Multiple digital signatures

[_John_Daniel_]

I am trying to create a document that can be certified as ready for review and signing and then circulated for multiple signatures .

The document( a standard operating procedure ) must reviewed and signed by 5 or 6 people and I have to be able to prove it has not been changed other than being signed but I can't figure out how to make signing the form fields as an allowable action.

Here is what I'm doing now

create document in word and convert it to a pdf in adobe acrobat 8 pro on windows xp
in the form menu click create new form
click through and use the current document to create form
In Live Cycle designer I :
Add the digital signature fields
then I'm lost

This seem the closest to what i want to do but this seems to complicated
http://www.adobe.com/devnet/livecycle/articles/multiple_sigs_tip.html

I don't think I need a policy server but I'm not sure.

I just need to invalidate signatures if someone uses acrobat to edit the document text and images after it has been certified and/or certified and signed.

Thanks

John

[Steven_Madwin]

Hi Joe,

Regarding item 1, that one I'm not 100% sure about, but one thing to check since the file is being downloaded from a server is to right mouse click on the PDF file, select properties from the pop-up menu, and see if the file is blocked. You're looking for this:

Have them try unblocking if that's the issue and see what happens.

With regard to to item 2, not since digital signatures were added to version 4 of Acrobat (security came in version 3) have you been able to encrypt, or remove encryption, on a signed file. If you want to prevent printing secure the file before the digital signatures are applied. This includes Reader Enabling a file as well as that process is a digital signature at its heart.

Steve

[joebsobe]

I found my issue with write-protect Steve, thanks for your help.

If anyone else runs into a similar issue, they may be making the same mistake we were with security policy changes, versus signature allowed changes.

Applying a security policy to a document must be done after the document is complete, after forms especially signature boxes are positioned.

The process should be;

• Apply the correct security policy (collaborative review, final QA security) at the front-end

The security policy has settings for what changes are allowed after the file is saved.

If that conflicts with the permitted change choices from the signature, the file is read as write-only because the security and the signature permissions conflict.

• The file author MUST sign with a certificate signature

That locks the file from changes, traces the audit trail, and allows for revision viewing.

The allowed changes selection in the signature certificate MUST match that in the security policy or you get a read-only file (even though windows is not a read only attribute).

• The file is then saved and sent for review approval (works correctly)

[Matthew_Bowman]

Hi Steve,

I am encountering an issue with the digital signature function as well. I have a form that requires 3 different signees to apply a digital signature to the form, but two of these signees must sign in two different places on the form. Is there a way that I could have them sign once and apply this signature in multiple locations so that each signee only has to save the form locally one time? I have searched for a solution to this issue and the only thing I can come up with is redesigning the form to only require one signature from each signee, but this isn't exactly what my stakeholder is looking for.

Thanks,

Matt

[Steven_Madwin]

Hi Matt,

The short answer is no, you cannot duplicate signature appearances on multiple pages like you can with other form form fields.

Much of the digital signature world is based on the wet ink signature world. If you are sitting with a large document (on paper) in front of you and have to sign on multiple pages, then each pages requires that you put pen to page individually. This all boils down to what happens when you go to court (if nobody ever sued anyone else then this might be different). Each signature has its own unique thumbprint and you need to count on that to prove that the signer signed what they thought they were signing and is who they say they say they are. The problem with allowing someone to sign page 1 and have the same signature appearance show up on page 7 is the signer can claim they never saw page 7 and had no notion that they were agreeing to something they hadn't seen. By have individual thumbprints for each signature you can prove that the signer did sign the document twice. PDF files can be tricky things with page templates that spawn (adding additional pages to the document) unbeknownst to the signer. If we allowed signature duplication it would open up a hole for bad guys to exploit. 

Steve

[CevinKarney]

Hi Steve,

So I am having an issue where I have a form that needs to be signed by 4 people. I saw earlier in this thread you mentioned that a way to do this would be to send the form out and have 1 person sign it then email it to the next person and have them go from 1 person to the next until all 4 have signed it and thus the form has all 4 signatures when it is returned. This would work fine but I was wondering if there is a way that I could send out the form to all 4 people, have them each sign it, send it back to me, and have something put all 4 forms together so that there is one form with all 4 signatures?

Thanks

[Steven_Madwin]

Hi,

If you did that you'd end up with four separate files. You could bundle them into a portfolio (the portfolio is a container that hold separate files of any type, not just PDF's), but they can never be merged them into one file PDF form file. The problem is you can never add pages to a signed file because it would break the signature. You know you are just trying to add more signatures, but Acrobat doesn't. All Acrobat see is a page has been inserted into a signed file and knows that the signer didn't sign that page, thus it invalidates the signature with a message that the signed file has been altered.

Steve

[cindis61994726]

I have a file that needs to get signed by up to 10 people, but it does not need to be in sequence.  One person's acceptance, or not, has no bearing on the next.  It appears the only way to obtain signatures is one at a time.  And if any choose to not sign (signifying not acceptance), the workflow stops and the remainder on the chain do not get to view/sign.  I thought I'd read there was a way to obtain parallel signatures, but can't figure that out.  Hoping you can assist.

Thanks -

Cindi

[Test Screen Name]

The location is a really, really unimportant thing. Thinking about location shows too close an analogy to the paper based workflow. Every PDF digital signature, without exception, certifies the WHOLE PDF, and cannot be separated from that context.

[CFW_III]

We are having a similiar issue. In my office, we are using Adobe Acrobat X Pro to combine PDF's into one document. After combing all the docs, we are adding digital signature blocks where necessary. There is no requirement for us to sign the document. We then distribute the docs for signatures using the DISTRIBUTE option, utilitzing the "work flow" that Adobe X has. The issue is that when we send out a doc with digital signature blocks, we can't have more than one person sign the doc using the digital signature blocks we have created. Ideally, if we have 10 signatures required, one person will sign 9 while another person will sign only one. Can anyone advise us on how we may accomplish this?

[Guest]

I have a similar but not identical problem, always belonging to multiple signatures. I have a form with multiple signature fields with javascript that, when the user signs, populate a Date field. In addition this javascript shows the other signatures in a sort of "signature workflow".

The form was created with Acrobat 9 and now we have moved to Acrobat X.

The javascript caused a warning, with the old Acrobat version, but the signatures were valid and modifications were shown. Now the signatures are considered invalid. What changed? How can be managed?

Thank You in advance

[kerakatera]

Does anyone know whether one can sign a pdf with Adobe X Pro and then forward it to the next person for signing without saving the document on your pc? An end user would prefer that the documents not have to be stored on each person's computer after signing for security reasons.

[Steven_Madwin]

The file has to be saved somewhere. You could save it to a shared network drive, but the signing process requires the the file be saved to disk before the signature is computed. When digital signatures were first introduced into Acrobat signing did take place in memory, but that became a security risk so we had to err on the side of safety and require that signatures be created to files written to disk. The problem with signing out of memory is it is too easy for someone (in this case the bad guy) to introduce a command to change the file in the middle of the signing process in memory. For instance a piece of text that says "I agree to pay $100" gets changed to "I agree to pay $1000". The signer doesn't see the change until it is too late. By forcing the file to be written to disk it eliminates the memory highjacking problem and provides a more secure signing environment. If there were no bad guys we could have left the signing process the way it was, but alas...

Steve

[kerakatera]

Thanks so much for your reply. I thought that it was something like that. My users insist that when they open a pdf in their web browser (Internet Explorer) they can sign a document without saivng it. They did show me that they can do this, but I can't duplicate it as I don't have rights to access the particular files that they are using. In this case it would be saved to the temporary Internet file. In the browser is the signature still handled by Adobe Acrobat? If so is there a different mechanism that is used?

[Steven_Madwin]

Hi,

It looks like the file isn't being saved, but it is, only to a temp file. Initially, when you view the file in the browser the file is loaded into memory. If the option "optimize for fast web view" was selected when the file was created, when you open the PDF in the browser just the first page is downloaded and displayed, then the rest of the file is downloaded, but everything is in memory. When you start the signing operation the file is written to disk, it just that the signer doesn't see that action. After the signature is created if the signer wants to send the file they are still required to do a save operation and give the file a name, but what they are really doing is making a copy of the signed temp file.

Steve

[kerakatera]

That is great. Thanks so much for the information. So I guess my solution is to figure out an uncomplicated way for them to open it in their web browser. They may like that option.

[neerjaj36819175]

Hi Adobe Staff,

why a signature doesn’t work when someone else had already signed. My manager created an adobe form and he digitially signed with the company's logo and with his signature. He sent that document to me to sign on that. But I was not able to sign. Sgn section was grayed out. But when we tested on his no signature PDF, I was able to sign and then, he was able to sign. Please clear my confusion. Thanks.

Neerja

[Test Screen Name]

It is a design choice. Most people want the form to be locked when it is signed.  But it is an option for the form creator.

[neerjaj36819175]

It means what the process of not locking the pdf? any suggestion?

[Steven_Madwin]

Hi Neerja,

I'm not quite sure what work-flow you are using, but here's my guess.

If you are dealing with a document that does not contain any existing signature fields, then when you initiate the signing process Acrobat will ask you to draw (inscribe) a field somewhere on the document. After you draw the field, but before you proceed with the signing operation you have one signature field. You may consider it the first signature field, but it is also the last signature field on the document. When a signer is signing the last signature field, and only if it is the last signature field Acrobat will offer the signer the option to lock the document after signing (see screen shot below).

If there are still unsigned signature fields on the document the Lock Document After Signing checkbox is not displayed. It is possible that your boss is selecting this checkbox thereby blocking you from signing, but when you sign you are leaving the checkbox deselected, thereby allowing him to successfully sign.

If there are existing signature fields that were placed on the page(s) by the document author (creator) then it is possible that there is associated code with one of the fields that locks the document at signing time, but without seeing the file, or watching over your shoulders, this is all just speculation on my part.

Steve

[neerjaj36819175]

Great!! Good help! Thanks Steve!!