1. Introducing CounterSign
Nathan McMinn Technical Consultant - Alfresco

2. What are Digital Signatures?
“A digital signature is a mathematical scheme for demonstrating the authenticity of a digital message or document”

3. 3 Criteria for Digital Signatures
Authenticity:
Guarantees that a signer is who they say that they are
Conveys intent, that the document was intentionally signed for the stated reason

4. 3 Criteria for Digital Signatures
Non-repudiation:
Ensures that a signer cannot make a claim that their key is secure while simultaneously claiming that they did not sign a document
Requires hard to forge signing artifacts

5. 3 Criteria for Digital Signatures
Integrity:
Verification that a document or message has not been altered since it was signed

6. How do Digital Signatures Work?
Create a hash of the document
Sign the hash with a private key
(Optionally) embed the signed hash in the document
Digital signatures rely on asymmetric encryption to allow signing and verification

7. PDF vs. Everything Else
PDF documents have separate areas for storing content and signatures. This enables a PDF document to have multiple embedded signatures that do not alter the content, and thus, the hash of the content remains consistent across signings.
CounterSign supports this via iText

8. PDF vs. Everything Else, part 2
Any type of document can be signed, but the signature is (generally) a separate artifact With a combination of the document, the signature and the public key of the purported signer, the signature can be verified
CounterSign supports this too, including creating signatures, attaching them to the doc, managing the artifacts and verifying the signature.

9. Project Origin and Direction
Origin: The Alfresco PDF Toolkit
PDF Toolkit has a digital signature function but it is best suited for automated system signatures set by content rules
Not very user friendly for end-users that wish to apply signatures!
CounterSign started as a branch in the PDF toolkit, until it became apparent that the scope would be beyond just PDF docs
Fork time!

10. The Old Way
The Alfresco PDF toolkit can apply signatures, but the interface is not very user friendly!
Origin: The Alfresco PDF Toolkit
PDF Toolkit has a digital signature function but it is best suited for automated system signatures set by content rules
Not very user friendly for end-users that wish to apply signatures!
CounterSign started as a branch in the PDF toolkit, until it became apparent that the scope would be beyond just PDF docs
Fork time!

11. CounterSign Design Goals
Simple for non-technical users
Self-service (where possible)
Simple to administer
Self Contained - External PKI integration possible, but not required
Regulatory / Standards compliance
Self service in this context means enabling a user to automatically generate their own signing artifacts within the constraints laid out by the admin
Regulatory requirements are focused on US FDA CFR21 Part 11
Desired standards compliance is focused on CAdES / PAdES / XAdES once dependency issues are resolved.

12. CounterSign Design Goals, API
Java Service API – currently sparse, but growing
JavaScript API
Signature provider interface for external PKI integration
Custom Actions for applying signatures, creating form fields and more
Self service in this context means enabling a user to automatically generate their own signing artifacts within the constraints laid out by the admin
Regulatory requirements are focused on US FDA CFR21 Part 11
Desired standards compliance is focused on CAdES / PAdES / XAdES once dependency issues are resolved.

13. A Word on Standards
Current CounterSign release (1.0) cannot achieve CAdES / PAdES compliance for PDF documents due to a dependency in Alfresco. Working on it!
BouncyCastle version shipped with Alfresco is incompatible with the versions of iText needed for CAdES / PAdES compliance.

14. Demo

15. Required Reading
Bruno Lowagie’s whitepaper on PDF Signatures:

16. Project and Contact Info
Nathan McMinn – Technical Consultant nathanmcminn.com CounterSign: