Maniphest T8537

Expected size of signature
Open, NormalPublic
Actions

Assigned To
None
Authored By
svuorela
Tue, Nov 3, 9:50 AM
Tags
Subscribers
svuorela
• werner

Description

When signing a pdf file, the signature bundle (CMS or our own pgp extension) is placed in the middle of the pdf file.

For this to work, some amount of bytes is reserved in the pdf file to later write the signature into. The amount can be larger than the size of the signature. there is padding available.

Currently in poppler, for the gpgme backend, it is a hardcoded 10'000 bytes, which is larger than any current signatures seen.

For the nss backend in poppler, some maths involving the certificate chain, signature types and such is involved to get a much smaller number in most cases (and the possibility to get a bigger number once PQC and/or larger keys get involved)

It would be nice if gpgme could offer functionality for 'the resulting signature will be less than xxx bytes' to help here.

Event Timeline

svuorela created this task.Tue, Nov 3, 9:50 AM
• werner triaged this task as Normal priority.Wed, Nov 4, 9:53 AM
• werner added a project: gpgme.
• werner added a subscriber: • werner.

Even if you have such a feature how will you handle the case that a second signature is to be applied later. In my understanding the non-hashed block can be used for this. I understand that this would only be a used for a parallel signature and not for a counter-signature (serial signature).

svuorela added a comment.Wed, Nov 4, 10:26 AM

to the best of my knowledge, parallel signatures in the pdf signature system is not supported. Multiple signatures would be wrapping the pdf in pdf and signing that the same way the first was signed.

Also a lot of metadata, like signername are in the pdf part of the pdf, not in the signature part of the pdf, which also kind of make parallel signatures at least weird.