What is a Digital Signature in PDFs?
A digital signature in PDFs is used to verify the authenticity and integrity of a document.
It is a cryptographic mechanism that ensures that a PDF file has not been tampered with since its creation and that it comes from the expected sender. Digital signatures use public-key cryptography, where the signer generates a unique digital certificate containing their public key. This certificate is used to encrypt a hash value of the document, which is then embedded within the PDF.
Recipients can verify the signature by decrypting the embedded hash value using the signer's public key, ensuring that the document has not been altered and comes from the expected source.
Digital signatures provide assurance of the authenticity, integrity, and non-repudiation of PDF documents, making them crucial for sensitive or legally binding files.
There are many software applications and online services that support digital signatures for PDF documents.
What a signature actually covers
A digital signature creates a hash over a byte range of the file and encrypts it with the signer's private key. The result is stored together with the signing certificate. Verification repeats the hash and checks it against the certificate. The byte range is what makes this work in a format that can be edited. Because an incremental update appends rather than rewrites, the bytes covered by an earlier signature stay untouched, and a document can be signed by several people in turn, with every signature still verifiable.
Validity is two separate questions
A viewer answers two things, and they are easy to mix up. First, has the document changed since it was signed? Second, is the signing certificate trusted, and was it valid at the time of signing?
A document can be completely unmodified and still show a warning, simply because the certificate is self-signed or issued by an authority the reader does not trust. Timestamps from a trusted authority, and embedded revocation data, let a signature stay verifiable years later, even after the certificate itself has expired.
A signature is not the same as a signature that has been drawn or pasted onto a page. An image of handwriting is page content and carries no cryptographic claim at all.