LTV (Long Term Validation)

LTV is a mechanism used in PAdES signatures to keep them valid for a long time. It works as a kind of archive: information such as certificates and revocation status is stored in a PDF structure called the DSS. At the end, a timestamp should be added to protect this information, which can extend the validity of the signatures even beyond the expiration of the Certification Authorities' certificates.

PKI SDK can add LTV information both at signing time and in a second step, with the @Lacuna.Pki.Pades.PadesTimestamper PDF timestamper. As explained above, enabling LTV with a timestamp is the most robust method, because it can also extend the validity of earlier signatures or earlier timestamps. Both methods are shown below.

In the first example, we enable LTV at signing time (without a timestamp):

// enabling LTV on the signature policy
var policy = PadesPolicySpec.GetBasic(TrustArbitrators.Windows);
policy.SignerSpecs.AttributeGeneration.EnableLtv = true;

var signer = new PadesSigner();
signer.SetSigningCertificate(signingCert);
signer.SetPdfToSign(pdfBytes);
signer.SetPolicy(policy);
signer.ComputeSignature();

byte[] signedPdf = signer.GetPadesSignature();  // returns the bytes of the signed PDF, with LTV enabled

In the second example, we enable LTV on an existing signature with the @Lacuna.Pki.Pades.PadesTimestamper PDF timestamper:

// PDF already signed
byte[] signedPdf = ...

// the default timestamping policy already has LTV enabled;
// we enable it again only to show where this property is
var policy = PadesPolicySpec.GetBasic();
policy.StamperSpecs.EnableLtv = true;

// Instantiating the PDF timestamper with LTV
var stamper = new PadesTimestamper();
stamper.SetPdf(signedPdf);
stamper.SetPolicy(policy);
stamper.SetTimestampRequester(tsRequester);  // timestamp requester
stamper.Stamp();

// Returning the timestamped PDF, with LTV enabled
byte[] signedPdfLtv = stamper.GetStampedSignature();

See also​

See also