pdfelectronic-signature

Merging PDF signatures of the same PDF

Preamble: I am not trying to merge different PDFs.

I was wondering. Does the signature of a PDF modify the signed portion of the document or is it appended to some other section of the file?

If the signed portion of the document does not include the signatures, it should be possible to transfer the signature of a document to another file containing the exact same document:

In practice, sending identical PDF to person A and B or signing, I get PDF[A] and PDF[B] back, I can then transfer signature of B to PDF[A], getting PDF[A, B].

Is that theoretically possible? Has someone already tried it?

Solution

  • First of all, I assume you mean a special case of electronic signatures which often are referred to as digital signatures: These signatures allow verification using the hash of the bytes signed by the signature.

    Furthermore, I assume you mean the interoperable types of digital PDF signatures as specified in the PDF specifications and related documents with the extra condition that the signed bytes encompass the whole signed revision except only the placeholder for the signature container. (The PDF specification allows to sign less but common validators forbid that.)

    Under these assumptions:

    No, what you want to do is not possible.

    Signing does not merely append a signature container somewhere; instead it first extends the PDF with some extra objects to represent the signature and hold its signature container, and then it creates a signature for that prepared PDF, not for the original one.

    enter image description here

    The preparations by two different persons A and B most likely are not identical, so the ranges signed by them differ.

    Furthermore, real "parallel signing" of the identical content is not possible in interoperable digital PDF signing, only a consecutive, serial signing. Thus, if you have a PDF with multiple signatures, the bytes signed by the second one actually include the first signature:

    enter image description here

    Thus, you cannot simply transfer the signature of B as a second signature to the PDF already signed by A because a second signature has to sign something completely different than a first one.

    (That being said, there is a larger signing software house whose software used to create signed PDFs with multiple SignerInfos in a single signature container; this is forbidden in the PDF specification for interoperable signatures but a situation validators seldom check for. During validation Adobe Acrobat here only validated the first SignerInfo; some other software only validated the last; in the end this only caused a lot of confusion.)