[MS-OVBA] V3 Signature Documentation?

roger-eggenberger 1

Hi,

in this blog entry and KB5000676 a new VBA project signature scheme 'V3 signature' is mentioned.

However, it seems not to be documented in the currently available [MS-OVBA] - is there going to be a new version of [MS-OVBA] or is the 'V3 signature' scheme documented somewhere else?

Thanks,
roger

Tom Jebo 1,996 Reputation points Microsoft Employee

2021-05-20T19:39:18.897+00:00

Hi Roger,

Thanks for the question. I'll look into this and get back to you.

Best regards,
Tom Jebo
Sr Escalation Engineer
Microsoft Open Specifications
Tom Jebo 1,996 Reputation points Microsoft Employee

2021-05-21T00:10:43.23+00:00

Hi Roger,

Thanks for your patience on this issue. I believe the relevant information for VBA projects would be in [MS-OFFCRYPTO] 2.5:

https://learn.microsoft.com/en-us/openspecs/office_file_formats/ms-offcrypto/2770c801-5f0f-4326-89e8-d6ef15b68ef1

However, I don't see any information specific to the V3 signature nor any new updates recently that would be related. I'll do some more digging and get back to you soon with an update.

Tom
Tom Jebo 1,996 Reputation points Microsoft Employee

2021-05-21T17:45:37.917+00:00

And the VBA digital signature information is common to Office apps and described in [MS-OSHARED] 2.3.2:

https://learn.microsoft.com/en-us/openspecs/office_file_formats/ms-oshared/f80ee18c-d72f-4c3c-9ea5-a56f396322e0

It should still be in the _signatures stream (for example, in the .dotm file for Word, that's where the VBA project is) and defined by the above structures.
As far as the V3 specific information, I'm still digging that out but should have it shortly.

Tom
Tom Jebo 1,996 Reputation points Microsoft Employee

2021-05-21T17:54:11.833+00:00

Question to you @roger-eggenberger , which application are you targeting for parsing the VBA project signature? Word, PowerPoint or Excel? PPT and Excel use an OLE property ([MS-OSHARED] 2.3.3.2.2.1 PIDDSI, specifically GKPIDDSI_DIGSIG) to store the VBA project digital signature. Word on the other hand stores the VBA sig in the _signatures stream of the normal.dotm.

Tom
Tom Jebo 1,996 Reputation points Microsoft Employee

2021-05-21T23:19:39.793+00:00

@roger-eggenberger Just checking with you to see if you're seeing these updates? I've not seen anything since your first post yesterday morning.

Tom

1 answer

Tom Jebo 1,996 Reputation points Microsoft Employee

2021-05-26T06:22:52.443+00:00

Hi @roger-eggenberger ,

Thanks for your patience on this issue.

The relevant parts for the VBA digital signature are:

[MS-OVBA]
2. 4.2.3 - this has the Content Hash algorithm for the original signature version
2. 4.2.4 - this has the Content Hash algorithm for the Agile signature version
This does not currently include the V3 content hash algorithm which will include more content.

[MS-OSHARED]
2. 3.2.4.3.1 - this contains the digital signature information for the original signature version
2. 3.2.4.3.2 - this contains the digital signature information for the Agile or V2 signature version
This also does not currently include the V3 signature algorithm

The V3 signature descriptions have not yet been published. I will post here again when I have an ETA for the new descriptions to be published in these documents.

Best regards,
Tom Jebo
Sr Escalation Engineer
Microsoft Open Specifications
Please sign in to rate this answer.
roger-eggenberger 1 Reputation point

2021-06-07T08:09:28.983+00:00

Hi @Tom Jebo ,

thanks for the quick answer.

We will mostly parse Excel and Word and to a lesser extent Powerpoint.

I'm looking forward to the updated [MS-OVBA] and [MS-OSHARED] documentation with V3 signature algorithm.

Best regards,
roger
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

[MS-OVBA] V3 Signature Documentation?

1 answer

Your answer