Hi!
My name is Cristian, I'm a undergrad researcher from Brazil, and I'm studying digital signatures, and now taking an special look into PDF signatures. I've read a lot of documentation about it, have a good understanding about the "inside" of PDF signature and now I'm working on solutions for some "real world" problems we need to take care here.
Ok, let's go to the main one that we aren't managing to solve, maybe someone can give me some help:
I'm dealing with many documents (and I mean *really* many documents) signed using simple PDF signatures. But in some months or in a year the signer certificates are going to expire. But the signature MUST still be valid after that, they are important documents and should be verifiable for many years from now. Don't blame me for not using time stamps, I was not the one who signed this documents, I'm the one who needs to solve this problem ;)
The solution was pretty obvious: let's time stamp them all now... Time stamp is an unsigned PKCS#7 attribute, I can add it whenever I want. But then I found out another obvious problem: The space where I can put the modified PKCS#7 is fixed, defined by /ByteRange. Adobe and many other signers make a worse case calculation to define the /Contents size, and that means that in signed documents we have some space left for extra info, but in all this documents, it is less space than we need to add a time stamp.
So, the idea is not bad at all, I've validated it making my own signed PDFs with huge /Contents space and have demonstrated that I can add a time stamp later with no prejudice to signature validation. But unfortunately it will not help at all with the real world problem I'm dealing with.
For "judicial" purpose, I can just counter-sign all this document (none is certified, all are just signed) with incremental add of a new signature, and put a time stamp on this signatures. Theoretically, the second time stamp also ensures that the first signature was made on a valid period of time. But Adobe Reader does not see that :(
So, anyone can see a solution for that? What can we do, to keep using adobe reader as a validator? My best shot for now is use the counter-sign idea and implement a separate validator to deal with old signatures validation, using the second time stamp as a proof of existence of the first signature in a safe time.
