.. /*  
    * This file is part of the SavaPage project <https://www.savapage.org>.
    * Copyright (c) 2026 Datraverse B.V.
    * Author: Rijk Ravestein.
    *
    * SPDX-FileCopyrightText: (c) 2020 Datraverse B.V. <info@datraverse.com>
    * SPDX-License-Identifier: CC-BY-SA-4.0
    *
    * For more information, please contact Datraverse B.V. at this
    * address: info@datraverse.com
    */

.. _ch-pdfpgp:

.. figure:: ../images/manual/savapage-logo-no-text-100px.png
   :width: 75px

PDF/PGP Verification
====================

.. admonition:: |ADMONITION_TABLE_OF_CONTENTS|

   - :numref:`{number}. {name} <ch-pdfpgp-in-a-nutshell>`
   - :numref:`{number}. {name} <ch-pdfpgp-signature>`
   - :numref:`{number}. {name} <ch-pdfpgp-verification-webapp>`


|image51|

.. note::

   PDF/PGP Verification originated and is prototyped in the |PRODUCT_NAME|
   Community. It has no formal status outside, but could become a more
   widely accepted Open Standard. This :ref:`Feature
   Preview <preface-conventions-feature-preview>` is offered to
   provoke feedback on the verification method and reference
   implementation. Please share your experiences and requirements.


.. _ch-pdfpgp-in-a-nutshell:

PDF/PGP in a Nutshell
---------------------

Many organizations who are bound to legal and regulatory requirements
use `PKI <https://en.wikipedia.org/wiki/Public_key_infrastructure>`__
based services to verify *authenticity* and *integrity* of PDF
documents. `X.509 <https://en.wikipedia.org/wiki/X.509>`__ is the “de
facto” standard for this security measure.

While some have a self-imposed X.509 policy, most organizations are not
aware of security issues or are deterred by PKI requirements, that
include third-party Certificate Authorities (CAs), Time Stamping
Authorities (TSAs), and PDF signature-compliant PDF readers.

For those organizations PDF/PGP Verification is a simple
`OpenPGP <https://www.openpgp.org/>`__ based PKI alternative. It works
as follows:

1. The PDF document is *signed* by including its detached OpenPGP
   signature as PDF comment.

  .. RST_HTML_NEWLINE

2. The PDF is *verified* by stripping the comment OpenPGP signature, and
   using it to verify the remainder PDF.

Organizations can easily use their own Web Site to implement a PDF/PGP
Verification Service. This is the use-case:

1. Published PDF documents are PDF/PGP signed and have a visible URL
   link to the Verification Service at the top of the first page.

  .. RST_HTML_NEWLINE

2. A User, who received the PDF through whatever channel, wants to
   verify its authenticity and integrity, and clicks the link.

  .. RST_HTML_NEWLINE

3. The Web App opens in the browser and invites the user to upload the
   PDF for verification.

  .. RST_HTML_NEWLINE

4. The User trusts the Secure Connection and Website Identity (SSL
   certificate) and uploads the PDF.

  .. RST_HTML_NEWLINE

5. The Web App uses the Public OpenPGP Key of the trusted signer to
   verify the uploaded PDF and communicates the verdict to the User.

SavaPage implements a reference PDF/PGP Verification Service where
PDF documents are signed and verified with the server's :ref:`OpenPGP Key
Pair <ch-install-on-linux-openpgp-keys>`.

.. caution::

   PDF/PGP Verification will surely not hold against stringent
   certificate-based legal and regulatory requirements. On the other
   hand, for many organizations it will lower the threshold to adopt a
   simple and pretty-good security policy.



.. /*  
    * Images
    */
.. |image51| image:: ../images/manual/savapage-feature-preview-75x100.png
   :width: 50px