Validation of PAdES-LTV signatures fails on newer Acrobat Reader DC version (2020.009.20067).

[jclorenzo]

Recently we have detected for some PDF files signed with a PAdES-LTV signature that signature validation in Acrobat DC shows that signatures are not valid due "the document has been modified or damaged since it was signed". Apparently the "modification" is the inclusion of the TSP signature.

In the past, files signed in the same way and validated whith previous Acrobat DC versions had been not showed problems.

We have check this files with an old Acrobat Reader XI (v.11.02) and no validation errors are showed, all the signatures are considered correct. Also, we validate the signatures with other PDF viewers and with online validation systems and in all cases the signatures are cosidered valid.

We detect this behaviour in Acrobat DC 2020.009.20067 version, but we don't know from wich version it happens.

Could be any problem with the last version of Acrobat DC?

I attach an example PDF file.

Regards

[Diego1587]

Hello,

So I'm not the only one with this shocking problem! I've lost one day trying to check if the problem was in my software that generates PAdES-LTA, and at the end I found the "issue". So it seems that something changed in the latest version of Acrobat Reader DC I have on my development machine (2021.001.20135): I found on a VM that I use for test an older version of Acrobat Reader DC (2020.013.20074) and opening the very same file with this version, the signature is valid. You can see the two screenshots. 

In order to be sure the signatures are valid, I use DSS software by the Europen Union ( https://ec.europa.eu/cefdigital/DSS/webapp-demo/validation ), and my signature is valid.

[jclorenzo]

Hi Diego

After reviewing our entire signing process several times, we confirmed that the problem is not the signature itself which, as you say, is correct.

The problem, at least in our case, was caused by the attachments that we included in the signed PDF. For some reason, starting with this version of Reader, the application began to consider that the generated PDFs that included attachments files had been modified after signing, although this was not true.

To avoid this behavior of Acrobat Reader, we rewrote completely the process of attaching files to the PDFs and the error disappeared.

Unfortunately that does not fix the issue of pre-signed PDF files and, in view of the number of responses to my first post, I doubt it will be fixed in any version of Acrobat Reader in the future. ^_^

Finally, we have decided to warn our clients of this situation and recommend the use of other PDF viewers instead of Acrobar Reader.

Greetings.

[Diego1587]

Hello,

Unfortunatly I've no attachments inside the PDF. So, at least for me, the problem persists. The issue is only with PAdES-LTA, because if I create a PAdES-LT there is no problem. LTA, respect to LT, has an extra signature named Document Time Stamp added. If I remove manually the LTA part from the PDF file, the base PAdES signature is instead valid, so I'm sure I'm not "corrupting" the first signature adding the LTA part... Very strange.