Digital Signatures and PDF Documents

1/26/2011 By Frank 0 comments

Digital signatures can be used to authenticate the source of a PDF document (who signed it?) and to provide the integrity of a PDF document (did the document change after it was signed?). In this article I will show how to apply one or more digital signatures and how to verify digital signatures using PDFKit.NET 3.0.

Signing

Consider the following form:

pdf-form-before-digital-signature.png

This form has two sections of form fields; one for the student and one for the teacher. Normally, first the student will fill out his portion and sign the document. This can be achieved programmatically as follows:

1 // ------------------------------------------- 2 // STUDENT FILLS OUT FIELDS AND SIGNS DOCUMENT 3 // ------------------------------------------- 4 5 using (FileStream sourceFile = new FileStream( 6 "form.pdf", FileMode.Open, FileAccess.Read)) 7 { 8 // open the form 9 Document document = new Document(sourceFile); 10 11 // fill out the data fields 12 TextField projectNr = document.Fields["projectNumber"] as TextField; 13 projectNr.Value = "FF-235"; 14 15 TextField sName = document.Fields["studentName"] as TextField; 16 sName.Value = "Bob Stapleton"; 17 18 TextField sDate = document.Fields["studentDate"] as TextField; 19 sDate.Value = "April 18, 2007"; 20 21 // retrieve the signature field 22 SignatureField sigField = document.Fields["studentSignature"] 23 as SignatureField; 24 25 // open certicate store. 26 Pkcs12Store store = null; 27 using (FileStream storeFile = new FileStream( 28 "BobStapleton.pfx", FileMode.Open, FileAccess.Read)) 29 { 30 store = new Pkcs12Store(storeFile, "studentpassword"); 31 } 32 33 // let the factory decide which type should be used. 34 SignatureHandler handler = StandardSignatureHandler.Create(store); 35 36 // associate the handler with the signature field 37 sigField.SignatureHandler = handler; 38 39 // set optional info. 40 sigField.ContactInfo = "+31 (0)77 4748677"; 41 sigField.Location = "The Netherlands"; 42 sigField.Reason = "I hereby declare!"; 43 44 // save the signed document - while saving, the handler 45 // will be called to sign the saved content 46 using (FileStream outFile = new FileStream( 47 "signedByStudent.pdf", FileMode.Create, FileAccess.ReadWrite)) 48 { 49 document.Write(outFile); 50 } 51 }

After executing the code above and opening the PDF document in the PDF reader, the document looks as follows:

pdf-form-after-digital-signature.png

Note the question mark as shown by the PDF reader. This means that the certificate has not yet been trusted by the client machine. This is simply a matter of adding the certificate to the trust store.

Next, the teacher will review the student's data and then fill out the final fields and sign it. This can be achieved programmatically as follows:

1 // ----------------------------------------------------- 2 // TEACHER FILLS OUT FINAL FIELDS AND SIGNS THE DOCUMENT 3 // ----------------------------------------------------- 4 5 using (FileStream sourceFile = new FileStream( 6 "signedByStudent.pdf", FileMode.Open, FileAccess.Read)) 7 { 8 // open the form 9 Document document = new Document(sourceFile); 10 11 // fill out the data fields 12 TextField tName = document.Fields["teacherName"] as TextField; 13 tName.Value = "Max Boulton"; 14 15 TextField tDate = document.Fields["teacherDate"] as TextField; 16 tDate.Value = "April 18, 2007"; 17 18 // retrieve the signature field 19 SignatureField sigField = document.Fields["teacherSignature"] 20 as SignatureField; 21 22 // open certicate store. 23 Pkcs12Store store = null; 24 using (FileStream storeFile = new FileStream( 25 "MaxBoulton.pfx", FileMode.Open, FileAccess.Read)) 26 { 27 store = new Pkcs12Store(storeFile, "teacherpassword"); 28 } 29 30 // let the factory decide which type should be used. 31 SignatureHandler handler = StandardSignatureHandler.Create(store); 32 33 // associate the handler with the signature field 34 sigField.SignatureHandler = handler; 35 36 // set optional info. 37 sigField.ContactInfo = "+31 (0)77 4748677"; 38 sigField.Location = "The Netherlands"; 39 sigField.Reason = "I hereby declare!"; 40 41 // save the signed document - while saving, the handler 42 // will be called to sign the saved content 43 using (FileStream outFile = new FileStream( 44 "signedByTeacher.pdf", FileMode.Create, FileAccess.ReadWrite)) 45 { 46 document.Write(outFile, DocumentWriteMode.AppendUpdate); 47 } 48 }

If you look at the code, it is practically the same as the previous code sample. The only significant difference is that I pass an extra argument to the Document.Write method: DocumentWriteMode.AppendUpdate. This tells PDFKit.NET to save all changes as a so-called Update. I will discuss this in the next section.

After executing the code above and opening the PDF document in the PDF reader, the document looks as follows:

pdf-form-after-digital-signature-final.png

Note that the icon of the first signature has changed to a warning sign. This indicates that "the document has been updated since signed". This is exactly the case.

Updates

Note that when we saved the second signature, we passed an extra argument to Document.Write, namely DocumentWriteMode.AppendUpdate. This instructs PDFKit.NET to save the new field data and the signature as an Update. This means that the original PDF data is left entirely intact and the changes are concatenated. The figure below illustrates this.

pdf-form-adding-two-digital-signatures.png

Consequently, the first signature remains valid because the exact data that was signed hasn't changed; we have just added an update.

So after saving the update there are now in fact two versions of the document; one that signed by the student and one that was signed by the teacher. It is useful to retrieve the exact document to which a given signature was applied. Obviously the signer only vows for that version and not for the versions that were created afterwards.

Given a document you can enumerate all updates or versions of the document and save a copy to disk as follows:

1 // ---------------------------------------------------- 2 // ENUMERATE UPDATES IN DOCUMENT THAS BEEN SIGNED TWICE 3 // ---------------------------------------------------- 4 5 using (FileStream sourceFile = new FileStream( 6 "signedByTeacher.pdf", FileMode.Open, FileAccess.Read)) 7 { 8 // open the form 9 Document document = new Document(sourceFile); 10 11 // count the number of updates 12 Console.WriteLine( "This document has {0} updates.", 13 document.Updates.Count ); 14 15 // save each update as a new PDF document 16 foreach (Update update in document.Updates) 17 { 18 string name = string.Format( 19 "signedByTeacher_{0}.pdf", update.Index ); 20 using (FileStream updateFile = new FileStream( 21 name, FileMode.Create, FileAccess.Write)) 22 { 23 update.Write(updateFile); 24 } 25 } 26 }

But perhaps even more interesting, you can open a signed document and per signature field you can retrieve the signed update. The following code sample enumerates all signature fields and saves the signed update.

1 // ----------------------------------------------------------- 2 // ENUMERATE SIGNATURE FIELDS AND SAVE SIGNED UPDATE PER FIELD 3 // ----------------------------------------------------------- 4 5 using (FileStream sourceFile = new FileStream( 6 "signedByTeacher.pdf", FileMode.Open, FileAccess.Read)) 7 { 8 // open the form 9 Document document = new Document(sourceFile); 10 11 foreach (Field field in document.Fields) 12 { 13 // is this a signature field? 14 SignatureField sigField = field as SignatureField; 15 if (null != sigField) 16 { 17 // has it been signed? 18 if (sigField.IsSigned) 19 { 20 // save the update and name it after the field 21 string name = string.Format( 22 "{0}.pdf", sigField.FullName); 23 using (FileStream updateFile = new FileStream( 24 name, FileMode.Create, FileAccess.Write)) 25 { 26 sigField.SignedUpdate.Write(updateFile); 27 } 28 } 29 } 30 } 31 }

After executing this code, two new PDF documents have been saved: studentSignature.pdf and teacherSignature.pdf. Each document shows the version that was signed by the respective field.

Verifying

Until now we have discussed signing documents. The verification was left to the PDF reader application. But PDFKit.NET also allows you to verify signatures programmatically. This is extremely simple as shown in the next code sample. The sample opens the PDF document that was signed by the student and the teacher and enumerates the signature fields. Per signature, information about the signature state is written to the console.

1 // ---------------------------------- 2 // DUMP STATE OF EACH SIGNATURE FIELD 3 // ---------------------------------- 4 5 using (FileStream inFile = new FileStream( 6 "signedByTeacher.pdf", FileMode.Open, FileAccess.Read)) 7 { 8 // open form 9 Document document = new Document(inFile); 10 11 foreach (Field field in document.Fields) 12 { 13 // is this a signature field? 14 SignatureField sigField = field as SignatureField; 15 if (null != sigField) 16 { 17 Console.WriteLine("Field '{0}'", sigField.FullName); 18 19 // has it been signed? 20 if (sigField.IsSigned) 21 { 22 // verify, based on the default handlers. 23 bool verified = sigField.Verify(); 24 Console.WriteLine(" -- {0}", verified ? 25 "Verified" : "Not verified"); 26 27 if (verified) 28 { 29 // has the document been modified after signing? 30 bool modified = sigField.DocumentModifiedAfterSigning; 31 Console.WriteLine(" -- {0}", modified ? 32 "Modified after signing" : 33 "Not modified after signing"); 34 } 35 } 36 else 37 { 38 Console.WriteLine(" -- Not signed", sigField.FullName); 39 } 40 } 41 } 42 }

After executing the above code, the following is written to the console:

sign-pdf-trough-console.png

By the way, Adobe has changed the icons for the different signature states across its Acrobat versions. The screenshots in this article are from Acrobat 8.0.


No comments yet.

Speak up!

Your email address will never be published or shared.