Adding PDF revocation information as an signed attribute pdfRevocationInfoArchival OID 1.2.840.113583.1.1.8

Question

We have added pdfRevocationInfoArchival OID (1.2.840.113583.1.1.8) as a signed attribute while generating signature. While building this attribute we used external CRL file (ca-crl.crl) and builds the OID 1.2.840.113583.1.1.8 as ASN1 object. After signing pdf and timestamping signature, everything works fine. But we are not able to understand the identifier (adbe-revocationInfoArchival) which added is in the PDF is correct and which can be used to verify this PDF by fetching this OID. Also we are not able to check that this attribute is in proper format in which PDF can verify it. Is there any tool or utility available to check this attribute which is inserted as a signed attribute is valid.

If any PDF tool/utility is available to visualize attribute are available in PDF please share.

We have build the issuers CRL info at position [0] is this correct to way add the CRL in this OID? I have share the code below code snippet

The following object identifier identifies Adobe's revocation information attribute:

adbe-revocationInfoArchival OBJECT IDENTIFIER ::=
        { adbe(1.2.840.113583) acrobat(1) security(1) 8 }

Adobe's Revocation Information attribute value has ASN.1 type RevocationInfoArchival:

    /**
     ** RevocationInfoArchival ::= SEQUENCE {
     **   crl [0] EXPLICIT SEQUENCE of CRLs, OPTIONAL
     **   ocsp [1] EXPLICIT SEQUENCE of OCSP Responses, OPTIONAL
     **   otherRevInfo [2] EXPLICIT SEQUENCE of OtherRevInfo, OPTIONAL
      }
    */

Adobe's Revocation Information attribute value building using in Java Bouncy Castle API:

private ASN1EncodableVector genPdfInfoArchival(ASN1EncodableVector v) {
        
        ASN1EncodableVector v1 = new ASN1EncodableVector();
        
        List crls = new ArrayList();
        ASN1InputStream t = null;
        try {
            
            CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
            CRL crl = certFactory.generateCRL(new FileInputStream(new File("e://app//esp//crl//NSDLe-GovCA2019-Test-2.crl")));
            System.out.println("crl:" + crl);
            crls.add((X509CRL)crl);
            
            if (!crls.isEmpty()) {
                ASN1EncodableVector v11 = new ASN1EncodableVector();
                for (Iterator i = crls.iterator(); i.hasNext();) {
                    t = new ASN1InputStream(new ByteArrayInputStream(i.next().getEncoded()));
                    v11.add(t.readObject());
                }
                //0 for CRL
                v1.add(new DERTaggedObject(true, 0, new DERSequence(v11)));
            }
} 
        
        return v1;}

After building OID adding it in SignerInforGeneratorBuilder as a signed attribute and generating the signature and then adding this signature in PDF

            CMSSignedDataGenerator gen = new CMSSignedDataGenerator();
            ASN1EncodableVector signedAttr = new ASN1EncodableVector();
            String ID_ADBE_REVOCATION = "1.2.840.113583.1.1.8";

            //TODO add message digest for sgning - nikhilW
            Attribute attr = new Attribute(CMSAttributes.messageDigest,  new DERSet(new DEROctetString(IOUtils.toByteArray(hashdata))));
            signedAttr.add(attr);
            
            //TODO generate pdf info archival and add it as CMS signed attribute - nikhilW
            ASN1EncodableVector pdfInfo = genPdfInfoArchival(signedAttr);
            Attribute ar = new Attribute(new ASN1ObjectIdentifier(ID_ADBE_REVOCATION),   new DERSet (new DERSequence(pdfInfo)));
            signedAttr.add(ar);
            
            List certList = new ArrayList();
            certList.addAll(Arrays.asList(certificateChain));
            Store certs = new JcaCertStore(certList);
            
            DefaultSignedAttributeTableGenerator sa = new DefaultSignedAttributeTableGenerator(new AttributeTable(signedAttr));
            SignerInfoGeneratorBuilder builder = new SignerInfoGeneratorBuilder(new BcDigestCalculatorProvider());
            
            builder.setSignedAttributeGenerator(sa);

Please find below google drive link contains sample signed pdf file hello_signed_ts_pdfarchivalinfo.pdf
pdf_sample_signed

Any help would be appreciated.

user_4688747 · Answer

I have checked for the attribute added in pdf using below java source code. Also there is iText Java utility which will debug pdf object tree iText RUP or download it from my google drive link Download iTextRUP Java Jar run it with java -jar jar-name may it will help debuging pdf objects.

Pdf Archival Info Retrieval Source Code Returns CRL stream object at position [0]

private void getPdfRevoInfoArch(SignerInformation signerInform) {
        
        AttributeTable at = signerInform.getSignedAttributes();
        
        ASN1Encodable arch =    at.get(new ASN1ObjectIdentifier("1.2.840.113583.1.1.8")).getAttrValues().getObjectAt(0);
        
        //ASN1Encodable arch1 = at.get(new ASN1ObjectIdentifier("1.2.840.113583.1.1.8")).getAttrValues().getObjectAt(1);
                
        System.out.println("arc:" + arch);
        System.out.println("archSize:" + at.get(new ASN1ObjectIdentifier("1.2.840.113583.1.1.8")).getAttrValues().size());
        
    }

Adding PDF revocation information as an signed attribute pdfRevocationInfoArchival OID 1.2.840.113583.1.1.8

1 Answers