PDF_NOT_ETSI error while trying to verify a signature with DSS Validation Tool

[IonutCorbu]

Hello! I finally ended my PAdES signature creation using PDFNet and OPENSSL and it is recognized by Adobe PDF Reader, but I have a problem while trying to verify it is DSS validation tool. I received the following error:

and in the detailed version, I saw this problem:

I tried to compare the signature with one realised with DSS tool, but I was not able to see the difference between those 2.

I attach here both signatures decoded from DER using Cyberchef:
-my signature
my_signature.txt
-dss signature
dss_signature.txt

Could you help me?
Best Wishes,
Ionut Corbu

[bsanchezb]

Could you please provide a complete PDF file for analysis?

[IonutCorbu]

Sure! Here is the file signed with DSS file:
file_signed.pdf
and here is the file obtained using my solution:
file_signed.pdf

I verified the signed attributes, but i don't know if the problem is there or not.

[bsanchezb]

Your CMS contains an empty eContent attribute, which shall not be present for a CMS within a PDF signature. The CMS in PDF shall be of a detached format, while your signature "commits" that it covers the encapsulated content, thus DSS invalidates the signature.
This is your signature:

and below is a CMS created by DSS:

As you see, DSS omits the eContent attribute when creating a signature.

Adobe, apparently, does not check the attribute, which is, in fact, invalid. See ISO 32000-1 for adbe.pkcs7.detached subFilter:

12.8.3.3 CMS (PKCS #7) signatures
...
No data shall be encapsulated in the CMSSignedData field.
...

And ETS EN 319 142-1:

4.1 General requirements for PAdES signatures based on PDF signatures

NOTE: Given that PAdES signatures are enveloped inside a PDF document and are detached in the sense of a CMS signature, the signature placement is implied by ISO 32000-1 [1]. In ISO 32000-1 [1], section 12.8.3.3.1 reads "No data shall be encapsulated in the PKCS#7 SignedData field". 

Remove the encapsulated content and your signature should be valid (unless there is any other issue).

[bsanchezb]

Closed