3 ms·

Cool. So it seems like PDF signatures are broken by design, not just implementation. If you can just append unsigned content to a signed PDF, you are toast. In

Cool. So it seems like PDF signatures are broken by design, not just implementation. If you can just append unsigned content to a signed PDF, you are toast. Interestingly, Adobe has created a cottage industry of certificate providers and has strict security requirements like use of HSMs to prevent private keys from being exposed. As you can imagine, these certificates are stupidly expensive for what they do.

leni536 8y ago
Well, Adobe Reader 9 seems to catch all three attacks. Maybe the design is dumb but it can be saved: Don't accept a signature that excludes anything from hashing except the signature and certificates itself. Although I hope that visual elements can't reference into the byte range of the signature/certificates.
wbond 8y ago
From looking at the table at the end of the article, it would seem it is difficult to get PDF signature verification completely correct, but it is possible. That said, having worked on PDF signature generation in the past, the spec is very complicated, partially due to the structure of PDF documents and how they can be appended, including signed additions.
- blattimwind 8y ago
  PDF Signatures violate the The Cryptographic Signature Doom Principle, which is that your signing scheme will lead to doom unless the signature wraps the entirety of your document's binary representation. Same for XML signatures. Violating the TCSDP doesn't mean that your scheme is technically wrong, but it does mean that implementations will often be wrong in funny ways.
  - jessaustin 8y ago
    "the The" It's so important it requires two articles.
- dunham 8y ago
  Especially complicated if you want the "LTV" thing to show up in Acrobat. As far as I could determine (I've done it and acrobat is happy), it requires fetching and embedding the necessary CRLs for the TSA (timestamp authority) cert chain before getting the signature, but you don't have the certs with the CRL urls until after you get the signature. And the URLs can change over time (our TSA just switched its cert chain, but they did notify us ahead of time).
arethuza 8y ago
I think you can use pretty much any certificate to sign PDFs - there is a separate option to certify PDFs that does indeed require special certificates and use of HSMs: https://helpx.adobe.com/acrobat/using/certificate-based-signatures.html#certifying_and_signing_documents https://helpx.adobe.com/acrobat/using/certificate-based-sign... Edit: As an aside, it is amazing the number of people who think that PDFs can't be edited (and are amazed when even MS Word can do it these days).
rauhl 8y ago
> Cool. So it seems like PDF signatures are broken by design, not just implementation. If you can just append unsigned content to a signed PDF, you are toast. I don’t know that I’d say that. Seems like it'd be useful behaviour to be able to make post-signature modifications so long as it’s clear what they are. As a concrete example, it’s the obvious way to implement a documented contractual negotiation: party A drafts a contract & signs it, then party B makes modifications & signs the bundle of (original contract, signature, modifications), then party A countersigns party B’s modifications & signature, indicating acceptance. Or maybe I’m missing something?
- arethuza 8y ago
  I seem to remember that you could amend a signed PDF and add stuff to add a white rectangle over something you want to change (e.g. a pass/fail entry) and then stick in the new text over the rectangle. The original text was there, and hadn't been modified so the signature was still valid, but the superficial appearance of the document was misleading even if it was possible to identify the tampering if you knew what to do (which I suspect 99.9% of people reading PDFs would never bother doing).
  - rauhl 8y ago
    Yeah, that would be bad — hence my proviso ‘so long as it’s clear what [the post-signature modifications] are.’ If modifications aren’t clearly called out, then that’s a (bad) bug in the viewer.
    - arethuza 8y ago
      I think that's where certification was supposed to come in (its been 10+ years since I worked with this stuff so my recollection is a bit vague) - you create the main structure of the document and then lock that down with certification and allow people to complete existing fields, including adding signatures.
- IgorPartola 8y ago
  The issue isn't the functionality, it's the design of the format. This design will lead to an endless slew of possible attacks. It is just a poor way of doing things. What you want is to sign the whole file. It looks like the design here is a hack using the existing PDF format instead of adding a container to the PDF. If you want multiple parties signing the same document, you should have a container that allows you to append additional signatures to the container. The idea that you need to have a squiggly line inside the PDF to show that it's valid is really dumb in this context anyways. Instead the PDF reader should show you that "@raul signed this document on 2019-03-06 at 11:47:55 EST, here is his GPG signature", and that's it. No squiggly lines needed.
JorgeGT 8y ago
> these certificates are stupidly expensive for what they do Not everywhere, in my country you can get them for free, from institutional CAs included in the EU Trusted Lists that Adobe trusts: https://ec.europa.eu/digital-single-market/en/eu-trusted-lists-trust-service-providers https://ec.europa.eu/digital-single-market/en/eu-trusted-lis...
ct520 8y ago
>As you can imagine, these certificates are stupidly expensive for what they do. For US based certificate looking at - $2000~ for 10k signing via entrust trusted adobe cert. Not cheap correct

leni536 8y ago

Well, Adobe Reader 9 seems to catch all three attacks. Maybe the design is dumb but it can be saved: Don't accept a signature that excludes anything from hashing except the signature and certificates itself. Although I hope that visual elements can't reference into the byte range of the signature/certificates.

wbond 8y ago

From looking at the table at the end of the article, it would seem it is difficult to get PDF signature verification completely correct, but it is possible. That said, having worked on PDF signature generation in the past, the spec is very complicated, partially due to the structure of PDF documents and how they can be appended, including signed additions.

blattimwind 8y ago
PDF Signatures violate the The Cryptographic Signature Doom Principle, which is that your signing scheme will lead to doom unless the signature wraps the entirety of your document's binary representation. Same for XML signatures. Violating the TCSDP doesn't mean that your scheme is technically wrong, but it does mean that implementations will often be wrong in funny ways.
- jessaustin 8y ago
  "the The" It's so important it requires two articles.
dunham 8y ago
Especially complicated if you want the "LTV" thing to show up in Acrobat. As far as I could determine (I've done it and acrobat is happy), it requires fetching and embedding the necessary CRLs for the TSA (timestamp authority) cert chain before getting the signature, but you don't have the certs with the CRL urls until after you get the signature. And the URLs can change over time (our TSA just switched its cert chain, but they did notify us ahead of time).

arethuza 8y ago

I think you can use pretty much any certificate to sign PDFs - there is a separate option to certify PDFs that does indeed require special certificates and use of HSMs: https://helpx.adobe.com/acrobat/using/certificate-based-signatures.html#certifying_and_signing_documents https://helpx.adobe.com/acrobat/using/certificate-based-sign... Edit: As an aside, it is amazing the number of people who think that PDFs can't be edited (and are amazed when even MS Word can do it these days).

rauhl 8y ago

> Cool. So it seems like PDF signatures are broken by design, not just implementation. If you can just append unsigned content to a signed PDF, you are toast. I don’t know that I’d say that. Seems like it'd be useful behaviour to be able to make post-signature modifications so long as it’s clear what they are. As a concrete example, it’s the obvious way to implement a documented contractual negotiation: party A drafts a contract & signs it, then party B makes modifications & signs the bundle of (original contract, signature, modifications), then party A countersigns party B’s modifications & signature, indicating acceptance. Or maybe I’m missing something?

arethuza 8y ago
I seem to remember that you could amend a signed PDF and add stuff to add a white rectangle over something you want to change (e.g. a pass/fail entry) and then stick in the new text over the rectangle. The original text was there, and hadn't been modified so the signature was still valid, but the superficial appearance of the document was misleading even if it was possible to identify the tampering if you knew what to do (which I suspect 99.9% of people reading PDFs would never bother doing).
- rauhl 8y ago
  Yeah, that would be bad — hence my proviso ‘so long as it’s clear what [the post-signature modifications] are.’ If modifications aren’t clearly called out, then that’s a (bad) bug in the viewer.
  - arethuza 8y ago
    I think that's where certification was supposed to come in (its been 10+ years since I worked with this stuff so my recollection is a bit vague) - you create the main structure of the document and then lock that down with certification and allow people to complete existing fields, including adding signatures.
IgorPartola 8y ago
The issue isn't the functionality, it's the design of the format. This design will lead to an endless slew of possible attacks. It is just a poor way of doing things. What you want is to sign the whole file. It looks like the design here is a hack using the existing PDF format instead of adding a container to the PDF. If you want multiple parties signing the same document, you should have a container that allows you to append additional signatures to the container. The idea that you need to have a squiggly line inside the PDF to show that it's valid is really dumb in this context anyways. Instead the PDF reader should show you that "@raul signed this document on 2019-03-06 at 11:47:55 EST, here is his GPG signature", and that's it. No squiggly lines needed.

JorgeGT 8y ago

> these certificates are stupidly expensive for what they do Not everywhere, in my country you can get them for free, from institutional CAs included in the EU Trusted Lists that Adobe trusts: https://ec.europa.eu/digital-single-market/en/eu-trusted-lists-trust-service-providers https://ec.europa.eu/digital-single-market/en/eu-trusted-lis...

ct520 8y ago

>As you can imagine, these certificates are stupidly expensive for what they do. For US based certificate looking at - $2000~ for 10k signing via entrust trusted adobe cert. Not cheap correct