0

我们正在制作一个 webapp，其功能之一是制作 PaDES 签名。代码太大，无法在此处分享，但工作流程如下所示：

  • 通过在浏览器中进行所有必要的转换，PDF 已准备好进行签名
  • 使用所选算法计算摘要
  • 如果使用DSS库生成分离的 CaDES 签名，则摘要会发送到后端
  • 在后端生成的分离签名被发送回浏览器以插入到准备好的 PDF 中以制作 PaDES 签名

对于大多数 PDF 文件，该解决方案运行良好。但是，在某些文件中，Acrobat 不会显示签名，就好像它不存在一样，但是当尝试使用我们的 web 应用程序（在后端使用 DSS 进行验证）进行验证时，一切都显示正常。使用DSS在线验证工具检查时也显示正常。

以下是签名 PDF 中最相关的部分：

    1 0 obj
        <</AcroForm<</Fields[1057 0 R] /SigFlags 3>>/Type /Catalog /Pages 3 0 R
        /Dests 8 0 R
        /Metadata 1056 0 R
        >>
        .
        .
        .
        1057 0 obj
        <<
        /FT /Sig
        /Type /Annot
        /Subtype /Widget
        /F 132
        /T (Signature1057)
        /V 1059 0 R
        /P 3 0 R
        /Rect [335.17360432942706 796.500010172526 535.173604329427 746.500010172526]
        /AP <<
        /N 1060 0 R
        >>
        >>
        endobj
    .
    .
    .
        
        1059 0 obj
        <<
        /Type/Sig
        /Filter/Adobe.PPKLite
        /SubFilter/ETSI.CAdES.detached
        /Name (Name)
        /ContactInfo ()
        /Location (Location)
        /Reason ()
        /M (D:20200813165733+02'00')
        /Contents <3082104b06092a864886f70d010702a082103c30821038020101310f300d06096086480165030402010500300b06092a864886f70d010701a0820d57308206e2308204caa003020102020944e5524cc00bede260300d06092a864886f70d01010b0500304a310b30090603550406130252533110300e06035504070c0742656f67726164310f300d060355040a0c064e65745365543118301606035504030c0f436c6f7564204341204e6574536554301e170d3139313231383133343231395a170d3232313231383133343231395a30819d310b3009060355040613025253310f300d06035504080c065365726269613111300f06035504070c0842656c6772616465310e300c06035504110c053131303730311a301806035504090c1150617269736b65206b6f6d756e652032343112301006035504040c095261646f7365766963310f300d060355042a0c064e696b6f6c613119301706035504030c104e696b6f6c61205261646f736576696330820122300d06092a864886f70d01010105000382010f003082010a0282010100cf2e36a81919b993cb52b88235a258b2b008a770862a42c1724e9652826a6394bf2426ca450946bb3726306162474e75003d532182b3fe492e099503a11e10429624611998ac2ff0942f729d3d275228bdcee172ffab42fb10509aa796cad95fd79a82fc8ee29f74c4ca0d76aa64f6f16d5b6f5c281eea870ea7054633a5b5b6eb06b7abbb60752f6cf5c17c3967e1d4b1a401d54d7579c256c04b9f7c293a7d9c8c566e4ad92c32574de1da9afcddb282506e2cf77de31c543f5291e439480705d246142d41e7566e92f1cf4115c286e88a7a3a564a9395cf64a2570fc691c74393907695d7c76a6317123a5342b0ea39239ba0e93a2c862e2eafe87a3064ad0203010001a38202753082027130090603551d1304023000300e0603551d0f0101ff0404030206c0301f0603551d2304183016801403e93e995d06eef7519b67deff9cea818009e456301d0603551d0e04160414e930d3083630ac3da05cefaf64efceb6256ddf5430400603551d1f043930373035a033a031862f687474703a2f2f7374617266697368746573742e6e6574736574676c6f62616c2e72732f636c6f756463612e63726c30819d06082b060105050701030101ff04818d30818a303a06082b06010505070b02302e060704008bec49010130238621687474703a2f2f63612e6e65747365742e72732f646f6b756d656e746163696a613008060604008e4601013008060604008e4601043016060604008e460102300c1303657572020100020203e8300b060604008e4601030201143013060604008e4601063009060704008e4601060130819806082b0601050507010104818b308188303b06082b06010505073002862f687474703a2f2f7374617266697368746573742e6e6574736574676c6f62616c2e72732f636c6f756463612e637274304906082b06010505073001863d687474703a2f2f706b7363612e6e6574736574676c6f62616c2e72733a383038302f6f6373702f726573706f6e6465722f706b73636c6f75646f6373703081960603551d2004818e30818b3027060604008b300101301d301b06082b06010505070201160f687474703a2f2f657473692e636f6d3027060604008b300102301d301b06082b06010505070201160f687474703a2f2f657473692e636f6d300b060704008bec4001023000302a06092a817a01690a040103301d301b06082b06010505070201160f687474703a2f2f6e656b692e636f6d300d06092a864886f70d01010b05000382020100269f2baeed5bc772c3606da57ebba2b4ef6a715d82c2018d5973edd74cc08bf9f266363f1ef3289e34060bce9b52463210cc36d5c8d87c7742b3c04b5227792391db8f686d19866f457c7e47a722d279619b35d7bf569cc2cf599fd13c81f938ce8b08f2d1eb2613e7259b8f59c0e34b5403246e94ef891b4293762677ccd9516f5e2ca36f4b7827f671b2463785bf8804454f2fc2a7de84114cf602d241040aad943d991198a3858a65acf1b468a9b006dc859ffaa46510d16253e72385d57535802288c9ddeb8114ebecdbc4e267d17e188c9cf4d7180b79a4b8bab89d03d6a5011e601f12fc2c132f33e8b872092a4dff6182e0b45536a23dfb2b7eeeffb34540e306c4d1e6e4d595086f76ecf5e2e1ab713a87a5785aea9eea518d391b8982893f2bae03a14ed13cbff25494713c1b79e6dbcdc50059f9df92b4000c597c499b0e654e7defb348ddcf35cb3f51ebb4d934b0395dcd7952a2ac1c1ab5dcc8271b21f54276c0da3a91a54dcf68d9b30c274e968c467d5b3f188535987ed8898444bc8779b405889c54960681863986ebccd4266ae3de4cebc0bf15f7d91bfb41708df87a95a6da46fb951b7b9aaffee53b38e75f582f9b851ea61685f1e60014264fc8bfcb31697653fa68c997cacb033fd4cafdffdfd9fb6d6a52027cc6680c1418d7902ddb11245cc006df2332234740d7d4579f56733308d97d9208e1803082066d30820455a003020102020917664a8436102867b6300d06092a864886f70d01010b05003049310b30090603550406130252533110300e06035504070c0742656f67726164310f300d060355040a0c064e65745365543117301506035504030c0e526f6f74204341204e6574536554301e170d3139313231373038343234355a170d3434313231363137333034355a304a310b30090603550406130252533110300e06035504070c0742656f67726164310f300d060355040a0c064e65745365543118301606035504030c0f436c6f7564204341204e657453655430820222300d06092a864886f70d01010105000382020f003082020a0282020100b47b0b9d976f18457719af6a147880e006ec1cd472bacc31a58327eb2aa7e162e0e113128b0a0bed1950a8ae0bff962f132928bd434a7e0c887c17e610f243ebda0419fa4b2fba4bda643796cf7d97a7e8e0b0828b383c850e95d87210dee367f64520ffbc093720658a899f9f988eb7a08d8bca0615e1b6e4fa058d0c1f00b7b2c09b05099aa193aec4e989bae4d59bfc9d044e281927fbb88e9d23cf9676c75b27890cf04de07a38b0d129fa1de1fd10cc360757738adc9bd9677bfea812aa8611729cf3a114cd6233ed9c4c705a10e5c6f03f7117bfeb04988c3d96a193e18506ddc44819db7d083bc0cdad8335bae0a7a44b2a56c404bb43c87673e9ab9ec321f341cbad17176ad77db663a20b676cc338c6b36e58aa13f1e61ad596ed176d9d2b0bdd36c3cabab22410607d62f97c8349877efabdaf16dce49ef4a67c7780b1bb30b9250bdb5fbdad84d56d43be3484ca6e5bdec3666a230ab5fec46b056beedc8b2e43bb6106f682d5026d3393d73f652f2a83db15d3ad4a5be9b7df0d04d8a0bcbbabc2f791c72ece6d3911936a9c3ea99d4b7f6f101d15ab45032f693fbef1a78d90b48de23ef3b70148c1833e563bcc9259677ed15f869dff111492bd986221082abdac1d0ce1d2c5683a25e4db27c849a818d8fe1cc01207345653305749878c6d09db0e3f04bdae444046a8294c640eafff35114b9f71a1e874750203010001a38201553082015130120603551d130101ff040830060101ff020100300e0603551d0f0101ff040403020106301f0603551d23041830168014e265e5d9a4b6b03700cd20a6d65b7140f1be4e5b301d0603551d0e0416041403e93e995d06eef7519b67deff9cea818009e456303f0603551d1f043830363034a032a030862e687474703a2f2f7374617266697368746573742e6e6574736574676c6f62616c2e72732f726f6f7463612e63726c304a06082b06010505070101043e303c303a06082b06010505073002862e687474703a2f2f7374617266697368746573742e6e6574736574676c6f62616c2e72732f726f6f7463612e637274305e0603551d200457305530530604551d2000304b302e06082b060105050702011622687474703a2f2f6e65747365742e72732f646f6b756d656e746163696a612e706466301906082b06010505070202300d0c0b4e657453657420646f6373300d06092a864886f70d01010b050003820201001ac4e839342cc09ec23dbb6f4e325b6e2f494d502fd6bda7095e4699f4b477464fb10898eff7a09d40c51fc9e3ad67f08ca9762955ce89b9d6076551618d665b65532b426c2101abad0f528a19aa9c18d99f71dbd8c9299cbb50b610867af26c3a59e9ed995677ab490a75d88fd2452dacfcb88b7520b500f54ab66eba612c082448dd51202cce3ea5084a8ccf8045dea6804d6a9d399414f2c86a012aa9beb5773d88e67056023e203a006e93080805ee3d7b57c8537217145be51c3c96583e981a0f10a3f31ffa914ea531caa3960baf02336a9ccf271439057217899e77d7d86b46bf02354abb7ba18578434a20918b4eb1d4b753947c07457a682d69f8938c5c25d80bc0cd24fc2b41bbe4ecb8ccbecdab68755706c9f9df462fe3266f1c1c6cbc405587db22e210d847c19210bfe1cbda5af5994a6651527a819ae27bd09de8359c50a7c80155978e17c32e64e6e191c3ee39f92e82699457b644a4b36e26bbfd803fc37b15d41f3bb855c3e199d01a26d6d6b97ea1b9fbc50964246449c6c580299884e741656ac907dc44f348b171b581ffd23bfd962ba42e7c89876ee3c5212a5dd1046ad5a5547fd762881b3045b809bc492317d73e9ebd9788028ab428a2178db972466c16b595002670f089154516f0cc17f6352575fe8d314b17fee1aa610c5e2a70c7c9f8f9880b1dc99a50d9ba9f4db469f7bc2c61af90ae4d318202b8308202b40201013057304a310b30090603550406130252533110300e06035504070c0742656f67726164310f300d060355040a0c064e65745365543118301606035504030c0f436c6f7564204341204e6574536554020944e5524cc00bede260300d06096086480165030402010500a0820132301806092a864886f70d010903310b06092a864886f70d010701301c06092a864886f70d010905310f170d3230303831333134353830325a302d06092a864886f70d0109343120301e300d06096086480165030402010500a10d06092a864886f70d01010b0500302f06092a864886f70d01090431220420e1e4ce48e389182ecc1ea924190b2ac21fe9a967542fd3d86db0ae1f63019575308197060b2a864886f70d010910022f318187308184308181307f04201e7237e91573f4cd8f76c4c57f2db25be8efe728f4f916cebee707c3bd23f512305b304ea44c304a310b30090603550406130252533110300e06035504070c0742656f67726164310f300d060355040a0c064e65745365543118301606035504030c0f436c6f7564204341204e6574536554020944e5524cc00bede260300d06092a864886f70d01010b050004820100c4d080863e1edce5cd5d7d8634e477ac6697e9e881b21fa4b6033a5b0d1fa8adf2afab5d972e4637bda97b49017308f78ff2329fbd16e31642d5f38f4fa27f44fbb50725c76bfb951cbd8f3b0a492bee6f0d9e7bc2ea41a7c67e97c3ea58deabcb5799d558c350822b4a2689ed1ff2991d9322a0b66574aa83e0d16607adff088a11723eff1ef0c5505e7f98b57ddbe3bb66b2cd94d1ab62b3f32cb8af80f3dcb6a13aeca316f0ac7c448884fa77fb01bf67be38fab46f9b40fe08202d118e56a1b5c0db45a4cf368aa3f586b585fd63805ec316b338498d8873be2c9e2663f880e48b99993ade775d3584d412222ae5014bdf064d83715cfb90d40be20aba910000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000>
        /ByteRange [0000000000 0000220234 0000236618 0000022770]>>
            endobj
        .
        .
        .
        trailer <<
          /Size 1064
          /Root 1 0 R
          /Info 2 0 R
          /ID [<a48978cd2c166094b3e771ab606ea301><531ccc430c71ee517274ec4d5f6e2c34>]
        >>

一切似乎都很好，但由于某种原因，Acrobat 忽略了签名。如果您想看一下，这是整个文件：https ://easyupload.io/2lrfg8

4

2 回答 2

2

签名的 PDF 中有多个错误。

  • 正如@David 在他的回答中提到的那样，第一页有两个Annots条目。

  • 正如我在评论中所写的，签名（字段和）小部件对象的P条目指向页面树的Pages内部节点，而不是Page叶节点。

  • FRM表单 XObject 在其内容流中有错误：

    q
  1 0 0 1 0 0 cm
  /n2 Do
  Q\n

    （那个“\n”确实是一个反斜杠和一个“n”，而不是一个换行符。）

  • 字典中有一个包含流内容的损坏对象 1062

    1062 0 obj
<<
/Length q 1 0 0 1 0 0 cm /img1 Do Q

  • 交叉引用偏移不正确，至少对于与签名相关的对象。

如果通过以下方式解决这些问题

  • 将两个注释条目合二为一，
  • 更改P条目以指向正确的Page字典，
  • 删除那个“\n”序列，
  • 用实际的流长度替换字典中的流内容，以及
  • 更正与签名相关的交叉引用条目，

Adobe Reader 显示签名；但是，在所有这些修复更改了文件之后，显然是无效的：

截屏

因此，

一切似乎都很好，但由于某种原因，Acrobat 忽略了签名。

如上所述，文件中有许多错误，因此不能责怪 Adob​​e Acrobat 没有显示您的签名。所以实际上是相反的，任何忽略那么多错误然后仍然在没有任何警告的情况下验证签名的签名验证软件都是错误的。此类错误可能会导致文件在不同的查看器上显示不同，因此签名的可信度受到限制。这实际上可以用作 PDF 签名验证的另一个攻击媒介。

（请注意，上面提到的错误可能不是唯一的，只是我在分析手头的问题时偶然发现的错误。）

于 2020-08-17T13:21:48.230 回答
1

您的 PDF 肯定有问题。看看其中一个页面字典：

4 0 obj <<
/Type /Page
/MediaBox [0 0 595 842]
/Rotate 0
/Parent 3 0 R
/Resources <<
    /ProcSet[/PDF /Text]
    /ExtGState 14 0 R
    /Font 15 0 R
>>
/Annots [ 
    10 0 R
    11 0 R
    12 0 R
    13 0 R
]
/Annots [
    1057 0 R
]
/Contents 5 0 R
>>
endobj

我为易读性添加了一些结构，但本质是在这本字典中有两个名为“Annots”的键。对于 PDF 文件，这是一个严重的禁忌：“同一个字典中的多个条目不应具有相同的键”。

我不确定你是如何添加这个签名的，但显然它没有正确发生。我可以在这里尝试做千里眼，并猜测有效的 PDF 文件在添加签名的页面上的 PDF 中没有任何注释。

于 2020-08-13T18:23:53.250 回答