Having trouble validating programmatically Digital Signature in a PDF

Question

Hello,So as the title suggests, I'm trying to write Python code to validate digital signatures in PDF 1.6 files.I read all the documentation I could find on the subject, but the truth is I can't understand how Adobe comes up with its signature.Indeed, the signature part of the file looks like this :397 0 obj</Filter .....When I manually decode the signature in the PKCS7 data I obtain a hash :1446...78f2But, when I hash the following data :%PDF-1.6.....</Filter....%EOF[0x0d0a] with hash 96d0...3fb2 Can somebody help me figure this out ?

MikelKlink · Accepted Answer

When I manually decode the signature in the PKCS7 data I obtain a hash :
1446...78f2

You have to take care when analyzing a PKCS#7 signature container, it may contain multiple digests, each with a different function.

The SignerInfo object in your signature container has signed attributes (aka authenticated attributes). Thus, the hash signed by the signature bytes therein is not the hash of the document in question but the hash of the untagged set of signed attributes:

SEQUENCE (2 elem)
  OBJECT IDENTIFIER 1.2.840.113583.1.1.8 pdfRevocationInfoArchival (Adobe Acrobat security)
  SET (1 elem)
    SEQUENCE (0 elem)
SEQUENCE (2 elem)
  OBJECT IDENTIFIER 1.2.840.113549.1.9.3 contentType (PKCS #9)
  SET (1 elem)
    OBJECT IDENTIFIER 1.2.840.113549.1.7.1 data (PKCS #7)
SEQUENCE (2 elem)
  OBJECT IDENTIFIER 1.2.840.113549.1.9.4 messageDigest (PKCS #9)
  SET (1 elem)
    OCTET STRING (32 byte) D2C9C1B474BEE8C586A39001CF069CF6D44A65B27ADC701E7AC97AA9D94C02AF

The hash you are looking for is the value of the messageDigest signed attribute. It is the hash you calculated for the document

But, when I hash the following data :
%PDF-1.6.....<</ByteRange[ 0 93895 98647 2347558] /Contents/Filter....%EOF[0x0d0a]
I can't get the same hash (d2c9...02af)

Bernd Alheit · Answer

Why does you post this in the forum for Adobe Acrobat?

Sign up

To post, reply, or follow discussions, please sign in with your Adobe ID.

Sign in to Adobe Community

To post, reply, or follow discussions, please sign in with your Adobe ID.

Scanning file for viruses.

This file cannot be downloaded