When you sign a PDF with a physical USB security key or an enterprise smart card, the PDF software scans the entire document structure and creates a wildly complex math equation known as a hash code. This hash code is permanently locked into the Signature Dictionary. If a hacker intercepts the file and changes the price on the invoice from $100 to $900, the physical file bytes change. This immediately breaks the mathematical harmony of the hash equation locked in the dictionary, aggressively warning the next viewer that fraud was committed.
The Visual Widget vs. The Invisible Math
A Digital Signature in PDF is strictly divided into two completely separate phenomena:
- The Visual Widget (Sig Field): This is the part humans understand. It's a standard Form Field box on the page. It can display a PNG image of your cursive signature, the time/date, or a generic logo (like DocuSign).
- The Value Dictionary (The Hash): This is the invisible part the computer cares about. This data dictionary stores the complex hexadecimal cryptographic stream (the `
`). If someone deletes the visible visual widget box, the underlying math dictionary *still* persists and will still flag the document as illegally altered.
Certification vs Approval
| Signature Type | What it means | What happens if modified? |
|---|---|---|
| MDP (Certifying) | "I am the Author. The file is locked." | The very first signature. You can dictate strict rules (e.g. 'Users can only fill in blank forms, nothing else'). |
| Approval Signature | "I agree to these terms." | A standard sign-off. If a second user adds their approval signature, it mathematically stacks on top without breaking the previous layer. |
| Timestamping | "This existed at Exactly 12:05 PM" | Pings a secured third-party atomic clock server so the user cannot manipulate their computer's local system time to backdate a contract. |
The Data Architecture
% This translates a visual Form box into a Mathematical Signature 12 0 obj << /Type /Sig % Declares this is a Signature Dictionary /Filter /Adobe.PPKLite % The encryption handler used (Public-Key) /SubFilter /adbe.pkcs7.detached % The specific cryptographic protocol /Name (John Doe) % The extracted name of the signer /M (D:20260313101500-08'00') % Date and timezone string % This is the critical part: ByteRange arrays dictate EXACTLY which parts of the physical file are calculated by the hash. Notice how it skips the middle bytes where the signature itself will be injected! /ByteRange [ 0 839 960 1200 ] % The actual mathematical Hex lock based entirely on the user's private key /Contents <04820B44...> >> endobj
The /ByteRange array is essential. A signature formula cannot hash itself. So the formula calculates everything before the signature, skips the signature block itself, and then hashes everything after it.
Common Implementation Errors
- Breaking Multiple Signatures. If Bob signs a document, he seals the file. If Alice then signs the document, but her software saves a "Full Rewrite" of the file rather than a proper "Incremental Update" appended to the end of the file structure, the structure is violently disrupted and Bob's initial signature hash is instantly corrupted and invalidated.
Frequently Asked Questions
No. Drawing your name is called an 'Electronic Signature' (e-Sign) and holds very little security weight because it can be trivially photoshopped onto another document. A 'Digital Signature' uses a certificate ID issued by a trusted authority to generate a cryptographic trace inside the Signature Dictionary.
When you open the PDF, the software runs the math formula again to see if the hash matches. If someone altered the contract text after the signature was placed, the hash instantly fails. Acrobat will display a glaring red warning banner stating: 'Signature is INVALID. Document has been altered.'
Yes. Every time someone mathematically signs the PDF, the PDF executes an 'Incremental Update'. This essentially seals the previous version of the file, allowing the new person to sign their specific layer without breaking the previous person's hash integrity.
Scribbling on a screen does not physically modify the PDF byte code with a PKI hash lock. It just adds a visual element to the screen. A true Digital Signature requires a specialized digital ID certificate.
No. Merging PDFs permanently destroys the underlying byte structure to create a brand new file layout. Because the original physical byte layout is gone, the hash equation immediately breaks, wiping out all previously applied digital signatures.
Add an Electronic Signature Free
If you just need to place a standard business electronic signature (eSign) on a document to push a deal forward, upload your file and use our secure signing tool.
Sign PDF Document