5 ms·

How to Break PDF Signatures

50 points by hannob 8y ago

vxNsr 8y ago
Well this is bad news for everyone.
weinzierl 8y ago
I used to love PDF but the more time passes the more I think it is broken beyond any repair. HTML/CSS/JS covers almost any usecase. Then there is ePub (kind of HTML.. anyway) for eBooks, CBR for Comics, DJVU for scanned content and so on. There probably is a better format for any niche usecase you can imagine.
- schoen 8y ago
  What would you suggest for downloading technical documentation, legislation, court decisions, and academic papers?
  - weinzierl 8y ago
    Why would you want to download it in the first place? You can read the documents in your browser just fine and chances are you will be reading the PDFs in the browser anyway. If you insist to download and archive it DJVU is fine for the documents you mentioned because it contains rendered graphics as well as searchable text. ePub is another option if you need vector images and outline fonts. I give you the point about academic papers because math in the browser is subpar. I would have written "still subpar" but I think that is what I have been saying for at least ten years now - I'm not sure there is any hope. On the other hand I often read papers on my mobile and it is not as convenient as reading the web. Especially the two column layout that many papers have is a nuisance. I wish there was a way to distribute papers with beautiful math and reflowable text.
    - deogeo 8y ago
      > Why would you want to download it in the first place? You can read the documents in your browser just fine Because you don't want it to 404 on you after a year or two.
      - weinzierl 8y ago
        If that is your concern: "Save as..." works pretty well in modern browsers. I use Zotero for organizing the documents I want to keep and that works pretty well too. I'm sure there are other options, offline (like Zotero) or cloud based. And there are always archive.org and archive.is...
- saagarjha 8y ago
  > HTML/CSS/JS covers almost any usecase. This doesn't cover the usecase of something that looks the same across different systems.
  - weinzierl 8y ago
    DJVU satisfies that requirement perfectly while PDF doesn't. If you don't embed all your fonts into the PDF it will look different on different systems and even if you do: as long as font rendering happens on the target system you will never get 100% pixel perfectly the same output.
    - saagarjha 8y ago
      I haven't use DjVu very much, but as far as I was aware it doesn't store vector data?
      - weinzierl 8y ago
        No it doesn't but vector data involves rendering on the target system and this leads to unavoidable differences between the output of different rendering systems. DJVU avoids this because it contains bitmaps. If small differences are no problem ePub is an option.
        jsiepkes 8y ago
        DjVI was specifically designed to contain scanned documents. It was never designed for documents which were digitally authored. Using a rasterized technique is certainly not a good idea in an era where the DPI of screens is increasing. Also since PDF is the standard in the printing industry I think we can safely say the margin of differences is so small they are non existent.
        weinzierl 8y ago
        As in ssid, use ePub if you need vector. If you need something that will be displayed the same under any conceivable circumstances, and still will be in many years, consider DJVU. I see DJVU mainly as a viable alternative for archiving, where people usually use PDF/A or TIFF (yes some still archive everything as TIFF).
- gowld 8y ago
  PDF consistently generates documents that anyone can see and verify the content. HTML/CSS/JS change the content different depending on how you look at them and with which tools.
  - weinzierl 8y ago
    > PDF consistently generates documents that anyone can see and verify the content. You cannot rely on that. PDF combined with font and vector graphics rendering is just an insanely complex beast and there is lots of trickery that can change the appearance of the document. For example there is a font that changes its characters with font size and therefore zoom level. When it comes to verification: see OP how well that works. If you want verifieable content use plain text and bitmaps. Really that's your best bet.
xvilka 8y ago
Choice of Linux PDF viewers is very strange[1] - basically, no open source viewers listed. [1] https://www.pdf-insecurity.org/signature/viewer.html https://www.pdf-insecurity.org/signature/viewer.html
- weinzierl 8y ago
  Does any of them support signature verification at all? Last time I checked there was pdfsig and that was it.
  - johnisgood 8y ago
    I think mupdf supports it if you compile it with that feature enabled, and I also heard about "mutool sign", which is supposed to be able to sign and verify, but I never used it. In fact, I don't even have the binary for some reason. I will try to compile mupdf from scratch now and see if it supports signatures properly. It would be good if it supported it right out of the box. Maybe some of their devs can clarify this. So... I compiled it and now I have mutool. I tried to run `mutool sign SampleSignedPDFDocument.pdf` and it gave me this output: verifying signature on page 1 result: '' The PDF I am using: https://blogs.adobe.com/security/SampleSignedPDFDocument.pdf https://blogs.adobe.com/security/SampleSignedPDFDocument.pdf I have no idea how I can format the output. Is there a way to use code blocks on here?
- hannob 8y ago
  Read the FAQ: https://www.pdf-insecurity.org/other/faq.html https://www.pdf-insecurity.org/other/faq.html Basically they tested almost everything you could think of, but none of the major open source viewers supports PDF signature verification in the first place.
adrianmonk 8y ago
Is this a flaw in the format or just bugs in implementations of viewers? Seems like it must just be fixable bugs. On the chart showing which viewers are vulnerable, some of them have no vulnerabilities. So in theory other viewers should be able to be fixed.
cmurf 8y ago
The article lists 'Adobe Acrobat Reader DC' for Linux but I don't see a Linux option at https://get.adobe.com/reader/otherversions/ https://get.adobe.com/reader/otherversions/ although there is an Android option, maybe there's a way to make that work on Linux, or use e.g. Windows 7 version of Acrobat with Wine. This page doesn't make it totally clear if the free reader is sane to use. https://appdb.winehq.org/objectManager.php?sClass=application&iId=847 https://appdb.winehq.org/objectManager.php?sClass=applicatio...
- amaccuish 8y ago
  *wouldn't recommend since it hasn't been updated in a long time ftp://ftp.adobe.com/pub/adobe/reader/unix/9.x/9.5.5/enu/

50 points by hannob 8y ago

Well this is bad news for everyone.

I used to love PDF but the more time passes the more I think it is broken beyond any repair. HTML/CSS/JS covers almost any usecase. Then there is ePub (kind of HTML.. anyway) for eBooks, CBR for Comics, DJVU for scanned content and so on. There probably is a better format for any niche usecase you can imagine.

schoen 8y ago
What would you suggest for downloading technical documentation, legislation, court decisions, and academic papers?
- weinzierl 8y ago
  Why would you want to download it in the first place? You can read the documents in your browser just fine and chances are you will be reading the PDFs in the browser anyway. If you insist to download and archive it DJVU is fine for the documents you mentioned because it contains rendered graphics as well as searchable text. ePub is another option if you need vector images and outline fonts. I give you the point about academic papers because math in the browser is subpar. I would have written "still subpar" but I think that is what I have been saying for at least ten years now - I'm not sure there is any hope. On the other hand I often read papers on my mobile and it is not as convenient as reading the web. Especially the two column layout that many papers have is a nuisance. I wish there was a way to distribute papers with beautiful math and reflowable text.
  - deogeo 8y ago
    > Why would you want to download it in the first place? You can read the documents in your browser just fine Because you don't want it to 404 on you after a year or two.
    - weinzierl 8y ago
      If that is your concern: "Save as..." works pretty well in modern browsers. I use Zotero for organizing the documents I want to keep and that works pretty well too. I'm sure there are other options, offline (like Zotero) or cloud based. And there are always archive.org and archive.is...
saagarjha 8y ago
> HTML/CSS/JS covers almost any usecase. This doesn't cover the usecase of something that looks the same across different systems.
- weinzierl 8y ago
  DJVU satisfies that requirement perfectly while PDF doesn't. If you don't embed all your fonts into the PDF it will look different on different systems and even if you do: as long as font rendering happens on the target system you will never get 100% pixel perfectly the same output.
  - saagarjha 8y ago
    I haven't use DjVu very much, but as far as I was aware it doesn't store vector data?
    - weinzierl 8y ago
      No it doesn't but vector data involves rendering on the target system and this leads to unavoidable differences between the output of different rendering systems. DJVU avoids this because it contains bitmaps. If small differences are no problem ePub is an option.
      - jsiepkes 8y ago
        DjVI was specifically designed to contain scanned documents. It was never designed for documents which were digitally authored. Using a rasterized technique is certainly not a good idea in an era where the DPI of screens is increasing. Also since PDF is the standard in the printing industry I think we can safely say the margin of differences is so small they are non existent.
        weinzierl 8y ago
        As in ssid, use ePub if you need vector. If you need something that will be displayed the same under any conceivable circumstances, and still will be in many years, consider DJVU. I see DJVU mainly as a viable alternative for archiving, where people usually use PDF/A or TIFF (yes some still archive everything as TIFF).
gowld 8y ago
PDF consistently generates documents that anyone can see and verify the content. HTML/CSS/JS change the content different depending on how you look at them and with which tools.
- weinzierl 8y ago
  > PDF consistently generates documents that anyone can see and verify the content. You cannot rely on that. PDF combined with font and vector graphics rendering is just an insanely complex beast and there is lots of trickery that can change the appearance of the document. For example there is a font that changes its characters with font size and therefore zoom level. When it comes to verification: see OP how well that works. If you want verifieable content use plain text and bitmaps. Really that's your best bet.

xvilka 8y ago

Choice of Linux PDF viewers is very strange[1] - basically, no open source viewers listed. [1] https://www.pdf-insecurity.org/signature/viewer.html https://www.pdf-insecurity.org/signature/viewer.html

weinzierl 8y ago
Does any of them support signature verification at all? Last time I checked there was pdfsig and that was it.
- johnisgood 8y ago
  I think mupdf supports it if you compile it with that feature enabled, and I also heard about "mutool sign", which is supposed to be able to sign and verify, but I never used it. In fact, I don't even have the binary for some reason. I will try to compile mupdf from scratch now and see if it supports signatures properly. It would be good if it supported it right out of the box. Maybe some of their devs can clarify this. So... I compiled it and now I have mutool. I tried to run `mutool sign SampleSignedPDFDocument.pdf` and it gave me this output: verifying signature on page 1 result: '' The PDF I am using: https://blogs.adobe.com/security/SampleSignedPDFDocument.pdf https://blogs.adobe.com/security/SampleSignedPDFDocument.pdf I have no idea how I can format the output. Is there a way to use code blocks on here?
hannob 8y ago
Read the FAQ: https://www.pdf-insecurity.org/other/faq.html https://www.pdf-insecurity.org/other/faq.html Basically they tested almost everything you could think of, but none of the major open source viewers supports PDF signature verification in the first place.

adrianmonk 8y ago

Is this a flaw in the format or just bugs in implementations of viewers? Seems like it must just be fixable bugs. On the chart showing which viewers are vulnerable, some of them have no vulnerabilities. So in theory other viewers should be able to be fixed.

cmurf 8y ago

The article lists 'Adobe Acrobat Reader DC' for Linux but I don't see a Linux option at https://get.adobe.com/reader/otherversions/ https://get.adobe.com/reader/otherversions/ although there is an Android option, maybe there's a way to make that work on Linux, or use e.g. Windows 7 version of Acrobat with Wine. This page doesn't make it totally clear if the free reader is sane to use. https://appdb.winehq.org/objectManager.php?sClass=application&iId=847 https://appdb.winehq.org/objectManager.php?sClass=applicatio...

amaccuish 8y ago
*wouldn't recommend since it hasn't been updated in a long time ftp://ftp.adobe.com/pub/adobe/reader/unix/9.x/9.5.5/enu/