Signature validation between Acrobat XI and DC

Report · Feb 08, 2018

Hello,

We produce a qualified digital signature from Acrobat Reader and we have a different result during the validation process between Acrobat Reader XI and Acrobat Reader DC.

The first one manages to validate the signature and the second one generate an error (see below).

That is the same document, with the same signature and qualified certificate.

Like we use a Certificate Authority referenced into the European Trusted List, our qualified certificate uses the following QCstatement :

qcStatements:

0:d=0 hl=2 l= 125 cons: SEQUENCE

2:d=1 hl=2 l= 8 cons: SEQUENCE

4:d=2 hl=2 l= 6 prim: OBJECT :0.4.0.1862.1.4

12:d=1 hl=2 l= 8 cons: SEQUENCE

14:d=2 hl=2 l= 6 prim: OBJECT :0.4.0.1862.1.1

22:d=1 hl=2 l= 80 cons: SEQUENCE

24:d=2 hl=2 l= 6 prim: OBJECT :0.4.0.1862.1.5

32:d=2 hl=2 l= 70 cons: SEQUENCE

34:d=3 hl=2 l= 68 cons: SEQUENCE

36:d=4 hl=2 l= 66 cons: SEQUENCE

38:d=5 hl=2 l= 60 prim: IA5STRING :https:https://www.preuve-electronique.org/ListeRevocations/cgu.pdf

100:d=5 hl=2 l= 2 prim: PRINTABLESTRING :en

104:d=1 hl=2 l= 21 cons: SEQUENCE

106:d=2 hl=2 l= 6 prim: OBJECT :0.4.0.1862.1.6

114:d=2 hl=2 l= 11 cons: SEQUENCE

116:d=3 hl=2 l= 9 cons: SEQUENCE

118:d=4 hl=2 l= 7 prim: OBJECT :0.4.0.1862.1.6.1

We don't really understand why the same document produces different result during the validation process between the two versions of the Reader.

Is there a reason?

Report · Feb 08, 2018

Link to the signed document :

https://sealfile.sealweb.eu/f/a6235047b9/?dl=1

Report · Feb 12, 2018

Hello,

the encoding of the QC statements does not seem to match the ETSI standard.

If you try to validate your signature with EU DSS tool Digital Signature Service : Advanced Electronic Signature validation (AdES) you'll get an "Internal Server Error" for the same reason.

Acrobat XI and DC behave differently as version XI does not handle the QC statements that have been introduced with ETSI EN 319 412-5. As the issue is related to this portion of the certificate, Acrobat XI is not impacted as it completely ignores the unsupported QC statements.

Acrobat DC instead knows how to validate the new QC statements and therefore triggers an exception because they're encoded incorrectly.

Regards

Andrea Valle

Adobe

Report · Feb 13, 2018

Hi Andrea,

Ok, I understand why Acrobat XI checks the signature with success and Acrobat DC not.

But I am not sure that the encoding of the QCStatements are wrong. If I use the tool dumpasn1 or openssl, QCStatements are well decoded and I have no error. We can see the output from dumpasn1 in the following file: https://sealfile.sealweb.eu/f/8ecad53720/?dl=1

Acrobat DC gives us the following error "Erreur de décodage BER" without anymore explication. EU DSS Tool gives us an "Internal Error" but we are not sure that the reason is from the ASN1 encoding.

Is-it possible to have an output of the ASN1 decoding from Acrobat DC to compare?

Regards,

Sylvain

dumpasn1