.OTF File Format – DSIG

Header

Signature record

Signature block, format 1

Format 1 is for whole fonts with TrueType outlines, CFF or CFF2 data, or both. It is also the only format allowed in a collection.

Making and checking the signature

The signed digest covers the font as it would be without its DSIG table. To sign:

1. If the font already has a DSIG table, remove the table and its table record, move the other tables’ offsets to match, and recalculate checksumAdjustment in head.
2. Append the chosen flags value to a copy of that font data.
3. Hash the result with a secure one-way hash (the specification gives MD5 as an example) to get the content digest.
4. Make the PKCS#7 signature block from the digest.
5. Make a new DSIG table holding the block.
6. Add it to the font, moving table offsets as needed.
7. Add its table record to the table directory.
8. Recalculate checksumAdjustment in head.

To check, software repeats steps 1 to 4 on a copy in memory, using the flags value stored in the font. The final change to checksumAdjustment does not break the signature, because step 1 undoes it.

Before signing, the font must be tidy, or the digest will not match after a reader rebuilds it:

• the magic number in head is right, and the table directory’s search fields agree with numTables;
• table records are in tag order with no duplicate tags;
• every table starts on a multiple of 4, and the first table comes straight after the directory;
• sorted by offset, tables do not overlap and have at most 3 bytes of padding between them (offset[i] + length[i] ≤ offset[i+1] and ≥ offset[i+1] − 3), and the padding bytes are zero;
• the last table ends within the file;
• every table checksum and checksumAdjustment are correct.

Collections

• A signed collection has one DSIG table for the whole file, which must be the last table in the file. It is found through dsigTag, dsigLength and dsigOffset in a version 2.0 collection header, not through a table directory.
• The signature covers the entire file, so nothing can be added to it unnoticed. Fonts inside a collection should not be signed one by one, since building the collection would break their signatures.
• The steps above change: in step 1, an existing DSIG is removed and the header’s three signature fields set to 0, with no checksumAdjustment to recalculate; in steps 6 and 7 the table is added to the file and the header fields point to it; step 8 does not apply.
• Signatures in a collection must be format 1.

Example

The DSIG table of Georgia (Georgia.ttf, as shipped with macOS), 6,008 bytes at offset 373,580, starts:

0005B34C  00 00 00 01 00 01 00 01  00 00 00 01 00 00 17 64   ...............d
0005B35C  00 00 00 14 00 00 00 00  00 00 17 5C 30 82 17 58   ...........\0..X
0005B36C  06 09 2A 86 48 86 F7 0D  01 07 02 A0 82 17 49 30   ..*.H.........I0

Further in, the packet names SHA-1 (1.3.14.3.2.26) as its digest method and carries Microsoft’s Authenticode content type 1.3.6.1.4.1.311.2.1.4. The OpenType specification itself does not say which content type the packet must use.