Digital Signatures in C#

• Digital signature is a way to ensure that the person who uses the electronic data,
document and information is an authorized person.
• Digital signature is a stamp user places on the data that is unique to him/her and is very difficult to forge.

Use of key in digital signature

1. Private key: The person who made his signature, uses his/her private key to encrypt the hash into encrypted form.
2. Public key: In the process of verification of the digital signature, the public key of that
person who encrypted the hash is used to decrypt the hash.
Note: If the hashes of both the signing and the verification is the same then the signature is valid and the person is authorized to use the data and information

create digital signature in #c

1. Sender applies hash algorithm to the data being sent and creates a message digest.
Message digest is compact representation of the data being sent.
2. Sender then encrypts the message digest with the private key to get a digital signature
3. Sender sends the data over a secure channel
4. Receiver receives the data and decrypts the digital signature using public key and retrieves the message digest
5. Receiver applies the same hash algorithm as the sender to the data and creates a new message digest
6. If sender’s digest and receiver’s digest match then it means that the message really came from the said sender


1. Presign:

Required: pdf, certificate chain Serverside, setup signature infrastructure, extract message digest and send the digest to client as a byte-array

2. Signing:

Required: message digest as byte-array, private key Clientside, apply cryptographic algorithms to message digest to generate the signed digest from the hash and send this signature to the server

3. Postsign:

Required: signed digest as byte-array, pdf Server-side insert the signed digest
into the prepared signature, insert the signature into the PDF-document

Related .net Framework Provide

.NET Framework provides classes RSACrypto Service Provider, RSAPKCS1 Signature Formatter and RSAPKCS1 Signature Deformatter that allow you create and verify digital signatures. All of them reside in System.Security.Cryptography namespace

Example (Using itextshap):

  1. using iTextSharp.text.pdf;
  2. using System;
  3. using System.Collections.Generic;
  4. using System.IO;
  5. using System.Security.Cryptography.X509Certificates;
  6. using Org.BouncyCastle.Security;
  7. using Org.BouncyCastle.X509;
  8. using X509Certificate = Org.BouncyCastle.X509.X509Certificate;
  9. using;

All the above-mentioned references are used for accessing DSC, Signing DSC, Reading PDF and Creating new signed PDF.

Create a variable for X509Certificate2 and Get all the DSC users registered to local store and for current user using X509Store, PFB then X509Store “st” will collect all the certificates

  1. X509Certificate2 certClient = null;
  2. X509Store st = new X509Store(StoreName.My, StoreLocation.CurrentUser);
  3. st.Open(OpenFlags.MaxAllowed);
  4. X509Certificate2Collection collection = st.Certificates;

C# code :

  1. Pkcs12Store store = new Pkcs12Store(new FileStream(KEYSTORE, FileMode.Open), PASSWORD);
  2. String alias = “”;
  3. ICollection<X509Certificate> chain = new List<X509Certificate>();
  4. // searching for private key
  5. foreach (string al in store.Aliases)
  6. if (store.IsKeyEntry(al) && store.GetKey(al).Key.IsPrivate) {
    alias = al;
  7. AsymmetricKeyEntry pk = store.GetKey(alias);
  8. foreach (X509CertificateEntry c in store.GetCertificateChain(alias))
  9. RsaPrivateCrtKeyParameters parameters = pk.Key as RsaPrivateCrtKeyParameters;
  10. PdfReader reader = newPdfReader(src);
  11. FileStream os = newFileStream(dest, FileMode.Create);
  12. PdfStamper stamper = PdfStamper.CreateSignature(reader, os, ‘\0’);
  13. // Creating the appearance
  14. PdfSignatureAppearance appearance = stamper.SignatureAppearance;
  15. appearance.Reason = “Test signing”; appearance.Location = “test Location”;
  16. appearance.SetVisibleSignature(newRectangle(36, 748, 144, 780), 1, “sig”);
  17. // Creating the signature
  18. IExternalSignature pks = newPrivateKeySignature(parameters, DigestAlgorithms.SHA256);
  19. MakeSignature.SignDetached(appearance, pks, chain, null, null, null, 0, CryptoStandard.CMS);


Author – Disha Raval

Get a Quote