RE: [libreoffice-users] Re: Digital signing MS format documents

I can easily believe that the terms protection, signing, and save with password are easily 
confused.  

 - Dennis

DETAILS

The digital signature case is quite different than Save with Password (which is done with 
password-based encryption, not signing).

Both are quite different from *Protection* of documents to be read-only entirely or in part (but 
not requiring a password to open and read). 

Protection is most commonly encountered in spreadsheets used as forms so that the user of the form 
does not inadvertently type in fields that are not meant to be changeable.  Protection can be 
locked with a password so that only the author can release it easily.  (It is trivial to overcome 
by direct access to the XML of the ODF document, however, and protections can even be forged.)

It is quite possible that protection does not pass across from Microsoft Office documents to 
LibreOffice (and back).  One important difficulty is that the hash used to authenticate a password 
for releasing a protection is computed differently on the two systems, so the password simply won't 
work in both places. There are solutions to that, but I haven't seen any being used.


 - Dennis

-----Original Message-----
From: Tom Davies [mailto:tomdavies04@yahoo.co.uk] 
Sent: Friday, September 16, 2011 11:59
To: users@global.libreoffice.org
Subject: RE: [libreoffice-users] Re: Digital signing MS format documents

Hi :)
Are you sure that's not a password rather than a signature?  I had a similar 'problem' at work = ie 
that is was unexpectedly easy to open a document that was supposed to be protected in some way.  

Now i am wondering if my works file was just signed when it should have been password protected.  
Of course it's impossible to find out from the accounts department exactly what they were trying to 
do and what they really ended up doing.  
Regards from
Tom :)

--- On Fri, 16/9/11, Dennis E. Hamilton <dennis.hamilton@acm.org> wrote:

From: Dennis E. Hamilton <dennis.hamilton@acm.org>
Subject: RE: [libreoffice-users] Re: Digital signing MS format documents
To: users@global.libreoffice.org
Date: Friday, 16 September, 2011, 17:51

I believe those APIs are for OOXML packages, not the binary formats.

It could be that they also work on the binary formats (.doc, .xls, ...),
but I would be a little surprised if that were the case.

This has me wonder if digital signatures are even available on the
binary formats (.doc, .xls, ...).  

To confirm that they are (perhaps):

I created a document in Word 2010 and then inserted a "signature line."
This is an inserted block where a recipient is expected to review and 
then "sign" the document.  The signature is then protected as a digital 
signature.

I saved it as a .doc

When I opened it, there is a notice on the top that says "This document
needs to be signed."  The View Signatures button showed me that there
is a requested signature from Dennis E. Hamilton.

I clicked the option to sign it as Dennis E. Hamilton. I typed my name
into the signature line field, and clicked Sign.  This had the document
marked as final too.

Then when I clicked to see signature details, it says valid XAdES-EPES
signature.  Wow, and it shows that I signed with a certificate issued
to orcmid that is valid from 2011-03-03 to 2111-02-07.  Hmm, this is
a self-issued certificate that the operating system gave to me.  

When this .doc is opened in LibreOffice, it is as if I had never 
signed it, and the text I typed in for my signature is also missing
in the signature block.

I could find no way to have a .doc signature that was on the document
the way that LibreOffice signs ODF documents.  It could be that I
didn't know where to look, but the signing in Word seems wildly
different from signing in LibreOffice.

-----Original Message-----
From: draganb [mailto:d_bocevski@yahoo.com] 
Sent: Friday, September 16, 2011 00:18
To: users@global.libreoffice.org
Subject: [libreoffice-users] Re: Digital signing MS format documents

Yes, the available API could be used for signing AND verification. And also,
as I learned today, MS also offers a non .NET set of APIs for C and C++
developers.
"The Windows 7 Packaging feature is a set of COM-based API that provides
support for accessing, modifying, and saving packages by using C and C++." -
(http://msdn.microsoft.com/en-us/library/dd371623.aspx) 

(from:
http://blogs.msdn.com/b/dmahugh/archive/2011/04/19/libopc-version-0-0-1-released.aspx)
Historically, there have been two popular .NET APIs for Open XML
development: System.IO.Packaging (which first appeared in .NET 3.0) and the
Open XML SDK, released in early 2007. There’s also a COM-based native
packaging API available for non-.NET Windows developers.


Aside from this, some enthusiasts began working on a open source component
for working with OPC container named libopc. They also wrote a LibreOffice
extension for working with MS formats as an alternative to the LO native
support for MS formats. It could turn out an interesting project. 
(http://www.youtube.com/watch?v=RzUlEVLnz6U&feature=player_embedded#!)

Dragan



--
View this message in context: 
http://nabble.documentfoundation.org/Digital-signing-MS-format-documents-tp3331970p3341213.html
Sent from the Users mailing list archive at Nabble.com.

-- 
For unsubscribe instructions e-mail to: users+help@global.libreoffice.org
Problems? http://www.libreoffice.org/get-help/mailing-lists/how-to-unsubscribe/
Posting guidelines + more: http://wiki.documentfoundation.org/Netiquette
List archive: http://listarchives.libreoffice.org/global/users/
All messages sent to this list will be publicly archived and cannot be deleted


-- 
For unsubscribe instructions e-mail to: users+help@global.libreoffice.org
Problems? http://www.libreoffice.org/get-help/mailing-lists/how-to-unsubscribe/
Posting guidelines + more: http://wiki.documentfoundation.org/Netiquette
List archive: http://listarchives.libreoffice.org/global/users/
All messages sent to this list will be publicly archived and cannot be deleted

-- 
For unsubscribe instructions e-mail to: users+help@global.libreoffice.org
Problems? http://www.libreoffice.org/get-help/mailing-lists/how-to-unsubscribe/
Posting guidelines + more: http://wiki.documentfoundation.org/Netiquette
List archive: http://listarchives.libreoffice.org/global/users/
All messages sent to this list will be publicly archived and cannot be deleted


-- 
For unsubscribe instructions e-mail to: users+help@global.libreoffice.org
Problems? http://www.libreoffice.org/get-help/mailing-lists/how-to-unsubscribe/
Posting guidelines + more: http://wiki.documentfoundation.org/Netiquette
List archive: http://listarchives.libreoffice.org/global/users/
All messages sent to this list will be publicly archived and cannot be deleted