获取要签名的PDF内容，然后稍后再签名

Question

我关注以下帖子：iTextSharp-如何获取PDF内容进行签名，然后在以后进行签名，作为从PDF文档获取数据的基础，创建一个带有空白签名的临时文件，然后返回该临时文件的哈希值。散列被发送到在本地拥有令牌的客户端，在那里对其进行签名，并返回到签名的web应用程序。此时，我将其转换为字节并生成最终的签名文档。

但是，签名的文档没有有效的签名，显示消息：Error in decoding BER。

1）生成临时文件的代码，添加空白签名并返回Base64编码哈希：

Public Shared Function GetBytesToSign(ByVal unsignedPdf As String, ByVal tempPdf As String, ByVal signatureFieldName As String) As String
    Using reader As PdfReader = New PdfReader(unsignedPdf)
        Using os As FileStream = File.OpenWrite(tempPdf)
            Dim stamper As PdfStamper = PdfStamper.CreateSignature(reader, os, vbNullChar)
            Dim appearance As PdfSignatureAppearance = stamper.SignatureAppearance
            appearance.SetVisibleSignature(New Rectangle(36, 748, 144, 780), 1, signatureFieldName)
            Dim external As IExternalSignatureContainer = New ExternalBlankSignatureContainer(PdfName.ADBE_PKCS7_DETACHED, PdfName.ADBE_PKCS7_SHA1)
            MakeSignature.SignExternalContainer(appearance, external, 8192)
            Dim Hash As Byte() = SHA256.Create().ComputeHash(appearance.GetRangeStream())
            Dim Base64 As String = Convert.ToBase64String(Hash)
            Return Base64
        End Using
    End Using
End Function

3）我接收签名哈希并将其转换为字节，生成最终的签名文件：

Public Shared Sub EmbedSignature(ByVal tempPdf As String, ByVal signedPdf As String, ByVal signatureFieldName As String, ByVal signedBytes As Byte())
    Using reader As PdfReader = New PdfReader(tempPdf)
        Using os As FileStream = File.Create(signedPdf)
            Dim external As IExternalSignatureContainer = New MyExternalSignatureContainer(signedBytes)
            MakeSignature.SignDeferred(reader, signatureFieldName, os, external)
        End Using
    End Using
End Sub

Partial Class MyExternalSignatureContainer
    Implements IExternalSignatureContainer

    Private ReadOnly signedBytes As Byte()

    Public Sub New(ByVal signedBytes As Byte())
        Me.signedBytes = signedBytes
    End Sub

    Public Function Sign(data As Stream) As Byte() Implements IExternalSignatureContainer.Sign
        Return signedBytes
        'Throw New NotImplementedException()
    End Function

    Public Sub ModifySigningDictionary(signDic As PdfDictionary) Implements IExternalSignatureContainer.ModifySigningDictionary
        Throw New NotImplementedException()
    End Sub
End Class

签名PDF

mkl,谢谢你回来

  Public Function GetBytesToSignNew(ByVal unsignedPdf As String, ByVal tempPdf As String, ByVal signatureFieldName As String, ByVal certificateChain As Org.BouncyCastle.X509.X509Certificate()) As Byte()
    ' we create a reader and a stamper
    Dim reader As PdfReader = New PdfReader(unsignedPdf)
    Dim baos As FileStream = File.OpenWrite(tempPdf)
    Dim chain = certificateChain
    Dim pdfStamper As PdfStamper = PdfStamper.CreateSignature(reader, baos, Microsoft.VisualBasic.ChrW(92), Nothing, True)
    Dim sap As PdfSignatureAppearance = pdfStamper.SignatureAppearance
    sap.Certificate = certificateChain(0)
    sap.SetVisibleSignature(New iTextSharp.text.Rectangle(36, 720, 160, 780), 1, signatureFieldName)
    'sap.SetVisibleSignature(signatureFieldName);
    sap.SignDate = DateTime.Now
    Dim dic As PdfSignature = New PdfSignature(PdfName.ADOBE_PPKLITE, PdfName.ADBE_PKCS7_DETACHED)
    dic.Date = New PdfDate(sap.SignDate)
    dic.Name = CertificateInfo.GetSubjectFields(chain(0)).GetField("CN")
    sap.CryptoDictionary = dic
    sap.Certificate = certificateChain(0)
    sap.Acro6Layers = True
    sap.Reason = "test"
    sap.Location = "test"
    Dim external As IExternalSignatureContainer = New ExternalBlankSignatureContainer(PdfName.ADOBE_PPKLITE, PdfName.ADBE_PKCS7_DETACHED)
    MakeSignature.SignExternalContainer(sap, external, 8192)
    Dim signatureContainer As PdfPKCS7 = New PdfPKCS7(Nothing, chain, "SHA256", False)
    Dim hash() As Byte = DigestAlgorithms.Digest(sap.GetRangeStream, "SHA256")

    PDFHash.Text = Convert.ToBase64String(hash)

    Session("signatureContainer") = signatureContainer

    Return hash

End Function

 Private Sub Sign21032020(signatureContainer As PdfPKCS7, ByVal certificateChain As Org.BouncyCastle.X509.X509Certificate(), signedBytes As Byte(), tmpPdf As String, signedPdf As String, signatureFieldName As String) As Byte

    Try
        Using reader As PdfReader = New PdfReader(tmpPdf)
            Using outputStream As FileStream = File.OpenWrite(signedPdf)
                Dim external As IExternalSignatureContainer = New MyExternalSignatureContainer(signedBytes, certificateChain, signatureContainer)
                MakeSignature.SignDeferred(reader, signatureFieldName, outputStream, external)
            End Using
        End Using

        ' Return New Byte()

    Catch ex As Exception
        File.Delete(tmpPdf)
        Console.WriteLine("Error signing file: " + ex.Message)
    End Try

End Sub

从客户端返回的签名哈希：

DU7KOJKQS8/7+O00TE7F/IYZCZRIWLTXAOWAADJWK2SSZYNAR1FXB4ANOIMLQE3XKR680EGDG5ORJGD4IIU4GDCM0LGIRTO/+YFWZ+RALL6PUSW8ZKI3UKTCNGXGAI3UUDGGHMV/KNFXKNNOVD5JUAVSSL3H6CLJQV8/KNB2VFCPM7R5K4ZIYXM7LTVKJ98OWS7D7ServP6FJTCMIJFTQ6IVEF6V5MJPFRZZX43ETKOU

temppdf：

Temppdf

SignedPDF：

罗伯托·皮雷斯

Answer 1

这里的主要问题是，您只是简单地将客户端返回的签名字节嵌入到PDF中，而不需要进一步的ado。

但是，由于您在子筛选器中的签名声称是adbe.pkcs7.sha1签名，您需要嵌入一个PKCS#7/CMS签名容器，而这不是您的客户端返回的。

在这里，您切换到在签名子过滤器中声明adbe.pkcs7.detached。这也要求您嵌入一个PKCS#7/CMS签名容器，而且这也比使用adbe.pkcs7.SHA1更可取，后者使用SHA1（一个被认为已经不够安全的摘要算法），在PDF上下文中，它甚至被证明是不安全的。

此外，您现在嵌入了一个PKCS#7/CMS签名容器。因此，Adobe Reader现在可以解码嵌入式签名（在解码BER时不再出错）。

但是您错误地生成了签名容器：

• 将已签名文档范围的哈希值发送给客户端进行签名。这是不正确的。除非您创建了非常原始的CMS容器，否则客户端必须对容器中所谓的“已签名属性”集合进行签名，而已签名字节的散列只是这些属性中的一个。
• 您将客户端返回的签名同时作为签名和文档哈希嵌入到PKCS#7容器中。

  virtual public byte[] getAuthenticatedAttributeBytes(byte[] secondDigest, byte[] ocsp, ICollection<byte[]> crlBytes, CryptoStandard sigtype)

（在这里，seconddigest参数必须包含PDF范围流的哈希值。）

消化字节数组，

让你的客户签下这个哈希，

  virtual public void SetExternalDigest(byte[] digest, byte[] RSAdata, String digestEncryptionAlgorithm)

使用pdfpkcs7对象的以下方法完成CMS签名容器：

  virtual public byte[] GetEncodedPKCS7(byte[] secondDigest, ITSAClient tsaClient, byte[] ocsp, ICollection<byte[]> crlBytes, CryptoStandard sigtype)

（这里的seconddigest、ocsp、crlbytes和sigtype的值必须与GetAuthenticatedattributeBytes调用中的值相同。）

最后使用Makesignature.SignDeferred和适当的IExternalSignatureContainer实现将这些字节嵌入到PDF中。