2nd password on digital signature file

Question

I am deploying Acrobat Standard 9 in a regulated environment (21 CFR Part 11) and need to have the digital signature file require a second password.  While I know this is possible it does not seem to be a feature activated upon a default install.  How do I turn on this feature?

Answer 1

Hi Madam Curie,
Part of the problem is the phraseology is incorrect so I'll start with some basic so we are all speaking the same language.
One thing to realize is you can digitally sign any piece of electronic data just like you can use you pen to sign any physical object such as a piece of paper, some one's cast, a wall, or you photo for your fans. In the electronic world you can sign your e-mail, your Word document, or as far as I'm concerned (realizing that I'm biased ) the most important thin, a PDF file.
A digital ID in the electronic world is analogous to a pen in the physical world. It is what you use to create a digital signature. A digital ID is comprised of three pieces; a public key, a corresponding private key, and a block of text with some identifying information. When the digital IS is initially created the public-key is signed with a private key. If the public key is signed with it's corresponding private key the digital ID is know as a "self-signed" digital ID. If it is signed by a different private key, the owner of that key becomes the issuer of the digital ID that it signs.
A digital signature in the  electronic world is analogous to a wet ink signature. You use a digital ID to create a digital signature.
The next thing to realize is a digital signature is cryptographic blob of data and is not something one would normally see. If you are geeky enough you can decode one and view it in a special purpose viewer, but for the most part nobody ever sees the signature contents.
When you do sign a PDF file you can either create a visible signature or an invisible signature. In the case of the later, all you do is write the digitally signed blob of data into the PDF file and don't bother creating any visual representation. It's the visual signature that throws most people for a loop, but the key thing to understand is the visual appearance you see in the signature field (which is nothing more than a special purpose text field) is NOT the signature, it is just a representation of the actual signature which you never see.
The visual appearance is comprised of three things, a background (which by default is the PDF trefoil logo) and a foreground that is divided into two halves, text and a graphic.
Acrobat (and when I say Acrobat I really mean both Acrobat and Reader) will let you create a digital signature with any digital ID that you have that is within it validity period, and includes digital signature as a key usage. The digital ID can be saved in several locations that Acrobat has access to. One is file on disk. The file would have the .p12 or .pfx file extension and you would have to add the file to Acrobat using the Security Setting dialog. Another place the digital ID can reside is the Windows Certificate Store of the Mac Keychain. If you've installed the digital ID into one of the OS based storage locations Acrobat will find it without you having to do anything else. Digital IDs can also reside on hardware devices such as a token (they look like a flash drive) or a smart card (they look like a credit card with a gold chip).
So, if you have a digital ID, but Acrobat doesn't know about it need to search you computer for a *.p12 or *.pfx, find out where the file is, than use the Add ID function in the Security Settings dialog to attache the file.
Finally, after you find and attache the file you can modify the Password Timeout to require that a password is always required. Or, if you want to import the file into the Windows Certificate Store you can use the High Assurance option to require a password otherwise Windows will just assume that if you can log in to your desktop then that's good enough.
Steve