|
View:
New views
7 Messages
—
Rating Filter:
Alert me
|
|
|
PDF signature validation problemsHi all, I have come to a problem about the
validation of PDF signatures. The extraction of the signed data from the PDF is
not the same with iText than with Adobe. If I’m not wrong, iText takes the “/ByteRange”
associated to a signature to calculate the digest of the data. In some cases, is
possible to modify the data of the PDF (for example with form’s fields), without
these changes affecting the ByteRange. But the visualization of the document
changes, so if there is a signature which covers that form field, the signature
should be considered invalid. If the changes in the form field are included at
the end of the document, it does not affect the ByteRange, so iText is not able
to detect these changes. The problem is that Adobe does. So, Adobe and iText
are returning different validation results. In the attachment, I send you 2 documents,
for making it more understandable: test1.pdf à PDF document certified
and with 2 signatures, each one covering different parts of the form. test2.pdf à The same PDF but with
the form field “Name” modified. iText says all signatures are
valid. Adobe recognizes the changes, and invalidates the signature which covers
that form field. If you look inside the PDF, you will see that changes are
included at the end of the document, so do not affect the ByteRanges of any
signature. My question is if has someone else got this
problem, and if so, if there is any way to reach it within the actual iText
last version? Or we will have to wait to a future implementation of the
feature? If it is an actual bug, will it be reached in the future? Thanks in advance to you all, Áurea ------------------------------------------------------------------------------ Come build with us! The BlackBerry(R) Developer Conference in SF, CA is the only developer event you need to attend this year. Jumpstart your developing skills, take BlackBerry mobile applications to market and stay ahead of the curve. Join us from November 9 - 12, 2009. Register now! http://p.sf.net/sfu/devconference _______________________________________________ iText-questions mailing list iText-questions@... https://lists.sourceforge.net/lists/listinfo/itext-questions Buy the iText book: http://www.1t3xt.com/docs/book.php Check the site with examples before you ask questions: http://www.1t3xt.info/examples/ You can also search the keywords list: http://1t3xt.info/tutorials/keywords/ |
|
|
Re: PDF signature validation problemsThere's a method in AcroFields to check if the signature covers all the document. If it doesn't you may flag it as invalid.
Paulo > -----Original Message----- > From: Áurea Alcaide [mailto:aalcaide@...] > Sent: Wednesday, October 21, 2009 5:16 PM > To: itext-questions@... > Subject: [iText-questions] PDF signature validation problems > > Hi all, > > > > I have come to a problem about the validation of PDF > signatures. The extraction of the signed data from the PDF is > not the same with iText than with Adobe. > > If I’m not wrong, iText takes the “/ByteRange” associated to > a signature to calculate the digest of the data. In some > cases, is possible to modify the data of the PDF (for example > with form’s fields), without these changes affecting the > ByteRange. But the visualization of the document changes, so > if there is a signature which covers that form field, the > signature should be considered invalid. If the changes in the > form field are included at the end of the document, it does > not affect the ByteRange, so iText is not able to detect > these changes. The problem is that Adobe does. So, Adobe and > iText are returning different validation results. > > > > In the attachment, I send you 2 documents, for making it more > understandable: > > > > test1.pdf à PDF document certified and with 2 signatures, > each one covering different parts of the form. > > test2.pdf à The same PDF but with the form field “Name” > modified. iText says all signatures are valid. Adobe > recognizes the changes, and invalidates the signature which > covers that form field. If you look inside the PDF, you will > see that changes are included at the end of the document, so > do not affect the ByteRanges of any signature. > > > > My question is if has someone else got this problem, and if > so, if there is any way to reach it within the actual iText > last version? Or we will have to wait to a future > implementation of the feature? If it is an actual bug, will > it be reached in the future? > > > > Thanks in advance to you all, > > > > Áurea > > > > Aviso Legal: Esta mensagem é destinada exclusivamente ao destinatário. Pode conter informação confidencial ou legalmente protegida. A incorrecta transmissão desta mensagem não significa a perca de confidencialidade. Se esta mensagem for recebida por engano, por favor envie-a de volta para o remetente e apague-a do seu sistema de imediato. É proibido a qualquer pessoa que não o destinatário de usar, revelar ou distribuir qualquer parte desta mensagem. Disclaimer: This message is destined exclusively to the intended receiver. It may contain confidential or legally protected information. The incorrect transmission of this message does not mean the loss of its confidentiality. If this message is received by mistake, please send it back to the sender and delete it from your system immediately. It is forbidden to any person who is not the intended receiver to use, distribute or copy any part of this message. ------------------------------------------------------------------------------ Come build with us! The BlackBerry(R) Developer Conference in SF, CA is the only developer event you need to attend this year. Jumpstart your developing skills, take BlackBerry mobile applications to market and stay ahead of the curve. Join us from November 9 - 12, 2009. Register now! http://p.sf.net/sfu/devconference _______________________________________________ iText-questions mailing list iText-questions@... https://lists.sourceforge.net/lists/listinfo/itext-questions Buy the iText book: http://www.1t3xt.com/docs/book.php Check the site with examples before you ask questions: http://www.1t3xt.info/examples/ You can also search the keywords list: http://1t3xt.info/tutorials/keywords/ |
|
|
|
|
|
|
|
|
|
|
|
Re: PDF signature validation problemsSignatures that don't cover all the document but are valid for the part of the document that they cover are called revisions and is supported by iText. You may extract a revision and get the doc at the time the signature was applied and is supported by iText. Acrobat 9 only accepts a signature as valid if it covers all the document, you can do the same with iText. I fail to see what you expect iText to do that it doesn't.
Paulo > -----Original Message----- > From: Áurea Alcaide [mailto:aalcaide@...] > Sent: Thursday, October 22, 2009 2:35 PM > To: itext-questions@... > Subject: Re: [iText-questions] PDF signature validation problems > > Thanks Paolo, but is not so easy. Some signatures don't cover > all the document, but continue beeing valid ones. > I think iText does not cover all possible cases involving > signature validation... > > Date: Wed, 21 Oct 2009 17:44:32 +0100 > From: Paulo Soares <psoares@...> > Subject: Re: [iText-questions] PDF signature validation problems > To: Post all your questions about iText here > <itext-questions@...> > Message-ID: > > <0CFE9E34DD5AC241AB9092ABD1F391FF27FFEB17E6@...> > Content-Type: text/plain; charset="utf-8" > > There's a method in AcroFields to check if the signature > covers all the document. If it doesn't you may flag it as invalid. > > Paulo > > > -----Original Message----- > > From: ?urea Alcaide [mailto:aalcaide@...] > > Sent: Wednesday, October 21, 2009 5:16 PM > > To: itext-questions@... > > Subject: [iText-questions] PDF signature validation problems > > > > Hi all, > > > > > > > > I have come to a problem about the validation of PDF > > signatures. The extraction of the signed data from the PDF is > > not the same with iText than with Adobe. > > > > If I?m not wrong, iText takes the ?/ByteRange? associated to > > a signature to calculate the digest of the data. In some > > cases, is possible to modify the data of the PDF (for example > > with form?s fields), without these changes affecting the > > ByteRange. But the visualization of the document changes, so > > if there is a signature which covers that form field, the > > signature should be considered invalid. If the changes in the > > form field are included at the end of the document, it does > > not affect the ByteRange, so iText is not able to detect > > these changes. The problem is that Adobe does. So, Adobe and > > iText are returning different validation results. > > > > > > > > In the attachment, I send you 2 documents, for making it more > > understandable: > > > > > > > > test1.pdf ? PDF document certified and with 2 signatures, > > each one covering different parts of the form. > > > > test2.pdf ? The same PDF but with the form field ?Name? > > modified. iText says all signatures are valid. Adobe > > recognizes the changes, and invalidates the signature which > > covers that form field. If you look inside the PDF, you will > > see that changes are included at the end of the document, so > > do not affect the ByteRanges of any signature. > > > > > > > > My question is if has someone else got this problem, and if > > so, if there is any way to reach it within the actual iText > > last version? Or we will have to wait to a future > > implementation of the feature? If it is an actual bug, will > > it be reached in the future? > > > > > > > > Thanks in advance to you all, > > > > > > > > ?urea Aviso Legal: Esta mensagem é destinada exclusivamente ao destinatário. Pode conter informação confidencial ou legalmente protegida. A incorrecta transmissão desta mensagem não significa a perca de confidencialidade. Se esta mensagem for recebida por engano, por favor envie-a de volta para o remetente e apague-a do seu sistema de imediato. É proibido a qualquer pessoa que não o destinatário de usar, revelar ou distribuir qualquer parte desta mensagem. Disclaimer: This message is destined exclusively to the intended receiver. It may contain confidential or legally protected information. The incorrect transmission of this message does not mean the loss of its confidentiality. If this message is received by mistake, please send it back to the sender and delete it from your system immediately. It is forbidden to any person who is not the intended receiver to use, distribute or copy any part of this message. ------------------------------------------------------------------------------ Come build with us! The BlackBerry(R) Developer Conference in SF, CA is the only developer event you need to attend this year. Jumpstart your developing skills, take BlackBerry mobile applications to market and stay ahead of the curve. Join us from November 9 - 12, 2009. Register now! http://p.sf.net/sfu/devconference _______________________________________________ iText-questions mailing list iText-questions@... https://lists.sourceforge.net/lists/listinfo/itext-questions Buy the iText book: http://www.1t3xt.com/docs/book.php Check the site with examples before you ask questions: http://www.1t3xt.info/examples/ You can also search the keywords list: http://1t3xt.info/tutorials/keywords/ |
|
|
Re: PDF signature validation problemsÁurea,
You are right when you think iText does not cover all possible cases involving signature validation. iText only cares about whether or not the signature correctly signs its byte range. Additionally there is the flag Paulo mentioned. It does not know anything about Adobe's allowed and disallowed changes. You may want to read about them in the Adobe technical white paper "Adobe Acrobat 9 Digital Signatures, Changes and Improvements" available at http://www.adobe.com/devnet/reader/articles/reader_compatibility/readercomp_digitalsignatures.pdf and other documents on that topic. Unfortunately it is not too easy to implement the detection of disallowed changes, and quite likely Adobe will update their algorithms whenever new disallowed changes are found which they don't recognize. Last time I checked it was possible to fool them. Regards, Michael. BTW: PAdES quite recently changed the rules somewhat. |
| Free embeddable forum powered by Nabble | Forum Help |