The actual digest length is larger than the approximation made

[qacha]

I'm trying to sign PDFs using v6.2.0-preview-1.

The attached reproducer generates the same PDF 100 times and tries to sign each of them using an ECDSA certificate. In some cases it succeeds, but in others it complains that the digest length is larger than the "approximation made", which (as far as I understand) comes from signing an empty stream. It seems like the size of the digest is not fixed. In this case, the digest length seems to be 934, 935, or 936 bytes; a different certificate with a proper chain resulted in digest lengths of 2851, 2852, or 2853.

It's possible that the varying size of the digest is due to the use of ECDSA. I don't know if ECDSA is meant to be supported, I'm certainly having some trouble (which I've yet to track down) with the result even when the signing is successful. If ECDSA is not going to be supported in this version, I'd appreciate a response saying so.

Sample output below; reproducer attached.

0: success
Filename='D:\data\incoming\PDFsharp.IssueSubmissionTemplate\assets\temp\IssueTemplate-WIN-CORE-6.0-CCF0D98EB7_temp.pdf'
1: success
2: success
3: success
4: success
5: success
6: The actual digest length 935 is larger than the approximation made 934. Not enough room in the placeholder to fit the signature.
7: success
8: success
9: success
10: success
11: The actual digest length 935 is larger than the approximation made 934. Not enough room in the placeholder to fit the signature.
12: success
13: The actual digest length 936 is larger than the approximation made 935. Not enough room in the placeholder to fit the signature.
14: success
15: success
16: The actual digest length 936 is larger than the approximation made 935. Not enough room in the placeholder to fit the signature.
17: success
18: The actual digest length 936 is larger than the approximation made 935. Not enough room in the placeholder to fit the signature.
19: success
20: success
21: The actual digest length 936 is larger than the approximation made 935. Not enough room in the placeholder to fit the signature.
22: The actual digest length 935 is larger than the approximation made 934. Not enough room in the placeholder to fit the signature.
23: success
24: success
25: The actual digest length 936 is larger than the approximation made 935. Not enough room in the placeholder to fit the signature.
26: success
27: The actual digest length 935 is larger than the approximation made 934. Not enough room in the placeholder to fit the signature.
28: success
29: success
30: success
31: The actual digest length 936 is larger than the approximation made 935. Not enough room in the placeholder to fit the signature.
32: success
33: success
34: success
35: success
36: The actual digest length 936 is larger than the approximation made 935. Not enough room in the placeholder to fit the signature.
37: success
38: success
39: success
40: success
41: success
42: success
43: success
44: success
45: success
46: The actual digest length 936 is larger than the approximation made 935. Not enough room in the placeholder to fit the signature.
47: The actual digest length 935 is larger than the approximation made 934. Not enough room in the placeholder to fit the signature.
48: success
49: The actual digest length 936 is larger than the approximation made 934. Not enough room in the placeholder to fit the signature.
50: success
51: The actual digest length 936 is larger than the approximation made 935. Not enough room in the placeholder to fit the signature.
52: success
53: success
54: success
55: The actual digest length 935 is larger than the approximation made 934. Not enough room in the placeholder to fit the signature.
56: success
57: The actual digest length 935 is larger than the approximation made 934. Not enough room in the placeholder to fit the signature.
58: The actual digest length 935 is larger than the approximation made 934. Not enough room in the placeholder to fit the signature.
59: success
60: success
61: The actual digest length 936 is larger than the approximation made 935. Not enough room in the placeholder to fit the signature.
62: success
63: The actual digest length 936 is larger than the approximation made 934. Not enough room in the placeholder to fit the signature.
64: success
65: The actual digest length 935 is larger than the approximation made 934. Not enough room in the placeholder to fit the signature.
66: success
67: The actual digest length 936 is larger than the approximation made 935. Not enough room in the placeholder to fit the signature.
68: success
69: The actual digest length 935 is larger than the approximation made 934. Not enough room in the placeholder to fit the signature.
70: success
71: The actual digest length 936 is larger than the approximation made 935. Not enough room in the placeholder to fit the signature.
72: The actual digest length 936 is larger than the approximation made 934. Not enough room in the placeholder to fit the signature.
73: success
74: The actual digest length 935 is larger than the approximation made 934. Not enough room in the placeholder to fit the signature.
75: The actual digest length 935 is larger than the approximation made 934. Not enough room in the placeholder to fit the signature.
76: The actual digest length 935 is larger than the approximation made 934. Not enough room in the placeholder to fit the signature.
77: The actual digest length 936 is larger than the approximation made 935. Not enough room in the placeholder to fit the signature.
78: success
79: success
80: success
81: The actual digest length 935 is larger than the approximation made 934. Not enough room in the placeholder to fit the signature.
82: The actual digest length 936 is larger than the approximation made 935. Not enough room in the placeholder to fit the signature.
83: The actual digest length 936 is larger than the approximation made 934. Not enough room in the placeholder to fit the signature.
84: success
85: success
86: The actual digest length 935 is larger than the approximation made 934. Not enough room in the placeholder to fit the signature.
87: The actual digest length 936 is larger than the approximation made 935. Not enough room in the placeholder to fit the signature.
88: success
89: success
90: The actual digest length 936 is larger than the approximation made 935. Not enough room in the placeholder to fit the signature.
91: success
92: success
93: success
94: success
95: The actual digest length 936 is larger than the approximation made 934. Not enough room in the placeholder to fit the signature.
96: The actual digest length 936 is larger than the approximation made 935. Not enough room in the placeholder to fit the signature.
97: The actual digest length 936 is larger than the approximation made 934. Not enough room in the placeholder to fit the signature.
98: The actual digest length 935 is larger than the approximation made 934. Not enough room in the placeholder to fit the signature.
99: success

Issue.zip

[ThomasHoevel]

Thanks for your feedback.

We sign an empty block and reserve 4 more bytes for the signature.
With your signing authority, 4 bytes are not enough and we have to add at least 6 bytes.

We did not yet test with ECDSA certificates. We cannot say if it works, but theoretically all sorts of certificates should do.