Search code examples
pdfdigital-signaturepdfbox

DSS, VRI - what is so mystructure?

I've just sign document using itext. I've LTV too.

enter image description here

I read in itext documentation - "The DSS contains references to certificates, and we can add references to OCSP responses and CRLs that can be used to re-verify the certificates"

yes, I fount them in my DSS.

I also read thet: "In the DSS, we can store VRI"

I dont understand why is VRI for? because there is the same OCSP responses and Certificates , which are in DSS.

Also wat does /61A2411B1..... means? is it some hash or Random number?

Solution

  • The structures you are interested in are defined in ETSI TS 102 778-4.

    I dont understand why is VRI for? because there is the same OCSP responses and Certificates , which are in DSS.

    While the Certs, OCSPs, and CRLs arrays in the DSS dictionary reference certificates, OCSP responses, and certificate revocation lists that may be used in the validation of any signatures in the document, the VRI dictionary contains Signature VRI dictionaries which reference the validation-related information for a single signature.

    As your document contained but one signature, the information looks unnecessarily duplicated.

    Also wat does /61A2411B1..... means? is it some hash or Random number?

    The key of each entry in the VRI dictionary is the base-16-encoded (uppercase) SHA1 digest of the signature to which it applies.

    PS: To clarify: key in the last sentence refers to the PDF structure: the VRI dictionary is a PDF dictionary in which a key (a PDF name object) is mapped to a value (another PDF object, in this case another PDF dictionary). It is not a cryptographic key from the signature...

    Thus, you take the signature in question, calculate its SHA1 hash, write it in uppercase base-16-encoding, make that string as a PDF name, and then use that PDF name as PDF dictionary key.