Demystifying the PDF Format: Object Streams, Linearization, and Digital Signatures

1. From PostScript to ISO 32000-2

Before PDF, documents were transmitted using Adobe PostScript—a Turing-complete programming language designed for laser printers. However, PostScript required full code execution to render, making random page access impossible (to view page 50, a viewer had to execute pages 1 through 49). In 1993, Dr. John Warnock introduced The Camelot Project, creating PDF as a declarative, fixed-layout format with immediate random page addressing.

2. The 4 Fundamental Sections of a PDF

Every valid PDF file consists of four strict physical sections arranged from top to bottom:

• Header: The initial line identifying the specification version (e.g., %PDF-1.7 or %PDF-2.0), followed by a binary comment ensuring binary transmission preservation.
• Body: The collection of indirect objects (fonts, raster images, content streams, page trees, annotations) forming the visual hierarchy.
• Cross-Reference Table (xref): An indexing table recording byte offsets for every object, enabling instant $O(1)$ random seek times without scanning the entire file.
• Trailer: Points to the Catalog dictionary (root object) and stores the exact byte position where the primary xref table starts.

3. PDF Primitive Data Types and Indirect Objects

PDF uses eight basic object types: Booleans, Numbers, Strings (literal or hex), Names (prefixed with /, such as /Type /Page), Arrays, Dictionaries, Streams, and the Null object. An indirect object is wrapped with an object ID and generation number:

3 0 obj
<<
  /Type /Page
  /Parent 1 0 R
  /MediaBox [0 0 612 792]
  /Contents 4 0 R
>>
endobj

5. Cryptographic Signatures (PKCS#7 and PAdES)

When signing a PDF digitally, a signature dictionary (/Type /Sig) is injected. The /ByteRange array defines two continuous byte ranges covering the entire file excluding the signature value itself. A cryptographic hash (SHA-256) is calculated over these exact byte spans, encrypted with the signer's private RSA/ECDSA key, and stored inside the PKCS#7 envelope. Any modification to a single character after signing breaks the byte hash, invalidating the signature.