Acrobat 9 and Validating Digital Signatures

Question

I'd heard that Acrobat 9 had found a way to eliminate the problem of sending your certificate to everyone who needs to validate your signature on a form, but I haven't been able to prove that. I'm testing 9 and so far the only difference I see is that instead of seeing an icon next to the signature stating that it can't be validated, it now states it in a bar across the top of the document. Has anyone else found something different?
Thanks!
Anita

Answer 1

For a signature to be considered valid, there must be a "trust" relationship between the validator and the signer. So if I sign a document and claim to be be "Bill Clinton", the signature doesn't show as valid unless you've established that I really signed the document using Bill Clinton's credentials. Public key cryptography provides this assurance by signing using a private key and publishing a public key that can be used to verify that the real private key was used. But you have to have that public key, and that is what is distributed and "trusted" within Acrobat or Reader.
In Acrobat 8, there are basically 2 ways to get that trust relationship: 1) Exchanging certificates with people you trust or 2) purchasing a certificate from an Adobe partner that sells pre-vetted and trusted certificates (where you have to do some work to prove you are who you say you are). These certificates have a trust relationship pre-built into Acrobat so you don't have to set up trust.
In Acrobat 9 there are 2 new mechanisms for establishing trust, but they facilitate, but not eliminate the need to establish trust.
First, you can create a security settings file which includes trust relationships and distribute it to your group either in an ad-hoc way (email, etc.) or by posting on a server and having Acrobat or Reader automatically load the settings. This makes it easier to set up signature workflows in a small group or enterprise environment.
Second, there is a new way for establishing large scale trust for digital identities issued by large organizations such as government agencies or countries where these will also have trust automatically managed by Acrobat and Reader.
The new features are described in http://www.adobe.com/devnet/acrobat/pdfs/sharing_security_settings_90.pdf