How to make a file manager with an electronic signature?

Question

PHP

Good afternoon.
It is necessary to implement a file manager with the ability to add an electronic signature to the downloaded data.
For now, I imagine it like this:

1. the user selects a file to upload and clicks on the "Sign" button (the signing itself is carried out on the user's side and is stored in a hidden field of the upload form). After the signature generation is completed, the user clicks on the "Submit" button and the data is transferred to the handler on the server;
   
2. the handler saves information about the file (original name and size) and the received electronic signature in the database and uploads the file to the server with a random name;
   
3. when you go to the page with information about the file, a selection is made from the database, parsing and verifying the electronic signature.
   

As a result, I have the following questions:

1. Is this implementation correct or am I missing something?
   
2. in accordance with the technical documentation

   if you want to sign a document of an arbitrary format, then you need to encode it in base64 format

   how can this be done in PHP or JavaScript?
   
3. Is it correct to create an electronic signature along with uploading a file, or is it better to first upload it to the server, and then transfer the base64 representation of the file to the client and return the signed data to the database?
   
4. What type of field is best to store a signature in the database? one file can be signed by several persons and its volume can be significant
   

PS Files are signed using Rutoken EDS and Rutoken Plugin

Answer 1

First, decide which signature you will use. Will key pairs be issued by your server or will you use the digital signature of CAs accredited by you. If signatures are generated by you, will both keys be stored on the server or will only the user have the private key.
In any case, before signing the document, it is necessary to generate its hash. To do this, it is highly desirable to integrate into the document all the resources to which it refers (fonts, subdocuments, pictures, etc.). Then a part of the document is selected, which must be closed with a signature (in the simplest case, this is the entire document file) and some hash is calculated from it. This hash is encrypted with a private key, the resulting encrypted hash is the signature.
For verification, exactly the same hash generation procedure is carried out, the signature is decrypted with the public key and compared with the hash just calculated. If they match, then the signature is valid.
The storage of signatures depends on whether the next signature must approve the previous one or only the document itself. For simple signatures, it is enough to store in a separate table a link to the document, to the signer and the signature itself. For the chain, you need to add another link to the previous signature.