The signature byte range is invalid in Acrobat

Question

I'm trying to make a timestamp of the PDF document using our library that we're making. I added a new section to the PDF document. I added new annotation object for the signature and the signature object containing the actual signature, and also a new xref table for the new section. When I check the xref entries everything seems right.

When I try to verify my signature in Acrobat I get the following error message "there are errors in the formatting of information contained in this signature (The signature byte range is invalid)".

However, when I check the byte range, everything seems right. I goes from the beginning of the document to the opening brackets of the Contents part, and from the end of it to the end of the document. I compared it with the document that has valid signature and it seems that byte ranges look the same.

I really don't understand what's wrong and why is Acrobat showing this error.

Here's the link to the signed file if anybody wants to have a look: https://ufile.io/mckajk9h

PS: I can share some part of the code, but the actual question is about the Acrobat reader and how it interprets PDF signatures, not my code. So, the relevant part should be the resulting PDF file that I shared.

Answer 1

There are some issues in your PDF.

The Major Issue

The major one which results in the non-intuitive error message: The first entry in your incremental update cross reference table is one byte too short:

As you can see, the first cross reference table entry (0000000000 65535 f\n) is one byte too short, according to the specification it has to be exactly 20 bytes long but yours is only 19 bytes long.

Whenever Adobe Acrobat sees structurally broken cross reference tables, it internally repairs the file. In the repaired file the objects are rearranged which renders the signature byte range invalid.

As soon as I had fixed this by adding a space between f and \n, Adobe Acrobat did not complain about a formatting error anymore. Of course it claimed that the document had been altered or corrupted, after all I had altered it. But at least it accepted the signature structure.

Minor Issues

Some of your offsets are incorrect, in your incremental update you have

xref
0 2
0000000000 65535 f
0000003029 00000 n 
12 2
0000003144 00000 n 
0000003265 00000 n  

Thus, object 12 should start at 3144 but it actually starts at 3145.

Furthermore, you have

startxref
19548
%%EOF 

So the xref keyword should start at 19548 but it starts at 19549.