Project

PNG-dSIG is an open source project to develop and maintain software support for the newly registered PNG dSIG (digital signature) chunk. This chunk allows embedded digital signatures within any PNG image without breaking the image itself — any image software (including browsers) that is not aware of the dSIG chunk will simply ignore it and display the image as before. This project provides a C library interoperable with libpng which is capable of extracting embedded signatures and their specific content.

The SourceForge project page for png-dsig is at <http://sourceforge.net/projects/png-dsig>
The source files are in the CVS repository at <http://png-dsig.cvs.sourceforge.net/png-dsig>

Technology

The digital signature embedded within the image is fully standard-compliant — a CMS (RFC2630)-compatible signature is used. This ensures maximum flexibility for any requirements that arise. The signature may also contain time stamps, even advanced electronic signatures (CAdES) are possible. Basically, a CMS signature is an ASN.1 DER-encoded structure. Thus PNG-dSIG aims at providing easy means for parsing DER-encoded byte streams and for converting these into easily accessible structures that reflect the underlying ASN.1 objects.

Documentation

This site will feature code examples of how to use png-dSIG. Existing documentation is available at ftp://ftp.simplesystems.org/pub/png/documents/signatures, where also a reference example of an PNG image containing a dSIG chunk is provided.

• Cryptographic Message Syntax - CMS (RFC2630)
• X.509 Certificate and CRL profile (RFC 3280)
• X.509 Timestamp protocol (RFC 3161)
• Advanced Electronic Signatures (CAdES-RFC 5126)