How can i change Hash Algorithm from SHA1 to SHA256 on openPDF 1.4.1

[duynguyeenx96]

Can I change Hash Algorithm from SHA1 to SHA256 when signing PDF files on openPDF version 1.4.1?
Here is my code:

public void signPdf(String inputPdfPath, String outputPdfPath, String p12FilePath, String p12Password, String reason, String location) throws Exception {
        KeyStore keystore = KeyStore.getInstance("PKCS12");
        try (FileInputStream fis = new FileInputStream(p12FilePath)) {
            keystore.load(fis, p12Password.toCharArray());
        }

        String alias = keystore.aliases().nextElement();
        PrivateKey privateKey = (PrivateKey) keystore.getKey(alias, p12Password.toCharArray());
        Certificate[] certChain = keystore.getCertificateChain(alias);

        PdfReader reader = new PdfReader(inputPdfPath);
        try (FileOutputStream os = new FileOutputStream(outputPdfPath);
             PdfStamper stamper = PdfStamper.createSignature(reader, os, '\0')) {

            PdfSignatureAppearance appearance = stamper.getSignatureAppearance();

            appearance.setReason(reason);
            appearance.setLocation(location);
            appearance.setAcro6Layers(true);

            Rectangle rectangle = new Rectangle(450, 790, 595, 842);

            appearance.setVisibleSignature(rectangle,1);

            PdfWriter writer = stamper.getWriter();
            writer.setEncryption(null, null, PdfWriter.ALLOW_PRINTING, PdfWriter.STANDARD_ENCRYPTION_128);

            appearance.setCrypto(privateKey, certChain, null, PdfSignatureAppearance.WINCER_SIGNED);
        }
    }

[andreasrosdal]

Yes, you can change the hash algorithm from SHA-1 to SHA-256 in OpenPDF 1.4.1 when signing PDFs. By default, the method appearance.setCrypto(...) uses SHA-1, so to use SHA-256 you need to use MakeSignature.signDetached(...), which allows explicit control over the digest algorithm.

Solution

Replace this line in your code:

appearance.setCrypto(privateKey, certChain, null, PdfSignatureAppearance.WINCER_SIGNED);

with this:

import com.lowagie.text.pdf.security.BouncyCastleDigest;
import com.lowagie.text.pdf.security.DigestAlgorithms;
import com.lowagie.text.pdf.security.ExternalDigest;
import com.lowagie.text.pdf.security.ExternalSignature;
import com.lowagie.text.pdf.security.MakeSignature;
import com.lowagie.text.pdf.security.PrivateKeySignature;
import org.bouncycastle.jce.provider.BouncyCastleProvider;

import java.security.Security;

// Add BouncyCastle provider if not already present
Security.addProvider(new BouncyCastleProvider());

ExternalSignature signature = new PrivateKeySignature(privateKey, DigestAlgorithms.SHA256, BouncyCastleProvider.PROVIDER_NAME);
ExternalDigest digest = new BouncyCastleDigest();

// Sign the PDF using SHA-256
MakeSignature.signDetached(
    appearance,
    digest,
    signature,
    certChain,
    null, // CRL
    null, // OCSP
    null, // TSA
    0,
    MakeSignature.CryptoStandard.CMS
);