Verifying OpenOffice document signature

Hi all,
When you sign an ODT document throught OpenOffice interface, an XML Signature file is generated inside ODT file structure: documentsignatures.xml.
I'm trying to verify this XML Signature using JDK 6 JSR 105 implementation, but i have some problems ...
I try a simple verification uncompressing ODT file (JAR file) and accessing documentsignatures.xml directly:
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
dbf.setNamespaceAware(true);
DocumentBuilder db = dbf.newDocumentBuilder();
Document d = db.parse("documentsignatures.xml");
NodeList nl = d.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");
X509Certificate cert = X509Certificate.getInstance(new FileInputStream("rootca.der"));
DOMValidateContext valContext = new DOMValidateContext(cert.getPublicKey(), nl.item(0));
XMLSignatureFactory fac = XMLSignatureFactory.getInstance("DOM");
XMLSignature signature = fac.unmarshalXMLSignature(valContext);
if (signature.validate(valContext)) {
    System.out.println("OK");
else {
    System.out.println("BAD SIGNATURE");
}But i get an exception:
Exception in thread "main" javax.xml.crypto.dsig.XMLSignatureException: javax.xml.crypto.URIReferenceException: java.lang.NullPointerException
at org.jcp.xml.dsig.internal.dom.DOMReference.dereference(DOMReference.java:352)
at org.jcp.xml.dsig.internal.dom.DOMReference.validate(DOMReference.java:311)
at org.jcp.xml.dsig.internal.dom.DOMXMLSignature.validate(DOMXMLSignature.java:230)
at VerifyODTSignature.main(VerifyODTSignature.java:63)It seems like a problem with reference resolution ... So i modify the initial code to handle an "URIDereferencer":
DOMValidateContext valContext = new DOMValidateContext(cert.getPublicKey(), nl.item(0));
valContext.setURIDereferencer(new URIDereferencer() {
       public Data dereference(URIReference uriReference, XMLCryptoContext context) throws URIReferenceException
                OctetStreamData osd = null;
                try
                    osd = new OctetStreamData(new FileInputStream("/referenced_xml_files/" + uriReference.getURI()));
                catch (Exception e)
                    e.printStackTrace();
                return osd;
        });But i get an:
Exception in thread "main" javax.xml.crypto.dsig.XMLSignatureException: javax.xml.crypto.dsig.TransformException: java.lang.ArrayIndexOutOfBoundsException: 23
at org.jcp.xml.dsig.internal.dom.DOMReference.transform(DOMReference.java:390)
at org.jcp.xml.dsig.internal.dom.DOMReference.validate(DOMReference.java:312)
at org.jcp.xml.dsig.internal.dom.DOMXMLSignature.validate(DOMXMLSignature.java:230)
at VerifyODTSignature.main(VerifyODTSignature.java:62)I supose that i'm not usign URIDereferencer properly, but i could'n find documentation or samples regarding this issues :(
Please, somebody can help me?
Thanks in advance!!!!
Edited by: borillo on Mar 4, 2008 8:23 AM

Hi all,
Finally Sean Mullan have found the problem. Here is his answer:
I finally found some time to debug into this problem. It is a bug in the canonicalization code and I will open a bug to have it fixed in JDK 6. It is only triggered if an element has over 23 attributes and the
office element in content.xml has 24 attributes!
The only workaround I can think of is to use a Apache XMLSec jar and override the implementation in the JDK. You can do this with the endorsed override mechanism of the JDK. What you need to do is download the following jars:
1) Java XMLSec (1.4 or later): http://xml.apache.org/security/dist/java-library/
2) Commons Logging:
http://commons.apache.org/downloads/download_logging.cgi
You need the commons logging library because the Apache implementation uses that instead of the JDK logging mechanism.
Put these two jars in a lib directory, and then specify that lib directory as the endorsed directory when running your application, for example:
java -Djava.endorsed.dirs=lib ...
This should work.
HTH,
Sean
"""

Similar Messages

Document Signature - Validation Issue

This is the recent help i've been trying to get on this subject over at acrobatusers.com. You can read through the issue i'm having through here, answer that was given and my response.
Summary: Basically there are multiple text fields that are set to required, customer name, email...etc. All fields must be locked after being digitally signed (through the document signature field). When default validation pattern are used (blank) it generates an error (Customer field could not be validated). After trying regular expression script, it generates an error (Customer field could not be validated). So i tried a number of different combinations of picture clauses, and from what i'm gathering you have to know exactly how many characters are going to be typed to use that sort of validation. Which in a customer name field you have know idea what their name is going to be (unless you customize a document for each individual customer (not possible)).
If anyone could help on this problem would be a lifesaver. Thank you
::COPY OF HELP QUESTION SUBMITTED::
Apparently I'm not getting the field validation examples in the Help (F1) of Livecycle. I've been struggling to get all the fields in a collection to validate properly. Once I add a Document Signature field to the document and assign the fields to a collection, it doesn't seem to like the default validation settings if I assign the fields to 'User Input: Required' So for the name field I've tried multiple validation patterns all to no avail. My question is how to write a custom validation pattern that allows for an unknown ammount of characters in a name, email..etc. I've tried A A which only validates if the user enters J D for example but John Doe does not work. I've tried other combinations but nothing works. Any help would be appreciated.
Thank you
::ANSWER SUBMITTED BY COMMUNITY EXPERT::
A:There are a couple of things you need to look at. First, is the Acrobat Picture Clause Reference. You can find it and other LiveCycle references on this site
http://partners.adobe.com/public/developer/xml/index_arch.html
The other thing to look at is using a JavaScript validation script with a Regular Expression. Regular Expressions are much more flexible that the picture clause at doing validation.
Answered by Thom Parker on Fri, Jul 6, 2007
::RESPONSE FROM ME BACK::
Q:After reading through the Picture Clause Reference I'm certain there is no way to validate the customer name field without first knowing how many characters will be entered in. And I'm pretty sure there is no simple way of just making it "required" without a pattern to verify against.
The Document Signature Field acts pretty weird if the text field is 'required' and there is nothing to validate it against. Which all in all I just want to make sure it is filled out. Customer Name field (First and Last name) one text field.
So I tried the regular expression route, and added it to the 'Validate' section of the text field. Still I think the problem lies in the way the Document Signature field processes the 'required' fields.
Now I noticed that this only happens if I set the document signature field to lock the required fields after digitally signing the document. This is a mandatory feature the document needs to have, along with the document signature. And the custom stamp option is not a viable solution to this either, since in my field of work everything is questioned whether or not it was altered or forged in some manner. And Custom 'Forged' stamps would not be too difficult to recreate, so that idea is out of the window.
I'm stumped on this and any suggetions as to what route to take would be greatly appreciated. I can not release a document to the customers with validation error messages popping up even though the fields are filled out. Just wouldn't be professional, and down right annoying considering it validates about 15 fields, and everyone except the date and tim

Hey Robert,
I've been having the same issue where, once digitally signed, I end up having an issue with my mandatory fields returning an error '[mandatory field name] validate failed'. Is this the sort of errors you are getting? I'm also trying to find answers on this as I've tried a few things but it hasnt worked well. One thing I did was to change the mandatory field back to optional and coded my submit button using the if clause when the submit button is pressed to check if the this mandatory field is filled in.
if ((pgDetails.txtReqBy.rawValue != null) &&(pgDetails.txtReqBy.rawValue != ""))
event.target.submitForm({cURL:"mailto:[email address]?subject=New/Edit Supplier Detail Form&body=Please find attached the completed form.",cSubmitAs:"PDF",cCharset:"utf-8"});
else
xfa.host.messageBox("Requested by field MUST be filled. Pls enter your full name.");
This seems to work fine except for one thing. If first time around, I fill the form out leaving the mandatory field blank, it returns the message "Requested by field MUST be filled. Pls enter your full name." So now I go back and fill in the mandatory field and, without navigating to another field, I click the submit button, I get the same message "Requested by field MUST be filled. Pls enter your full name." as it has not picked up the new value of the field. Any idea if there is code to make it re-read the field?
Rgds,
Jan

Document signature with date/time received stamp

Does anyone know if you can combine the feature of a date/time received stamp with the signature of the person who received it?
Regards,
Sean

Hi Sean,
The way a time stamp works is that it's a signature over the document signature, kind of like when a notary public signs a document. They (the notary) are not verifying the accuracy of the document, only that you signed it and when you signed it.
Generally (can you sense that this is going to get more complicated then it should be ), a time stamp is created (by a trusted third party) at signing time to prove that the signature existed a a particular point in time. If you timestamp your signature at signing time it cannot be time stamped again by the receiving party. If the receiving party wants to add a timestamp they need to sign the document themselves. An example of this is the patent office. It doesn't matter to them what time you signed the patent application, but rather when they received it. They add their own timestamp to show what time the application was received by signing the document a second time.
Now just to confuse things a bit, starting with Acrobat 9.1.0, if the signature was not time stamped at signing time, it has the ability to add a timestamp post signing. You can add the timestamp by opening the Signature Panel, right mouse click on the signature, and select Add Verification Information from the pop-up menu. You must have a timestamp server configured in the Security Settings console and the Include signature's revocation status when signing preference selected in order for this feature to be available, and the signature must be valid. You cannot add a timestamp post signing over an invalid signature.
I hope this helps,
Steve

Architectural Difference Effect on Signing/Verifying XML Document

Hi all,
I am using Apache Santuario for signing XML.
1. I have a Windows Server 2008 64 Bit, which is using JAVA 7 32 bit JVM. Let's say my signed document is Signed_A. On Windows Server 2008 I am signing the document but the verification fails for Signed_A.
2. Same application is being run on Windows 7 32 bit with the same JVM version. And the document is Signed_B on this machine. I am signing the document and verifying it without a problem.
3. If I move the document Signed_B (which I could sign & verify on Windows 7) to Windows 2008 Server, using the same application I can verify the document. So, my spider senses tell me that, there is a problem with signing.
4. Again if I move the document Signed_A to Windows 7 machine, I could not verify the signature.
I don't know whether the situation is occur because of the difference of processors on machines. But if you have anything that can help me please let me know. Anything could be helpful for now because I'm stuck in here.
Please feel free to ask if you need further explanations. I am not providing any code, because I am suspecting a configuration issue here.
Thanks in advance.

Hi,
Can you tell me about your project on short notes. For information.
Regards
R.Rajendran

Windows cannot verify the digital signature for the drivers required for this device. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. (Code

I get this message when I check the Device manager for my Ipod
Windows cannot verify the digital signature for the drivers required for this device. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. (Code 52)
How do I resolve this I have reinstalled iTunes but it still doesn't recognise my ipod

I reinstalled Itunes a couple of times. I unistalled all programs that I never use, I updated all of my drivers, Windows swept my computer and found no problems. I have a yellow causion lite when I look at the USB-port with the phone connected. All other devices work without a problem.

How can I add document signatures to a dynamic table?

I have a table where I am adding rows dynamically by adding a + or - button to add or remove rows to add to the table.
Right now I have a name field and an e-sign field. The problem I am having is that the document signature cannot be repeatable/ needs to be unique and so cannot be added to a dynamic table? Is there a work around for this?
Ultimately what I want is to have a PDF form look like below:
+ -
First Name | Last Name | Signature
First Name | Last Name | Signature
When the user clicks on + from the form above, then it just adds a new row like:
+ -
First Name | Last Name | Signature
First Name | Last Name | Signature
First Name | Last Name | Signature
Problem is the e-signature is a new instance and it says it cannot be repeatable? I want these to be different signatures but on one form to be added dynamically. Does this make sense? How can I do this?

I have a table where I am adding rows dynamically by adding a + or - button to add or remove rows to add to the table.
Right now I have a name field and an e-sign field. The problem I am having is that the document signature cannot be repeatable/ needs to be unique and so cannot be added to a dynamic table? Is there a work around for this?
Ultimately what I want is to have a PDF form look like below:
+ -
First Name | Last Name | Signature
First Name | Last Name | Signature
When the user clicks on + from the form above, then it just adds a new row like:
+ -
First Name | Last Name | Signature
First Name | Last Name | Signature
First Name | Last Name | Signature
Problem is the e-signature is a new instance and it says it cannot be repeatable? I want these to be different signatures but on one form to be added dynamically. Does this make sense? How can I do this?

Document Signature Field

How can I use a button to popup the Sign Document (certificate selection screen) similiar to how it is done with the Document Signature Field? Basically, do what the document signature field does but with a button instead?

I forgot to mention one other item. If for some reason it is not possible to do this with a button, is it possible to disable or set to readonly the control?

Document SIgnature Status becomes invalid after resigning

Hi all,
I have a form with two Document Signature.
When i clear and resign one of the Document Signature it status is invalid.
Please suggest me a solution.
Regards,
S.V.Satish Kumar

I tested the form you posted. Here is what I found, but I am not completely clear on what all your script is supposed to be doing.
Steps
1) I filled in the first "comment line"
2) I signed the first signature field
3) Results: The signature was valid, the document status (see screen shot 1signature_docstatus.gif) reported the signature was valid. The signature staus was valid as displayed in the signature panel (see screen shot 1signature_detail.gif)
4) I added and filled in a second "comment line"
5) I signed the second signature field
6) Results: The first signature was valid, the second signature was valid, and the document status repored that ther were "unsigned changes" since the last signature was applied (see screen shot 2signature_docstatus.gif) The signature statuses were valid with subsequent changes made to the document as displayed in the signature panel (see screen shot 2signature_detail.gif)
Don't confuse the "exclamation" mark icon with "Invalid", it is only a warning to inform you that changes have been made that are not "digitally signed", I suspect your some part of your script is causing this. If you want to have Acrobat\Reader display a green check mark icon, then you cannot make any changes to the document after the final signature has been applied.
If you haven't done so, take a look at the sample I posted on your duplicate post in this forum ( http://forums.adobe.com/thread/492773?tstart=0 ).
If a signature is "invalid" it will display a red "X" icon.
Regards
Steve

Apache Openoffice document connector in sharepoint

We have used Apache OpenOffice document in our SharePoint server.
Is there any way to open or edit OpenOffice, like Microsoft Office documents?
We have found Oracle provide the solution for SharePoint and OpenOffice connector extension.
But this is not a free. Any open source available for this?
Jey

Hi,
Open Office does not have the SharePoint ActiveX controls that ship with Office,
so they're unable to use the direct save to SharePoint functionality that Office has.
As a workaroud, you can try to open the document library in Windows Explorer view, and double click the document to open in Windows Explorer view.
What’s more, iFilterShop provides and iFilter for OPenOffice Documents in SharePoint, you can have a look at.
http://www.ifiltershop.com/sofilter.html
More information:
http://social.technet.microsoft.com/Forums/en-US/9ebdbf86-1715-46c4-882b-5f2cd02abaa0/using-openoffice-to-edit-and-save-documents-to-sharepoint-2010?forum=sharepointgeneralprevious
http://sharepoint.stackexchange.com/questions/23745/openoffice-sharepoint-2010-and-office-webapps
Thanks & Regards,
Jason
Jason Guo
TechNet Community Support

Document Signatures and Submiting via email

Hi,
My issue involves submitting an email and populating a document signature.
Using javascript I've set the preSubmit field to have the following line of code:
Page1.SignatureField1.validate.nullTest = "error";
I've enabled in Acrobat Professional 8, Enable Usage Rights.
While testing the form, when I select Submit by Email I get the error saying that "At least one required field was empty on export. Please fill in the required fields (highlighted) before continuing."
All well and good as this is what I want to occur.
The problem is once I sign the the document (which is the field that I've set to be validated in the above code), then click submit via email again I still get the above error message.
I tested this with the other objects such as text fields etc, they all work fine. The problem only occurs while trying to use a document signature field.
What am I doing wrong?

You need to remember the password, Adobe software does not offer any back door or password recovery for the creator.
It is recommended that, when setting certain things for a PDF, you keep the "before" file carefully as well as the "after". These things include security, reader extensions and signatures - all things that can be impossible to undo.

Open the OpenOffice document in Internet explorer

How to open the OpenOffice Document in Internet explorer using core java?

the only ideas that I can give you are...
applet
and look at the OpenOffice SDK.

Digital Signature in Document Signature field slow

The business requirement is for users to digital sign a Dynamic PDF. Digital ID's are created using Advanced - Security Settings - Digital ID - Add ID - Create a self-signed digital ID for use with Acrobat - New PKCS#12 digital ID , from Adobe Professional.
In the PDF, the user clicks in a Document Signature field to sign the document. It takes a VERY long time for this signature process to complete.
is there a trick I am missing? Is the slowness due to the way the digital ID was created?

Unfortunately, I cannot forward the form as it contains client data.
I have tested signing another PDF I've created with 2 fields using the same the digital ID's, and the process completed quickly.
Perhaps the problem lies with the size of my form which has 20 pages with 50 fields (on average) per page.
When signing the document, the signature details appear, the "saving file" temporary status bar appears and THEN the hourglass kicks in and takes 5 minutes before control is returned. Is there validation particular to the signing process I can disable? Alternatively, can I specify which pages are certified instead of the entire document?

How to verify whether the signature is updated?

How to verify whether the signature of anti-spam and anti-virus is updated??

If you are at the CLI and use antivirusstatus it also shows when the last update was done and when the last successfully was done. When it was successful the pattern are up to date.
Same it true for antispam (antispamstatus)
Best Regards,
Mark

Samba decode_pac_data: failed to verify PAC server signature

i have an os x server 10.6.3 bound in AD as Only Samba Fileserver
when a user connect to a share write the sambalog an error
decodepacdata: failed to verify PAC server signature
what is that ?
thx

Hi ejp,
It strips out marks headers such as sstrTxt: TXT: "g=*; k=rsa; t=y; p=
and gives me a bare public key.
For example, the output for public key without the replaceAll call gives me:
strTxt: TXT: "g=*; k=rsa; t=y; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCg8yo6rDhsNiwUfVR37HgF4bWqoG13Nd9XLT+Z0VLzCkWJZOdzGNQnnm7ujoQ8gbxeDvIo9RG5I3eZteBwD91Nf6P/E9lvJQDL2Qnz4EXH/CVW9DeEfvY1UJN9kc6q6KkYEPWssvVvlDOp2slbEKZCJtaPvVuGCAqfaps8J0FjOQIDAQAB"
Output for public key with the replaceAll call gives me:
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCg8yo6rDhsNiwUfVR37HgF4bWqoG13Nd9XLT+Z0VLzCkWJZOdzGNQnnm7ujoQ8gbxeDvIo9RG5I3eZteBwD91Nf6P/E9lvJQDL2Qnz4EXH/CVW9DeEfvY1UJN9kc6q6KkYEPWssvVvlDOp2slbEKZCJtaPvVuGCAqfaps8J0FjOQIDAQAB

The document signature field is repeatable

Hi!
I use signature fields in dynamic forms in Acrobat 7 without problems. In Reader and Acrobat 8 signature field is not displayed and in designer there is a warning that is it problem "The document signature field is repeatable" ...
Does someone know how to workaround this "feature", please?
Thanks,
--- Jaroslav

I forgot to mention one other item. If for some reason it is not possible to do this with a button, is it possible to disable or set to readonly the control?

Verifying OpenOffice document signature

Similar Messages

Maybe you are looking for