Previous Next

                                            725
    SECTION 8.7                                                        Digital Signatures



8.7 Digital Signatures

    A digital signature (PDF 1.3) can be used to authenticate the identity of a user and
    the document’s contents. It stores information about the signer and the state of
    the document when it was signed. The signature may be purely mathematical,
    such as a public/private-key encrypted document digest, or it may be a biometric
    form of identification, such as a handwritten signature, fingerprint, or retinal
    scan. The specific form of authentication used is implemented by a plug-in signa-
    ture handler. Third-party handler writers are encouraged to register their handler
    names with Adobe; see Appendix E.

    Signature information is contained in a signature dictionary, whose entries are
    listed in Table 8.102. Signature handlers can use or omit those entries that are
    marked optional in the table but are encouraged to use them in a standard way if
    they are used at all. In addition, signature handlers may add private entries of
    their own. To avoid name duplication, it is suggested that the keys for all such pri-
    vate entries be prefixed with the registered handler name followed by a period ( . ).

    Signatures are created by computing a digest of the data (or part of the data) in a
    document, and storing the digest in the document. To verify the signature, the di-
    gest is recomputed and compared with the one stored in the document. Differ-
    ences in the digest values indicate that modifications have been made since the
    document was signed.

    There are two defined techniques for computing a reproducible digest of the con-
    tents of all or part of a PDF file:

    • A byte range digest is computed over a range of bytes in the file, indicated by the
      the ByteRange entry in the signature dictionary. This range is typically the en-
      tire file, including the signature dictionary but excluding the signature value it-
      self (the Contents entry). When a byte range digest is present, all values in the
      signature dictionary are required to be direct objects. See implementation note
      139 in Appendix H.
    • An object digest (PDF 1.5) is computed by selectively walking a subtree of ob-
      jects in memory, beginning with the referenced object, which is typically the
      root object. The resulting digest, along with information about how it was com-
      puted, is placed in a signature reference dictionary, whose entries are listed in
      Table 8.103. The TransformMethod entry specifies the general method used to
      compute the digest, and the TransformParams entry specifies the variable por-

Previous Next