How to Digitally Sign an Autocad Drawing

check Best Answer

[Disclosure: I work for CoSign by ARX]

You're asking a number of good questions:

When I use the Autodesk tool to attach a digital signature, it says that "No valid digital ID is available on your system" and then sends me to VeriSign. However, I'm not sure what type of certificate I need to get, as there are quite a few to choose from. I would think I'd need a code signing certificate as opposed to a SSL cert, but I'm not sure. What type do I need?

You need an X.509 certificate (they're all X.509 certs) that includes "Digital Signature" as one of the values in the "Key usage" field.  Also known as a digital signature cert. While a single X.509 cert can include many different uses in the "Key usage" field, most Certification Authorities (CA) only issue certs for a single or closely related usage. See possible Key usage values from Microsoft and from section 4.2.1.3 of the standard.

SSL certs will NOT work as digital signature certs. Code sign certs aren't aimed at your usage either.Instead, "Digital Signature" certificates are used.

Hardware or Software storage of the digital signature certificates
Technically, digital signature certs can be stored on your PC. But this is a very bad idea. Just as engineers and architects commonly keep their professional seals in locked boxes, it is very common and often required to keep digital signature certificates inside hardware devices called Secure Signature Creation Devices (SSCD). Individual SSCDs can be used such as smart cards. But the administrative and maintenance costs of a smart card system, associated hardware, drivers, etc is very high.

[start plug] Instead, centralized SSCD systems are now common including those from my company, CoSIgn. Centralized systems have lower Total Cost of Ownership and more flexibility than smart cards. [/end plug]

Centralized signing systems can include automatic Certificate Authorities that will create the digital signature certificates as needed. The certs are stored and used by a tamper-proof signing appliance. The secret private keys never leave the tamper-proof box. (If the box is opened, all of the certs and keys are immediately erased.)

Also, will I need one for each project engineer who will be sealing the drawings, or one for the company that everyone can use? Do I need a managed PKI?

Just as every engineer has his or her own stamp, it is almost always the case that each engineer will have his or her own digital signature certificate. They (and you) will want to protect those certs as carefully as the engineers protect their seals. The engineer's cert represents the engineer same as the engineer's seal does.

Re: PKI. Yes, this is PKI for digital signatures. But don't worry, there are ways around the costs and complexity of an old-style pki system, just use a centralized signing appliance.

I've looked at ARX CoSign, which seems to do digitized signatures and seals. Does this include the digital signature certificate, or is it only the digital seal and digitized signature? Has anyone used their service before?

Yes, CoSign automatically creates the digital certs used by AutoCAD for digitally signing drawings. CoSign can also manage graphical representations of  the digital signature, but AutoCAD does not support this capability from any vendor at this time. The pdf standard does support this, so a graphical representation of the digital signature can be automatically added to pdf files by CoSign, including an image of the engineer's seal. If the pdf is changed then the digital signature is automatically invalidated and the viewer is warned that the file was changed since it was signed.

AutoCAD digital signatures and validation

The AutoCAD digital signature is attached to the drawing's file by AutoCAD using CoSign or an equivalent system. The signature is not visible on the drawing. Instead, AutoCAD notifies the viewer that the digital signature is present and whether it is valid or not.

A signature is valid if the file was originally digitally signed properly and has not been changed (in even the slightest way) since it was signed. The validation screen from AutoCAD is attached to this reply.

Re: people using CoSign. Contact sales@arx.com for references. Tell them Larry Kluger sent you.

attach_file Attachment verify.png 55.9 KB

Was this post helpful? thumb_up thumb_down

sloanextrany.blogspot.com

Source: https://community.spiceworks.com/topic/331331-autocad-attach-digital-signatures