Digitally Signing a PDF File

Introduction

The outbreak of the COVID-19 pandemic in 2019 increased substantially increased the use of electronic signatures. Nowadays, wet-ink signatures seem to be outdated.

Working from home-raised unprecedented issues for most companies that needed to sign documents in order to maintain the continuity of business operations. In response, we have seen an elevated interest in the use of electronic signatures.

Signing a PDF file saves time, lowers costs, increases productivity, reduces the need for paper-driven processes, and offers us the flexibility to approve a document from almost anywhere. Nevertheless, this may seem like a daunting task, especially for a first-timer.

The good news is that we can now execute this task easily by using the solution elaborated in the next section.

Difference between electronic and digital signatures

The differences between these two techniques are described below:

• An electronic signature is equivalent to a handwritten signature. It’s simply an exact image of the signature of the signatory, laid over a PDF document.

• A digital signatures is more secure and certifies that someone with a private signing key has seen the document and approved it. It’s very safe but at the same time, more complicated. Digital signatures can be seen as the online counterpart to a notarized signature. A trusted third party, known as a Certificate Authority, acts as a notary in terms of ascertaining the signatory’s identity.

You cannot remove a digital signature unless you are the one who placed it.

Generally, changing a certified PDF document is not possible. However, researchers at the Ruhr University Bochum in Germany have discovered these two types of attacks:

• Evil Annotation Attack (EAA).
• Sneaky Signature Attack (SSA).

These vulnerabilities enable the attacker to change the visible content of a PDF document by displaying unauthorized content over the certified content.

However, the certification remains valid and the application shows no warnings that unauthorized changes were made. However, the certification remains valid and the application shows no warnings that unauthorized changes were made. For additional details, we can refer to Falsifying And Weaponizing Certified Pdfs.

Scope

This lesson will showcase how to digitally sign a PDF document using a lightweight command-line-based utility developed in the Python programming language.