Sign PDF with PKCS # 11

0

Situation:

  • Electronic Card with Chip
  • Card Reader
  • PDF to Sign
  • Need to Sign the PDF with the Electronic Card
  • The card is an identity card that has a pin so I need to use a form that allows me to sign the PDF with a reader requesting a pin that can then validate that PDF if it is signed.

    I was making an application with APDU commands but the Digital signature as a PDF property is much harder than signing a hash.

    They gave me the possibility that PKCS # 11 is much easier but I can not make it work.

    PKCS page # 11

    I can not determine where to grab that DLL

    // Specify path to the unmanaged PCKS#11 library
            string libraryPath = @"siecap11.dll";
    

    Sample Signature

    public void SignPdfDocument()
        {
            // Specify path to the unsigned PDF that will be created by this code
            string unsignedPdfPath = @"c:\Test\unsigned.pdf";
    
            // Specify path to the signed PDF that will be created by this code
            string signedPdfPath = @"c:\Test\signed.pdf";
    
            // Create simple PDF document with iText
            using (Document document = new Document(PageSize.A4, 50, 50, 50, 50))
            {
                using (FileStream outputStream = new FileStream(unsignedPdfPath, FileMode.Create))
                {
                    using (PdfWriter pdfWriter = PdfWriter.GetInstance(document, outputStream))
                    {
                        document.Open();
                        document.Add(new Paragraph("Hello World!"));
                        document.Close();
                    }
                }
            }
    
            // Do something interesting with unsigned PDF document
            FileInfo unsignedPdfInfo = new FileInfo(unsignedPdfPath);
            Assert.IsTrue(unsignedPdfInfo.Length > 0);
    
            // Specify path to the unmanaged PCKS#11 library
            string libraryPath = @"siecap11.dll";
    
            // Specify serial number of the token that contains signing key. May be null if tokenLabel is specified.
            string tokenSerial = null;
    
            // Specify label of of the token that contains signing key. May be null if tokenSerial is specified
            string tokenLabel = @"Pkcs11Interop";
    
            // Specify PIN for the token
            string pin = @"11111111";
    
            // Specify label (value of CKA_LABEL attribute) of the private key used for signing. May be null if ckaId is specified.
            string ckaLabel = @"John Doe";
    
            // Specify hex encoded string with identifier (value of CKA_ID attribute) of the private key used for signing. May be null if ckaLabel is specified.
            string ckaId = null;
    
            // Specify hash algorihtm used for the signature creation
            HashAlgorithm hashAlgorithm = HashAlgorithm.SHA256;
    
            // Create instance of Pkcs11Signature class that allows iText to create PKCS#1 v1.5 RSA signature with the private key stored on PKCS#11 compatible device
            using (Pkcs11RsaSignature pkcs11RsaSignature = new Pkcs11RsaSignature(libraryPath, tokenSerial, tokenLabel, pin, ckaLabel, ckaId, hashAlgorithm))
            {
                // When signing certificate is stored on the token it can be usually read with GetSigningCertificate() method
                byte[] signingCertificate = pkcs11RsaSignature.GetSigningCertificate();
    
                // All certificates stored on the token can be usually read with GetAllCertificates() method
                List<byte[]> otherCertificates = pkcs11RsaSignature.GetAllCertificates();
    
                // Build certification path for the signing certificate
                ICollection<Org.BouncyCastle.X509.X509Certificate> certPath = CertUtils.BuildCertPath(signingCertificate, otherCertificates);
    
                // Read unsigned PDF document
                using (PdfReader pdfReader = new PdfReader(unsignedPdfPath))
                {
                    // Create output stream for signed PDF document
                    using (FileStream outputStream = new FileStream(signedPdfPath, FileMode.Create))
                    {
                        // Create PdfStamper that applies extra content to the PDF document
                        using (PdfStamper pdfStamper = PdfStamper.CreateSignature(pdfReader, outputStream, '
    // Specify path to the unmanaged PCKS#11 library
            string libraryPath = @"siecap11.dll";
    
    ', Path.GetTempFileName(), true)) { // Sign PDF document MakeSignature.SignDetached(pdfStamper.SignatureAppearance, pkcs11RsaSignature, certPath, null, null, null, 0, CryptoStandard.CADES); } } } } // Do something interesting with the signed PDF document FileInfo signedPdfInfo = new FileInfo(signedPdfPath); Assert.IsTrue(signedPdfInfo.Length > signedPdfPath.Length); }

    Thank you very much

        
    asked by Maximiliano Cesán 04.10.2018 в 17:06
    source

    0 answers