Adobe reader x, and win7, sha-1 instead of sha-256

Question

Good afternoon,
i have a problem similar to that posted at
http://forums.adobe.com/message/3707345
i try to sign the pdf (enable for signing with adobe livecycle ES, Right Managements)
but it always is signed with hash algorithm SHA-1
The hardware vendor of the smartcard, says that the problem is an adobe problem, because signing the file with its legacy software all works fine, and with its software the digest is SHA-256 (but the produced file is obviously not a signed pdf..)
For italian law the supported digest is SHA-256, and NOT SHA-1
I'm using the latest adobe reader version (10.1) and Win7
P.S.: adobe livecycle, enabling the pdf for signing with livecycle Right Management Service, put a sign with an adobe certificate and returns a pdf ready to be signed, and in this pdf the adobe sign is SHA-1
could be this the problem?
So, before signing the pdf it just contains an adobe SHA-1 sign (coming from livecycle web service)
With regards

Answer 1

Hi GP,
It's the smart card (or more correctly the software on the smart card) that is the bottleneck to getting to SHA-256. Here's what happens:
NOTE: When I say Acrobat I really mean both Acrobat and Reader
•    The user initiates the signing operation
•    Acrobat asks the user to pick a digital ID
•    The user select a digital ID from the drop-down list on the Sign Document dialog and then clicks the Sign button
•    Acrobat needs to write the file to disk for security purposes (another issue) and puts up the Save As dialog
•    The user selects a file name and save location and Acrobat writes the file to disk and it's at this time two things happen:
    o    The signature appearance is created so it can be part of the signed data (what you see in the signature field is not the signature, but rather a pictorial representation of the signature)
    o    A hole is created in the file and filled with zeros as a place holder where the actual signature will be written
•    Acrobat computes the digest over the file, excluding the hole filled with zeros. By default Acrobat is using the SHA-256digest method
•    Acrobat needs to get the digest encrypted (signed) by the private key associated with the signers digital ID
    o    If Acrobat has access to the private key it calls on the RSA library to do the encryption,
    o    If Acrobat doesn't have access to the private key it sends the SHA-256 digest to the software that does have access to the private key... In your case that's the cryptographic software residing on the smart card
•    It's up to the cryptographic software to feed the 32 byte SHA-256 digest into its encryption algorithm and have the private key encrypt the digest
•    The software on the smart card cannot handle a digest as large as 32-bytes, so it returns an error
•    In Acrobat 9.0.0 and earlier once the error message was returned the signing process was aborted and signature did not get created. Starting with version 9.1 if a PKCS#11 (the specification for smart cards) error is returned  Acrobat falls back to re-computing the digest using SHA-1 and starts the process again. It's here where the smart card software is getting the 20-byte SHA-1 digest and can get it encrypted using the private key.
•    Once the encrypted SHA-1 digest (this is really the digital signature) is computed the smart card sends it back to Acrobat
•    Acrobat in turn writes the signature into the hole it created in the PDF file, overwriting the zeros with actual hex values.
And that’s how you get a digital signature based on the SHA-1 digest method. If you absolutely need to use SHA-256 your only option is to get a newer smart card that can handle the larger digest.
Steve