat/Reader 9.1 are the first versions to support LTV/DSS.  All earlier versions will ignore it.

You will need to add the necessary code to iText to write DSS dictionaries – no such support exists today.

Leonard

Thank you Paulo and Leonard for your quick response and help, I really appreciate it. I am reading the PAdES LTV Profile (ETSI TS 102-778-4) document, but if only Adobe Reader/Acrobat 9.1 and above support it, it may not work for me, since the system is supposed to support 7.0 and above. If this is the only option, I may have to go with the difficult choice of resigning every document that is missing the revocation information. Do any of you know if this method to read long term validation information from a DSS dictionary works in older versions of Adobe Reader/Acrobat?

Do you have any examples or information on how to add the CRL or OCSP responses to the DSS dictionary? The signing with timestamp is currently just using something similar to what’s provided at http://itextpdf.sourceforge.net/howtosign.html and I am not sure if that uses the DSS dictionary, if it doesn’t, I am not sure the Long Term Validation information could be added this way.

Thanks again,

Daniel Uribe

I will have to go with resigning them, then. Thank you very much for the quick responses and help.

Daniel