Authentication of Information

The Challenge

For almost 150 years, the U.S. Government Printing Office (GPO) has been the official disseminator of Government documents and has assured users of their authenticity.

In the 21st century, the increasing use of electronic documents poses special challenges in verifying authenticity, because digital technology makes such documents easy to alter or copy, leading to multiple non-identical versions that can be used in unauthorized or illegitimate ways.

GPO’s Charge

To help meet the challenge of the digital age, GPO has begun implementing digital signatures to certain electronic documents on GPO Access that not only establish GPO as the trusted information disseminator, but also provide the assurance that an electronic document has not been altered since GPO disseminated it.

The visible digital signatures on online PDF documents serve the same purpose as handwritten signatures or traditional wax seals on printed documents. A digital signature, viewed through the GPO Seal of Authenticity, verifies document integrity and authenticity on GPO online Federal documents, at no cost to the customer.

Currently, the following documents are signed in FDsys:

• Budget of the United States Government (FY 2010)

• Compilation of Presidential Documents

• Congressional Bills

• Congressional Directory

• Congressional Record (Bound Edition)

• Federal Register

• List of CFR Sections Affected

• Public and Private Laws

• United States Government Manual

• United States Statutes at Large

How Does it Work?

GPO uses a digital certificate to apply digital signatures to PDF documents. In order for users to validate the certificate that was used by GPO to apply a digital signature to document, a chain of certificates or a certification path between the certificate and an established point of trust must be established, and every certificate within that path must be checked.

Validating Digital Signatures Presentations:

• Adobe Acrobat 7.0

• Adobe Acrobat 8.0

Requirements for Validating Digital Signatures

The following requirements must be met to validate PDF digital signatures.

• Adobe Acrobat or Reader 8.0 or 7.0

• Users must be connected to the Internet in order to have the ability to validate a digital signature on a PDF document. If a user is not connected to the Internet, the Certification Question Mark icon will display. Please see the Validation Icons section below for more information.

Authentication Frequently Asked Questions

Q: What does it mean when GPO says a file is authenticated?

A: GPO authenticates documents on by applying digital signatures to official content after its validity has been confirmed. GPO has begun its authentication efforts by signing and certifying PDF files. The technology used to certify these documents allows GPO to secure the data integrity, and provides users with assurance that the content is unchanged since it was disseminated by GPO.

In addition to certifying a document, GPO uses digital signature technology to add a visible Seal of Authenticity to authenticated and certified PDF documents. When GPO signs and certifies a document, a blue ribbon icon appears to the left of the Seal of Authenticity and in the Signatures tab within Adobe Acrobat or Reader. When users print a document that has been signed and certified by GPO, the Seal of Authenticity will automatically print on the document, but the blue ribbon will not print.

Q: What is GPO's Seal of Authenticity?

A: The GPO Seal of Authenticity is a graphic of an eagle next to the words “Authenticated U.S. Government Information.”

This seal notifies users that a document has been authenticated by GPO. By using digital signature technology to add the Seal to a PDF document, GPO attests that the document has not been altered since it was authenticated and disseminated by GPO.

Q: What are validation icons?

A: Validation icons appear next to the GPO Seal of Authenticity to notify users of the content's validity status. The following is a list of icons that are used by Adobe to convey information about digital signatures.

	The Blue Ribbon icon indicates that the certification is valid.
	The Certification Question Mark icon means that the document was certified, but the validity is unknown. The signer's identity is unknown, because the certificate path could not be built. This icon may appear if a user is not connected to the Internet or if a digital certificate is not available on a user's computer.
	The Check Mark icon indicates that the signature is valid.
	The Question Mark icon indicates that the signature could not be verified.
	The Warning Sign icon indicates that the document was modified after the signature was added.
	The Red "X" icon indicates that the certification is not valid.

Q: What certificate information should I expect to see in a file digitally signed and certified by GPO?

A: An electronic file that has been digitally signed and certified by GPO should include the following information:

• Name: Superintendent of Documents

• Organization: United States Government Printing Office

• Signed By: Superintendent of Documents

• Signer’s Contact Information: pkisupport@gpo.gov

• Reason for Signing: GPO attests that this document has not been altered since it was disseminated by GPO

Q: How can I tell if a signed and certified file has been changed?

A: If the content of a PDF file certified by GPO is altered, the certification will be invalidated. Users will know this by the appearance of the red "X" icon next to the GPO Seal of Authenticity.

Q: If I save a digitally signed and certified file to my own computer, is the signature still valid?

A: As long as the file is not changed, the electronic signature will remain valid. Users can save PDF files that have been digitally signed and certified by GPO for later use or email them to other users without affecting the digital signature.

Q: I opened a digitally signed and certified document that I saved on my computer several weeks ago. How can I be sure it has not been corrupted?

A: You can check the validity of a signature at any time, if your computer is connected to the Internet. To do so, open the document in Adobe Acrobat or Adobe Reader. Go to the Document menu, then select "Digital Signatures," then "Validate Signatures." The software will run a validation check to see if the digital certificate used to sign the document is valid. See "Instructions for Validating Signatures" for more information.

Q: I want to quote an authenticated document I downloaded. Do I have to retype the text?

A: Users can select text from a digitally signed and certified PDF file, then copy and paste it into a new document. The digital signature will not be transferred with the text.

Q: I have a PDF document that has been changed. Is there any way to see the signed version?

A: If changes are made to the signed version of a document, Adobe Acrobat and Reader provide the capability to view the signed version. To access this feature, click on the Signatures Tab and choose “View Signed Version” from the Options Menu. If multiple versions are available, users will have the ability to select this option. If multiple versions are not available, this option will be grayed out.

Q: Can I see some examples of changed files and files that have been signed, but not certified?

A: Below are some examples of files that have been changed or signed, but not certified.

• This file has been signed, but not certified.

• This file was signed, but not certified, and has been changed.

Q: Where can I get more help using digitally signed and certified PDF files?

A: Additional help information is available from the Adobe Acrobat (or Reader) Help file which is part of the Adobe software. To access additional help on validating digital signatures, open Acrobat or Reader, click on “Help,” click on “Adobe Acrobat (or Reader) Help,” click on “Search,” and use the following search term: “Digitally Signed Adobe PDF Documents.