Introducing CounterSign Nathan McMinn Technical Consultant - Alfresco

What are Digital Signatures? “A digital signature is a mathematical scheme for demonstrating the authenticity of a digital message or document” http://en.wikipedia.org/wiki/Digital_signature

3 Criteria for Digital Signatures Authenticity: Guarantees that a signer is who they say that they are Conveys intent, that the document was intentionally signed for the stated reason

3 Criteria for Digital Signatures Non-repudiation: Ensures that a signer cannot make a claim that their key is secure while simultaneously claiming that they did not sign a document Requires hard to forge signing artifacts

3 Criteria for Digital Signatures Integrity: Verification that a document or message has not been altered since it was signed

How do Digital Signatures Work? Create a hash of the document Sign the hash with a private key (Optionally) embed the signed hash in the document Digital signatures rely on asymmetric encryption to allow signing and verification

PDF vs. Everything Else PDF documents have separate areas for storing content and signatures. This enables a PDF document to have multiple embedded signatures that do not alter the content, and thus, the hash of the content remains consistent across signings. CounterSign supports this via iText

PDF vs. Everything Else, part 2 Any type of document can be signed, but the signature is (generally) a separate artifact With a combination of the document, the signature and the public key of the purported signer, the signature can be verified CounterSign supports this too, including creating signatures, attaching them to the doc, managing the artifacts and verifying the signature.

Project Origin and Direction Origin: The Alfresco PDF Toolkit PDF Toolkit has a digital signature function but it is best suited for automated system signatures set by content rules Not very user friendly for end-users that wish to apply signatures! CounterSign started as a branch in the PDF toolkit, until it became apparent that the scope would be beyond just PDF docs Fork time!

The Old Way The Alfresco PDF toolkit can apply signatures, but the interface is not very user friendly! Origin: The Alfresco PDF Toolkit PDF Toolkit has a digital signature function but it is best suited for automated system signatures set by content rules Not very user friendly for end-users that wish to apply signatures! CounterSign started as a branch in the PDF toolkit, until it became apparent that the scope would be beyond just PDF docs Fork time!

CounterSign Design Goals Simple for non-technical users Self-service (where possible) Simple to administer Self Contained - External PKI integration possible, but not required Regulatory / Standards compliance Self service in this context means enabling a user to automatically generate their own signing artifacts within the constraints laid out by the admin Regulatory requirements are focused on US FDA CFR21 Part 11 Desired standards compliance is focused on CAdES / PAdES / XAdES once dependency issues are resolved.

CounterSign Design Goals, API Java Service API – currently sparse, but growing JavaScript API Signature provider interface for external PKI integration Custom Actions for applying signatures, creating form fields and more Self service in this context means enabling a user to automatically generate their own signing artifacts within the constraints laid out by the admin Regulatory requirements are focused on US FDA CFR21 Part 11 Desired standards compliance is focused on CAdES / PAdES / XAdES once dependency issues are resolved.

A Word on Standards Current CounterSign release (1.0) cannot achieve CAdES / PAdES compliance for PDF documents due to a dependency in Alfresco. Working on it! BouncyCastle version shipped with Alfresco is incompatible with the versions of iText needed for CAdES / PAdES compliance.

Demo

Required Reading Bruno Lowagie’s whitepaper on PDF Signatures: http://itextpdf.com/book/digitalsignatures20130304.pdf

Project and Contact Info Nathan McMinn – Technical Consultant Twitter: @ntmcminn nathanmcminn.com CounterSign: https://github.com/ntmcminn/CounterSign