Signature is invalid when Sign and SetPrivilege (V23.7.0)

Aspose.PDF Product Family
1

Hello,

I’m facing same issue which is reported at 5 yrs ago Old Post

I got Signature is invalid when applying both certified signature and PdfFileSecurity.SetPriviledge
There are errors in the formatting or information containted in this signature (The signature byte range is invalid)”

Screenshot 2023-08-09 212223.png (3.5 KB)

Aspose.PDF Version=“23.7.0”
Net6.0

Here is full code
Please use self sign if you are going to test. It does not matter which certificate you use.

String orignPdf = string.Empty;
                String base64Pdf  = String.Empty;
		bool isSigned = false;
		// Just simulate.
		// This part is unnessary because real program will send the base64string
		using (FileStream fs = File.Open(@"your_pdf_file",FileMode.Open)){
            Byte[] bytArray = new Byte[(int)fs.Length];
            fs.Read(bytArray, 0, bytArray.Length);
            originPdf = Convert.ToBase64String(bytArray, Base64FormattingOptions.None);
        }
		
		DocumentPrivilege privilege = DocumentPrivilege.ForbidAll;
        privilege.AllowPrint = true;

        try
        {
            using (Document document = new Document(new MemoryStream(Convert.FromBase64String(orignPdf)), "" , true))
            {
                using (PdfFileSecurity fileSecurity = new PdfFileSecurity(document))
                {
                    // Set document privileges
                    fileSecurity.SetPrivilege(privilege);
                    fileSecurity.Save(@"C:\asposepdf\privilege.pdf");	// check whether this setting is working or not. It's working correctly
                    using (MemoryStream memoryStream = new MemoryStream())
                    {
                        fileSecurity.Save(memoryStream);
                        memoryStream.Position = 0;
                        orignPdf = Convert.ToBase64String(memoryStream.ToArray(), Base64FormattingOptions.None);
                    }
                }
// No need to save the pdf file to drive. It's not necessary for our case.
                using (PdfFileSignature pdfFileSignature = new PdfFileSignature())
                {
                    pdfFileSignature.BindPdf(new MemoryStream(Convert.FromBase64String(orignPdf)));
                    PKCS7 pKCS7 = new PKCS7(@"C:\asposepdf\your_pdf_file_certificate.pfx", "password")
                    {
                        ContactInfo = "This is a contact",
                        Location = "This is a location",
                        Reason = "This is a reason",
                        Date = System.DateTime.Now,
                        ShowProperties = true,
                        CustomAppearance = new SignatureCustomAppearance()
                        {
                            UseDigitalSubjectFormat = false,
                            FontFamilyName = "Arial",
                            FontSize = 6,
                            DateTimeFormat = "yyyy-MM-dd hh:mm:ss tt",
                            DateTimeLocalFormat = "yyyy-MM-dd hh:mm:ss tt",
                            ContactInfoLabel = "Contact Label",
                            LocationLabel = "Location Label",
                            ReasonLabel = "Reason Label",
                            DateSignedAtLabel = "Date Label",
                            ShowContactInfo = true,
                            ShowReason = true,
                            ShowLocation = true
                        }
                    };
                    
                    System.Drawing.Rectangle rectangle = new System.Drawing.Rectangle(
						100,
                        100,
                        200,
                        100);


					// Can't use this method.
					// Reason, Contact, Location are already applied in pKCS7. Why need to set again? Eg. If we hide ShowLocation at pKCS7 but it's not working.
					// It should be follow the pKCS7 setting.
                    /*
                    DocMDPSignature docMDPSignature = new DocMDPSignature(pKCS7, DocMDPAccessPermissions.AnnotationModification);
                    pdfFileSignature.Certify(1, 
						"Reason",
                        "Contact",
                        "Location",
                        true,
                        rectangle,
                        docMDPSignature);
                    */

                    pdfFileSignature.Sign(1,
                        true,
                        rectangle,
                        pKCS7);

                    using (MemoryStream memoryStream = new MemoryStream())
                    {
                        pdfFileSignature.Save(memoryStream);
                        memoryStream.Position = 0;
                        base64Pdf = Convert.ToBase64String(memoryStream.ToArray(), Base64FormattingOptions.None);
                        isSigned = true;
                    }
                }
            }

            if (isSigned)
            {                
                // save to file to check pdf is working correctly during development stage
                using (FileStream fileStream = File.Create(@"C:\asposepdf\signed.pdf"))
                {
                    using (MemoryStream memoryStream = new MemoryStream(Convert.FromBase64String(base64Pdf)))
                    {
                        memoryStream.Position = 0;
                        fileStream.Write(memoryStream.ToArray());
                        fileStream.Close();
                    }
                }
            }
        }
        catch (System.Exception)
        {
            throw;
        }
return base64Pdf;
2

@ir0nPdf

The issue in the referred thread was resolved. Please use PKCS7Detached with Encrypted documents.

Full code:

var inputPdf = "44579.pdf";
var inputPfx = "44579.pfx";
var outputEncryptedPdf = "44579_encrypted.pdf";
var outputSigndedPdf = "44579_signed.pdf";
var document = new Document(inputPdf);
var fileSecurity = new PdfFileSecurity(document);
var privilege = DocumentPrivilege.ForbidAll;
privilege.AllowPrint = true;
fileSecurity.SetPrivilege(privilege);
document.Save(outputEncryptedPdf);

using (var pdfSign = new PdfFileSignature())
{
    pdfSign.BindPdf(outputEncryptedPdf);
    var pkcs = new PKCS7Detached(inputPfx, "WayPoint");
    var docMdpSignature = new DocMDPSignature(pkcs, DocMDPAccessPermissions.NoChanges);
    var rect = new System.Drawing.Rectangle(0, 0, 100, 100);
    pdfSign.Certify(1, "Signature Reason", "Contact", "Location", true, rect, docMdpSignature);
    pdfSign.Save(outputSigndedPdf);
}

In case using PKCS7Detached does not help, please share your sample PDF document with us as well so that we can further proceed to assist you accordingly.

3

@asad.ali,

Sorry for late reply. Issue was solved with PKCS7Detached.
May I know why PKCS7 does not work? Should we always need to use “PKCS7Detached” instead of PKCS7?

Best Regards,

4

@ir0nPdf

You need to use “PKCS7Detached” for encrypted documents. For normal PDFs, PKCS7 would work as expected.