Repository navigation
PDF Spec 12 Security
Marc Jones edited this page Dec 30, 2025
·
1 revision
Part of: PDF-Spec-12-Interactive-Features
Navigation: PDF-Spec-12-Signatures | PDF-Spec-Index | Next →
RevocationInfoArchival ::= SEQUENCE { crl [0] EXPLICIT SEQUENCE of CRLs, OPTIONAL ocsp [1] EXPLICIT SEQUENCE of OCSP Responses, OPTIONAL otherRevInfo [2] EXPLICIT SEQUENCE of OtherRevInfo, OPTIONAL } OtherRevInfo ::= SEQUENCE { Type OBJECT IDENTIFIER Value OCTET STRING }
For byte range signatures, Contents shall be a hexadecimal string with '<' and '>' delimiters. It shall fit precisely in the space between the ranges specified by ByteRange . Since the length of PKCS#7 objects is not entirely predictable, the value of Contents shall be padded with zeros at the end of the string (before the '>' delimiter) before writing the PKCS#7 to the allocated space in the file.
The format for encoding signature values should be adbe.pkcs7.detached . This encoding allows the most options in terms of algorithm use. The following table shows the algorithms supported for the various SubFilter values.
Table 257 - SubFilter value algorithm support
| | SubFilter value | SubFilter value | SubFilter value |
|-----------------------|---------------------------------------------------------------------------------------|-------------------------|---------------------------------------------------------------------------------------|
| | adbe.pkcs7.detached | adbe.pkcs7.sha1 | adbe.x509.rsa.sha1 a |
| Message Digest | SHA1 (PDF 1.3) SHA256 (PDF 1.6) SHA384 (PDF 1.7) SHA512 (PDF 1.7) RIPEMD160 (PDF 1.7) | SHA1 (PDF 1.3) b | SHA1 (PDF 1.3) SHA256 (PDF 1.6) SHA384 (PDF 1.7) SHA512 (PDF 1.7) RIPEMD160 (PDF 1.7) |
| RSA Algorithm Support | Up to 1024-bit (PDF 1.3) Up to 2048-bit (PDF 1.5) Up to 4096-bit (PDF 1.5) | See adbe.pkcs7.detached | See adbe.pkcs7.detached |
| DSA Algorithm Support | Up to 4096-bits (PDF 1.6) | See adbe.pkcs7.detached | No |
## 12.8.4 Permissions
The Perms entry in the document catalogue (see Table 28) shall specify a permissions dictionary (PDF 1.5) . Each entry in this dictionary (see Table 258 for the currently defined entries) shall specify the name of a permission handler that controls access permissions for the document. These permissions are similar to those
defined by security handlers (see Table 22) but do not require that the document be encrypted. For a permission to be actually granted for a document, it shall be allowed by each permission handler that is present in the permissions dictionary as well as by the security handler.
NOTE An example of a permission is the ability to fill in a form field.
Table 258 - Entries in a permissions dictionary
| Key | Type | Value |
|--------|------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| DocMDP | dictionary | (Optional) An indirect reference to a signature dictionary (see Table 252). This dictionary shall contain a Reference entry that shall be a signature reference dictionary (see Table 252) that has a DocMDP transform method (see 12.8.2.2, 'DocMDP') and corresponding transform parameters. If this entry is present, consumer applications shall enforce the permissions specified by the P attribute in the DocMDP transform parameters dictionary and shall also validate the corresponding signature based on whether any of these permissions have been violated. |
| UR3 | dictionary | (Optional) A signature dictionary that shall be used to specify and validate additional capabilities (usage rights) granted for this document; that is, the enabling of interactive features of the conforming reader that are not available by default. For example, A conforming reader does not permit saving documents by default, but an agent may grant permissions that enable saving specific documents. The signature shall be used to validate that the permissions have been granted by the agent that did the signing. The signature dictionary shall contain a Reference entry that shall be a signature reference dictionary that has a UR transform method (see 12.8.2.3, 'UR'). The transform parameter dictionary for this method indicates which additional permissions shall be granted for the document. If the signature is valid, the conforming reader shall allow the specified permissions for the document, in addition to the application's default permissions. |
## 12.8.5 Legal Content Attestations
The PDF language provides a number of capabilities that can make the rendered appearance of a PDF document vary. These capabilities could potentially be used to construct a document that misleads the recipient of a document, intentionally or unintentionally. These situations are relevant when considering the legal implications of a signed PDF document.
Therefore, a mechanism shall be provided by which a document recipient can determine whether the document can be trusted. The primary method is to accept only documents that contain certification signatures (one that has a DocMDP signature that defines what shall be permitted to change in a document; see 12.8.2.2, 'DocMDP').
When creating certification signatures, conforming writers should also create a legal attestation dictionary , whose entries are shown in Table 259. This dictionary shall be the value of the Legal entry in the document catalogue (see Table 28). Its entries shall specify all content that may result in unexpected rendering of the document contents. The author may provide further clarification of such content by means of the Attestation entry. Reviewers should establish for themselves that they trust the author and contents of the document. In the case of a legal challenge to the document, any questionable content can be reviewed in the context of the information in this dictionary.
Table 259 - Entries in a legal attestation dictionary
| Key | Type | Value |
|-----------------------|-------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| JavaScriptActions | integer | (Optional) The number of JavaScript actions found in the document (see 12.6.4.16, 'JavaScript Actions'). |
| LaunchActions | integer | (Optional) The number of launch actions found in the document (see 12.6.4.5, 'Launch Actions'). |
| URIActions | integer | (Optional) The number of URI actions found in the document (see 12.6.4.7, 'URI Actions'). |
| MovieActions | integer | (Optional) The number of movie actions found in the document (see 12.6.4.9, 'Movie Actions'). |
| SoundActions | integer | (Optional) The number of sound actions found in the document (see 12.6.4.8, 'Sound Actions'). |
| HideAnnotationActions | integer | (Optional) The number of hide actions found in the document (see 12.6.4.10, 'Hide Actions'). |
| GoToRemoteActions | integer | (Optional) The number of remote go-to actions found in the document (see 12.6.4.3, 'Remote Go-To Actions'). |
| AlternateImages | integer | (Optional) The number of alternate images found in the document (see 8.9.5.4, 'Alternate Images') |
| ExternalStreams | integer | (Optional) The number of external streams found in the document. |
| TrueTypeFonts | integer | (Optional) The number of TrueType fonts found in the document (see 9.6.3, 'TrueType Fonts'). |
| ExternalRefXobjects | integer | (Optional) The number of reference XObjects found in the document (see 8.10.4, 'Reference XObjects'). |
| ExternalOPIdicts | integer | (Optional) The number of OPI dictionaries found in the document (see 14.11.7, 'Open Prepress Interface (OPI)'). |
| NonEmbeddedFonts | integer | (Optional) The number of non-embedded fonts found in the document (see 9.9, 'Embedded Font Programs'') |
| DevDepGS_OP | integer | (Optional) The number of references to the graphics state parameter OP found in the document (see Table 58). |
| DevDepGS_HT | integer | (Optional) The number of references to the graphics state parameter HT found in the document (see Table 58). |
| DevDepGS_TR | integer | (Optional) The number of references to the graphics state parameter TR found in the document (see Table 58). |
| DevDepGS_UCR | integer | (Optional) The number of references to the graphics state parameter UCR found in the document (see Table 58). |
| DevDepGS_BG | integer | (Optional) The number of references to the graphics state parameter BG found in the document (see Table 58). |
| DevDepGS_FL | integer | (Optional) The number of references to the graphics state parameter FL found in the document (see Table 58). |
| Annotations | integer | (Optional) The number of annotations found in the document (see 12.5, 'Annotations'). |
| OptionalContent | boolean | (Optional) true if optional content is found in the document (see 8.11, 'Optional Content'). |
| Attestation | text string | (Optional) An attestation, created by the author of the document, explaining the presence of any of the other entries in this dictionary or the presence of any other content affecting the legal integrity of the document. |
## 12.9 Measurement Properties
PDF documents, such as those created by CAD software, may contain graphics that are intended to represent real-world objects. Users of such documents often require information about the scale and units of measurement of the corresponding real-world objects and their relationship to units in PDF user space.
This information enables users of conforming readers to perform measurements that yield results in the units intended by the creator of the document. A measurement in this context is the result of a canonical function that takes as input a set of n coordinate pairs
<!-- formula-not-decoded -->
and produces a single number as output depending on the type of measurement. For example, distance measurement is equivalent to
<!-- formula-not-decoded -->
for n 2. ≥
Beginning with PDF 1.6, such information may be stored in a measure dictionary (see Table 261). Measure dictionaries provide information about measurement units associated with a rectangular area of the document known as a viewport .
A viewport (PDF 1.6) is a rectangular region of a page. The optional VP entry in a page dictionary (see Table 30) shall specify an array of viewport dictionaries, whose entries shall be as shown in Table 260. Viewports allow different measurement scales (specified by the Measure entry) to be used in different areas of a page, if necessary.
The dictionaries in the VP array shall be in drawing order. Since viewports might overlap, to determine the viewport to use for any point on a page, the dictionaries in the array shall be examined, starting with the last one and iterating in reverse, and the first one whose BBox entry contains the point shall be chosen.
NOTE 1 Any measurement that potentially involves multiple viewports, such as one specifying the distance between two points, shall use the information specified in the viewport of the first point.
Table 260 - Entries in a viewport dictionary
| Key | Type | Value |
|-------|-----------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Type | name | (Optional) The type of PDF object that this dictionary describes; shall be Viewport for a viewport dictionary. |
| BBox | rectangle | (Required) A rectangle in default user space coordinates specifying the location of the viewport on the page. The two coordinate pairs of the rectangle shall be specified in normalized form; that is, lower-left followed by upper-right, relative to the measuring coordinate system. This ordering shall determine the orientation of the measuring coordinate system (that is, the direction of the positive x and y axes) in this viewport, which may have a different rotation from the page. The coordinates of this rectangle are independent of the origin of the measuring coordinate system, specified in the O entry (see Table 262) of the measurement dictionary specified by Measure . |
Table 260 - Entries in a viewport dictionary (continued)
| Key | Type | Value |
|---------|-------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Name | text string | (Optional) A descriptive text string or title of the viewport, intended for use in a user interface. |
| Measure | dictionary | (Optional) A measure dictionary (see Table 261) that specifies the scale and units that shall apply to measurements taken on the contents within the viewport. |
A measure dictionary shall specify an alternate coordinate system for a region of a page. Along with the viewport dictionary, it shall provide the information needed to convert coordinates in the page's coordinate system to coordinates in the measuring coordinate system. The measure dictionary shall provide information for formatting the resulting values into textual form for presentation in a graphical user interface.
Table 261 shows the entries in a measure dictionary. PDF 1.6 defines only a single type of coordinate system, a rectilinear coordinate system, that shall be specified by the value RL for the Subtype entry, which is defined as one in which the x and y axes are perpendicular and have units that increment linearly (to the right and up, respectively). Other subtypes may be used, providing the flexibility to measure using other types of coordinate systems.
Table 261 - Entries in a measure dictionary
| Key | Type | Value |
|---------|--------|------------------------------------------------------------------------------------------------------------------------------------------------------|
| Type | name | (Optional) The type of PDF object that this dictionary describes; shall be Measure for a measure dictionary. |
| Subtype | name | (Optional) A name specifying the type of coordinate system to use for measuring. Default value: RL , which specifies a rectilinear coordinate system |
Table 262 shows the additional entries in a rectilinear measure dictionary. Many of the entries in this dictionary shall be number format arrays , which are arrays of number format dictionaries (see Table 263). Each number format dictionary shall represent a specific unit of measurement (such as miles or feet). It shall contain information about how each unit shall be expressed in text and factors for calculating the number of units.
Number format arrays specify all the units that shall be used when expressing a specific measurement. Each array shall contain one or more number format dictionaries, in descending order of granularity. If one unit of measurement X is larger than one unit of measurement Y then X has a larger order of granularity than Y. All the elements in the array shall contain text strings that, concatenated together, specify how the units shall be displayed.
- NOTE 2 For example, a measurement of 1.4505 miles might be expressed as '1.4505 mi', which would require one number format dictionary for miles, or as '1 mi 2,378 ft 7 5/8 in', which would require three dictionaries (for miles, feet, and inches).
EXAMPLE 1 A number format dictionary specifying feet should precede one specifying inches.
Table 262 - Additional entries in a rectilinear measure dictionary
| Key | Type | Value |
|-------|-------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| R | text string | (Required) A text string expressing the scale ratio of the drawing in the region corresponding to this dictionary. Universally recognized unit abbreviations should be used, either matching those of the number format arrays in this dictionary or those of commonly used scale ratios. EXAMPLE 1 a common scale in architectural drawings is '1/4 in = 1 ft', indicating that 1/4 inches in default user space is equivalent to 1 foot in real-world measurements. If the scale ratio differs in the x and y directions, both scales should be specified. |
| X | array | (Required) A number format array for measurement of change along the x axis and, if Y is not present, along the y axis as well. The first element in the array shall contain the scale factor for converting from default user space units to the largest units in the measuring coordinate system along that axis. The directions of the x and y axes are in the measuring coordinate system and are independent of the page rotation. These directions shall be determined by the BBox entry of the containing viewport (see Table 260). |
| Y | array | (Required when the x and y scales have different units or conversion factors) A number format array for measurement of change along the y axis. The first element in the array shall contain the scale factor for converting from default user space units to the largest units in the measuring coordinate system along the y axis. |
| D | array | (Required) A number format array for measurement of distance in any direction. The first element in the array shall specify the conversion to the largest distance unit from units represented by the first element in X . The scale factors from X , Y (if present) and CYX (if Y is present) shall be used to convert from default user space to the appropriate units before applying the distance function. |
| A | array | (Required) A number format array for measurement of area. The first element in the array shall specify the conversion to the largest area unit from units represented by the first element in X , squared. The scale factors from X , Y (if present) and CYX (if Y is present) shall be used to convert from default user space to the appropriate units before applying the area function. |
| T | array | (Optional) A number format array for measurement of angles. The first element in the array shall specify the conversion to the largest angle unit from degrees. The scale factor from CYX (if present) shall be used to convert from default user space to the appropriate units before applying the angle function. |
| S | array | (Optional) A number format array for measurement of the slope of a line. The first element in the array shall specify the conversion to the largest slope unit from units represented by the first element in Y divided by the first element in X . The scale factors from X , Y (if present) and CYX (if Y is present) shall be used to convert from default user space to the appropriate units before applying the slope function. |
| O | array | (Optional) An array of two numbers that shall specify the origin of the measurement coordinate system in default user space coordinates. The directions by which x and y increase in value from this origin shall be determined by the viewport's BBox entry (see Table 260). Default value: the first coordinate pair (lower-left corner) of the rectangle specified by the viewport's BBox entry. |
Table 262 - Additional entries in a rectilinear measure dictionary (continued)
| Key | Type | Value |
|-------|--------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| CYX | number | (Optional; meaningful only when Y is present) A factor that shall be used to convert the largest units along the y axis to the largest units along the x axis. It shall be used for calculations (distance, area, and angle) where the units are be equivalent; if not specified, these calculations may not be performed (which would be the case in situations such as x representing time and y representing temperature). Other calculations (change in x , change in y , and slope) shall not require this value. |
The X and Y entries in a measure dictionary shall be number format arrays that shall specify the units used for measurements in the x and y directions, respectively, and the ratio between user space units and the specified units. Y is present only when the x and y measurements are in different units or have different ratios; in this case, the CYX entry shall be used to convert y values to x values when appropriate.
Table 263 - Entries in a number format dictionary
| Key | Type | Value |
|-------|-------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Type | name | (Optional) The type of PDF object that this dictionary describes; shall be NumberFormat for a number format dictionary. |
| U | text string | (Required) A text string specifying a label for displaying the units represented by this dictionary in a user interface; the label should use a universally recognized abbreviation. |
| C | number | (Required) The conversion factor used to multiply a value in partial units of the previous number format array element to obtain a value in the units of this dictionary. When this entry is in the first number format dictionary in the array, its meaning (that is, what it shall be multiplied by) depends on which entry in the rectilinear measure dictionary (see Table 262) references the number format array. |
| F | name | (Optional; meaningful only for the last dictionary in a number format array) A name indicating whether and in what manner to display a fractional value from the result of converting to the units of this dictionary by means of the C entry. Valid values shall be: D Show as decimal to the precision specified by the D entry. F Show as a fraction with denominator specified by the D entry. R No fractional part; round to the nearest whole unit. T No fractional part; truncate to achieve whole units. Default value: D . |
| D | integer | (Optional; meaningful only for the last dictionary in a number format array) A positive integer that shall specify the precision or denominator of a fractional amount: When the value of F is D , this entry shall be the precision of a decimal display; it shall be a multiple of 10. Low-order zeros may be truncated unless FD is true . Default value: 100 (hundredths, corresponding to two decimal digits). When the value of F is F , this entry shall be the denominator of a fractional display. The fraction may be reduced unless the value of FD is true . Default value: 16. |
| FD | boolean | (Optional; meaningful only for the last dictionary in a number format array) If true , a fractional value formatted according to the D entry may not have its denominator reduced or low-order zeros truncated. Default value: false . |
Table 263 - Entries in a number format dictionary (continued)
| Key | Type | Value |
|-------|-------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| RT | text string | (Optional) Text that shall be used between orders of thousands in display of numerical values. An empty string indicates that no text shall be added. Default value: COMMA (2Ch). |
| RD | text string | (Optional) Text that shall be used as the decimal position in displaying numerical values. An empty string indicates that the default shall be used. Default value: PERIOD (2Eh). |
| PS | text string | (Optional) Text that shall be concatenated to the left of the label specified by U . An empty string indicates that no text shall be added. Default value: A single ASCII SPACE character (20h). |
| SS | text string | (Optional) Text that shall be concatenated after the label specified by U . An empty string indicates that no text shall be added. Default value: A single ASCII SPACE character (20h). |
| O | name | (Optional) A name indicating the position of the label specified by U with respect to the calculated unit value. Valid values shall be: S The label is a suffix to the value. P The label is a prefix to the value. The characters specified by PS and SS shall be concatenated before considering this entry. Default value: S . |
To use a number format array to create a text string containing the appropriately formatted units for display in a user interface, apply the following algorithm:
## Algorithm: Use of a number format array to create a formatted text string
- a) The entry in the rectilinear measure dictionary (see Table 262) that references the number format array determines the meaning of the initial measurement value. For example, the X entry specifies user space units, and the T entry specifies degrees.
- b) Multiply the value specified previously by the C entry of the first number format dictionary in the array, which converts the measurement to units of the largest granularity specified in the array. Apply the value of RT as appropriate.
- c) If the result contains no nonzero fractional portion, concatenate the label specified by the U entry in the order specified by O , after adding spacing from PS and SS . The formatting is then complete.
- d) If there is a nonzero fractional portion and no more elements in the array, format the fractional portion as specified by the RD , F , D , and FD entries of the last dictionary. Concatenate the label specified by the U entry in the order specified by O , after adding spacing from PS and SS . The formatting is then complete.
- e) If there is a nonzero fractional portion and more elements in the array, proceed to the next number format dictionary in the array. Multiply its C entry by the fractional result from the previous step. Apply the value of RT as appropriate. Then proceed to step 3.
The concatenation of elements in this process assumes left-to-right order. Documents using right-to-left languages may modify the process and the meaning of the entries as appropriate to produce the correct results.
EXAMPLE 2 The following example shows a measure dictionary that specifies that changes in x or y are expressed in miles; distances are expressed in miles, feet, and inches; and area is expressed in acres. Given a sample distance in scaled units of 1.4505 miles, the formatted text produced by applying the number format array would be
'1 mi 2,378 ft 7 5/8 in'.
<</Type /Measure /Subtype /RL /R (1in = 0.1 mi) /X [ <</U (mi) % x offset represented in miles /C .00139 % Conversion from user space units to miles /D 100000 ] /D [<< /U (mi) /C 1 >> % Distance: initial unit is miles; no conversion needed << /U (ft) /C 5280 >> % Conversion from miles to feet << /U (in) /C 12 % Conversion from feet to inches /F /F /D 8 >> % Fractions of inches rounded to nearest 1/8 ] /A [<</U (acres) % Area: measured in acres /C 640 >> % Conversion from square miles to acres ] >>
## 12.10 Document Requirements
## 12.10.1 General
Beginning with PDF 1.7, a document may specify requirements that shall be present in a conforming reader in order for the document to function properly. The Requirements entry in the document catalogue (see 7.7.2, 'Document Catalog') shall specify an array of requirement dictionaries , whose entries are shown in Table 264.
Table 264 - Entries common to all requirement dictionaries
| Key | Type | Description |
|-------|--------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Type | name | (Optional) The type of PDF object that this dictionary describes. If present, shall be Requirement for a requirement dictionary. |
| S | name | (Required) The type of requirement that this dictionary describes. The value shall be EnableJavaScripts . |
| RH | array | (Optional) An array of requirement handler dictionaries (see Table 265). This array lists the requirement handlers that shall be disabled (not executed) if the conforming reader can check the requirement specified in the S entry. |
The RH entry ensures backward-capability for this feature. Some PDF documents include JavaScript segments that verify compliance with certain requirements. Such JavaScript segments are called requirement handlers . Backward-compatibility shall be achieved by ensuring that either the conforming reader checks the requirement or the JavaScript segment checks the requirement, but not both.
When a PDF document is first opened, all JavaScript segments in the document shall be executed, including the requirement handlers. If the conforming reader understands the requirement dictionary, it shall disable execution of the requirement handlers named by the RH entry. If the requirement handler is in JavaScript, the conforming reader shall look up the segment using the Names dictionary (7.7.4, 'Name Dictionary').
In PDF 1.7, the only defined requirement type shall be EnableJavaScripts . This requirement indicates that the document requires JavaScript execution to be enabled in the conforming reader. If the EnableJavaScripts requirement is present, an interactive conforming reader may allow the user to choose between keeping JavaScript execution disabled or temporarily enabling it to benefit from the full function of the document.
If the EnableJavaScripts requirement is present in a requirement dictionary, the inclusion of the RH entry that specifies a JavaScript segment would be pointless. Writing a JavaScript segment to verify that JavaScript is enabled would not achieve the desired goal. The RH entry shall not be used in PDF 1.7.
## 12.10.2 Requirement Handlers
A requirement handler is a program that verifies certain requirements are satisfied. Table 265 describes the entries in a requirement handler dictionary.
Table 265 - Entries in a requirement handler dictionary
---
> **Navigation**: [[PDF-Spec-12-Signatures|← Previous]] | [[PDF-Spec-Index|Index]] | Next →