Digital Signature Features in LibreOffice

LibreOffice provides a comprehensive suite of digital signature features designed to ensure document authenticity, data integrity, and non-repudiation across its applications. This guide outlines the key capabilities available for signing standard OpenDocument formats, exporting signed PDFs, applying cryptographic timestamps, utilizing modern certificate standards, and signing internal macros to safeguard document workflows.

1. Document Signing for OpenDocument Formats (ODF)

LibreOffice allows users to digitally sign its native OpenDocument formats (such as .odt, .ods, and .odp). When a document is signed: * The signature applies to the entire document package, including content, embedded objects, and metadata. * If any part of the document is modified after the signature is applied, the signature becomes invalid, providing immediate tamper detection. * Multiple users can append their independent signatures to a single document without invalidating previous signatures.

2. PDF Digital Signing and Timestamping

LibreOffice supports advanced PDF signature options both during export and for existing files: * Export Signing: When exporting to PDF, users can apply a digital signature directly within the PDF export dialog using an installed certificate. * Signing Existing PDFs: LibreOffice Draw allows users to open and sign external PDF files without altering the underlying PDF structure. * Timestamp Authority (TSA): Users can configure RFC 3161-compliant Time Stamp Authorities. Adding a trusted timestamp proves that the document was signed at a specific time and assists in Long-Term Validation (LTV).

3. Certificate and Encryption Standards Support

LibreOffice integrates directly with system certificate stores to manage cryptographic operations: * X.509 Certificates: Supports standard hardware tokens, smart cards, and software certificates stored in the operating system’s keychain (Windows Certificate Store, macOS Keychain, or NSS/GPG on Linux). * OpenPGP/GPG Signatures: In addition to traditional X.509/PKI certificates, LibreOffice allows users to sign and encrypt documents using GnuPG/OpenPGP keys. * Modern Hash Algorithms: Utilizes secure cryptographic hash algorithms, including SHA-256 and SHA-512, for generating document digests.

4. Signature Lines

Users can insert visual signature lines into documents (primarily in LibreOffice Writer): * A signature line provides a designated graphical box for a physical or visual signature representation. * It can be tied directly to a digital certificate, prompting the signer to validate the document when interacting with the signature line. * Metadata, such as the signer’s name, title, and email address, can be embedded directly within the graphic interface.

5. Macro Security Signing

LibreOffice provides macro signing to protect against malicious scripts: * Developers and administrators can sign macro libraries stored inside documents or templates. * Users can set security levels in LibreOffice settings to only execute macros from trusted sources that possess a valid digital signature.

6. Signature Verification and Validation UI

LibreOffice includes built-in verification tools to give immediate feedback on the security state of an opened file: * A notification bar automatically appears when opening a signed document, indicating whether the signature is valid, expired, or compromised. * A detailed signature viewer allows users to inspect the certificate chain, the issuing Certificate Authority (CA), validity dates, and the specific algorithm used.