Computing byte range digest

1
votes

I'm building an app that lets user digitally sign a PDF. I'm using plugPDF SDK. It has no built in support for generating byte range digest so I have to do it myself. PlugPDF generates the PDF content from which I generate signed hash in Terminal:

openssl dgst -hex -sha256 -sign privateKey.pem -out encrypted.out invoice.content

From this hash I generate the PKCS#7 object:

openssl cms -in encrypted.out -sign -signer signer.pem -outform der -out cert.p7b

Then I inject it into the PDF using the plugPDF SDK. When I open it in Adobe Acrobat the PDF is signed but the signature is invalid. It says: “The Document has been altered or corrupted since the Signature was applied.”

I assume the problem is wrong hash value but I have no idea how else to generate it.

Here's an example tutorial: https://plugpdf.com/how-to-sign-pdf-document-with-pki-certificate-on-ios/

1
iosxcodepdfopenssldigital-signature

1 Answers

0
votes

The byte range digest for PDFs typically exclude the area of the PDF where the signature will be injected, so that the digest value should be the same before and after adding the signature. If they are not the same, then the assumption is that the file has been in some way modified since being signed.

It doesn't look like openssl's dgst command allows you to specify discontinuous byte ranges.