signPDFLM: Digitally sign and verify a PDF report

Description

Apply a cryptographic digital signature to a (report) PDF, as an alternative to the print-sign-scan workflow, and verify it. signPDFLM signs the PDF bytes with the signer's private key (RSA or EC) using SHA-256 and writes a detached signature sidecar <pdf>.sig (and, by default, the signer's public key <pdf>.pubkey.pem). verifyPDFLM confirms, with the signer's public key or certificate, that the PDF is byte-for-byte intact and was signed by that key (tamper-evidence and non-repudiation). These functions require the openssl package.

This is a detached signature (a separate .sig file), not a PAdES signature embedded inside the PDF; embedding a visible in-viewer signature requires a dedicated PDF tool (e.g. Adobe Acrobat or pyhanko). The detached signature is cryptographically equivalent for integrity and non-repudiation.

Usage

signPDFLM(pdf, key, password = NULL, signer = "", role = "",
       sigFile = paste0(pdf, ".sig"), writePubkey = TRUE)
verifyPDFLM(pdf, sigFile = paste0(pdf, ".sig"), pubkey = paste0(pdf, ".pubkey.pem"))

Value

signPDFLM invisibly returns a list with the sidecar path, the PDF sha256, the signer, and the public-key fingerprint; it writes the .sig sidecar as a side effect. verifyPDFLM invisibly returns TRUE only if both the signature is valid and the recorded hash matches, and prints a human-readable result.

Arguments

pdf: path to the PDF file to sign or verify.
key: the signer's private key: a path to a PEM key file or an openssl key object. Create one once with, e.g., openssl::rsa_keygen() and openssl::write_pem().
password: password for an encrypted private key, or NULL.
signer: name of the signer, recorded in the signature sidecar. Defaults to the login name.
role: optional role recorded in the sidecar, e.g. "Performed by" or "Reviewed by".
sigFile: path of the signature sidecar to write (signPDFLM) or read (verifyPDFLM).
writePubkey: if TRUE, also write the signer's public key next to the PDF for convenience. For non-repudiation, verify against the signer's independently-trusted public key or certificate, not one shipped with the file.
pubkey: the signer's public key or certificate used to verify: a PEM path (public key or X.509 certificate) or an openssl pubkey/cert object.

Author

Kyun-Seop Bae <k@acr.kr>

Examples

Run this code

#key <- openssl::rsa_keygen()
#openssl::write_pem(key, "signer_key.pem")
#IQLM("sasLM-IQ-Report.pdf", performedBy = "Kyun-Seop Bae")
#signPDFLM("sasLM-IQ-Report.pdf", "signer_key.pem", signer = "Kyun-Seop Bae")
#verifyPDFLM("sasLM-IQ-Report.pdf")