[GSOC] PDF Signing Support - Final

[Gökçen Eraslan]

Hello all,

After the GSoC midterm, there were two remaining important objectives to
do: to write the NSS code to create a PKCS7 object (which includes the
actual signature, ecrypted SHA1 digest and the public certificate) and
to improve the PDF signing GUI (which can be seen in the experimental
mode only).

For the NSS part, first I have used the NSS PKCS7 API (secpkcs7.h and
pkcs7t.h) to create the PKCS7 object. But it was very hard for me since
NSS lacks a proper documentation[1] (the one in the header files is not
sufficient). Anyway, later on, I have decided to newer and more fine
grained NSS CMS (Cryptographic Message Syntax) API (cms.h and cmst.h).

I have followed following steps to create a PKCS7 object:

1- We need a NSS CERTCertificate structure to operate on the NSS world.
So, DER encoded certificate data is obtained via the Encoded attribute
of XCertificate[2] and converted to a CERTCertificate structure using
the CERT_DecodeCertFromPackage function.

2- SHA1 sum of the PDF file is computed using the HASH_Create,
HASH_Begin, HASH_Update and HASH_End functions[3].

3a- An empty CMS message is created using NSS_CMSMessage_Create.

3b- A SignedData is created inside the CMS message using the
NSS_CMSSignedData_Create function.

3c- Since we use a detached PKCS7 object (which means that the PKCS7
signature object contains only the signature part, excluding the data
itself) for the signing, an empty Data object is created inside the
SignedData using NSS_CMSContentInfo_SetContent_Data.

3d- Certificate chain and signer info is added to the SignedData, using
NSS_CMSSignerInfo_IncludeCerts and NSS_CMSSignedData_AddSignerInfo
respectively.

3e- SHA1 is added to the CMS message using NSS_CMSSignedData_SetDigestValue.

3f- CMS message is DER-encoded via NSS_CMSEncoder_Start and
NSS_CMSEncoder_Finish. (NSS_CMSEncoder_Update is not used since we don't
have a Data).

4- Finally, DER encoded PKCS object is converted to the HEX
representation and written to the relevant structure of the PDF which is
prepared in the earlier commits.

And for the GUI part, I have used Thunderbird certificate selection GUI
design in the PDF export dialog. Now, the selected certificate
information is printed in a disabled Edit control and users are able to
clear the selected certificate to cancel the signing operation. (I have
also used the PassWord = True property in the .src file for the
certificate password input.)

At the end of the day, however, Adobe acroread shows the PDF signatures
as invalid for some reason. But, it shows the certificate details
correctly (which was not the case when I have used the old NSS PKCS7
API). So it seems DER/HEX encodings and the inclusion of the certificate
chain are correct but there is a bug, apparently. Maybe the calculation
of SHA1 or passing the private key password to NSS is wrong. I will try
to figure it out soon.

Thanks to kendy and sberg for their devoted support in this GSoC project.


Best regards.


[1] https://developer.mozilla.org/en-US/docs/NSS/PKCS_7_functions
[2]
http://api.libreoffice.org/docs/common/ref/com/sun/star/security/XCertificate.html#Encoded
[3]
http://www.mozilla.org/projects/security/pki/nss/ref/nssfunctions.html#utils

-- 
Gökçen Eraslan

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 554 bytes
Desc: OpenPGP digital signature
URL: <http://lists.freedesktop.org/archives/libreoffice/attachments/20120820/a8638273/attachment.pgp>