Integrity verification of Signature after Signature creation to ensure correct signed Document

15 files changed, 239 insertions, 104 deletions

diff --git a/pdf-as-common/src/main/java/at/gv/egiz/pdfas/common/exceptions/PdfAsSignatureException.java b/pdf-as-common/src/main/java/at/gv/egiz/pdfas/common/exceptions/PdfAsSignatureException.java
index 759a9ec8..f701bffc 100644
--- a/pdf-as-common/src/main/java/at/gv/egiz/pdfas/common/exceptions/PdfAsSignatureException.java
+++ b/pdf-as-common/src/main/java/at/gv/egiz/pdfas/common/exceptions/PdfAsSignatureException.java
@@ -33,4 +33,8 @@ public class PdfAsSignatureException extends PdfAsException {
 	public PdfAsSignatureException(String msgId, Throwable e) {
         super(msgId, e);
     }
+	
+	public PdfAsSignatureException(String msgId) {
+        super(msgId);
+    }
 }
diff --git a/pdf-as-common/src/main/java/at/gv/egiz/pdfas/common/utils/PDFUtils.java b/pdf-as-common/src/main/java/at/gv/egiz/pdfas/common/utils/PDFUtils.java
index 8eb2e8bb..68cfd80a 100644
--- a/pdf-as-common/src/main/java/at/gv/egiz/pdfas/common/utils/PDFUtils.java
+++ b/pdf-as-common/src/main/java/at/gv/egiz/pdfas/common/utils/PDFUtils.java
@@ -99,6 +99,33 @@ public class PDFUtils {
 		return data;
 	}
 	
+	public static byte[] extractSignatureData(byte[] signatureData, int[] byteRange) throws PDFIOException {
+		if(byteRange.length % 2 != 0) {
+			throw new PDFIOException("error.pdf.io.09");
+		}
+		
+		int lastOffset = byteRange[byteRange.length - 2];
+		int lastSize = byteRange[byteRange.length - 1];
+		
+		int dataSize = lastOffset + lastSize;
+		
+		byte[] data = new byte[dataSize];
+		int currentdataOff = 0;
+		
+		Arrays.fill(data, (byte)0x0);
+		
+		for(int i = 0; i < byteRange.length; i = i + 2) {
+			int offset = byteRange[i];
+			int size = byteRange[i+1];
+			
+			for(int j = 0; j < size; j++) {
+				data[offset + j] = signatureData[currentdataOff];
+				currentdataOff++;
+			}
+		}
+		return data;
+	}
+	
 	private static int extractASCIIInteger(byte[] data, int offset) {
 		int nextsepp = nextSeperator(data, offset);
 
diff --git a/pdf-as-common/src/main/java/at/gv/egiz/pdfas/common/utils/StreamUtils.java b/pdf-as-common/src/main/java/at/gv/egiz/pdfas/common/utils/StreamUtils.java
index 579099f0..50ec444c 100644
--- a/pdf-as-common/src/main/java/at/gv/egiz/pdfas/common/utils/StreamUtils.java
+++ b/pdf-as-common/src/main/java/at/gv/egiz/pdfas/common/utils/StreamUtils.java
@@ -28,24 +28,36 @@ import java.io.IOException;
 import java.io.InputStream;
 
 /**
- * Created with IntelliJ IDEA.
- * User: afitzek
- * Date: 8/29/13
- * Time: 9:54 AM
- * To change this template use File | Settings | File Templates.
+ * Created with IntelliJ IDEA. User: afitzek Date: 8/29/13 Time: 9:54 AM To
+ * change this template use File | Settings | File Templates.
  */
 public class StreamUtils {
 
-    public static byte[] inputStreamToByteArray(InputStream stream) throws IOException {
-        ByteArrayOutputStream bos = new ByteArrayOutputStream();
-        byte[] buffer = new byte[4096];
-        int readBytes = 0;
+	public static byte[] inputStreamToByteArray(InputStream stream)
+			throws IOException {
+		ByteArrayOutputStream bos = new ByteArrayOutputStream();
+		byte[] buffer = new byte[4096];
+		int readBytes = 0;
 
-        while((readBytes = stream.read(buffer)) != -1) {
-            bos.write(buffer, 0, readBytes);
-        }
-        stream.close();
-        bos.close();
-        return bos.toByteArray();
-    }
+		while ((readBytes = stream.read(buffer)) != -1) {
+			bos.write(buffer, 0, readBytes);
+		}
+		stream.close();
+		bos.close();
+		return bos.toByteArray();
+	}
+
+	public static boolean dataCompare(byte[] a, byte[] b) {
+		if (a != null && b != null) {
+			if (a.length == b.length) {
+				for(int i = 0; i < a.length; i++) {
+					if(a[i] != b[i]) {
+						return false;
+					}
+				}
+				return true;
+			}
+		}
+		return false;
+	}
 }
diff --git a/pdf-as-legacy/src/main/java/at/gv/egiz/pdfas/wrapper/PdfAsObject.java b/pdf-as-legacy/src/main/java/at/gv/egiz/pdfas/wrapper/PdfAsObject.java
index 9ed02053..bef3b01f 100644
--- a/pdf-as-legacy/src/main/java/at/gv/egiz/pdfas/wrapper/PdfAsObject.java
+++ b/pdf-as-legacy/src/main/java/at/gv/egiz/pdfas/wrapper/PdfAsObject.java
@@ -59,6 +59,7 @@ import at.gv.egiz.pdfas.lib.api.sign.SignParameter;
 import at.gv.egiz.pdfas.lib.api.verify.VerifyParameter;
 import at.gv.egiz.pdfas.lib.api.verify.VerifyResult;
 import at.gv.egiz.pdfas.lib.impl.SignaturePositionImpl;
+import at.gv.egiz.pdfas.lib.impl.StatusRequestImpl;
 
 public class PdfAsObject implements PdfAs {
 
@@ -82,14 +83,22 @@ public class PdfAsObject implements PdfAs {
 		}
 
 		SignatureDetailInformationWrapper sdi = (SignatureDetailInformationWrapper) signatureDetailInformation;
-		StatusRequest request = sdi.getStatus();
+		StatusRequest statusRequest = sdi.getStatus();
+		
+		if (!(statusRequest instanceof StatusRequestImpl)) {
+			throw new PdfAsException(ErrorCode.SIGNATURE_COULDNT_BE_CREATED,
+					"Invalid state");
+		}
 
+		StatusRequestImpl request = (StatusRequestImpl) statusRequest;
+		
 		if (request.needSignature()) {
 			try {
 				byte[] signature = sdi.wrapper.getSignParameter4().getPlainSigner().sign(
-						request.getSignatureData(), request.getSignatureDataByteRange(), sdi.wrapper.getSignParameter4());
+						request.getSignatureData(), request.getSignatureDataByteRange(), sdi.wrapper.getSignParameter4(), 
+						request.getStatus().getRequestedSignature());
 				request.setSigature(signature);
-				request = this.pdfas4.process(request);
+				request = (StatusRequestImpl) this.pdfas4.process(request);
 				if(request.isReady()) {
 					at.gv.egiz.pdfas.lib.api.sign.SignResult result = this.pdfas4.finishSign(request);
 					sdi.wrapper.syncNewToOld();
diff --git a/pdf-as-lib/src/main/java/at/gv/egiz/pdfas/lib/api/sign/IPlainSigner.java b/pdf-as-lib/src/main/java/at/gv/egiz/pdfas/lib/api/sign/IPlainSigner.java
index 903b9630..a167c596 100644
--- a/pdf-as-lib/src/main/java/at/gv/egiz/pdfas/lib/api/sign/IPlainSigner.java
+++ b/pdf-as-lib/src/main/java/at/gv/egiz/pdfas/lib/api/sign/IPlainSigner.java
@@ -25,6 +25,7 @@ package at.gv.egiz.pdfas.lib.api.sign;
 
 import iaik.x509.X509Certificate;
 import at.gv.egiz.pdfas.common.exceptions.PdfAsException;
+import at.gv.egiz.pdfas.lib.impl.status.RequestedSignature;
 
 /**
  * Signer interface
@@ -48,7 +49,7 @@ public interface IPlainSigner {
 	 * @return
 	 * @throws PdfAsException
 	 */
-    public byte[] sign(byte[] input, int[] byteRange, SignParameter parameter) throws PdfAsException;
+    public byte[] sign(byte[] input, int[] byteRange, SignParameter parameter, RequestedSignature requestedSignature) throws PdfAsException;
     
     /**
      * Gets the PDF Subfilter for this signer
diff --git a/pdf-as-lib/src/main/java/at/gv/egiz/pdfas/lib/impl/PdfAsImpl.java b/pdf-as-lib/src/main/java/at/gv/egiz/pdfas/lib/impl/PdfAsImpl.java
index 28bd9151..7dcdca2b 100644
--- a/pdf-as-lib/src/main/java/at/gv/egiz/pdfas/lib/impl/PdfAsImpl.java
+++ b/pdf-as-lib/src/main/java/at/gv/egiz/pdfas/lib/impl/PdfAsImpl.java
@@ -31,15 +31,12 @@ import java.awt.image.BufferedImage;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.File;
-import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.OutputStream;
 import java.util.ArrayList;
 import java.util.Calendar;
 import java.util.List;
 
-import javax.imageio.ImageIO;
-
 import org.apache.pdfbox.cos.COSArray;
 import org.apache.pdfbox.cos.COSBase;
 import org.apache.pdfbox.cos.COSDictionary;
@@ -47,14 +44,13 @@ import org.apache.pdfbox.cos.COSName;
 import org.apache.pdfbox.cos.COSString;
 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDPage;
-import org.apache.pdfbox.pdmodel.PDPageable;
-import org.apache.pdfbox.util.PDFImageWriter;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import at.gv.egiz.pdfas.common.exceptions.PDFIOException;
 import at.gv.egiz.pdfas.common.exceptions.PdfAsException;
 import at.gv.egiz.pdfas.common.exceptions.PdfAsSettingsException;
+import at.gv.egiz.pdfas.common.exceptions.PdfAsSignatureException;
 import at.gv.egiz.pdfas.common.exceptions.PdfAsValidationException;
 import at.gv.egiz.pdfas.common.settings.ISettings;
 import at.gv.egiz.pdfas.common.settings.Settings;
@@ -87,6 +83,7 @@ import at.gv.egiz.pdfas.lib.impl.status.PDFObject;
 import at.gv.egiz.pdfas.lib.impl.status.RequestedSignature;
 import at.gv.egiz.pdfas.lib.impl.verify.IVerifyFilter;
 import at.gv.egiz.pdfas.lib.impl.verify.VerifierDispatcher;
+import at.gv.egiz.pdfas.lib.util.SignatureUtils;
 import at.knowcenter.wag.egov.egiz.pdf.PositioningInstruction;
 import at.knowcenter.wag.egov.egiz.pdf.TablePos;
 import at.knowcenter.wag.egov.egiz.table.Table;
@@ -193,18 +190,11 @@ public class PdfAsImpl implements PdfAs, IConfigurationConstants {
 			IPdfSigner signer = PdfSignerFactory.createPdfSigner();
 			signer.signPDF(status.getPdfObject(), requestedSignature,
 					new PdfboxSignerWrapper(status.getSignParamter()
-							.getPlainSigner(), parameter));
+							.getPlainSigner(), parameter, requestedSignature));
 
 			// ================================================================
 			// Create SignResult
-			SignResultImpl result = new SignResultImpl(status.getSignParamter()
-					.getOutput());
-			OutputStream outputStream = result.getOutputDocument()
-					.createOutputStream();
-
-			outputStream.write(status.getPdfObject().getSignedDocument());
-
-			outputStream.close();
+			SignResult result = createSignResult(status);
 
 			return result;
 		} catch (Throwable e) {
@@ -424,7 +414,16 @@ public class PdfAsImpl implements PdfAs, IConfigurationConstants {
 			String signature = new COSString(request.getSignature())
 					.getHexString();
 			byte[] pdfSignature = signature.getBytes();
-
+			//byte[] input = PDFUtils.blackOutSignature(status.getPdfObject().getSignedDocument(), 
+			//		request.getSignatureDataByteRange());
+			VerifyResult verifyResult = SignatureUtils.verifySignature(request.getSignature(), request.getSignatureData());
+			RequestedSignature requestedSignature = request.getStatus().getRequestedSignature();
+			
+			if(!StreamUtils.dataCompare(requestedSignature.getCertificate().getFingerprintSHA(),
+					verifyResult.getSignerCertificate().getFingerprintSHA())) {
+				throw new PdfAsSignatureException("Certificates missmatch!");
+			}
+			
 			for (int i = 0; i < pdfSignature.length; i++) {
 				status.getPdfObject().getSignedDocument()[offset + i] = pdfSignature[i];
 			}
diff --git a/pdf-as-lib/src/main/java/at/gv/egiz/pdfas/lib/impl/signing/pdfbox/PADESPDFBOXSigner.java b/pdf-as-lib/src/main/java/at/gv/egiz/pdfas/lib/impl/signing/pdfbox/PADESPDFBOXSigner.java
index 4e82efa5..c8c4eeb4 100644
--- a/pdf-as-lib/src/main/java/at/gv/egiz/pdfas/lib/impl/signing/pdfbox/PADESPDFBOXSigner.java
+++ b/pdf-as-lib/src/main/java/at/gv/egiz/pdfas/lib/impl/signing/pdfbox/PADESPDFBOXSigner.java
@@ -35,7 +35,6 @@ import java.util.List;
 import org.apache.pdfbox.cos.COSBase;
 import org.apache.pdfbox.cos.COSDictionary;
 import org.apache.pdfbox.cos.COSName;
-import org.apache.pdfbox.cos.COSObject;
 import org.apache.pdfbox.exceptions.COSVisitorException;
 import org.apache.pdfbox.exceptions.SignatureException;
 import org.apache.pdfbox.pdmodel.PDDocument;
@@ -343,7 +342,7 @@ public class PADESPDFBOXSigner implements IPdfSigner, IConfigurationConstants {
 				sigFieldName = "PDF-AS Signatur";
 			}
 			
-			int count = SignatureUtils.countSignatures(doc);
+			int count = SignatureUtils.countSignatures(doc, sigFieldName);
 			
 			sigFieldName = sigFieldName + count;
 
diff --git a/pdf-as-lib/src/main/java/at/gv/egiz/pdfas/lib/impl/signing/pdfbox/PdfboxSignerWrapper.java b/pdf-as-lib/src/main/java/at/gv/egiz/pdfas/lib/impl/signing/pdfbox/PdfboxSignerWrapper.java
index faa49148..44915a42 100644
--- a/pdf-as-lib/src/main/java/at/gv/egiz/pdfas/lib/impl/signing/pdfbox/PdfboxSignerWrapper.java
+++ b/pdf-as-lib/src/main/java/at/gv/egiz/pdfas/lib/impl/signing/pdfbox/PdfboxSignerWrapper.java
@@ -39,6 +39,7 @@ import at.gv.egiz.pdfas.common.utils.StreamUtils;
 import at.gv.egiz.pdfas.lib.api.sign.IPlainSigner;
 import at.gv.egiz.pdfas.lib.api.sign.SignParameter;
 import at.gv.egiz.pdfas.lib.impl.signing.sig_interface.PDFASSignatureInterface;
+import at.gv.egiz.pdfas.lib.impl.status.RequestedSignature;
 
 public class PdfboxSignerWrapper implements PDFASSignatureInterface {
 
@@ -46,16 +47,17 @@ public class PdfboxSignerWrapper implements PDFASSignatureInterface {
 			.getLogger(PdfboxSignerWrapper.class);
 
 	private IPlainSigner signer;
-	@SuppressWarnings("unused")
-  private PDSignature signature;
+	private PDSignature signature;
 	private int[] byteRange;
 	private Calendar date;
 	private SignParameter parameters;
+	private RequestedSignature requestedSignature;
 
-	public PdfboxSignerWrapper(IPlainSigner signer, SignParameter parameters) {
+	public PdfboxSignerWrapper(IPlainSigner signer, SignParameter parameters, RequestedSignature requestedSignature) {
 		this.signer = signer;
 		this.date = Calendar.getInstance();
 		this.parameters = parameters;
+		this.requestedSignature = requestedSignature;
 	}
 
 	public byte[] sign(InputStream inputStream) throws SignatureException,
@@ -66,7 +68,7 @@ public class PdfboxSignerWrapper implements PDFASSignatureInterface {
 		logger.info("Byte Range 2: " + byteRange2);
 		try {
 			logger.info("Signing with Pdfbox Wrapper");
-			byte[] signature = signer.sign(data, byteRange, this.parameters);
+			byte[] signature = signer.sign(data, byteRange, this.parameters, this.requestedSignature);
 			return signature;
 		} catch (PdfAsException e) {
 			throw new PdfAsWrappedIOException(e);
diff --git a/pdf-as-lib/src/main/java/at/gv/egiz/pdfas/lib/util/SignatureUtils.java b/pdf-as-lib/src/main/java/at/gv/egiz/pdfas/lib/util/SignatureUtils.java
index 28713e1a..4527b92b 100644
--- a/pdf-as-lib/src/main/java/at/gv/egiz/pdfas/lib/util/SignatureUtils.java
+++ b/pdf-as-lib/src/main/java/at/gv/egiz/pdfas/lib/util/SignatureUtils.java
@@ -1,13 +1,31 @@
 package at.gv.egiz.pdfas.lib.util;
 
+import iaik.cms.CMSException;
+import iaik.cms.SignedData;
+import iaik.cms.SignerInfo;
+import iaik.x509.X509Certificate;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.security.SignatureException;
+
 import org.apache.pdfbox.cos.COSArray;
 import org.apache.pdfbox.cos.COSDictionary;
 import org.apache.pdfbox.cos.COSName;
 import org.apache.pdfbox.pdmodel.PDDocument;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import at.gv.egiz.pdfas.common.exceptions.PdfAsSignatureException;
+import at.gv.egiz.pdfas.lib.api.verify.VerifyResult;
+import at.gv.egiz.pdfas.lib.impl.verify.VerifyResultImpl;
 
 public class SignatureUtils {
 
-	public static int countSignatures(PDDocument doc) {
+	private static final Logger logger = LoggerFactory
+			.getLogger(SignatureUtils.class);
+
+	public static int countSignatures(PDDocument doc, String sigName) {
 		int count = 0;
 		COSDictionary trailer = doc.getDocument().getTrailer();
 		COSDictionary root = (COSDictionary) trailer
@@ -20,10 +38,93 @@ public class SignatureUtils {
 			COSDictionary field = (COSDictionary) fields.getObject(i);
 			String type = field.getNameAsString("FT");
 			if ("Sig".equals(type)) {
-				count++;
+				String name = field.getString(COSName.T);
+				if (name != null) {
+					logger.debug("Found Sig: " + name);
+					try {
+						if (name.startsWith(sigName)) {
+							String numberString = name.replace(sigName, "");
+
+							logger.debug("Found Number: " + numberString);
+
+							int SigIDX = Integer.parseInt(numberString);
+							if(SigIDX > count) {
+								count = SigIDX;
+							}
+						}
+					} catch (Throwable e) {
+						logger.error("Failed to extract Signature Name!", e);
+					}
+				}
 			}
+
 		}
+
+		count++;
+		
+		logger.debug("Returning sig number: " + count);
 		
 		return count;
 	}
+
+	
+	public static VerifyResult verifySignature(byte[] signature, byte[] input) throws PdfAsSignatureException {
+		//List<VerifyResult> results = new ArrayList<VerifyResult>();
+		try {
+			SignedData signedData = new SignedData(new ByteArrayInputStream(
+					signature));
+
+			signedData.setContent(input);
+			
+			// get the signer infos
+			SignerInfo[] signerInfos = signedData.getSignerInfos();
+			if (signerInfos.length == 0) {
+				throw new PdfAsSignatureException("Invalid Signature (no signer info created!)", null);
+			}
+			
+			if (signerInfos.length != 1) {
+				throw new PdfAsSignatureException("Invalid Signature (multiple signer infos found!)", null);
+			}
+			// verify the signatures
+			//for (int i = 0; i < signerInfos.length; i++) {
+				VerifyResultImpl verifyResult = new VerifyResultImpl();
+				//results.add(verifyResult);
+				try {
+					logger.info("Signature Algo: {}, Digest {}", signedData
+							.getSignerInfos()[0].getSignatureAlgorithm(),
+							signedData.getSignerInfos()[0].getDigestAlgorithm());
+					// verify the signature for SignerInfo at index i
+					X509Certificate signer_cert = signedData.verify(0);
+					// if the signature is OK the certificate of the
+					// signer is returned
+					logger.info("Signature OK from signer: "
+							+ signer_cert.getSubjectDN());
+					verifyResult.setSignerCertificate(signer_cert);
+
+				} catch (SignatureException ex) {
+					// if the signature is not OK a SignatureException
+					// is thrown
+					logger.error(
+							"Signature ERROR from signer: "
+									+ signedData.getCertificate(
+											signerInfos[0]
+													.getSignerIdentifier())
+											.getSubjectDN(), ex);
+
+					verifyResult.setSignerCertificate(signedData
+							.getCertificate(signerInfos[0]
+									.getSignerIdentifier()));
+					throw new PdfAsSignatureException("error.pdf.sig.08", ex);
+				}
+				
+				return verifyResult;
+			//}
+		} catch (CMSException e) {
+			throw new PdfAsSignatureException("error.pdf.sig.08", e);
+		} catch (IOException e) {
+			throw new PdfAsSignatureException("error.pdf.sig.08", e);
+		}
+		
+		
+	}
 }
diff --git a/pdf-as-lib/src/main/java/at/gv/egiz/sl/util/ISignatureConnector.java b/pdf-as-lib/src/main/java/at/gv/egiz/sl/util/ISignatureConnector.java
index fdb95f49..24a1b84d 100644
--- a/pdf-as-lib/src/main/java/at/gv/egiz/sl/util/ISignatureConnector.java
+++ b/pdf-as-lib/src/main/java/at/gv/egiz/sl/util/ISignatureConnector.java
@@ -26,8 +26,9 @@ package at.gv.egiz.sl.util;
 import iaik.x509.X509Certificate;
 import at.gv.egiz.pdfas.common.exceptions.PdfAsException;
 import at.gv.egiz.pdfas.lib.api.sign.SignParameter;
+import at.gv.egiz.pdfas.lib.impl.status.RequestedSignature;
 
 public interface ISignatureConnector {
 	public X509Certificate getCertificate(SignParameter parameter) throws PdfAsException;
-    public byte[] sign(byte[] input, int[] byteRange, SignParameter parameter) throws PdfAsException;
+    public byte[] sign(byte[] input, int[] byteRange, SignParameter parameter, RequestedSignature requestedSignature) throws PdfAsException;
 }
diff --git a/pdf-as-lib/src/main/java/at/gv/egiz/sl/util/ISignatureConnectorSLWrapper.java b/pdf-as-lib/src/main/java/at/gv/egiz/sl/util/ISignatureConnectorSLWrapper.java
index b564c215..077f2f9b 100644
--- a/pdf-as-lib/src/main/java/at/gv/egiz/sl/util/ISignatureConnectorSLWrapper.java
+++ b/pdf-as-lib/src/main/java/at/gv/egiz/sl/util/ISignatureConnectorSLWrapper.java
@@ -23,24 +23,23 @@
  ******************************************************************************/
 package at.gv.egiz.sl.util;
 
-import iaik.cms.CMSException;
-import iaik.cms.SignedData;
-import iaik.cms.SignerInfo;
 import iaik.x509.X509Certificate;
 
-import java.io.ByteArrayInputStream;
-import java.io.IOException;
-import java.security.SignatureException;
 import java.security.cert.CertificateException;
 import java.util.Iterator;
+import java.util.List;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import at.gv.egiz.pdfas.common.exceptions.PdfAsException;
 import at.gv.egiz.pdfas.common.exceptions.PdfAsSignatureException;
+import at.gv.egiz.pdfas.common.utils.StreamUtils;
 import at.gv.egiz.pdfas.lib.api.sign.SignParameter;
-import at.gv.egiz.pdfas.lib.impl.verify.VerifyResultImpl;
+import at.gv.egiz.pdfas.lib.api.verify.VerifyResult;
+import at.gv.egiz.pdfas.lib.impl.SignResultImpl;
+import at.gv.egiz.pdfas.lib.impl.status.RequestedSignature;
+import at.gv.egiz.pdfas.lib.util.SignatureUtils;
 import at.gv.egiz.sl.schema.CreateCMSSignatureResponseType;
 import at.gv.egiz.sl.schema.InfoboxAssocArrayPairType;
 import at.gv.egiz.sl.schema.InfoboxReadRequestType;
@@ -84,59 +83,20 @@ public class ISignatureConnectorSLWrapper implements ISignatureConnector {
 		return certificate;
 	}
 
-	public byte[] sign(byte[] input, int[] byteRange, SignParameter parameter) throws PdfAsException {
+	public byte[] sign(byte[] input, int[] byteRange, 
+			SignParameter parameter, RequestedSignature requestedSignature) throws PdfAsException {
 		RequestPackage pack = connector.createCMSRequest(
 				input, byteRange, parameter);
 		CreateCMSSignatureResponseType response = connector
 				.sendCMSRequest(pack, parameter);
-		try {
-			SignedData signedData = new SignedData(new ByteArrayInputStream(
-					response.getCMSSignature()));
-
-			signedData.setContent(input);
-
-			// get the signer infos
-			SignerInfo[] signerInfos = signedData.getSignerInfos();
-			if (signerInfos.length == 0) {
-				throw new PdfAsSignatureException("Invalid Signature (no signer info created!)", null);
-			}
-			// verify the signatures
-			for (int i = 0; i < signerInfos.length; i++) {
-				VerifyResultImpl verifyResult = new VerifyResultImpl();
-				try {
-					logger.info("Signature Algo: {}, Digest {}", signedData
-							.getSignerInfos()[i].getSignatureAlgorithm(),
-							signedData.getSignerInfos()[i].getDigestAlgorithm());
-					// verify the signature for SignerInfo at index i
-					X509Certificate signer_cert = signedData.verify(i);
-					// if the signature is OK the certificate of the
-					// signer is returned
-					logger.info("Signature OK from signer: "
-							+ signer_cert.getSubjectDN());
-					verifyResult.setSignerCertificate(signer_cert);
+		
+		VerifyResult verifyResult = SignatureUtils.verifySignature(response.getCMSSignature(), input);
 
-				} catch (SignatureException ex) {
-					// if the signature is not OK a SignatureException
-					// is thrown
-					logger.error(
-							"Signature ERROR from signer: "
-									+ signedData.getCertificate(
-											signerInfos[i]
-													.getSignerIdentifier())
-											.getSubjectDN(), ex);
-
-					verifyResult.setSignerCertificate(signedData
-							.getCertificate(signerInfos[i]
-									.getSignerIdentifier()));
-					throw new PdfAsSignatureException("error.pdf.sig.08", ex);
-				}
-			}
-		} catch (CMSException e) {
-			throw new PdfAsSignatureException("error.pdf.sig.08", e);
-		} catch (IOException e) {
-			throw new PdfAsSignatureException("error.pdf.sig.08", e);
+		if(!StreamUtils.dataCompare(requestedSignature.getCertificate().getFingerprintSHA(),
+				verifyResult.getSignerCertificate().getFingerprintSHA())) {
+			throw new PdfAsSignatureException("Certificates missmatch!");
 		}
-
+		
 		return response.getCMSSignature();
 	}
 
diff --git a/pdf-as-lib/src/main/java/at/gv/egiz/sl/util/MOAConnector.java b/pdf-as-lib/src/main/java/at/gv/egiz/sl/util/MOAConnector.java
index 73de30cf..1059dba1 100644
--- a/pdf-as-lib/src/main/java/at/gv/egiz/sl/util/MOAConnector.java
+++ b/pdf-as-lib/src/main/java/at/gv/egiz/sl/util/MOAConnector.java
@@ -55,10 +55,15 @@ import org.xml.sax.SAXException;
 
 import at.gv.egiz.pdfas.common.exceptions.PdfAsException;
 import at.gv.egiz.pdfas.common.exceptions.PdfAsMOAException;
+import at.gv.egiz.pdfas.common.exceptions.PdfAsSignatureException;
 import at.gv.egiz.pdfas.common.exceptions.PdfAsWrappedIOException;
 import at.gv.egiz.pdfas.common.settings.ISettings;
+import at.gv.egiz.pdfas.common.utils.StreamUtils;
 import at.gv.egiz.pdfas.lib.api.Configuration;
 import at.gv.egiz.pdfas.lib.api.sign.SignParameter;
+import at.gv.egiz.pdfas.lib.api.verify.VerifyResult;
+import at.gv.egiz.pdfas.lib.impl.status.RequestedSignature;
+import at.gv.egiz.pdfas.lib.util.SignatureUtils;
 
 public class MOAConnector implements ISignatureConnector {
 
@@ -135,7 +140,8 @@ public class MOAConnector implements ISignatureConnector {
 		return builder.build();
 	}
 
-	public byte[] sign(byte[] input, int[] byteRange, SignParameter parameter) throws PdfAsException {
+	public byte[] sign(byte[] input, int[] byteRange, SignParameter parameter
+			, RequestedSignature requestedSignature) throws PdfAsException {
 		CloseableHttpClient client = null;
 		try {
 			client = buildHttpClient();
@@ -220,7 +226,16 @@ public class MOAConnector implements ISignatureConnector {
 
 				if (cmsSignature != null) {
 					try {
-						return base64.decode(cmsSignature);
+						byte[] cmsSignatureData = base64.decode(cmsSignature);
+						
+						VerifyResult verifyResult = SignatureUtils.verifySignature(cmsSignatureData, input);
+
+						if(!StreamUtils.dataCompare(requestedSignature.getCertificate().getFingerprintSHA(),
+								verifyResult.getSignerCertificate().getFingerprintSHA())) {
+							throw new PdfAsSignatureException("Certificates missmatch!");
+						}
+						
+						return cmsSignatureData;
 					} catch(Exception e) {
 						throw new PdfAsException("error.pdf.io.07", e);
 					}
diff --git a/signature-standards/sigs-pades/src/main/java/at/gv/egiz/pdfas/sigs/pades/PAdESSigner.java b/signature-standards/sigs-pades/src/main/java/at/gv/egiz/pdfas/sigs/pades/PAdESSigner.java
index 67b17783..07d3b66c 100644
--- a/signature-standards/sigs-pades/src/main/java/at/gv/egiz/pdfas/sigs/pades/PAdESSigner.java
+++ b/signature-standards/sigs-pades/src/main/java/at/gv/egiz/pdfas/sigs/pades/PAdESSigner.java
@@ -30,6 +30,7 @@ import org.apache.pdfbox.pdmodel.interactive.digitalsignature.PDSignature;
 import at.gv.egiz.pdfas.common.exceptions.PdfAsException;
 import at.gv.egiz.pdfas.lib.api.sign.IPlainSigner;
 import at.gv.egiz.pdfas.lib.api.sign.SignParameter;
+import at.gv.egiz.pdfas.lib.impl.status.RequestedSignature;
 import at.gv.egiz.sl.util.ISignatureConnector;
 import at.gv.egiz.sl.util.ISignatureConnectorSLWrapper;
 import at.gv.egiz.sl.util.ISLConnector;
@@ -50,8 +51,9 @@ public class PAdESSigner implements IPlainSigner {
 		return this.plainSigner.getCertificate(parameter);
 	}
 
-	public byte[] sign(byte[] input, int[] byteRange, SignParameter parameter) throws PdfAsException {
-		return this.plainSigner.sign(input, byteRange, parameter);
+	public byte[] sign(byte[] input, int[] byteRange, SignParameter parameter
+			, RequestedSignature requestedSignature) throws PdfAsException {
+		return this.plainSigner.sign(input, byteRange, parameter, requestedSignature);
 	}
 
 	public String getPDFSubFilter() {
diff --git a/signature-standards/sigs-pades/src/main/java/at/gv/egiz/pdfas/sigs/pades/PAdESSignerKeystore.java b/signature-standards/sigs-pades/src/main/java/at/gv/egiz/pdfas/sigs/pades/PAdESSignerKeystore.java
index 7f62b294..758e98dd 100644
--- a/signature-standards/sigs-pades/src/main/java/at/gv/egiz/pdfas/sigs/pades/PAdESSignerKeystore.java
+++ b/signature-standards/sigs-pades/src/main/java/at/gv/egiz/pdfas/sigs/pades/PAdESSignerKeystore.java
@@ -59,6 +59,7 @@ import at.gv.egiz.pdfas.common.exceptions.PdfAsException;
 import at.gv.egiz.pdfas.common.exceptions.PdfAsSignatureException;
 import at.gv.egiz.pdfas.lib.api.sign.IPlainSigner;
 import at.gv.egiz.pdfas.lib.api.sign.SignParameter;
+import at.gv.egiz.pdfas.lib.impl.status.RequestedSignature;
 import at.gv.egiz.pdfas.lib.util.CertificateUtils;
 
 public class PAdESSignerKeystore implements IPlainSigner {
@@ -134,7 +135,7 @@ public class PAdESSignerKeystore implements IPlainSigner {
 	    signerInfo.setSignedAttributes(attributeArray);
 	  }
 	
-	public byte[] sign(byte[] input, int[] byteRange, SignParameter parameter) throws PdfAsException {
+	public byte[] sign(byte[] input, int[] byteRange, SignParameter parameter, RequestedSignature requestedSignature) throws PdfAsException {
 		try {
 			logger.info("Creating PAdES signature.");
 			IssuerAndSerialNumber issuer = new IssuerAndSerialNumber(cert);
diff --git a/signature-standards/sigs-pkcs7detached/src/main/java/at/gv/egiz/pdfas/sigs/pkcs7detached/PKCS7DetachedSigner.java b/signature-standards/sigs-pkcs7detached/src/main/java/at/gv/egiz/pdfas/sigs/pkcs7detached/PKCS7DetachedSigner.java
index 802b7590..5dbf6bac 100644
--- a/signature-standards/sigs-pkcs7detached/src/main/java/at/gv/egiz/pdfas/sigs/pkcs7detached/PKCS7DetachedSigner.java
+++ b/signature-standards/sigs-pkcs7detached/src/main/java/at/gv/egiz/pdfas/sigs/pkcs7detached/PKCS7DetachedSigner.java
@@ -51,6 +51,7 @@ import at.gv.egiz.pdfas.common.exceptions.PdfAsException;
 import at.gv.egiz.pdfas.common.exceptions.PdfAsSignatureException;
 import at.gv.egiz.pdfas.lib.api.sign.IPlainSigner;
 import at.gv.egiz.pdfas.lib.api.sign.SignParameter;
+import at.gv.egiz.pdfas.lib.impl.status.RequestedSignature;
 
 /**
  * Creates a PKCS7 detached PDF signature
@@ -80,7 +81,8 @@ public class PKCS7DetachedSigner implements IPlainSigner {
 		return cert;
 	}
 
-	public byte[] sign(byte[] input, int[] byteRange, SignParameter parameter) throws PdfAsException {
+	public byte[] sign(byte[] input, int[] byteRange, SignParameter parameter
+			, RequestedSignature requestedSignature) throws PdfAsException {
 		try {
 			logger.info("Creating PKCS7 signature.");
 			IssuerAndSerialNumber issuer = new IssuerAndSerialNumber(cert);