Timestamp in Digital Signature

I have a developed Acrobat plug-in based on DocSign sample project. It works properly for signing and verification.
But I can't pass timestamp information to Acrobat.
The AAcrobat 9 always reflects date-time status as "Signature date/time are from the clock on the signer's computer" on the left Signatures panel.
The follow functions don't request this information: PSSigValGetTextProc, PSGetBoolPropertyProc, PSGetAtomPropertyProc, PSGetTextPropertyProc, PSGetInt32PropertyProc.
PSSigValidateProc callback function fills a outSigPropCab cabinet with all possible values such as PROP_SigInfo_DateTrusted, PROP_SigInfo_VerifyDate, PROP_DSSigProp_Date, PROP_SigInfo_Date, PROP_DSSigProp_VerifyDate, PROP_DSSigProp_TrustedDate, PROP_SigInfo_TimeStamp. But it doesn't work.

Hi, Steven.
I can show the actual signature if it's necessary but signing algorithm is not supported by Adobe Default Security. The signing algorithm is russian GOST algorithm.
I fill PSSigGetSigValueParams.outSigValueData with CMS message of signature. Timestamp OID is in this signature.
If timestamp issuer isn't in trust-list then Acrobat should reflect: "Signature is timestamped but the timestamp could not be verified."
But in my case Acrobat reflects: "Signature date/time are from the clock on the signer's computer".
That's why I think the problem is that Acrobat dosn't support GOST timestamp signature algorithm or I fill wrong API parameters.
P.S.
Using GOST algorithm I manage reflect signature validation information correctly (except timestamp info).

Similar Messages

Timestamp digital signature

Hi,
We have implemented the digital signature that is triggered by setting a specify document status. We see however that the timestamp of the digital signature differs for other changes in document attributes. The timestamp for the digital signature is set by the Timezone-time. Both times can be looked up in the menu System-Status. The timestamp for the other changes are defined by the System time. Does anybody know how to align the two?

Systemtime and solution manager timezone were not in sync.

Applying a timestamp to a Digital Signature in Office

Hello,
I want to apply een digital signature to a Worddocument or to the macromodule of a Worddocument.
Because the certificate expires after a year, i want to add a timestamp.
Now I read in the article "Digital signatures in Office 2010" that there are two registry settings to control the type of signature Office creates: XAdESLevel and MinXAdESLevel.
So if I want to a signature with a timestamp i have to add the registry settings:
XAdESLevel = 2 (REG_DWORD)
MinXAdESLevel = 2 (REG_DWORD).
Is that all, or do i need tot provide Office with a time stamp server?
(I don't think i have a time stamp server).
Kind regards,

Hi,
As far as I know, if we want to use the time stamp functionality with digital signatures, we must complete the following:
Set up a time stamp server that is compliant with RFC 3161
Use the Group Policy setting, Specify server name, to enter the location of the time stamp server on the network.
On the other words, we need a time stamp server.
Quote From:
http://technet.microsoft.com/en-us/library/cc545900(v=office.14).aspx
Hope it's helpful.
Regards,
George Zhao
TechNet Community Support
It's recommended to download and install
Configuration Analyzer Tool (OffCAT), which is developed by Microsoft Support teams. Once the tool is installed, you can run it at any time to scan for hundreds of known issues in Office
programs.

Verifying digital signatures in PDF documents

I'm working on verifying PDFs digital signatures.
I know that when a PDF is signed, a byterange is defined, the certificates get embedded, and from what i've read, the signed message digest and the timestamp are also stored in the PDF.
I already can extract the certificates and validate them. Now I'm trying to validate the pdf's integrity and my problem is I don't know where the signed message digest is located.
In this sample signed pdf (http://blogs.adobe.com/security/SampleSignedPDFDocument.pdf), I can clearly identify the digest since it is down below the embedded certificates: /DigestMethod/MD5/DigestValue/ (line 1520).
But that PDF sample seems to be from 2009, and I suspect the message digest is stored in a different way now, because I signed a PDF with Adobe Reader and I can't find any message digest field like the previous one. Can someone tell if the digests are now stored in a different way? Where are they located?
Anyway, for now I'm using that sample document, and trying to verify its integrity. I'm getting the document's bytes to be signed acording to the specified byterange, and digesting them with MD5 algorithm, but the digest value I get doesn't match with the one from the message digest field... Am I doing something wrong? Is the digest also signed with the signer's private key?
I appreciate any help.

You cannot rely on the digest to be in a certain place in PDF. If you want to manually verify the digest in a PDF signature here's what you need to do.
1. Open PDF in a Text Editor.
2. Find Signature Dictionary for your signature.
3. Get the Hex String which is the value of the /Contents entry in the Signature Dictionary.
4. Convert Hex String to binary string and discard trailing zeros. Remember that in a Hex string each byte is represented with two characters and the last one might be a zero. So, when you discard zeros make sure that what you get left has even number of bytes.
5. Use one of the commercially available BER Viewers (you can find free BER Viewers on the Web) to convert the binary string to ANSI.1 representation.
6. Analyze the BER-decoded PKCS#7 signature object (RFC 2315 describes it) and find the digest that you are looking for in it. It is an OCTET STRING.
If you want to programmatically validate a signature, you need to write code that does all that. Signature validation includes much more than checking the digest. You need to build chain, validate each certificate in the chain, check revocation for each certificate in the chain, etc. RFC 5280 is the guide what to do.
Good luck!

Validating digital signatures successfull on Win7 but fails on Vista/XP/W2K3

Microsoft has announced (Security Advisory 2880823: Recommendation to discontinue use of SHA-1) that
they will stop recognizing the validity of SHA-1 based certificates after 2016. Microsoft started to sign their files with digital signatures which use the stronger SHA-2 hashing algorithm. For the countersignatures (Time Stamping Authenticode Signatures)
they also use SHA-256. These certificates can be validated fine on Windows 7/8 but can't be validated on Windows Vista, Windows XP and Windows Server 2003R2. The status of certificates in the Certification Path are OK but on the older operating systems the
countersignature seem to be missing... See the forum thread
EMET 4.1 Update 1: 'The digital signature of the object did not verify.' on Vista/XP in the
Enhanced Mitigation Experience Toolkit (EMET) Support Forum for several screenshots.
Can someone explain this behavior and maybe provide a solution?
W. Spu

Hi,
It looks like it is related with this
https://technet.microsoft.com/library/security/2749655
This issue might be caused by a missing timestamp Enhanced Key Usage (EKU) extension during certificate generation and signing of Microsoft core components and software.
Microsoft is aware of an issue involving specific digital certificates that were generated by Microsoft without proper timestamp attributes. These digital certificates were later used to sign some Microsoft core components and software binaries. This
could cause compatibility issues between affected binaries and Microsoft Windows. While this is not a security issue, because the digital signature on files produced and signed by Microsoft will expire prematurely, this issue could adversely impact the ability
to properly install and uninstall affected Microsoft components and security updates.
So have you applied this update on XP\Vista\Server 2003?
http://support.microsoft.com/kb/2749655
This update will help to ensure the continued functionality of all software that was signed with a specific certificate that did not use a timestamp Enhanced Key Usage (EKU) extension. To extend their functionality, WinVerifyTrust will ignore the lack of
a timestamp EKU for these specific X.509 signatures.
Yolanda Zhu
TechNet Community Support

Digital Signatures Missing

hello.. when i downloaded the installer for the "plugin" version of FP 11.7.700.232, for use with "windows xp" and "firefox", i noticed that the installer didn't have a digital signature.. i would think that it is supposed to be digitally signed..
i downloaded the file from "adobe.com" and i tried downloading it a second time, but it still wasn't digitally signed..
the "NPSWF32_11_7_700_232.dll" file that was installed in the "macromed" folder is digitally signed.. the "NPSWF32_11_7_700_232.dll" file seems to be the main FP program-file..
i am not experiencing any problems with using FP 11.7.700.232, with "windows xp" and "firefox"..
(mozilla's plugin-check says that it is out-of-date.. i hope that won't be a problem, where mozilla blocks it)..

hey pat.. you must have downloaded a file that was different from the one that i downloaded.. i downloaded the plugin version of FP 11.7.700.232.. the digital signature for it is not timestamped..
here is a link for downloading the file:
http://fpdownload.macromedia.com/get/flashplayer/current/licensing/win/install_flash_playe r_11_7_plugin.exe

How to configure CoSign Electronic Digital Signatures for UCM 11g

Hi everyone,
current I am doing a UCM poc with CoSign Electronic Digital Signature for a customer, this case is that when user approve a check-in PDF document in workflow, the user can use "sign and approve" to invoke the electronic digital signature action.
since ECM 11g is based on weblogic, I configured the keystore for the weblogic as the below steps:
1) use keytool to import a keystrore file just as cosigncert.jks from the cert file which provided by the vendor CoSign.
2) Security Realms->myRealm->Providers->Credential Mapping, create a new provider using "PKI Credential Mapping Provider" and configure the storekey cosigncert.jks for this provider.
3) Security Realms->myRealm->Providers->Authentication, select DefaultIdentityAsserter and add x509
4) configure storekey for AdminServer and UCM managerServer using cosigncert.jks
5) configure SSL for AdminServer and UCM managerServer.
after finishing this steps, access the UCM console to do the approve with siginature. but it always throw "can not find the validate certification path"
does any one know which step missing?
Thanks & Regards
shifeng

Take a look at this chapter in the manual http://docs.oracle.com/cd/E23943_01/doc.1111/e10978/c03_repository.htm#CSMRC1611
(Electronic Signature is now a feature of WebCenter Content; if you are looking for a 3rd party solution for signatures, but perhaps also timestamps, check what partners can do for you)

Digital Signatures / Custom Signature Logo

Good morning -
I'm getting quickly acclimated to the concept of digital signatures as my employer is stiving towards a paperless office. I have several questions that have come up, but I'll start with (hopefully) an easy one:
When a digital signature appearance is beign created, one option is "Logo", which will place the Adobe "A" behind the signature image and timestamp information. Is it possible to put a custom logo behind there - such as my company's emblem?
Many thanks,
Warren

Hi Warren,
The answer is yes, you can replace the PDF trefoil (it's not the Adobe A) with your own logo as the background. Open the image file in Acrobat and it will get converted to a PDF file. Don't worry about cropping the image. For this you do need Acrobat as the free Adobe Reader cannot convert images to PDF. The next thing is to save the file with a specific name and to a specific location.
The file name you are going to use is SignatureLogo.pdf and please note there is no space in the file name. You need to save the file in the following location:
Windows XP: C:\Documents and Settings\<user>\Application Data\Adobe\Acrobat\<version>\Security
Vista or Win 7: C:\Users\<user>\AppData\Roaming\Adobe\Acrobat\<version>\Security
Macintosh: \Users\<user name>\Library\Application Support\Adobe\Acrobat\<version>\Security
I'm sure you've figured out that <user> is going to correspond to the name of the logged in user and <version> is the current major version of Acrobat or Reader. Although Acrobat and Reader get installed into different locations, and even use separate registry entries, they do share the users application data directory.
Steve

Digital signature fields in AutoCAD?

Is there any way to insert a digital signature field in AutoCAD and then make the PDF? That way it is ready for the engineer's electronic digital signature and timestamp?

No. You can't have multiple digital signature fields with the same namein the same document as you can with other types of fields. Since a digital signature applies to the entire document, not just a page, pages, or section of a page, it doesn't really make sense.

SOAP encryption. should digital signature added before or after encryption?

I'm developing secure web services. I want to add timestamp, digital signature and encrypt the soap message. What's the order? 1. timestamp, 2. signature, 3. encryption?

Assuming the API you are using allows you to apply all pieces in any order, I would encrypt before signing. Signature verification should be quicker than decrypting and if the signature fails, you don't have to bother decrypting. If you think the timestamp is something confidential, add that before you encrypt, otherwise not.
Edit: Though I don't think there's really a "right" or "wrong" way to do it. There's trade-offs no matter which way you do it. If you encrypt last then someone looking at the message just sees an arbitrary blob of bytes...
Edited by: dstutz on Apr 10, 2008 7:45 AM

Digital Signature Issues

Hi, I am brand new to this forum, But this is my second question. I am running Abobe Acrobat Pro 9.0.
          I have been tasked with making a document that is Digital Signature ready.
          I was able to make a digital signature for my document. However, I have two warning that come up.
               Once the document is signed, a blue bar shows up at the top of the page. It has the following statement: "At least one signature has problems, Please fill out the following form. If you are the form author, choose distribute form in the forms menu to send it to your recipients"
                When expanding on the yellow triangle, There is one green check mark (with a statement that says: "The document has not been modified since this signature was applied".
                    Two warnings show up:
                     1) "The signers identiy is unknown because it has not been included in your list of trusted identities and none of its parent certificates are trusted identities".
                     2) " Signature date/time are from the clock on the signers computer".
               George, I have not been able to paste the Javascripts from that freeware into my Adobe program. I am not sure if it is the permissions set in the Adobe program or the restrictions my company has with altering computer software.
          Is there something that I might be able to do to remove the warnings?
          Very Respectfully: Rossknechtt,

For #1, it will always show that for self-signed certificates that you have not yet chosen to trust. When you add the identity to your list of trusted identities
and choose to trust it as a trusted root.
For #2, it will say that unless the time was retrieved from a timestamp server when the signature was applied. So what you're seeing is normal if one was not used.
More information on all of this is in the Acrobat Help document.

How do I add a digital signature to Word 2011?

I am at a loss at to adding a digital signature to Word 2011 docs on my macbook pro, any ideas???

Formscentral does not support forms with digital signature workflows. I suggest you see if our Echosign product meets your needs.

Issue in Java concurrent program for Digital Signature Stamping

Hi All,
Im calling a Java concurrent program which does digital signature stamping on the PDF report generated.Program able to able to read the PDF file as input and also digital signature stored as file in the application but
ends in error in create signature method , need help in this regard.
Error:
Parameter 0 is Request id of with out Digital signature file
Parameter 1 is employee id of approver
Parameter:0:99203256
Parameter:1:1414603
$$$$ start query fileinfo with callable statment
programName>>>>>>>>BTPOPORPXML
$$$$ Without digital Signature file Name $$$
$/inst_top/finprod/apps/FINPROD_CPNQERPAAPZP10/logs/appl/conc/out/BTPOPORPXML_99203256_1.PDF
PFX File Reading Start
PFX File Reading Ends
PFX File size is: 6460 Byte size is: 6460
Elements present
java.lang.NullPointerException
at
com.lowagie.text.pdf.PdfSignatureAppearance.getAppearance
(Unknown Source)
at
com.lowagie.text.pdf.PdfSignatureAppearance.preClose
(Unknown Source)
at
com.lowagie.text.pdf.PdfSignatureAppearance.preClose
(Unknown Source)
at com.lowagie.text.pdf.PdfStamper.close(Unknown
Source)
at
btvl.oracle.apps.po.digsig.BTVLDigSign.runProgram
(BTVLDigSign.java:151)
at oracle.apps.fnd.cp.request.Run.main
(Run.java:157)
Edited by: 999033 on May 16, 2013 7:20 PM

Hi Charls,
I have successfully implemented at our end in 11i. Pl.try at your end.
v_request_id := FND_REQUEST.SUBMIT_REQUEST (passed your arguments... );
COMMIT;
IF NVL( v_request_id , 0 ) = 0 THEN
DBMS_OUTPUT.PUT_LINE( 'Item Assignment to Organization Program Not Submitted');
p_status := 'FAILURE' ;
p_err_msg := 'ERROR RAISED AFTER SUBMITTING THE IMPORT ITEM ORG.ASSIGNMENT CONCURRENT REQUEST ... ' ;
ELSE
v_finished := FND_CONCURRENT.WAIT_FOR_REQUEST
request_id => v_request_id,
interval => 0,
max_wait => 0,
phase => v_phase,
status => v_status,
dev_phase => v_request_phase,
dev_status => v_request_status,
message => v_message
LOOP
EXIT WHEN ( UPPER(v_request_phase) = 'COMPLETE' OR v_phase = 'C');
END LOOP;
HTH
Sanjay

Update on 10.6.8 fails due to digital signature on update is missing

wanting to install the Parallels version 10 and it won't work on 10.6.8 version of my Mac OS so I learned how to go to the software update which indicates an update is available. When I go ahead and load the update it runs fine and then stops with a message that the Macbook Pro EFI Firmware Update can't be saved. It says the digital signature on the update is missing or invalid.
I don't know if the digital signature is on my computer or the update? I would upgrade to a more recent version of the OS but don't know what will work.
Can anyone help?
Dan

Parallels 10 isn't compatible with 10.6 according to the web site.
Mac Requirements
Hardware:
A Mac computer with an Intel Core 2 Duo, Core i3, Core i5, Core i7, or Xeon processor (Core Solo and Core Duo processors are no longer supported)
Minimum 2 GB of memory (4 GB of memory is recommended to run Windows 7 in a virtual machine or if your host OS is Lion)
About 850 MB of disk space on the boot volume (Macintosh HD) for Parallels Desktop installation
About 15 GB of disk space for each virtual machine
Software:
OS X Yosemite 10.10 or later
OS X Mavericks 10.9.4 or later
Mac OS X Mountain Lion 10.8.5 or later
Mac OS X Lion 10.7.5 or later
Check that your computer is compatible with Mountain Lion/Mavericks/Yosemite.
To check the model number hold down the option/alt key, go to the Apple menu and select System Information.
MacBook (Late 2008 Aluminum, or Early 2009 or newer) model number 5,1 or higher
MacBook Pro (Mid/Late 2007 or newer) model number 3,1 or higher
Your Mac needs:
OS X v10.6.8 or OS X Lion already installed
2 GB or more of memory (More is better - 4 GB minimum seems to be the consensus)
8 GB or more of available space
Check to make sure your applications are compatible. PowerPC applications are no longer supported after 10.6.
Application Compatibility
Applications Compatibility (2)
Do a backup before installing.
If you can/do upgrade, I recommend you make a copy of the installer and move it out of your Applications folder. The installer self-destructs. The copy will keep you from having to download the installer again. You can make a bootable USB stick to install using this free program.
Bootable USB Flash Drive – Diskmaker X
Mountain Lion
Note - Mavericks is no longer available.

Making Multiple Digital Signatures Read-only in Form (Acrobat 9)

I have created a form which includes two (2) digital signature fields. What needs to occur with the form is Person1 fills the form and then digitally signs it thereby making the form fields read-only . Person2 then digitally signs the form which should make Person1's digital signature read-only.
Here's what I've done:
1) For the Person1 digital signature field, in Digital Signature Properties, under the Signed tab, I have selected Mark as read-only <all fields except these> and selected the Person2 digital signature field.
2) For the Person2 digital signature field, in Digital Signature Properties, under the Signed tab, I have selected Mark as read-only <all fields> since once Person2 signs the form I do not want Person1 to be able to clear the digital signature and make changes to the form.
Here's what actually occurs:
Step 1 above works fine. Once the signature is applied all the form fields are read-only except for the Person2 digital signature field.
The problem is that after Person2 digitally signs the form, even though I selected all fields as read-only, Person1 can 'clear' their signature which leaves all the form fields available for editing and leaves Person2's digital signature still on the form.
I honestly don't care about 'validating' signatures on this form since it's going to be printed but I cannot allow Person2's signature to remain on the form and allow Person1 to edit the form.
--Mike.

Hi!
I have the same problem. Have not been able to figure it out, although tried everything.
Hope somebody can help
- MackeMan

Timestamp in Digital Signature

Similar Messages

Maybe you are looking for