4

I have a requirement where a PDF document is generated on the application server in a web based .Net application and the same is digitally signed and mailed to the recepient. The signing and mail action will happen on user's action in the web application (on his browser on the desktop). The users signing digital signature will be in a USB etoken attached to his local desktop.

Is this feasible and how can we do the same?

1
  • 1
    Smartcard + PKCS#11? To precise that: You create the PDF on the server, send it to the client, which signs it (using his smartcard / eToken) and mails it somewhere?
    – SEJPM
    Jul 14, 2015 at 12:41

3 Answers 3

2

If the signature is supposed to assert document ownership or acceptance by the user, then the power to sign should remain in the hands of the user (precisely where his "USB etoken" resides). Since signature algorithms begin by a hash function invocation (the message to sign is hashed, and the rest of the algorithm uses the hash value as input), at least the hash of the PDF file should be sent to the user's machine.

Javascript in Web browsers does not have (yet) the ability to access hardware devices on the user's side. You won't be able to do such a thing without some kind of user-side native or pseudo-native code; this means ActiveX, Silverlight (subject to user's authorization), a (signed) Java applet, or some non-Web executable that the user runs on his machine. None of these technologies is really easy to deploy. None of these will work with tablets / smartphones (for these, a full-blown app will be needed).

Anyway, if you want the user to sign, then you want to potentially make the user accountable for whatever he signs. This is a partly legal issue, for which technology is only part of the solution. You will need a signature solution that would potentially "hold in court", which depends a lot on the local jurisdiction.

2

Most of the web applications require Digital Signing documents, files, eReturns (XML or JSON) etc, from user’s Browser using user’s local machine Key-store, USB Token or Smartcard. Older methods being java applets, Active X, etc which are phased out or are being phased out from the new Modern Browser offerings.

Recently much is being talked about WebCrypto API but as of now, WebCrypto API does not provide access to (Windows) or any other Key stores or local crypto USB/Smartcard device.

Although webcrypto does not provide access to smart cards, there is an application called FortifyApp that provides a webcrypto polyfill that does via that same interface.

My company also offers free Signer.Digital Browser Extension for Signing from modern browsers, setup for the same may be downloaded from cNet site https://download.cnet.com/Signer-Digital-Chrome-Extension/3000-33362_4-78042540.html

You would be able to access local systems Certificate Store from Chrome Browser and JavaScript functions in this extension or any other extension available in Chrome Web Store.

Sample ASP.NET MVC Project (Working in VS2015) may be Downloaded

Working implementation may be tested at this portal

Digital Signing from Web Browser

Digital Signing from Web Browser

0
0

What you are describing is weird. A digital signature supposes that the private key never leaves the control of its owner. That means that if the document has to be signed by the user, the operation can only happen on the client machine, and the whole responsability belongs to the user.

On the other hand, it is perfectly acceptable to sign a document server side. In that case, the private key resides on the server (it can be in a HSM), and the responsability belongs to the owner of the application. The signature only says that provided the system was correctly functionning, the document was generated there in known conditions. It will not have the same value as a personnal digital signature because it can in theory be used by anyone with admin privileges on the system.

1
  • The question has a tag "web-application". Also says USB token. Web application may have thousands of user. I also work on solution to support thousands of user from HSM but, please read the answer in the context of question. Apr 16, 2020 at 1:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .