|
This post has NOT been accepted by the mailing list yet.
Hello,
I can write you after I meet a problem that currently on the signing of a pdf file using : Hash algorithm: sha256 Digest algo: sha256withrsa iText version 5.0.2 BC version 14.1.38 I can only signed the pdf I get this error: Error signature authentication. Signature contains incorrect data, unrecognized, damaged or suspicious. Support Information: SigDict / Contents illegal data Thank you in advance. Cordially. |
|
1. You are writing to the address of a company: 1T3XT BVBA
Look at the to: of your mail: it says [hidden email] instead of [hidden email] Are you a paying customer? If not, please use the correct address. 2. If you're a paying customer, you know that hotmail, gmail and yahoo addresses aren't allowed. 3. If you post the same question, you'll have to provide more info. For instance: are you sure you're private key is an RSA key? It could be DSA too, couldn't it? Also sha256withrsa? I'd expect some upper cases there. And sha256? Java expects SHA-256. In short: there are plenty of things that could be wrong. I've seen the same error with people who signed with a private key and then used a public certificate that was not related whatsoever to that private key. Honestly, you'll have to do a better effort phrasing your question correctly if you expect an answer. On 20/06/2012 15:08, [hidden email] wrote: > Hello, > I can write you after I meet a problem that currently on the signing of a pdf file using : > > Hash algorithm: sha256 > Digest algo: sha256withrsa > iText version 5.0.2 > BC version 14.1.38 > > I can only signed the pdf I get this error: > > Error signature authentication. > > Signature contains incorrect data, unrecognized, damaged or suspicious. > Support Information: SigDict / Contents illegal data > > Thank you in advance. > > Cordially. ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ iText-questions mailing list [hidden email] https://lists.sourceforge.net/lists/listinfo/itext-questions iText(R) is a registered trademark of 1T3XT BVBA. Many questions posted to this list can (and will) be answered with a reference to the iText book: http://www.itextpdf.com/book/ Please check the keywords list before you ask for examples: http://itextpdf.com/themes/keywords.php |
|
In reply to this post by zouzou
Tahnks for replay,
I m sur that i use RSA key and sha256, the java version is 5. Excuse me i m new in crypto and iText. |
|
Hello everyone,
currently I use the latest version of iText I can sign a pdf with the sha256 parcontre moùent verification is done with the code of iText fails! Here is the exception thrown: ExceptionConverter: java.security.InvalidKeyException: Illegal Key must not be null Has sun.security.rsa.RSAKeyFactory.engineTranslateKey (Unknown Source) Has sun.security.rsa.RSAKeyFactory.toRSAKey (Unknown Source) Has sun.security.rsa.RSASignature.engineInitVerify (Unknown Source) Has java.security.Signature $ Delegate.engineInitVerify (Unknown Source) Has java.security.Signature.initVerify (Unknown Source) Has iaik.pkcs.pkcs11.provider.signatures.PKCS11Signature.engineInitVerify (PKCS11Signature.java: 317) Has java.security.Signature $ Delegate.init (Unknown Source) Has java.security.Signature $ Delegate.chooseProvider (Unknown Source) Has java.security.Signature $ Delegate.engineInitVerify (Unknown Source) Has java.security.Signature.initVerify (Unknown Source) Has com.itextpdf.text.pdf.security.PdfPKCS7. <init> (PdfPKCS7.java: 392) Has com.itextpdf.text.pdf.security.PdfPKCS7. <init> (PdfPKCS7.java: 225) Has com.itextpdf.text.pdf.AcroFields.verifySignature (AcroFields.java: 2308) Has com.itextpdf.text.pdf.AcroFields.verifySignature (AcroFields.java: 2258) Has myPackage.DocumentPDFSigne.verifierPDF (DocumentPDFSigne.java: 317) On reading this error stack we can see that the signing certificate does not contain the public key but this is not the case because my signing certificate contain the key public good. Is there someone who can tell me more about? Maybe you too have already experience this problem. Thank you for your help. |
|
Can you verify it with Reader? If you can, please the PDF for inspection.
Paulo On Thu, Jul 5, 2012 at 3:06 PM, zouzou <[hidden email]> wrote: > Hello everyone, > > currently I use the latest version of iText I can sign a pdf with the sha256 > parcontre moùent verification is done with the code of iText fails! > > Here is the exception thrown: > > ExceptionConverter: java.security.InvalidKeyException: Illegal Key must not > be null > Has sun.security.rsa.RSAKeyFactory.engineTranslateKey (Unknown Source) > Has sun.security.rsa.RSAKeyFactory.toRSAKey (Unknown Source) > Has sun.security.rsa.RSASignature.engineInitVerify (Unknown Source) > Has java.security.Signature $ Delegate.engineInitVerify (Unknown Source) > Has java.security.Signature.initVerify (Unknown Source) > Has iaik.pkcs.pkcs11.provider.signatures.PKCS11Signature.engineInitVerify > (PKCS11Signature.java: 317) > Has java.security.Signature $ Delegate.init (Unknown Source) > Has java.security.Signature $ Delegate.chooseProvider (Unknown Source) > Has java.security.Signature $ Delegate.engineInitVerify (Unknown Source) > Has java.security.Signature.initVerify (Unknown Source) > Has com.itextpdf.text.pdf.security.PdfPKCS7. <init> (PdfPKCS7.java: 392) > Has com.itextpdf.text.pdf.security.PdfPKCS7. <init> (PdfPKCS7.java: 225) > Has com.itextpdf.text.pdf.AcroFields.verifySignature (AcroFields.java: 2308) > Has com.itextpdf.text.pdf.AcroFields.verifySignature (AcroFields.java: 2258) > Has myPackage.DocumentPDFSigne.verifierPDF (DocumentPDFSigne.java: 317) > > > On reading this error stack we can see that the signing certificate does not > contain the public key but this is not the case because my signing > certificate contain the key public good. > > Is there someone who can tell me more about? > > Maybe you too have already experience this problem. > > Thank you for your help. > > -- > View this message in context: http://itext-general.2136553.n4.nabble.com/iText-and-signing-pdf-fils-tp4655392p4655534.html > Sent from the iText - General mailing list archive at Nabble.com. ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ iText-questions mailing list [hidden email] https://lists.sourceforge.net/lists/listinfo/itext-questions iText(R) is a registered trademark of 1T3XT BVBA. Many questions posted to this list can (and will) be answered with a reference to the iText book: http://www.itextpdf.com/book/ Please check the keywords list before you ask for examples: http://itextpdf.com/themes/keywords.php |
|
Thank you for your response Paulo,
In fact after the end of the execution of my signature programe I have a pdf file signed with a signature that appears on this pdf but I actually want to check the signed pdf in my programe as a result PdfReader reader = new PdfReader (new RandomAccessFileOrArray (mypdf), null); AcroFields reader.getAcroFields af = (); Af.getSignatureNames ArrayList names = (); String name = ""; for (int k = 0, k <names.size () k + +) { name = (String) names.get (k); } pk = af.verifySignature (name); If you want i can send you the result signed pdf. Thank you in advance. |
|
In reply to this post by Paulo Soares-4
Thank you for your response Paulo,
In fact after the end of the execution of my signature programe I have a pdf file signed with a signature that appears on this pdf but I actually want to check the signed pdf in my programe as a result PdfReader reader = new PdfReader (new RandomAccessFileOrArray (mypdf), null); AcroFields reader.getAcroFields af = (); Af.getSignatureNames ArrayList names = (); String name = ""; for (int k = 0, k <names.size () k + +) { name = (String) names.get (k); } pk = af.verifySignature (name); If you want i can send you the result signed pdf. Thank you in advance. |
|
In reply to this post by Paulo Soares-4
Thank you for your response Paulo,
In fact after the end of the execution of my signature programe I have a pdf file signed with a signature that appears on this pdf but I actually want to check the signed pdf in my programe as a result : PdfReader reader = new PdfReader (new RandomAccessFileOrArray (mypdf), null); AcroFields reader.getAcroFields af = (); Af.getSignatureNames ArrayList names = (); String name = ""; for (int k = 0, k <names.size () k + +) { name = (String) names.get (k); } pk = af.verifySignature (name); If you want i can send you the result signed pdf. Thank you in advance. |
|
In reply to this post by Paulo Soares-4
thankd
-- View this message in context: http://itext-general.2136553.n4.nabble.com/iText-and-signing-pdf-fils-tp4655392p4655540.html Sent from the iText - General mailing list archive at Nabble.com. ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ iText-questions mailing list [hidden email] https://lists.sourceforge.net/lists/listinfo/itext-questions iText(R) is a registered trademark of 1T3XT BVBA. Many questions posted to this list can (and will) be answered with a reference to the iText book: http://www.itextpdf.com/book/ Please check the keywords list before you ask for examples: http://itextpdf.com/themes/keywords.php |
|
In reply to this post by zouzou
Don't send the PDF to me, post it in the mailing list (or a link if
it's too big). I ask again one last time, does it verify with Acrobat? Paulo On Thu, Jul 5, 2012 at 5:02 PM, zouzou <[hidden email]> wrote: > Thank you for your response Paulo, > > In fact after the end of the execution of my signature programe I have a pdf > file signed with a signature that appears on this pdf but I actually want to > check the signed pdf in my programe as a result > > PdfReader reader = new PdfReader (new RandomAccessFileOrArray (mypdf), > null); > AcroFields reader.getAcroFields af = (); > Af.getSignatureNames ArrayList names = (); > String name = ""; > for (int k = 0, k <names.size () k + +) { > name = (String) names.get (k); > } > pk = af.verifySignature (name); > > If you want i can send you the result signed pdf. > > Thank you in advance. > > -- > View this message in context: http://itext-general.2136553.n4.nabble.com/iText-and-signing-pdf-fils-tp4655392p4655537.html > Sent from the iText - General mailing list archive at Nabble.com. > > ------------------------------------------------------------------------------ > Live Security Virtual Conference > Exclusive live event will cover all the ways today's security and > threat landscape has changed and how IT managers can respond. Discussions > will include endpoint security, mobile security and the latest in malware > threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ > _______________________________________________ > iText-questions mailing list > [hidden email] > https://lists.sourceforge.net/lists/listinfo/itext-questions > > iText(R) is a registered trademark of 1T3XT BVBA. > Many questions posted to this list can (and will) be answered with a reference to the iText book: http://www.itextpdf.com/book/ > Please check the keywords list before you ask for examples: http://itextpdf.com/themes/keywords.php ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ iText-questions mailing list [hidden email] https://lists.sourceforge.net/lists/listinfo/itext-questions iText(R) is a registered trademark of 1T3XT BVBA. Many questions posted to this list can (and will) be answered with a reference to the iText book: http://www.itextpdf.com/book/ Please check the keywords list before you ask for examples: http://itextpdf.com/themes/keywords.php |
|
Thanks Paulo for your replay.
Here is the signed pdf file that i have an error wehen i try to verify signature : circuitinfo.signed.pdf Cordially. |
|
zouzou,
After sorting the "source code" you provided (which obviously never had a chance to compile, let alone run) I ran it and got a "java.security.NoSuchAlgorithmException: SHA256 MessageDigest not available". So I added the appropriate BouncyCastle provider and ran it again. Voilà! No exception anymore. Especially no "java.security.InvalidKeyException: Illegal Key must not be null" as you reported. Thus, if you still have that problem, supply working Java code which does reproduce the issue. Regards, Michael PS: iText trunk, BC 1.47. |
|
In reply to this post by Paulo Soares-4
Hi,
There is the error i get when i try to verify the pdf sgnature : ks provider = SUN version 1.6 SUN version 1.6 SunRsaSign version 1.5 SunJSSE version 1.6 SunJCE version 1.6 SunJGSS version 1.0 SunSASL version 1.5 XMLDSig version 1.0 SunPCSC version 1.6 Sign Fin... signature Début verif hashalgo = 2.16.840.1.101.3.4.2.1 Création du log CertSign dans le fichier : C:\Users\aamrani\.certeurope\certsign\certsign.log.txt signCert = [0] Version: 1 SerialNumber: 1341431830 IssuerDN: E=test@TestRosny.fr,C=FR,ST=France,L=FR,O=Rosny,OU=Test Rosny,CN=Test Start Date: Wed Jul 04 21:57:10 CEST 2012 Final Date: Thu Jul 04 21:57:10 CEST 2013 SubjectDN: E=test@TestRosny.fr,C=FR,ST=France,L=FR,O=Rosny,OU=Test Rosny,CN=Test Public Key: null Signature Algorithm: SHA1withRSA Signature: 1ad9330c62f2354fa8b1a111eb40865832b4c35d fa117020e953a6ddac5dcbdc2c2c6fa155e4761a 749dcd6d76a5c4f1ef2c3e1a43ba476c75bc2c1a 41003e54a55115bca7ab9dd2aed5e386d0199570 79ab76bb6f423d858cb6a5fff6e646252c19fa56 482f4d0c521d9645f7eb10ae8b2e33e2c2ab4525 bc35c7843d1f178c7b7f0895a72e9e144ae16ad7 513229bb1de52d049647dfa629185e6a2a5df15d 5a910af26fb6427c3881c617b88c9d03be89bd1f fe3da58b71d768ecc088d67629977180f52a20bc aaea1227eaef7803e24ee5c4ce8e70b69a135f06 b83c470a8f08064d8bd15823cece4d529aaa4f58 9a0518a03248af99e93fdcdfb914d03e digestAlgorithmOid = 2.16.840.1.101.3.4.2.1 -- algo = SHA256 -- algo = SHA256 --------1-------- ik = No installed provider supports this key: (null) the signed pdf : circuitinfo.signed.pdf Thanks |
|
In reply to this post by mkl
Hi Michael,
I added this statement Security.addProvider (new BouncyCastleProvider ()); just before the start of the audit and it works well. Now the question is I have to add the provider BC obligatroirement me because I use one of IAIK; Regards, zouzou. |
|
zouzou,
I think iText explicitly uses BC classes directly in a number of places. Most likely, therefore, use of BC is mandatory if you use the iText cryptographic functions extensively. (Once someone proposed adding wrappers for different cryptographic libraries but I don't think that is high on the priority list if at all --- even though it would have made life easier for integrators when the BC 1.47 trouble started). You may not have to add a new BC instance to the providers each time your application verifies, though. if you use the method overloads with explicit provider argument instead of resorting to the default one, registering it once should suffice. You may probably even get away without BC for many iText functions if you explictly select the IAIK provider in those method overloads... Regards, Michael |
|
Hello Michael and other contributors,
I wonder if there are good practices for the provider adds the JVM and the usage of storage iText-5.3.0 for signed SHA256? Currently I worked on an applet that signature using SHA1 PDF and iText-2.0.4 This applet signs the pdf without adding BC before the provider signature verification. The IAIK provider is to add on to launch the applet. And it works very well. Now, I worked on the development of this applet to sign with SHA256. So I change the version of iText I switched to the latest version 5.3.0 I have also changed with the version of BC-bcpkix jdk15on bcprov-147 and-147-jdk15on. At this level reaches the applet signed but failed to verify the signature. And when I add the provider BC Vanat just the verification of the signature [Security.addProvider (new BouncyCastleProvider ());] applet comes to being signed and verified with suucès. Only in this project I use the IAIK provider for cryptographic functions. my questions are: What are best practices for using iText-5.3.0 with another provider for that BC sign with SHA256? In the previous post to answer me you talked about overload functions, what are these functions? If one has no choice to use another provider than BC when or in what place should add? Regards. |
|
Hi zouzou,
I would recommend just to accept that iText is build to use BC. It's not just the of the JCA provider but also the direct reference to BC classes from the iText code. The internal structure of BC and iaik classes is very different. So you have to have BC in the classpath and can register it as crypto provider, too. You won't see any benefit from adding iaik. Greetings Andreas > Hello Michael and other contributors, > > I wonder if there are good practices for the provider adds the JVM and the > usage of storage iText-5.3.0 for signed SHA256? > > Currently I worked on an applet that signature using SHA1 PDF and > iText-2.0.4 > This applet signs the pdf without adding BC before the provider signature > verification. The IAIK provider is to add on to launch the applet. And it > works very well. > > Now, I worked on the development of this applet to sign with SHA256. So I > change the version of iText I switched to the latest version 5.3.0 I have > also changed with the version of BC-bcpkix jdk15on bcprov-147 > and-147-jdk15on. > > At this level reaches the applet signed but failed to verify the signature. > > And when I add the provider BC Vanat just the verification of the signature > [Security.addProvider (new BouncyCastleProvider ());] applet comes to being > signed and verified with suucès. > > Only in this project I use the IAIK provider for cryptographic functions. > > my questions are: > > What are best practices for using iText-5.3.0 with another provider for that > BC sign with SHA256? > > In the previous post to answer me you talked about overload functions, what > are these functions? > > If one has no choice to use another provider than BC when or in what place > should add? > > Regards. > > -- > View this message in context: http://itext-general.2136553.n4.nabble.com/iText-and-signing-pdf-fils-tp4655392p4655590.html > Sent from the iText - General mailing list archive at Nabble.com. > > ------------------------------------------------------------------------------ > Live Security Virtual Conference > Exclusive live event will cover all the ways today's security and > threat landscape has changed and how IT managers can respond. Discussions > will include endpoint security, mobile security and the latest in malware > threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ > _______________________________________________ > iText-questions mailing list > [hidden email] > https://lists.sourceforge.net/lists/listinfo/itext-questions > > iText(R) is a registered trademark of 1T3XT BVBA. > Many questions posted to this list can (and will) be answered with a reference to the iText book: http://www.itextpdf.com/book/ > Please check the keywords list before you ask for examples: http://itextpdf.com/themes/keywords.php -- Andreas Kühne phone: +49 177 293 24 97 mailto: [hidden email] Trustable Ltd. Niederlassung Deutschland Ströverstr. 18 - 59427 Unna Amtsgericht Hamm HRB 5868 Directors Andreas Kühne, Heiko Veit Company UK Company No: 5218868 Registered in England and Wales ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ iText-questions mailing list [hidden email] https://lists.sourceforge.net/lists/listinfo/itext-questions iText(R) is a registered trademark of 1T3XT BVBA. Many questions posted to this list can (and will) be answered with a reference to the iText book: http://www.itextpdf.com/book/ Please check the keywords list before you ask for examples: http://itextpdf.com/themes/keywords.php |
|
In reply to this post by zouzou
zouzou,
As Andreas already said, currently you should just accept that iText is built to use BC. Currently BC is hardwired in some iText classes. The existence of a number of method overloads with an additional provider argument is a hint, though, that iText aims at providing the covered functionality with other security providers, too. I don't know how far this support already works. Overloaded methods are methods of the same class with the same name but different parameter types, e.g. KeyStoreUtil.loadCacertsKeyStore(String) and KeyStoreUtil.loadCacertsKeyStore(). Unless some other code in your program time and time again changes the list of registered security providers, doing it once during startup should suffice. Wheter or not BC needs to be at a special position in that list, depends on the requirements of all the components of your program making use of security provider functions. Sometimes it's quite a hassle to put them in the right order... ;) Regards, Michael |
|
iText needs BC but it's possible to bypass it and create an external
signature (a complete CMS or CAdES) using whatever means available. If using the iText signature code the provider can be explicitly selected or the selection will be done using the normal Java mechanism as mkl and Andreas already said. I admit that an interface for the hash functions may make some sense, the signature is already taken care in the ExternalSignature interface. Paulo On Thu, Jul 12, 2012 at 11:03 AM, mkl <[hidden email]> wrote: > zouzou, > > As Andreas already said, currently you should just accept that iText is > built to use BC. > > zouzou wrote >> What are best practices for using iText-5.3.0 with another provider for >> that BC sign with SHA256? > > Currently BC is hardwired in some iText classes. The existence of a number > of method overloads with an additional provider argument is a hint, though, > that iText aims at providing the covered functionality with other security > providers, too. I don't know how far this support already works. > > zouzou wrote >> In the previous post to answer me you talked about overload functions, >> what are these functions? > > Overloaded methods are methods of the same class with the same name but > different parameter types, e.g. KeyStoreUtil.loadCacertsKeyStore(String) and > KeyStoreUtil.loadCacertsKeyStore(). > > zouzou wrote >> If one has no choice to use another provider than BC when or in what place >> should add? > > Unless some other code in your program time and time again changes the list > of registered security providers, doing it once during startup should > suffice. Wheter or not BC needs to be at a special position in that list, > depends on the requirements of all the components of your program making use > of security provider functions. Sometimes it's quite a hassle to put them in > the right order... ;) > > Regards, Michael > > -- > View this message in context: http://itext-general.2136553.n4.nabble.com/iText-and-signing-pdf-fils-tp4655392p4655593.html > Sent from the iText - General mailing list archive at Nabble.com. ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ iText-questions mailing list [hidden email] https://lists.sourceforge.net/lists/listinfo/itext-questions iText(R) is a registered trademark of 1T3XT BVBA. Many questions posted to this list can (and will) be answered with a reference to the iText book: http://www.itextpdf.com/book/ Please check the keywords list before you ask for examples: http://itextpdf.com/themes/keywords.php |
|
Hi Paulo!
> iText needs BC but it's possible to bypass it and create an external > signature (a complete CMS or CAdES) using whatever means available. If > using the iText signature code the provider can be explicitly selected > or the selection will be done using the normal Java mechanism as mkl > and Andreas already said. Yes, that's the way we went. But I didn't want come up with this solution to prevent confusion. Moreover we dropped all references to BC from the code manually to get a tiny applet. The hashing is done using the ever-ready Sun provider, all other complex / crypto stuff is delegated to our server. But I wouldn't take this path again, as the code is cut off from further iText development ... @zouzou: My conclusion: iText requires BC, so don't nag the applet user by squeezing another provider thru the wire. Greetings Andreas -- Andreas Kühne phone: +49 177 293 24 97 mailto: [hidden email] Trustable Ltd. Niederlassung Deutschland Ströverstr. 18 - 59427 Unna Amtsgericht Hamm HRB 5868 Directors Andreas Kühne, Heiko Veit Company UK Company No: 5218868 Registered in England and Wales ------------------------------------------------------------------------------ Live Security Virtual Conference Exclusive live event will cover all the ways today's security and threat landscape has changed and how IT managers can respond. Discussions will include endpoint security, mobile security and the latest in malware threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/ _______________________________________________ iText-questions mailing list [hidden email] https://lists.sourceforge.net/lists/listinfo/itext-questions iText(R) is a registered trademark of 1T3XT BVBA. Many questions posted to this list can (and will) be answered with a reference to the iText book: http://www.itextpdf.com/book/ Please check the keywords list before you ask for examples: http://itextpdf.com/themes/keywords.php |
| Powered by Nabble | Edit this page |
