Digital signature Filter / SubFilter

Hi,
i have a question regarding the use of digital signatures.
As a filter value i am usingAdobe.PPKLite but i am not quite sure about the SubFilter. As i understand there are three possible values:
- adbe.pkcs7.detached
- adbe.pkcs7.sha1
- adbe.x509.rsa.sha1
Now i need to create PDF/A compliant pdfs and i read somewhere that it is not recommended (or not compliant?) to use
'adbe.x509.rsa.sha1' (pkcs#1 format). Instead one of the other two should be used.
Now since SHA1 is too weak only 'adbe.pkcs7.detached' (pkcs#7 format) remains.
But what does the 'detached' stands for?
Does it mean that the digest or the certicate have to be stored in an extra file? (Similar to the xml signing mechanism: "Enveloping signatures are over   data within the same XML document as the signature; detached signatures are over data external to the   signature element.") ?
Thanks for clarifying,
ToM

thank you for the input.
So if i understand the spec correct it is like this:
1.)
If i use adbe.x509.rsa_sha1 (=PKCS#1 format) then:
Contents = contains the crypted message digest
Cert = contains the X509 certificate
2.)
If i use adbe.pkcs7.detached (=PKCS#7 format) then:
Contents = signed message digest (in PKCS#7 SignedData field) + the x509 certificate according to rfc2315
Cert = not to be used
3.) But i can't figure out what the spec means by:
"adbe.pkcs7.detached: The original signed message digest over the document’s byte range shall be incorporated as the normal PKCS#7 SignedData field. No data shall be encapsulated in the PKCS#7 SignedData field."
Does that mean, that the data being signed is not included in the PKCS#7 structure? (But isn't that what the ByteRange is for?)
I couldn't find any other info in  ISO 32000 - maybe i need to study PKCS#7, too :-/
Thanks
ToM

Similar Messages

  • How to add the new Signature Filter to LiveCycle Digital Signatures?

    I have been wrote my own plugin for Adobe Reader.
    This plugin creates signatures by cryptoalgorithm "GOST R 34.10-2001" instead of RSA used in Reader and Livecycle.
    As a result, I can't validate signatures created by my plugin in the LiveCycle Digital Signatures. In the log file of JBoss are written next:
    "Unsupported signature filter detected: GostSignaturePlugin".
    My question is how to install a support of my signature filter in to the LiveCycle Digital Signatures?
    Is it possible to install my existing plugin for adobe reader into LiveSycle, or I must to write new plugin for LiveSycle?

    Hello Jose,
    Try making an entry in tables SMOFFILTAB and SMOFFILFLD.
    This might help!
    Best Regards,
    Shanthala Kudva.

  • PubSec Digital signatures in Acrobat 9

    Hi,
    i m developing a digital signature plug-in, PubSec, to be specific. My plugin will, hopefully, digitally sign open pdf, and also able to verify them. The signature i am creating will be standard so that any other plugin, including Acrobat's own, can also verify it, and my plugin can verify others too. For this, i will leave the Filter unset and only set subfilter appropriately.
    Now, when implementing the signature creation and verification callbacks i found it very difficult, and in some cases am stuck, while getting required information from the provided arguments of the callbacks. For instance, from this structure "PSSigValidateDialogParams" i want to extract information such as:
    - signature's verification status
    - signer's certificate
    - reason location, etc.
    But so far i can only get the verification status as:
    ASInt32 sigValDigest = ASCabGetInt( sigValCab,  PROP_SigVal_Digest,  kDSSigValUnknown   );
    ASInt32 sigValTrustFlags = ASCabGetInt( sigValCab,  PROP_SigVal_TrustFlags,  kDSSigValUnknown   );
    ASInt32 sigValId = ASCabGetInt( sigValCab,  PROP_SigVal_Id,  kDSSigValUnknown );
    And i dont even completely understand what each of these mean. And i cannot get the rest of the info from the structure as well, as i cant find any discription about them in documentation. I did find a "Digital signature API Reference" document for acrobat 6, but none for acrobat 9. And even in acrobat 6, there is no description for most of the functions and structure, just the prototype.
    Please help me get the above information from the PSSigValidateDialogParams, or atleast point me towards the documentation of the digital signature api reference for acrobat 9. Thanks

    Hi,
    Go to: http://livedocs.adobe.com/acrobat_sdk/9/Acrobat9_HTMLHelp/API_References/Acrobat_API_Refer ence/Digital_Signatures/PubSec.html#kPSSigTrustUntrusted
    and search for  DSValidState
    enum DSValidState {  DSSigBlank = 0,
      DSSigUnknown,
      DSSigInvalid,
      DSSigValid,
      DSSigDoubleChecked,
      DSSigValidStateEnumSize
    and here: http://livedocs.adobe.com/acrobat_sdk/9/Acrobat9_HTMLHelp/API_References/Acrobat_API_Refer ence/Digital_Signatures/PubSec.html#kPSSigTrustAll
    enum DSSigValState {  kDSSigValUnknown = 0,
      kDSSigValUnknownTrouble,
      kDSSigValUnknownBytesNotReady,
      kDSSigValInvalidTrouble,
      kDSSigValUnused,
      kDSSigValJustSigned,
      kDSSigValFalse,
      kDSSigValTrue,
      kDSSigValEnumSize
    Regards,
    mwak

  • Initializing Factory class with Digital Signature

    Hi All,
    I am trying to Initialize the Factory class using digital signature. These are the steps I fallowed.
    1. Created a Java application "Application1" in Jdeveloper.
    2. Copied config, ext, lib folder from the Design console directory to the Application1/Project1 folder.
    3. added the lib and ext jars to the project properties.
    4. Modified the run/debug profile in the project properties to point to the xlconfig file in config folder.
    5. added the "-DXL.HomeDir=. -Djava.security.auth.login.config=config\authwl.conf" in the java options.
    Java code:
    public class SignatureLogin {
    public static void main(String[] args) throws Exception {
    Properties jndi =
    ConfigurationClient.getComplexSettingByPath("Discovery.CoreServer").getAllSettings();
    tcSignatureMessage signedMsg = tcCryptoUtil.sign("xelsysadm", "PrivateKey");
    tcUtilityFactory factory = new tcUtilityFactory(jndi, signedMsg);
    tcUserOperationsIntf usrIntf = (tcUserOperationsIntf)factory.getUtility("Thor.API.Operations.tcUserOperationsIntf");
    System.out.println("signature login complete");
    // Do something with usrIntf here
    Map filter = new HashMap();
    filter.put("Users.Key", "7464");
    tcResultSet rSet = usrIntf.findAllUsers(filter);
    rSet.goToRow(0);
    System.out.println(rSet.toString());
    factory.close();
    System.out.println("logout complete");
    System.exit(0);
    Then ran the java class. I am able to get the connection but when I am using findAllUsers(map) method to search the usr table I am get a nullpointer exception.
    Exception in thread "main" java.lang.NullPointerException
         at Thor.API.Operations.tcUserOperationsClient.findAllUsers(Unknown Source)
         at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
         at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
         at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
         at java.lang.reflect.Method.invoke(Method.java:597)
         at Thor.API.Base.SecurityInvocationHandler$1.run(Unknown Source)
         at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
         at weblogic.security.service.SecurityManager.runAs(Unknown Source)
         at weblogic.security.Security.runAs(Security.java:41)
         at Thor.API.Security.LoginHandler.weblogicLoginSession.runAs(Unknown Source)
         at Thor.API.Base.SecurityInvocationHandler.invoke(Unknown Source)
         at $Proxy0.findAllUsers(Unknown Source)
         at com.ssi.utils.custom.code.SignatureLogin.main(SignatureLogin.java:26)
    I need some help to fix this.
    Thanks

    Hi,
    Were you able to resolve the issue as I am facing same issue.
    I have a custom application deployed on same weblogic managed server where OIM is installed but when I try to find user in OIM it gives me null pointer exception.
    I have even checked the username with which connection is established using ioUtilityFactory.getUserName() and it gives me the correct user.
    Thanks
    Edited by: user1105482 on 26-Apr-2011 04:38

  • Digital Signature Filteration based on Profiles

    Hi,
    Problem : Instead of using theSignature Field and hardcoding the signature issuer profile (eg : cn=TEST), I have a javascript code written in the button which pops-up the digital signature window where all the signatures are displayed in the combo. I need to filter out only those digital signature which belongs to a particular profile.
    I have attached the PDF for your reference. Please provide me the javascript code which can filter the signatures based on the profiles. Let me know if you require any more clarification for the same.
    Regards
    Mahesh Pillay
    [email protected]

    Steve,
    Thanks for your reply...
    I had tried with the seed value but unfortunalty could not find the correct syntex/code for setting the seed value in my javascript code.
    Appreciate if could provide me the code , since i am not an expert in javasceript and i am trying this for a very long time...
    Thanks in advance...
    Regards
    Mahesh Pillay

  • Digital Signature in Driver File Details

    I've looked at every post I can find and haven't found a solution/next step.
    I'm receiving Code 52, Windows cannot verify the digital signature for the drivers......
    I built WDK project in VS2013 with driver filter and package, simple mouse filter, works in test signing.  BOth projects I added the signing "Production Sign" and my appropriate certificate (DigiCert EV Code Sign).  I've verified my CAT
    file and SYS files are both signed using Signtool Verify with and without /c for cat and all shows signed.  When I install with DPINST I get the nice popup saying it's signed  trust publisher xyz "Install or Dont Install" which I don't
    get unless signed.  But it always shows my driver Not digitally signed" and doesn't show publisher, 
    I've tried to add the Cross-Cert with signtool and recieved good output (no errors and it completed).
    I've checked the setupapi.dev.log and found:
         sig:           Catalog  =
    sig: Catalog = C:\Windows\System32\DriverStore\FileRepository\mmmoufiltr.inf_amd64_neutral_f5bf7acbe4650e24\motixmoufiltr.cat
    ! sig: Verifying file against specific (valid) catalog failed! (0x800b0109)
    ! sig: Error 0x800b0109: A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
    I receive this for every file in the catalog (i.e. coinstaller, sys, etc).  
    I've also found in events security
    Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.
    File Name: \Device\HarddiskVolume1\Windows\System32\drivers\mmmoufiltr.sys
    I made sure my cert was in "Trusted Root Certification Authorities". 
    I'm not sure what else to check.  I've read through the guides at length, but obviously am missing something.  Any advice appreciated.
    Brent

    For someone elses benefit, it turns out my code signing certificate was a SHA2 cert which is the future.  I was installing in a Windows 7, and it didn't support the SHA2, so I got a SHA1 certificateion, did all the same steps and works now.

  • Do AVI Compression Filters require a Microsoft Digital Signature in LV

    Hello all,
            My company has written a custom video codec. I installed the custom codec onto my machine. When I did I was warned that this codec did not have "Microsoft Digital Signature". I said "ok" and installed it anyway. The codec appeared in my Hardware codec properties tab. I figured all was good. I was wrong.
             When I run the VI "IMAQ AVI get filter names" it does not appear in the returned list. I assumed the reason for this to be because the VI only returns Microsoft approved codecs. Am I right? I also tried using the codec by using a string constant and placing its name exactly how it appears in the HArdware properties tab into the "IMAQ AVI create" VI. This did not work either.
             Am I right by assuming that I cannot run non-microsoft approved codecs in IMAQ LV?  Is there a way around this? Any feedback???
    Foiled by MS,
    Glen D.

    Hey Glen D.,
    The Get Filter Names VI returns only the filters that are able to work the NI's AVI functions. What the VI does is it gets the list of filters from DirectShow and then it tests each one with a sample frame to see if it can compress the image or not. Then the function returns a list of the codecs that work. This does not necessarily mean that the function works only with Microsoft approved codecs. So if your custom codec can somehow align with the DirectShow architecture, then your codec should be detected by the IMAQ AVI functions.
    I hope this answers your question. Please let me know if you have any further questions or concerns. Thanks, and have a great day.
    Regards,
    DJ L.

  • How do I add a digital signature to Word 2011?

    I am at a loss at to adding a digital signature to Word 2011 docs on my macbook pro, any ideas???

    Formscentral does not support forms with digital signature workflows. I suggest you see if our Echosign product meets your needs.

  • Issue in Java concurrent program for Digital Signature Stamping

    Hi All,
    Im calling a Java concurrent program which does digital signature stamping on the PDF report generated.Program able to able to read the PDF file as input and also digital signature stored as file in the application but
    ends in error in create signature method , need help in this regard.
    Error:
    Parameter 0 is Request id of with out Digital signature file
    Parameter 1 is employee id of approver
    Parameter:0:99203256
    Parameter:1:1414603
    $$$$ start query fileinfo with callable statment
    programName>>>>>>>>BTPOPORPXML
    $$$$ Without digital Signature file Name $$$
    $/inst_top/finprod/apps/FINPROD_CPNQERPAAPZP10/logs/appl/conc/out/BTPOPORPXML_99203256_1.PDF
    PFX File Reading Start
    PFX File Reading Ends
    PFX File size is: 6460 Byte size is: 6460
    Elements present
    java.lang.NullPointerException
    at
    com.lowagie.text.pdf.PdfSignatureAppearance.getAppearance
    (Unknown Source)
    at
    com.lowagie.text.pdf.PdfSignatureAppearance.preClose
    (Unknown Source)
    at
    com.lowagie.text.pdf.PdfSignatureAppearance.preClose
    (Unknown Source)
    at com.lowagie.text.pdf.PdfStamper.close(Unknown
    Source)
    at
    btvl.oracle.apps.po.digsig.BTVLDigSign.runProgram
    (BTVLDigSign.java:151)
    at oracle.apps.fnd.cp.request.Run.main
    (Run.java:157)
    Edited by: 999033 on May 16, 2013 7:20 PM

    Hi Charls,
    I have successfully implemented at our end in 11i. Pl.try at your end.
    v_request_id := FND_REQUEST.SUBMIT_REQUEST (passed your arguments... );
    COMMIT;
    IF NVL( v_request_id , 0 ) = 0 THEN
    DBMS_OUTPUT.PUT_LINE( 'Item Assignment to Organization Program Not Submitted');
    p_status := 'FAILURE' ;
    p_err_msg := 'ERROR RAISED AFTER SUBMITTING THE IMPORT ITEM ORG.ASSIGNMENT CONCURRENT REQUEST ... ' ;          
    ELSE
    v_finished := FND_CONCURRENT.WAIT_FOR_REQUEST
    request_id => v_request_id,
    interval => 0,
    max_wait => 0,
    phase => v_phase,
    status => v_status,
    dev_phase => v_request_phase,
    dev_status => v_request_status,
    message => v_message
    LOOP
    EXIT WHEN ( UPPER(v_request_phase) = 'COMPLETE' OR v_phase = 'C');
    END LOOP;
    HTH                    
    Sanjay

  • Update on 10.6.8 fails due to digital signature on update is missing

    wanting to install the Parallels version 10 and it won't work on 10.6.8 version of my Mac OS so I learned how to go to the software update which indicates an update is available. When I go ahead and load the update it runs fine and then stops with a message that the Macbook Pro EFI Firmware Update can't be saved. It says the digital signature on the update is missing or invalid.
    I don't know if the digital signature is on my computer or the update? I would upgrade to a more recent version of the OS but don't know what will work.
    Can anyone help?
    Dan

    Parallels 10 isn't compatible with 10.6 according to the web site.
    Mac Requirements
    Hardware:
    A Mac computer with an Intel Core 2 Duo, Core i3, Core i5, Core i7, or Xeon processor (Core Solo and Core Duo processors are no longer supported)
    Minimum 2 GB of memory (4 GB of memory is recommended to run Windows 7 in a virtual machine or if your host OS is Lion)
    About 850 MB of disk space on the boot volume (Macintosh HD) for Parallels Desktop installation
    About 15 GB of disk space for each virtual machine
    Software:
    OS X Yosemite 10.10 or later
    OS X Mavericks 10.9.4 or later
    Mac OS X Mountain Lion 10.8.5 or later
    Mac OS X Lion 10.7.5 or later
    Check that your computer is compatible with Mountain Lion/Mavericks/Yosemite.
    To check the model number hold down the option/alt key, go to the Apple menu and select System Information.
    MacBook (Late 2008 Aluminum, or Early 2009 or newer) model number 5,1 or higher
    MacBook Pro (Mid/Late 2007 or newer) model number 3,1 or higher
    Your Mac needs:
    OS X v10.6.8 or OS X Lion already installed
    2 GB or more of memory (More is better - 4 GB minimum seems to be the consensus)
    8 GB or more of available space
    Check to make sure your applications are compatible. PowerPC applications are no longer supported after 10.6.      
    Application Compatibility
    Applications Compatibility (2)
    Do a backup before installing. 
    If you can/do upgrade, I recommend you make a copy of the installer and move it out of your Applications folder. The installer self-destructs. The copy will keep you from having to download the installer again.  You can make a bootable USB stick to install using this free program.
    Bootable USB Flash Drive – Diskmaker X
    Mountain Lion
    Note - Mavericks is no longer available.

  • Making Multiple Digital Signatures Read-only in Form (Acrobat 9)

    I have created a form which includes two (2) digital signature fields.  What needs to occur with the form is Person1 fills the form and then digitally signs it thereby making the form fields read-only .  Person2 then digitally signs the form which should make Person1's digital signature read-only.
    Here's what I've done:
    1) For the Person1 digital signature field, in Digital Signature Properties, under the Signed tab, I have selected Mark as read-only <all fields except these> and selected the Person2 digital signature field.
    2) For the Person2 digital signature field, in Digital Signature Properties, under the Signed tab, I have selected Mark as read-only <all fields> since once Person2 signs the form I do not want Person1 to be able to clear the digital signature and make changes to the form.
    Here's what actually occurs:
    Step 1 above works fine.  Once the signature is applied all the form fields are read-only except for the Person2 digital signature field.
    The problem is that after Person2 digitally signs the form, even though I selected all fields as read-only, Person1 can 'clear' their signature which leaves all the form fields available for editing and leaves Person2's digital signature still on the form.
    I honestly don't care about 'validating' signatures on this form since it's going to be printed but I cannot allow Person2's signature to remain on the form and allow Person1 to edit the form.
    --Mike.

    Hi!
    I have the same problem. Have not been able to figure it out, although tried everything.
    Hope somebody can help
    - MackeMan

  • Digital Signature invalid when sign a PDF with instances

    Hi,
    I created a XDP document with LiveCycle Designer ES2.
    This document contains:
    - Some required fields (text fields, data fields ecc...)
    - A Subform that user can add more instance pressing a button, contains some fields
    - A Digital Signature (With a simple fields collection contains only the signature field)
    I render the XDP for get a PDF (using ReaderExtensions component) by LiveCycle Workbench ES3.
    Then I open the PDF with Adobe Reader X.
    I compile the form and don't press on button increase the instances of Subform.
    Sign the document and the signature is valid.
    Now, instead, if I make the same but increase the instance of Subform, then sign, the signature is invalid...
    Can the problem is the different versions of Designer and Workbench?
    In past I got some problems, and sometime I resolved creating a new document and copying all the object of old form in new one... It's an ugly solution but it worked.
    But in this case don't resolve nothing.
    Any help?
    Thank You!

    Hi,
    I created a XDP document with LiveCycle Designer ES2.
    This document contains:
    - Some required fields (text fields, data fields ecc...)
    - A Subform that user can add more instance pressing a button, contains some fields
    - A Digital Signature (With a simple fields collection contains only the signature field)
    I render the XDP for get a PDF (using ReaderExtensions component) by LiveCycle Workbench ES3.
    Then I open the PDF with Adobe Reader X.
    I compile the form and don't press on button increase the instances of Subform.
    Sign the document and the signature is valid.
    Now, instead, if I make the same but increase the instance of Subform, then sign, the signature is invalid...
    Can the problem is the different versions of Designer and Workbench?
    In past I got some problems, and sometime I resolved creating a new document and copying all the object of old form in new one... It's an ugly solution but it worked.
    But in this case don't resolve nothing.
    Any help?
    Thank You!

  • My computer will not let me download because it says there is no digital signature I need this for a college course how can i download it?

    I am taking a web design class and my instructor wishes us all to use the same browser. She has provided a link in her syllabus and it does go to the download site for Firefox. However, as I am running the download my computer pops up with "there is no digital signature" and "this file is corrupt" and will not download it. What to do?

    Make sure that you do not run the file directly, but save the file to the Desktop and start the installation via a double-click.<br />
    You may need to unlock the file via the right-click context menu: Properties > Security

  • Digital Signature in XML Report

    Hi Friends,
    In Oracle EBS R12, I have a custom XML report developed and running fine.
    There is a requirement to add the feature of Digital Signature in the output of this report. Please help me with the detailed steps to achieve this.
    PS: I have tried a few links from Google and Article notes from oracle support. But, no success.
    If anyone has implemented this successfully, some hints would be of great help.
    The XML report is form-16 of employees.
    Regards,
    Gursangat

    Duplicate thread (please post only once).
    How to add a digital signature in xml publisher report
    How to add a digital signature in xml publisher report

  • Using iText to generate a digital signature that can be signed in Adobe Reader

    I am able to create a digital signature in a pdf using iText.  Adobe Reader does not allow that digital signature to be signed.  Everything I have been reading suggests that I need to enabe Reader Usage Rights, but that requires using Adobe Pro.  I was hoping that I would only need Adobe Reader inorder to digitally sign the pdf, is that possible?

    Not without the required rights...

Maybe you are looking for