PAdES-LTV PDF Signature (Long Term Validation) in C#

A PAdES-B-LT signature (LTV, long term validation) can be validated years later, even when the certification authority no longer publishes the revocation information of the signing certificate. The signature is time-stamped and the certificate chain and the CRL and OCSP responses are embedded in the PDF document (the Document Security Store).

How to create a PAdES-LTV signature in C#

• SignatureStandard = PdfSignatureStandard.PadesLT adds the validation data after the signature is created.
• PadesLtvLevel selects the revocation information: IncludeCrlAndOcsp, IncludeOcspOnly (smaller files), IncludeCrl or None.
• TimeStamping.ServerUrl is required: the signature gets a trusted time (RFC 3161). Servers that require authentication are supported (user name and password, or a TLS client certificate).

C# code

/// <summary>
/// Signs a PDF file with a time-stamped PAdES-LT signature, with the validation data embedded in the document.
/// </summary>
static void SignPdfWithPadesLongTermValidation(string unsignedPdfFile, string signedPdfFile)
{
    PdfSignature pdfSignature = new PdfSignature(LibrarySerialNumber);

    pdfSignature.LoadPdfDocument(unsignedPdfFile);

    pdfSignature.DigitalSignatureCertificate = LoadSigningCertificate();

    pdfSignature.SigningReason = "I approve this document";
    pdfSignature.SigningLocation = "Accounting department";
    pdfSignature.SignaturePosition = SignaturePosition.TopLeft;

    pdfSignature.HashAlgorithm = SignLib.HashAlgorithm.SHA256;

    // PAdES-B-LT: the validation data (certificates and revocation information) is added to the document
    // security store of the PDF document, after the signature is created.
    pdfSignature.SignatureStandard = PdfSignatureStandard.PadesLT;

    // The revocation information collected from the certification authority and embedded in the document:
    // IncludeCrlAndOcsp - the CRLs and the OCSP responses; IncludeOcspOnly - the OCSP responses (smaller files)
    // and the CRLs only when an OCSP response is not available; IncludeCrl - the CRLs only; None - no revocation data.
    pdfSignature.PadesLtvLevel = PadesLtvLevel.IncludeCrlAndOcsp;

    // The signature is time-stamped (RFC 3161): a trusted time is added to the signature.
    pdfSignature.TimeStamping.ServerUrl = TimestampServerUrl;
    pdfSignature.TimeStamping.HashAlgorithm = SignLib.HashAlgorithm.SHA256;

    // A time-stamping server that requires authentication:
    // pdfSignature.TimeStamping.UserName = "username";
    // pdfSignature.TimeStamping.Password = "password";
    // or a TLS client certificate:
    // pdfSignature.TimeStamping.AuthenticationCertificate = certificate;

    File.WriteAllBytes(signedPdfFile, pdfSignature.ApplyDigitalSignature());

    Console.WriteLine("The PDF signature was created." + Environment.NewLine);
}

The validation data is taken from the addresses written in the signing certificate: a certificate issued by a certification authority that publishes a CRL or an OCSP responder. A self-signed test certificate gets only the certificate in the document.

For archiving, the PAdES-B-LTA level adds a document time-stamp over the signature and the validation data; it is renewed before the certificate of the time-stamping authority expires.

Frequently asked questions