Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feature: Only validate a signature in signed PDF document #140

Open
Mato-Z opened this issue Dec 31, 2022 · 0 comments
Open

Feature: Only validate a signature in signed PDF document #140

Mato-Z opened this issue Dec 31, 2022 · 0 comments

Comments

@Mato-Z
Copy link

Mato-Z commented Dec 31, 2022

Hello. Would be possible add option only for validate a signature/signed PDF document? Output would be some log file with result of validation.
For example:

  • The overall result of the verification.
  • Common cryptographically evaluation like: Cryptographically valid signature or not from the reason...
  • Informs whether the signature is verified at the time of the time stamp (primarily), at the current moment, or at the time inserted into the PDF file by the system where the signature was added.
  • Signature format of the PDF file PKCS#7/AdES-PAdES (compliance with EU eIDAS) if AdES is used what type: BASELINE_B, BASELINE_T, BASELINE_LT, BASELINE_LTA, simillary with PKCS#7_B,T etc.
  • A list of information available from the signature certificate, for example who signed the document, from which organization, contacts, serial number of the certificate, etc.
  • Who is the issuer of the certificate and some information about this issuer.
  • Information on whether the certification authority that issued the certificate is on the EUTL list, and thus whether it is qualified (publicly available information from this source.)
  • From when to when the certificate is valid.
  • Revocation information mainly OCSP, possibly CRL e.g. certificate statement was verified/certificate was revoked/verification failed due to ...
  • Time stamp verification, the time stamp was issued by a trusted - qualified authority on the EUTL list? (publicly available information from this source.)
  • Does the timestamp have a valid certificate? And from when to when it is valid...
  • Has the timestamp certificate not been revoked? (OCSP/CRL)

The program has already implemented most of the functions, the rest consist mainly of checking publicly available lists (For example Adobe use it too). I think that open-source DSS demo already implemented some of these too.
Many thanks for your consideration.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant