IPdfExternalSigner Interface


IPdfExternalSigner Interface

Signs a PDF document with a private key held outside the library - in a hardware security module (HSM), a smart card, a PKCS#11 token or a cloud key service.

Namespace: SelectPdf.Universal
Assembly: SelectPdf.Universal (in SelectPdf.Universal.dll) Version: 26.5

Syntax

Copy

public interface IPdfExternalSigner

Public Interface IPdfExternalSigner

The IPdfExternalSigner type exposes the following members.

Properties

	Name	Description
	Certificates	Gets the certificates of the signer, each DER-encoded: the signing certificate first, then the certificates of its issuers.

Top

Methods

	Name	Description
	Sign	Signs the request with the private key of the signing certificate.

Top

Remarks

The library builds the whole signature - the certificates, the signed attributes, the timestamp and the long-term validation data - and asks the signer for one thing only: the raw signature value over Data. The private key never has to leave the device or service that holds it.

Pass an implementation to Sign(IPdfExternalSigner) or to a PdfDigitalSignatureElement. When the signature cannot be produced while the document is being saved - a remote signing service where the signer approves on another device - use PrepareExternalSignature(IListByte, String) and CompleteExternalSignature(String, String, String, IListByte, PdfSignatureDigest, Byte) instead.

Example

Copy

// A signer backed by any key that can sign a digest:
// an HSM, a smart card, a key service.
class KeyServiceSigner : IPdfExternalSigner
{
    private readonly System.Security.Cryptography.RSA key;
    public KeyServiceSigner(IList<byte[]> certificates,
        System.Security.Cryptography.RSA key)
    {
        Certificates = certificates;
        this.key = key;
    }

    public IList<byte[]> Certificates { get; }

    public byte[] Sign(PdfExternalSigningRequest request)
    {
        var hash = new System.Security.Cryptography.HashAlgorithmName(
            request.DigestAlgorithm.ToString());
        return key.SignHash(request.Digest, hash,
            System.Security.Cryptography.RSASignaturePadding.Pkcs1);
    }
}

PdfSecurityManager manager = new PdfSecurityManager();
manager.Load("contract.pdf");
manager.Sign(new KeyServiceSigner(certificates, key), "Signature1");
manager.Save("contract-signed.pdf");

' A signer backed by any key that can sign a digest:
' an HSM, a smart card, a key service.
Class KeyServiceSigner
    Implements IPdfExternalSigner

    Private ReadOnly key As System.Security.Cryptography.RSA
    Private ReadOnly chain As IList(Of Byte())

    Public Sub New(certificates As IList(Of Byte()),
                   key As System.Security.Cryptography.RSA)
        chain = certificates
        Me.key = key
    End Sub

    Public ReadOnly Property Certificates As IList(Of Byte()) _
        Implements IPdfExternalSigner.Certificates
        Get
            Return chain
        End Get
    End Property

    Public Function Sign(request As PdfExternalSigningRequest) As Byte() _
        Implements IPdfExternalSigner.Sign
        Dim hash As New System.Security.Cryptography.HashAlgorithmName(
            request.DigestAlgorithm.ToString())
        Return key.SignHash(request.Digest, hash,
            System.Security.Cryptography.RSASignaturePadding.Pkcs1)
    End Function
End Class

Dim manager As New PdfSecurityManager()
manager.Load("contract.pdf")
manager.Sign(New KeyServiceSigner(certificates, key), "Signature1")
manager.Save("contract-signed.pdf")

Reference

SelectPdf.Universal Namespace