Bug 109371 - Signatures become invalid when adding three or more signatures
Summary: Signatures become invalid when adding three or more signatures
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice
Classification: Unclassified
Component: LibreOffice (show other bugs)
Version:
(earliest affected)
5.3.4.2 release
Hardware: All All
: medium normal
Assignee: Not Assigned
URL:
Whiteboard: target:7.3.0 target:7.2.3
Keywords:
: 124207 (view as bug list)
Depends on:
Blocks: Digital-Signatures
  Show dependency treegraph
 
Reported: 2017-07-26 03:30 UTC by Ivan Batalin
Modified: 2021-11-02 11:07 UTC (History)
7 users (show)

See Also:
Crash report or crash signature:
Regression By:


Attachments
Three digital signatures on document (220.87 KB, image/png)
2017-07-26 03:30 UTC, Ivan Batalin
Details
Screenshot of invalid signatures (43.88 KB, image/png)
2021-03-20 07:11 UTC, Ivan Batalin
Details
Screenshot of an example document with three signatures made with the same cert (159.95 KB, image/png)
2021-10-29 14:51 UTC, Gabor Kelemen (allotropia)
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Ivan Batalin 2017-07-26 03:30:31 UTC
Created attachment 134860 [details]
Three digital signatures on document

When adding three or more Digital Signature in XCaDES format third and the next signatures are marked as invalid.
With an old Digital Signature algorithm valid only the first and the last signatures, but the date of signature from the second are zero valued.

With PCaDES (PDF) all works as expected.

This Issue exists in all LibreOffice suite after this version, including 5.4 (current development build at 21.07.2017)

See an attachment screenshot
Comment 1 Samuel Mehrbrodt (allotropia) 2017-07-27 10:25:08 UTC
Confirmed with current master (3a7e836ab532fcb52770b72ef054841768154891).
Comment 2 QA Administrators 2018-07-29 02:38:52 UTC Comment hidden (obsolete)
Comment 3 Ivan Batalin 2018-07-29 04:18:55 UTC
This bug are still present in version 6.0.5.2, using build 1:6.0.5~rc2-0ubuntu0.16.04.1~lo1.
Needs to be resolved to use digital signatures in corporate document systems.
Comment 4 Dieter 2019-03-20 13:34:30 UTC
*** Bug 124207 has been marked as a duplicate of this bug. ***
Comment 5 QA Administrators 2021-03-20 04:41:22 UTC Comment hidden (obsolete)
Comment 6 Ivan Batalin 2021-03-20 07:10:01 UTC
This bug is still present in 7.1.1.2 LO version 20.04 Libreoffice Lime PPA
Comment 7 Ivan Batalin 2021-03-20 07:11:56 UTC
Created attachment 170581 [details]
Screenshot of invalid signatures
Comment 8 Gabor Kelemen (allotropia) 2021-10-29 14:48:50 UTC
This is fixed now with:

https://git.libreoffice.org/core/+/fd5463343ab7f784070f1ab87a345eed20803d07%5E%21

author	Tomaž Vajngerl <tomaz.vajngerl@collabora.co.uk>	Wed Oct 27 14:15:17 2021 +0200
committer	Tomaž Vajngerl <quikee@gmail.com>	Thu Oct 28 08:49:57 2021 +0200

xmlsec: signing the document fails the 3rd time (invalid signature)

Third signature with the same key is no longer considered invalid.

Thanks Tomaž for solving this longstanding problem :)
Comment 9 Gabor Kelemen (allotropia) 2021-10-29 14:51:32 UTC
Created attachment 176002 [details]
Screenshot of an example document with three signatures made with the same cert