Adobe Acrobat SDK
Implementation Notes
Adobe® Supplement to the ISO 32000
Implementation Notes to the PDF Reference, sixth edition 124
8.7 Digital Signatures
139. Acrobat computes a byte range digest only when the signature dictionary is referenced from a
signature field. There is no byte range signature (that is, there is only an object signature) for FDF file
signatures and usage rights signatures referenced from the
UR
entry of a permissions dictionary. In
Acrobat 7.0, byte range digests are also computed for usage rights signatures referenced from the
UR3
entry of a permissions dictionary.
Note:
This note is also attached to the description of the value of the
Changes
key in Table 8.102.
140. Acrobat 6.0 and later do not provide the
Changes
entry.
8.7.1 Transform Methods
141. Acrobat 6.0 and 7.0 always generate
DigestValue
when creating MDP signatures. Acrobat 6.0
requires the presence of
DigestValue
in order to validate MDP signatures. Acrobat 7.0 does not use
DigestValue
but compares the current and signed versions of the document.
142. Acrobat 6.0 requires a usage rights signature dictionary that is referenced from the
UR
entry of the
permissions dictionary in order to validate the usage rights. Acrobat 7.0 supports both
UR
and
UR3
; it
uses the
UR3
dictionary if both are present. Adobe PDF generating applications that support PDF 1.6
and greater generate
UR
only for backwards compatibility with Adobe Reader 6.0.
143. In Adobe Reader 6.0, any usage right that permits the document to be modified implicitly enables the
FullSave right.
Adobe Reader 7.0 and 8.0 mimic Reader 6.0 behavior if the PDF document contains a
UR
dictionary but
omits a
UR3
dictionary. If the PDF document contains a
UR3
dictionary, only rights specified by the
Annots entry that permit the document to be modified implicitly enable the FullSave right. For all other
rights, FullSave must be explicitly enabled in order to save the document. (Signature rights permit
saving as part of the signing process but not otherwise).
If the
P
entry in the
UR
transform parameters dictionary is
true
, Acrobat 7.0 and greater conforming
readers permit only those rights that are enabled by the entries in the dictionary. However, viewers
permit saving the document as long as any rights that permit modifying the document are enabled.
144. In Acrobat 6.0 and greater, the
DigestMethod
entry in the signature reference dictionary is required,
even though this specification indicates that entry is optional.
145. In Acrobat 6.0 and greater, the
V
entry in the various transform parameters dictionaries are required,
even though this specification indicates otherwise. Those dictionaries include the
DocMDP
transform
parameters dictionary, the
UR
transform parameters dictionary, and the
FieldMDP
transform
parameters dictionary.
8.7.2 Signature Interoperability
146. In versions earlier than Acrobat 6.0, it was a requirement that the signer’s signature be the first
certificate in the PKCS#7 object. Acrobat 6.0 removed this restriction, but for maximum compatibility
with earlier versions, this practice should be followed.
