You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@pdfbox.apache.org by "Tilman Hausherr (Jira)" <ji...@apache.org> on 2023/08/11 15:15:00 UTC
[jira] [Closed] (PDFBOX-5647) Showing signature verified for tampered document
[ https://issues.apache.org/jira/browse/PDFBOX-5647?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tilman Hausherr closed PDFBOX-5647.
-----------------------------------
Resolution: Not A Bug
Thank you [~mkl]
[~tanmay.sharma97] Is this question from somebody else in your team?
https://stackoverflow.com/questions/76856720
Closing as not a bug.
> Showing signature verified for tampered document
> ------------------------------------------------
>
> Key: PDFBOX-5647
> URL: https://issues.apache.org/jira/browse/PDFBOX-5647
> Project: PDFBox
> Issue Type: Bug
> Components: Signing
> Reporter: Tanmay Sharma
> Priority: Blocker
> Attachments: Doc1_signed.pdf, Doc1_signed_corrupted.pdf
>
>
> A 2 page document was signed. The signature of document was verified by [ShowSignature sample|https://github.com/apache/pdfbox/blob/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/ShowSignature.java] and it prints "Signature Verified".
> Then a corrupted signed PDF was created by deleting the second page of the same signed PDF and the signature of the corrupted PDF was also verified using [ShowSignature sample|https://github.com/apache/pdfbox/blob/trunk/examples/src/main/java/org/apache/pdfbox/examples/signature/ShowSignature.java]. Ideally the verification should fail because hash of the document is changed (as second page is deleted). But instead of printing "Signature verification failed", it still prints "Signature Verified".
> How the signature of corrupted pdf is still getting verified successfully?
> Both signed pdf and corrupted signed pdf is added in the attachments.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@pdfbox.apache.org
For additional commands, e-mail: dev-help@pdfbox.apache.org