PDF External Signature - Trouble Hashing Document - pdf

Question

First things first, I'm somewhat new to posting on StackOverflow, so please do tell me if I'm not providing enough information or something.
I'm interfacing with an external digital signature service. I can get a signature and add it to the original PDF using iTextSharp. It's correctly picked up by Adobe Acrobat; however, the signature is invalid because "The document has been altered or corrupted since it was signed".
I've managed to track the problem down to how I'm generating the original document's hash - as I understand it, the document's hash should be constant (ie. calls to the hashing function with the same document should always return the same hash) because said document hash is used to validate the signature. My hashing function, however, returns a different hash each time. Am I wrong in my assumption that this is a problem? If not, how would I make it have the desired behaviour?
Here goes my code:
public static string Hash(byte[] pdf, List<X509Certificate> chain, string hashAlgorithm, RCSignatureFieldsRecord fields, RCSignaturePositionRecord position)
{
IDigest messageDigest = DigestAlgorithms.GetMessageDigest(hashAlgorithm);
PdfSignatureAppearance sap = BuildAppearence(pdf, chain, fields, position);
Stream data = sap.GetRangeStream();
byte[] hash = DigestAlgorithms.Digest(data, messageDigest);
PdfPKCS7 sgn = new PdfPKCS7(null, chain, hashAlgorithm, false);
byte[] sh = sgn.getAuthenticatedAttributeBytes(hash, null, null, CryptoStandard.CMS);
byte[] signedAttributesHash = DigestAlgorithms.Digest(new MemoryStream(sh), messageDigest);
IDigest digest = DigestUtilities.GetDigest(hashAlgorithm);
byte[] messageHash = DigestAlgorithms.Digest(digest, signedAttributesHash);
byte[] sha256Prefix = { 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20 };
byte[] digestInfo = new byte[sha256Prefix.Length + messageHash.Length];
sha256Prefix.CopyTo(digestInfo, 0);
messageHash.CopyTo(digestInfo, sha256Prefix.Length);
return Convert.ToBase64String(digestInfo);
}
private static PdfSignatureAppearance BuildAppearence(byte[] pdf, List<X509Certificate> chain, RCSignatureFieldsRecord fields, RCSignaturePositionRecord position)
{
PdfReader reader = new PdfReader(pdf);
MemoryStream baos = new MemoryStream();
PdfStamper stamper = PdfStamper.CreateSignature(reader, baos, '\0', null, true);
PdfSignatureAppearance sap = stamper.SignatureAppearance;
sap.Certificate = chain[0];
sap.SignDate = DateTime.Now;
PdfSignature dic = new PdfSignature(PdfName.ADOBE_PPKLITE, PdfName.ADBE_PKCS7_DETACHED);
dic.Date = new PdfDate(sap.SignDate);
dic.Name = CertificateInfo.GetSubjectFields(chain[0]).GetField("CN");
sap.CryptoDictionary = dic;
sap.Certificate = chain[0];
sap.Acro6Layers = true;
setupSignatureFields(sap, fields);
setupVisualSignature(sap, position);
Dictionary<PdfName, int> exc = new Dictionary<PdfName, int>();
exc.Add(PdfName.CONTENTS, 8192 * 2 + 2);
sap.PreClose(exc);
return sap;
}
Any help would be greatly appreciated!
Edit
Based on mkl's response, I've refactored my code. I've opted for the second option (closing sap with an empty signature and keeping baos with the half-signed PDF). However, I'm getting a (not very descriptive) exception when calling sap.Close(dic):
The given key was not present in the dictionary.
at System.ThrowHelper.ThrowKeyNotFoundException()
at System.Collections.Generic.Dictionary`2.get_Item(TKey key)
at iTextSharp.text.pdf.PdfSignatureAppearance.Close(PdfDictionary update)
Here's the updated code:
public static Tuple<string, byte[]> Hash(byte[] pdf, List<X509Certificate> chain, string hashAlgorithm, RCSignatureFieldsRecord fields, RCSignaturePositionRecord position)
{
// build signature appearence
PdfReader reader = new PdfReader(pdf);
MemoryStream baos = new MemoryStream();
PdfStamper stamper = PdfStamper.CreateSignature(reader, baos, '\0', null, true);
PdfSignatureAppearance sap = stamper.SignatureAppearance;
sap.Certificate = chain[0];
sap.SignDate = DateTime.Now;
PdfSignature dic = new PdfSignature(PdfName.ADOBE_PPKLITE, PdfName.ADBE_PKCS7_DETACHED);
dic.Date = new PdfDate(sap.SignDate);
dic.Name = CertificateInfo.GetSubjectFields(chain[0]).GetField("CN");
sap.CryptoDictionary = dic;
sap.Certificate = chain[0];
sap.Acro6Layers = true;
setupSignatureFields(sap, fields);
setupVisualSignature(sap, position);
Dictionary<PdfName, int> exc = new Dictionary<PdfName, int>();
exc.Add(PdfName.CONTENTS, 8192 * 2 + 2);
sap.PreClose(exc);
// calculate hash
IDigest messageDigest = DigestAlgorithms.GetMessageDigest(hashAlgorithm);
Stream data = sap.GetRangeStream();
byte[] hash = DigestAlgorithms.Digest(data, messageDigest);
PdfPKCS7 sgn = new PdfPKCS7(null, chain, hashAlgorithm, false);
byte[] sh = sgn.getAuthenticatedAttributeBytes(hash, null, null, CryptoStandard.CMS);
byte[] signedAttributesHash = DigestAlgorithms.Digest(new MemoryStream(sh), messageDigest);
IDigest digest = DigestUtilities.GetDigest(hashAlgorithm);
byte[] messageHash = DigestAlgorithms.Digest(digest, signedAttributesHash);
byte[] sha256Prefix = { 0x30, 0x31, 0x30, 0x0d, 0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01, 0x05, 0x00, 0x04, 0x20 };
byte[] digestInfo = new byte[sha256Prefix.Length + messageHash.Length];
sha256Prefix.CopyTo(digestInfo, 0);
messageHash.CopyTo(digestInfo, sha256Prefix.Length);
// close the signature appearence with an empty signature and return the hash and pdf with empty signature field
sap.Close(dic); // throws an exception
return new Tuple<string, byte[]>(Convert.ToBase64String(digestInfo), baos.ToArray());
}

Answer 1

as I understand it, the document's hash should be constant (ie. calls to the hashing function with the same document should always return the same hash) because said document hash is used to validate the signature. My hashing function, however, returns a different hash each time. Am I wrong in my assumption that this is a problem?
You are correctly assuming that the hash of a fixed document is constant. This after all is a major point of hashing.
You err, though, assuming that your use case is an example of this. Because you hash different documents in each run.
In BuildAppearence each time a different PDF is generated because in particular the current time is stored in it both as signing time (explicitly by your code) and as document modification time (implicitly by iText). Furthermore, a unique ID is generated and stored in the PDF (implicitly by iText). Depending on other aspects of the PDF there may yet be more entries in the PDF which change from call to call.
While it is possible to patch those implicitly set PDF entries in iText to become injectable, the clean way to implement signing would be to follow the iText signing examples and keep the originally produced version of the PDF and later inject the signature into it.