Document Signing

Question

Document Signing

Peter Volz 1,295

Hello,

I need the OID of X509 certificate types for digitally signing using certificate of MS Word documents: DOC and DOCX and PDF.

I guess they should not have the same OIDs, not sure though, anyone knows? :)

Best.

Tom Jebo 2,336 Reputation points Microsoft Employee Moderator

2023-06-26T19:00:02.5466667+00:00

Hi @Peter Volz ,

Are you looking for the mechanism/algorithm used to verify the signature? According to RFC3280, the algorithm identifiers are or have associated OIDs.

Reference: 5.1.2.2 Signature

This field contains the algorithm identifier for the algorithm used to sign the CRL. [PKIXALGS] lists OIDs for the most popular signature algorithms used in the Internet PKI. This field MUST contain the same algorithm identifier as the signatureAlgorithm field in the sequence CertificateList (section 5.1.1.2).

From MS-OFFCRYPTO 2.5.1.2:

Signature (variable): A binary representation of the signature, generated as specified in [RFC3280], except stored in little-endian form. EncodedCertificate (variable): An encoded representation of the certificate. MUST contain the ASN.1 [ITUX680-1994] DER encoding of an X.509 certificate. For more details, see [RFC3280]

Is this what you need?

Best regards,
Tom Jebo
Microsoft Open Specifications Support
Peter Volz 1,295 Reputation points

2023-06-27T02:49:43.63+00:00
Hello Tom,

Thanks for helping out, appreciated, but not exactly...

I'm gonna read all certificates from My Store and select the ones that can be used to sign PDF, DOC, DOCX, PDF and XPS file.

In .Net Framework 4.0, to do so, you'll need the appropriate OIDs, for example this code select the proper certificates that can be used for S/mime Email Signing:

OID 1.3.6.1.5.5.7.3.4 is : Secure Email

Dim EKU As X509EnhancedKeyUsageExtension = TryCast(MyCertificate.Extensions("2.5.29.37"), X509EnhancedKeyUsageExtension) If EKU IsNot Nothing Then If EKU.EnhancedKeyUsages("1.3.6.1.5.5.7.3.4") IsNot Nothing Then 'This is S/mime certificate End If End If

Now, need the OID of document signing certificates :)

Thanks :)
Tom Jebo 2,336 Reputation points Microsoft Employee Moderator

2023-06-28T20:43:50.41+00:00

Hi @Peter Volz ,

Thank you for the clarification. I'm checking with the Office security team to make sure that I get you accurate information. Thanks for your patience.

Best regards,
Tom Jebo
Microsoft Open Specifications Support
Tom Jebo 2,336 Reputation points Microsoft Employee Moderator

2023-06-30T21:58:50.4733333+00:00

Hi @Peter Volz ,

I believe you should be referencing:

1.3.6.1.4.1.311.10.3.12: szOID_KP_DOCUMENT_SIGNING

I am still waiting on confirmation from our security folks on this but thought I would pass it along.

Tom
Peter Volz 1,295 Reputation points

2023-07-01T23:44:18.7+00:00

Hello

Thanks for help, I also found 1.3.6.1.4.1.311.10.3.2 is for timestamping, so shall consider 1.3.6.1.4.1.311.10.3 for the root, just do you have any idea about this one?

1.3.6.1.5.5.7.3.36

Thanks, no idea if code signing or s/mime secure email certificates can also be used to sign documents?

1 answer

Your answer

Tom Jebo 2,336 Reputation points Microsoft Employee Moderator

2023-06-26T19:00:02.5466667+00:00

Hi @Peter Volz ,

Are you looking for the mechanism/algorithm used to verify the signature? According to RFC3280, the algorithm identifiers are or have associated OIDs.

Reference: 5.1.2.2 Signature

This field contains the algorithm identifier for the algorithm used to sign the CRL. [PKIXALGS] lists OIDs for the most popular signature algorithms used in the Internet PKI. This field MUST contain the same algorithm identifier as the signatureAlgorithm field in the sequence CertificateList (section 5.1.1.2).

From MS-OFFCRYPTO 2.5.1.2:

Signature (variable): A binary representation of the signature, generated as specified in [RFC3280], except stored in little-endian form. EncodedCertificate (variable): An encoded representation of the certificate. MUST contain the ASN.1 [ITUX680-1994] DER encoding of an X.509 certificate. For more details, see [RFC3280]

Is this what you need?

Best regards,
Tom Jebo
Microsoft Open Specifications Support
Peter Volz 1,295 Reputation points

2023-06-27T02:49:43.63+00:00

Hello Tom,

Thanks for helping out, appreciated, but not exactly...

I'm gonna read all certificates from My Store and select the ones that can be used to sign PDF, DOC, DOCX, PDF and XPS file.

In .Net Framework 4.0, to do so, you'll need the appropriate OIDs, for example this code select the proper certificates that can be used for S/mime Email Signing:

OID 1.3.6.1.5.5.7.3.4 is : Secure Email

Dim EKU As X509EnhancedKeyUsageExtension = TryCast(MyCertificate.Extensions("2.5.29.37"), X509EnhancedKeyUsageExtension) If EKU IsNot Nothing Then If EKU.EnhancedKeyUsages("1.3.6.1.5.5.7.3.4") IsNot Nothing Then 'This is S/mime certificate End If End If

Now, need the OID of document signing certificates :)

Thanks :)
Tom Jebo 2,336 Reputation points Microsoft Employee Moderator

2023-06-28T20:43:50.41+00:00

Hi @Peter Volz ,

Thank you for the clarification. I'm checking with the Office security team to make sure that I get you accurate information. Thanks for your patience.

Best regards,
Tom Jebo
Microsoft Open Specifications Support
Tom Jebo 2,336 Reputation points Microsoft Employee Moderator

2023-06-30T21:58:50.4733333+00:00

Hi @Peter Volz ,

I believe you should be referencing:

1.3.6.1.4.1.311.10.3.12: szOID_KP_DOCUMENT_SIGNING

I am still waiting on confirmation from our security folks on this but thought I would pass it along.

Tom
Peter Volz 1,295 Reputation points

2023-07-01T23:44:18.7+00:00

Hello

Thanks for help, I also found 1.3.6.1.4.1.311.10.3.2 is for timestamping, so shall consider 1.3.6.1.4.1.311.10.3 for the root, just do you have any idea about this one?

1.3.6.1.5.5.7.3.36

Thanks, no idea if code signing or s/mime secure email certificates can also be used to sign documents?

Answer 1

Tom Jebo 2,336 Microsoft Employee Moderator

@Peter Volz ,

It turns out that this is a configurable setting. Please refer to EKU filtering for an explanation of the policy.

Tom

Share via

Document Signing

1 answer

Your answer