OpenPDF uses hardcoded digest algorithm SHA-1 for timestamp imprint. Doesn't support any other algorithm (e.g. SHA-256)

Created on 3 Jan 2020 · 2Comments · Source: LibrePDF/OpenPDF

OpenPDF being forked from Itext4 is till using hard coded SHA-1 digest for timestamp imprint. Itext, itext5 onwards, allows to use TSAClient to get timestamp imprints
https://github.com/itext/itextpdf/blob/develop/itext/src/main/java/com/itextpdf/text/pdf/security/PdfPKCS7.java

// When requested, go get and add the timestamp. May throw an exception.
            // Added by Martin Brunecky, 07/12/2007 folowing Aiken Sam, 2006-11-15
            // Sam found Adobe expects time-stamped SHA1-1 of the encrypted digest
            if (tsaClient != null) {
                byte[] tsImprint = tsaClient.getMessageDigest().digest(digest);
                byte[] tsToken = tsaClient.getTimeStampToken(tsImprint);
                if (tsToken != null) {
                    ASN1EncodableVector unauthAttributes = buildUnauthenticatedAttributes(tsToken);
                    if (unauthAttributes != null) {
                        signerinfo.add(new DERTaggedObject(false, 1, new DERSet(unauthAttributes)));
                    }
                }
            }

In older standard https://www.etsi.org/deliver/etsi_en/319100_319199/31914201/01.01.01_60/en_31914201v010101p.pdf (it was mentioned to use SHA-1

but now it is more flexible.
Latest doc https://www.etsi.org/deliver/etsi_ts/119500_119599/11953401/01.01.01_60/ts_11953401v010101p.pdf
refers to https://tools.ietf.org/html/rfc5816 and allows to use more secure algorithms.

Adobe has also SHA-256 default in versions 9 onwards.

I can create a PR for this, I need to know if there is any other reason for this not being done already.

Source