Signature validation between Acrobat XI and DC

[sylvainr61802075]

Hello,

We produce a qualified digital signature from Acrobat Reader and we have a different result during the validation process between Acrobat Reader XI and Acrobat Reader DC.

The first one manages to validate the signature and the second one generate an error (see below).

That is the same document, with the same signature and qualified certificate.

Like we use a Certificate Authority referenced into the European Trusted List, our qualified certificate uses the following QCstatement :

qcStatements:

    0:d=0  hl=2 l= 125 cons: SEQUENCE         

    2:d=1  hl=2 l=   8 cons: SEQUENCE         

    4:d=2  hl=2 l=   6 prim: OBJECT :0.4.0.1862.1.4

   12:d=1  hl=2 l=   8 cons:  SEQUENCE         

   14:d=2 hl=2 l=   6 prim: OBJECT :0.4.0.1862.1.1

22:d=1  hl=2 l=  80 cons: SEQUENCE         

   24:d=2 hl=2 l=   6 prim: OBJECT :0.4.0.1862.1.5

32:d=2  hl=2 l=  70 cons: SEQUENCE         

   34:d=3 hl=2 l=  68 cons: SEQUENCE         

   36:d=4 hl=2 l=  66 cons: SEQUENCE         

   38:d=5 hl=2 l=  60 prim: IA5STRING :https://www.preuve-electronique.org/ListeRevocations/cgu.pdf

100:d=5  hl=2 l=   2 prim: PRINTABLESTRING   :en

104:d=1  hl=2 l=  21 cons: SEQUENCE         

  106:d=2 hl=2 l=   6 prim:   OBJECT :0.4.0.1862.1.6

114:d=2  hl=2 l=  11 cons: SEQUENCE         

  116:d=3 hl=2 l=   9 cons: SEQUENCE         

  118:d=4 hl=2 l=   7 prim: OBJECT :0.4.0.1862.1.6.1

We don't really understand why the same document produces different result during the validation process between the two versions of the Reader.

Is there a reason?

[sylvainr61802075]

Link to the signed document :

https://sealfile.sealweb.eu/f/a6235047b9/?dl=1

[Andrea Valle]

Hello,

the encoding of the QC statements does not seem to match the ETSI standard.

If you try to validate your signature with EU DSS tool Digital Signature Service : Advanced Electronic Signature validation (AdES) you'll get an "Internal Server Error" for the same reason.

Acrobat XI and DC behave differently as version XI does not handle the QC statements that have been introduced with ETSI EN 319 412-5. As the issue is related to this portion of the certificate, Acrobat XI is not impacted as it completely ignores the unsupported QC statements.

Acrobat DC instead knows how to validate the new QC statements and therefore triggers an exception because they're encoded incorrectly.

Regards

Andrea Valle

Adobe

[sylvainr61802075]

Hi Andrea,

Ok, I understand why Acrobat XI checks the signature with success and Acrobat DC not.

But I am not sure that the encoding of the QCStatements are wrong. If I use the tool dumpasn1 or openssl, QCStatements are well decoded and I have no error. We can see the output from dumpasn1 in the following file: https://sealfile.sealweb.eu/f/8ecad53720/?dl=1

Acrobat DC gives us the following error "Erreur de décodage BER" without anymore explication. EU DSS Tool gives us an "Internal Error" but we are not sure that the reason is from the ASN1 encoding.

Is-it possible to have an output of the ASN1 decoding from Acrobat DC to compare?

Regards,

Sylvain

dumpasn1