PDF digital signatures for beginners

I am developing a PHP application that automatically signs pdf files and I am very confused about certain aspects. I read the PDF specifications and managed through the part of adding annotation, objects, empty signature field, etc but I don't seem to understand anything about computing the hash for the /Contents in the signature dictionary. The documentation is pretty vague about this part. Here's what I am interested in:
what specific hash algorithm do I have to apply to the newly generated pdf file with the dummy signature?
(I should mention that I am inclining using for the /SubFilter adbe.pkcs7.detached or adbe.pkcs7.sha1,)
what is the content of the pkcs7 envelope and how do I generate it?
how to convert the pkcs7 envelope to hex?
I must mention I have no training in cryptography and I've come to this forum after a few days of documenting on the subject without any succes.

I am at the point where I have a certificate, a private key (in PEM or DER format) and a binary string (the data that needs to be hashed). I would be helpfull if someone could explain me (in plain english, like telling a story) what to do to obtain the final value of the signature that's going to go in the final version of the file (ie: the value for the /Contents).
I must say that I've tried a work-around: tried openssl_pkcs7_sign that signs an S/MIME message and tried to extract the signature from there and I got to the point where when opening the file in Acrobat I get the message that the signature is invalid because the document has been altered or corrupted since it was applied. Since this doesn't work I am ready to implement the hashing function from 0, but I didn't find anywhere an example, structure or any other information on the pkcs7 envelope for pdf files. I am glad for any help, even if it means just some reading suggestions (with titles, maybe links, not just saying that I need to do more reading, please).
I am also attaching a file and maybe someone can analyze it and tell me what is wrong with it. I know there is some unnecesary data n the file, but I believe it has nothing to do with the signature.

Similar Messages

PDF Digital Signature for Offer letter

How to enable, pdf digital signature for BI Publisher, we need to enable for the offer letter generated thro' irecruitment .
Please advice
Thanks
Siva

I haven't seen anything related to doing this for iRecruitment but have you checked over the standard BI Publisher support for digital signatures?
17 Support for Digital Signature in PDF Documents
http://download.oracle.com/docs/cd/E10383_01/doc/bip.1013/e10416/bip_digital_sigs.htm

How to format the text in a Digital Signature for a PDF in landscape orientation?

I have a custom Digital Signature plug-in which prompts the user to enter few details on a dialog and then renders the signature. Now, the problem is for a page which has PDPageGetRotate value as 90. In this case, the entire content(text) in the signature is rendered reversed i.e its displayed upside down. However, for a page in portrait mode, i.e with rotation value as 0, signature is correctly displayed.
Can anybody help me by explaining which callback/method to use to frame the text appearance? I think there needs to be some change in the parameters passed to DigSigAPCreateLayeredStreamEx, am i correct?
Let me know any comments/suggestions on this issue of correctly rendering text in a digital signature for a rotated page.

Just setup the appropriate transformation matrix.

How to configure CoSign Electronic Digital Signatures for UCM 11g

Hi everyone,
current I am doing a UCM poc with CoSign Electronic Digital Signature for a customer, this case is that when user approve a check-in PDF document in workflow, the user can use "sign and approve" to invoke the electronic digital signature action.
since ECM 11g is based on weblogic, I configured the keystore for the weblogic as the below steps:
1) use keytool to import a keystrore file just as cosigncert.jks from the cert file which provided by the vendor CoSign.
2) Security Realms->myRealm->Providers->Credential Mapping, create a new provider using "PKI Credential Mapping Provider" and configure the storekey cosigncert.jks for this provider.
3) Security Realms->myRealm->Providers->Authentication, select DefaultIdentityAsserter and add x509
4) configure storekey for AdminServer and UCM managerServer using cosigncert.jks
5) configure SSL for AdminServer and UCM managerServer.
after finishing this steps, access the UCM console to do the approve with siginature. but it always throw "can not find the validate certification path"
does any one know which step missing?
Thanks & Regards
shifeng

Take a look at this chapter in the manual http://docs.oracle.com/cd/E23943_01/doc.1111/e10978/c03_repository.htm#CSMRC1611
(Electronic Signature is now a feature of WebCenter Content; if you are looking for a 3rd party solution for signatures, but perhaps also timestamps, check what partners can do for you)

Digital Signatures for cProjects Approval

Hi Folks,
I am on cProjects 4.5 and from what I understand there are 2 options for this based on whether or not I check the "Signature of Approval with User Certificate" box in Project Type config.
Unchecked - user is prompted for cProjects password and this works fine. Only issue for us is, we are on the portal and most likely cProjects password will be different and unknown to user. As per note 928527 this is standard behavior and tough luck for anybody on the portal.
Checked - use is given the ability to digitally sign the PDF approval document. When I select "sign" on the PDF I am given the ability to create a new ID or use an existing ID from a file, server etc. I created a new ID and signed the document. Once I do this and click the transfer button the system appears to hang. The progress indicator appears and keeps going.
Therefore my questions are:
1. Is there any additional config I need to do in cProjects. ADS or anywhere else?
2. How exactly does adobe digital signatures work? If anybody simply create a signature how does that provide any verification of authenticity?
Appreciate any help.
Thanks,
Lashan

Hi,
please see teh Configuration Content for cProjects 4.5 available in SAP Solution Manager and also as PDF attachment to SAP Note 1035436.
There it says:
Making Settings for the Approval
Use
You can use user certificates for digital signatures of approvals.
Prerequisites
● You are using Microsoft® Internet Explorer 6.0 or higher.
● You have a user certificate that is suitable for digital signatures (for example, the single
sign-on certificate).
● You have installed Adobe® Reader and Adobe Document Services.
Procedure
To verify the signature, enter the corresponding root certificate in the certificate list of the
Personal Security Environment (PSE, transaction STRUST). For more information, see the
documentation for the activity and the Adobe Document Services u2013 Configuration Guide NW
2004s on SAP Service Marketplace at service.sap.com/adobe u2192 Media Library u2192
Documentation.
In fact, what is described in the ADS documentation referenced above is that you have to install
the certificate also on the ADS.
Kind regards,
Florian

Digital signature for form-16

Hi Experts,
We have to implement digital signature for form-16 on only SAP system (not on portal). Can anyone write me steps to configure and impelement it in ECC6.0
I have read SAP Note 1168740 and tried to open the link
Steps to install these credetials is explained at following URL:
                         http://help.sap.com/saphelp_nw70/helpdata/en/db/ aafb211ead420faeeaa24e99eb5f41/frameset.htm
Further information on digital signature can be found at:
                         http://help.sap.com/saphelp_nw70/helpdata/EN/46/ 1ca382f3ec5873e10000000a11466f/frameset.htm
and also tried to get information on "Adobe Document Services Configuration Guide".
However, i am unable to get the details. Pls help me to resolve this.
Thanks & Regards,
Shree NP.
Edited by: SAP.HR.NP on Jan 4, 2012 11:20 AM

Hi Shree,
As mentioned in your post, the configuration given in the document is Basis related. However, the entire configuration for Digital Signature for Form 16 is available in Note 1168740. Are you facing some problem in opening the links mentioned in the Note?
You can try to visit the below links:
a) Uploading a digital signature in the system:
   You obtain your credentials and the corresponding public keys (as part of a certificate) for certifying and signing from a
   certification authority. Steps to install these credetials is explained at following URL:
http://help.sap.com/saphelp_nw70/helpdata/en/db/aafb211ead420faeeaa24e99eb5f41/frameset.htm
Further information on digital signature can be found at:
http://help.sap.com/saphelp_nw70/helpdata/EN/46/1ca382f3ec5873e10000000a11466f/frameset.htm
Also, go through the Note 1589254 (Form 16 central note for ADS configuration). In order to include digital signature to Form 16's PDF, some additional ADS configuration is required. This note provide check point of ADS configuration for Form16. Once done check the form 16 and let me know if you are getting some error on executing Form 16 with digital signature? Or are the signature not working at all?
Regards,
Nishtha

PDF digital signature SDK

We are software house in document management are, and we want incorporate in our document management solution the feature of PDF digital signature.
What is your best SDK product for doing this (PDF Library SDK or Acrobat SDK)?
We have a windows client developed in C++ unmanaged and a web client developed in C#.
And what is the price of the product?
The price includes royalty free when delivered integrated with our product?
Thanks & Regards,
Rui Oliveira

It is to be delivered integrated with our software that it is installed in multiple servers and with multiple web/windows computers doing digital signatures.
The windows client is developed in C++ unmanaged and the web client developed in C#.
In first stage, could be enough to integrate with our windows version (developed in C++ unmanaged). This is a thick windows client installed in each client computer (Acrobat Pro is not installed in each client computer).
tks

Windows cannot verify the digital signature for the drivers required for this device. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. (Code

I get this message when I check the Device manager for my Ipod
Windows cannot verify the digital signature for the drivers required for this device. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. (Code 52)
How do I resolve this I have reinstalled iTunes but it still doesn't recognise my ipod

I reinstalled Itunes a couple of times. I unistalled all programs that I never use, I updated all of my drivers, Windows swept my computer and found no problems. I have a yellow causion lite when I look at the USB-port with the phone connected. All other devices work without a problem.

Need a Suggestion For implementing the Digital Signature For the Documents

Hi,
Currently I am working in a Document Management System. I need a Good Suggestion for how to implement a Digital Signature For the Documents.
Thanks in Advance
Sabarish V

Hmm, if you are not using Oracle Payroll, what are you using for payroll? I am wondering why you could not use your payroll system, whatever it is, to handle this reimbursement program.
Well, you may want to talk to Oracle support about how to handle this in Oracle iExpense. You can certainly handle advances for Expense Reports. You would then apply the advance to the expense report items. The catch is I don't think you can stop expense item entry after the adavance is satisfied. You would have to set up a work flow process of some kind to have the expense reports reviewed and only approve expenses that are applied to the advance, is what I am thinking. Not your ideal solution, but something to think about. It could be the Oracle folks might know of a sneaky way to handle this. What you are trying to do is unusual. Employee advances are common, but the idea of not being able to exceed the advance amount is what unusual about this. Normally you will accept any expenses over the advance amount and reimburse the employee for those extra amounts not advanced.
Good luck.
John Dickey

Digital Signatures for Changing the statuses in Issue Mgmt

Hi
Has anyone put in place digital signatures for Issue
Managemnt when we change the status values in an issue.
We are looking at SAP Note 835584 - Digital signature for documents,
but that is not applicable for us as we want to initiate the digital
signature when the status profile "SLFI0001" kicks in and the status is
changed from one to the other.(eg in process to completed etc)
We have created the digital signature and the strategies, but are
looking for a place to attach this with the status profile "SLFI0001".
Is there a place we can attach the digital signature strategies to this
status profile?
Anyone has any ideas on how it can be done?
Thanks in advance..
sap ques..

We have a document that needs to be signed by more than one individual -- and in our process we are using the Topacz signature pad to get the signature. It's similar to the one you sign at the grocery store, drug store, etc. In order to NOT have the first signature invalidated, we were told to edit the registry...and it works perfectly!
[HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\8.0\AVAlert\cCheckbox]
"iDigSigSaveAsCertified"=dword:00000001
[HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\8.0\AVAlert\cCheckbox\cAnnots]
"iReaderEnableSaveWarn"=dword:00000001
Obviously if you are using a different version of Acrobat, you'll have to change the key accordingly.
Hopefully this will work with your process.
Good luck!!

Implementing digital signatures for Form 16

I have configured ADS for my development ECC. I need to configure digital signatures for Form 16. Please can anybody guide me how to go about this. I am unable to find a proper document.

I am following the below mentioned steps for Digital Signature implementation in form 16 HR,but i am stuck in step 3,can anyone guide me through.
Transaction code: STRUST
1. Select the newly created ‘SSL Client SOAPClient’
2. Select Edit -> Create Certificate Request
3. Copy the Request and sign it (SAPNetCA)
a) Select Edit -> Import Certificate Response and save
b) Double click and select ‘SSL Client SOAPClient’ option to load the certificate
c) Add ‘SSO_CA’ and ‘SAPNetCA’ to Certificate List and save
Regards,
Rohit

Digital Signatures for mutliple company code

Hi,
Our client have multiple company codes & they want to use digital signature for all the company code and there be individual authorised digital signatory for each comp code.
Now the question is , whether we have procure different digital signature for individual company codes & if so how system will identifies which authorised ditigatl signature should be assigned to respective company code...?
=> We are not able to download Adobe Form local & aslo is it mandatory to have digital signature to download Form 16 on a local system.
System details : ECC 6
SP Level : 38
Thanks & Regrads,

Digital Signature is person specific
You have to take the Digital signature ( A number assigned for each signatory with the tool),from an authorized services provided by NSDL
In a single company code if you have 2/3 signatories , first you need to make groups based on the signing authorities, in combination of PA/PSA/EG/ESG/BA etc
The form 16 is to be generated on the above criteria applicable.
3 file of form16 will be generated and send accross to 3 signing authorities
The signing authority can open the form using the tool ,digitial signatory software install and can authenticate the form16.
As per NSDL form16 is now not an statuory doucment. Its just an Tax Information of an Employee.
which is not required to be attached with your ITR's also
So why do you require the Digital signature to be printed on the form16 . Pls check this up with your finance team
Thansk & Regards
Hemant V. Mahale

How to get digital signature for Google Map geocoding V3 in PL/SQL?

Hi, Gurus:
    Could anyone provide me an example about how to generate digital signature for Google Maps service v3 in PL/SQL? We tried to upgrade our program using Google maps service from v2 to v3. We are using PL/SQl on background to send request to Google for geocoding. We found some sample code to register with digital signature, but none of them is based on PL/SQl. Notice I used Google business client ID "gme-XXX" and wallet.
https://developers.google.com/maps/documentation/business/webservices/auth#digital_signatures
Google Maps API - more URL signing samples
Here is my code for V2. I notice in order to get signature, I need to use HMAC-SHA1 algorithm.
procedure Get_Geocoding(P_s_Address in varchar2, P_s_Geocoding out varchar2, P_n_accuracy out number, P_b_success out boolean) is
l_address varchar2(4000);
l_url varchar2(32000);
l_response varchar2(3200);
n_first_comma number;
n_second_comma number;
n_level_length number;
BEGIN
/* TODO implementation required */
l_address:=APEX_UTIL.URL_ENCODE(P_s_Address);
l_address := replace(l_address,' ','+');
l_url := 'http://maps.google.com/maps/geo?q='||l_address||'&'||'output=csv'||'&'||'client=gme-XXX';
l_response := utl_http.request(l_url, APEX_APPLICATION.G_PROXY_SERVER, '/u02/app/oracle/admin/apexsb/wallet', 'XXXXXXXX');
n_level_length:=0;
n_first_comma:=instr(l_response,',',1,1);
n_second_comma:=instr(l_response,',',1,2);
n_level_length:=n_second_comma-n_first_comma-1;
P_n_accuracy:=0;
if n_level_length>0 then
P_n_accuracy:=to_number(substr(l_response,n_first_comma+1, n_level_length));
end if;
l_response:=substr(l_response,instr(l_response,',',1,2)+1);
--dbms_output.put_line('In function: l_response ='||l_response);
P_s_Geocoding:=l_response;
if (P_s_Geocoding<>'0,0') then
P_b_success:=true;
--dbms_output.put_line('true');
else
P_b_success:=false;
--dbms_output.put_line('false');
end if;
END;
Thanks!

Hi, guys:
    I tried to generate digital signature for Google map service
     Maps for Business: Generating Valid Signatures - YouTube
    Generating an HMAC-SHA-1 Signature Using Only PL/SQL
      OAuth and the PL/SQL | Data Warehouse in the Cloud
   but I got error message from Google:
Unable to authenticate the request. Provided 'signature' is not valid for the provided client ID. Learn more: https://developers.google.com/maps/documentation/business/webservices/auth
   I think there is something wrong with my code to generate signature, as if I remove the part regarding client and signature, it will work, can anyone help me on this problem?
/*Procedure Get_Geocoding is used to get geocoding with accuracy level for V3 business account, you can find Google map digital signature descrirption from
https://developers.google.com/maps/documentation/business/webservices/auth#digital_signatures
if geocoding is 0,0, procedure returns false to indicate failure of get geocoding*/
procedure Get_Geocoding2(P_s_Address in varchar2, P_s_Geocoding out varchar2, P_n_accuracy out number, P_b_success out boolean) is
--private key for Google business account, this is provided by Google with client name.
l_private_key_src varchar2(200):='xxxxxxxxxxxxxxxxxxx';
l_private_key_b64_alter varchar2(200):= translate(l_private_key_src,'-_','+/');
l_private_key_bin raw(2000);
l_client_name varchar2(100):='gme-xxx';
l_signature_mac raw(2000);
l_signature_b64 varchar2(200);
l_signature_b64_alter_back varchar2(200);
l_Google_service_domain varchar2(200):='http://maps.googleapis.com';
l_address varchar2(4000);
l_url varchar2(32000);
l_path varchar2(32000);
l_response varchar2(32000);
l_page UTL_HTTP.HTML_PIECES;
n_actual_length number;
json_obj json;
json_tempobj json;
jl_listOfValues json_list;
json_geom_obj json;
json_loc json;
l_lat VARCHAR2(40);
l_lng VARCHAR2(40);
l_status VARCHAR2(255);
json_accuracy json;
--temp_string varchar2(10000);
n_first_comma number;
n_second_comma number;
n_level_length number;
BEGIN
/* TODO implementation required */
l_private_key_bin := utl_encode.base64_decode(UTL_I18N.string_to_raw(l_private_key_b64_alter, 'AL32UTF8'));
l_address:=APEX_UTIL.URL_ENCODE(P_s_Address);
--dbms_output.put_line(l_address);
l_address := replace(l_address,' ','+');
l_path := '/maps/api/geocode/json?address='||l_address||'&'||'sensor=true';
dbms_output.put_line(l_path);
l_signature_mac :=DBMS_CRYPTO.mac(UTL_I18N.string_to_raw(l_path, 'AL32UTF8'), DBMS_CRYPTO.hmac_sh1,l_private_key_bin);
l_signature_b64:= UTL_RAW.cast_to_varchar2(UTL_ENCODE.base64_encode(l_signature_mac));
l_signature_b64_alter_back:=translate(l_signature_b64,'+/','-_');
dbms_output.put_line(l_signature_b64_alter_back);
--get response from Google map service
l_url:=l_Google_service_domain||l_path||'&client='||l_client_name||'&signature='||l_signature_b64_alter_back;
--l_url:=l_Google_service_domain||l_path;
dbms_output.put_line(l_url);
l_page:=utl_http.request_pieces( l_url, 99999);
for i in 1..l_page.count loop
l_response:=l_response||l_page(i);
end loop;
n_actual_length:=length(l_response);
dbms_output.put_line(n_actual_length);
dbms_output.put_line(l_response);
--parse JSON result
json_obj:=new json(l_response);
l_status := json_ext.get_string(json_obj, 'status');
IF l_status = 'OK' then
jl_listOfValues := json_list(json_obj.get('results'));
json_tempobj := json(jl_listOfValues.get(1));
json_geom_obj := json(json_tempobj.get(3));
json_loc := json_ext.get_json(json_geom_obj, 'location');
l_lat := to_char(json_ext.get_number(json_loc, 'lat'));
l_lng := to_char(json_ext.get_number(json_loc, 'lng'));
P_s_Geocoding:=l_lat||','||l_lng;
dbms_output.put_line('##########'||P_s_Geocoding);
case json_ext.get_string(json_geom_obj, 'location_type')
when 'ROOFTOP' then P_n_accuracy:=9;
when 'RANGE_INTERPOLATED' then P_n_accuracy:=7;
when 'GEOMETRIC_CENTER' then P_n_accuracy:=5;
else P_n_accuracy:=3;
end case;
P_b_success:=true;
else
P_b_success:=false;
P_n_accuracy:=0;
P_s_Geocoding:='0,0';
end if;
END;

Digital signatures for calibration inspection (inspection type 14)

Hi,
I want to use digital signatures for results recording and usage decision (ud) when performing a calibration (inspection type 14). Normally you'd set-up the material authorization for digital signatures. But this can't be added to maintenance plans or equipment. Is there any way to set-up digital signatures for calibrations?
Regards,
Maarten

Explore SAP Note 576307
It may help u.

How can I create digital signatures for my users using Windows 2008 Active Directory Certificate Services?

Hi,
I need to create local digital signatures for my users. How can I do that using W2k8 Active Directory Certificate Services? We are gonna sign Office 2010 documents.
What company offers cheap digital signatures solutions?
Thanks in advanced

Consider the following:
if you use your local CA server to issue digital signature certificates, there is no cost, because you are eligible to issue so many certificates as you need. However, documents signed by these certificates will be considered trusted only within your AD
forest and other machines that explicitly trust your local CA. Any external client will not trust your signatures.
If you want to make your signature trusted outside your network (say, in worldwide), you need to pruchase a certificate from trusted commercial CA (VeriSign, GoDaddy, GlobalSign, StartCom, etc) according to respective vendor price list. In that case you
don't need to have your local CA server, because it is not used. All certificate management is performed by the external CA. A most common scenario is to purchase signing certificate for particular departament principals (head managers) or few certificates
for a whole company (all documents are revised by a responsible person or persons who holds signing certificate and sign them after review).
so, it is not clear from your post what exactly you need.
My weblog: http://en-us.sysadmins.lv
PowerShell PKI Module: http://pspki.codeplex.com
Windows PKI reference:
on TechNet wiki

PDF digital signatures for beginners

Similar Messages

Maybe you are looking for