Class PdfPKCS7
java.lang.Object
com.gitlab.pdftk_java.com.lowagie.text.pdf.PdfPKCS7
This class does all the processing related to signing and verifying a PKCS#7
signature.
It's based in code found at org.bouncycastle.
-
Nested Class Summary
Nested ClassesModifier and TypeClassDescriptionstatic class
a class that holds an X509 namestatic class
class for breaking up an X500 Name into it's component tokens, ala java.util.StringTokenizer. -
Field Summary
FieldsModifier and TypeFieldDescriptionprivate Collection
private Collection
private byte[]
private String
private Set
private byte[]
private String
private byte[]
private byte[]
private static final String
private static final String
private static final String
private static final String
private static final String
private static final String
private static final String
private static final String
private static final String
private static final String
private static final String
private static final String
private static final String
private String
Holds value of property location.private MessageDigest
private PrivateKey
private String
Holds value of property reason.private byte[]
private Signature
private byte[]
private X509Certificate
private Calendar
Holds value of property signDate.private int
private String
Holds value of property signName.private boolean
private boolean
private int
-
Constructor Summary
ConstructorsConstructorDescriptionVerifies a signature using the sub-filter adbe.x509.rsa_sha1.Verifies a signature using the sub-filter adbe.pkcs7.detached or adbe.pkcs7.sha1.PdfPKCS7
(PrivateKey privKey, Certificate[] certChain, CRL[] crlList, String hashAlgorithm, String provider, boolean hasRSAdata) Generates a signature. -
Method Summary
Modifier and TypeMethodDescriptionbyte[]
getAuthenticatedAttributeBytes
(byte[] secondDigest, Calendar signingTime) When using authenticatedAttributes the authentication process is different.Get the X.509 certificates associated with this PKCS#7 objectgetCRLs()
Get the X.509 certificate revocation lists associated with this PKCS#7 objectGet the algorithm used to calculate the message digestbyte[]
Gets the bytes for the PKCS#1 object.byte[]
Gets the bytes for the PKCS7SignedData object.byte[]
getEncodedPKCS7
(byte[] secondDigest, Calendar signingTime) Gets the bytes for the PKCS7SignedData object.Returns the algorithm.private static org.bouncycastle.asn1.ASN1Primitive
getIssuer
(byte[] enc) Get the "issuer" from the TBSCertificate bytes that are passed instatic PdfPKCS7.X500Name
Get the issuer fields from an X509 CertificateGetter for property location.Getter for property reason.Getter for property signDate.Get the X.509 certificate actually used to sign the digest.int
Get the version of the PKCS#7 "SignerInfo" object.Getter for property sigName.private static org.bouncycastle.asn1.ASN1Primitive
getSubject
(byte[] enc) Get the "subject" from the TBSCertificate bytes that are passed instatic PdfPKCS7.X500Name
Get the subject fields from an X509 Certificateint
Get the version of the PKCS#7 object.static KeyStore
Loads the default root certificates at <java.home>/lib/security/cacerts with the default provider.static KeyStore
loadCacertsKeyStore
(String provider) Loads the default root certificates at <java.home>/lib/security/cacerts.void
setExternalDigest
(byte[] digest, byte[] RSAdata, String digestEncryptionAlgorithm) Sets the digest/signature to an external calculated value.void
setLocation
(String location) Setter for property location.void
Setter for property reason.void
setSignDate
(Calendar signDate) Setter for property signDate.void
setSignName
(String signName) Setter for property sigName.void
update
(byte[] buf, int off, int len) Update the digest with the specified bytes.boolean
verify()
Verify the digest.static String
verifyCertificate
(X509Certificate cert, Collection crls, Calendar calendar) Verifies a single certificate.static Object[]
verifyCertificates
(Certificate[] certs, KeyStore keystore, Collection crls, Calendar calendar) Verifies a certificate chain against a KeyStore.
-
Field Details
-
sigAttr
private byte[] sigAttr -
digestAttr
private byte[] digestAttr -
version
private int version -
signerversion
private int signerversion -
digestalgos
-
certs
-
crls
-
signCert
-
digest
private byte[] digest -
messageDigest
-
digestAlgorithm
-
digestEncryptionAlgorithm
-
sig
-
privKey
-
RSAdata
private byte[] RSAdata -
verified
private boolean verified -
verifyResult
private boolean verifyResult -
externalDigest
private byte[] externalDigest -
externalRSAdata
private byte[] externalRSAdata -
ID_PKCS7_DATA
- See Also:
-
ID_PKCS7_SIGNED_DATA
- See Also:
-
ID_MD5
- See Also:
-
ID_MD2
- See Also:
-
ID_SHA1
- See Also:
-
ID_RSA
- See Also:
-
ID_DSA
- See Also:
-
ID_CONTENT_TYPE
- See Also:
-
ID_MESSAGE_DIGEST
- See Also:
-
ID_SIGNING_TIME
- See Also:
-
ID_MD2RSA
- See Also:
-
ID_MD5RSA
- See Also:
-
ID_SHA1RSA
- See Also:
-
reason
Holds value of property reason. -
location
Holds value of property location. -
signDate
Holds value of property signDate. -
signName
Holds value of property signName.
-
-
Constructor Details
-
PdfPKCS7
public PdfPKCS7(byte[] contentsKey, byte[] certsKey, String provider) throws SecurityException, CRLException, InvalidKeyException, CertificateException, NoSuchProviderException, NoSuchAlgorithmException, IOException Verifies a signature using the sub-filter adbe.x509.rsa_sha1.- Parameters:
contentsKey
- the /Contents keycertsKey
- the /Cert keyprovider
- the provider ornull
for the default provider- Throws:
SecurityException
- on errorCRLException
- on errorInvalidKeyException
- on errorCertificateException
- on errorNoSuchProviderException
- on errorNoSuchAlgorithmException
- on errorIOException
- on error
-
PdfPKCS7
public PdfPKCS7(byte[] contentsKey, String provider) throws SecurityException, CRLException, InvalidKeyException, CertificateException, NoSuchProviderException, NoSuchAlgorithmException Verifies a signature using the sub-filter adbe.pkcs7.detached or adbe.pkcs7.sha1.- Parameters:
contentsKey
- the /Contents keyprovider
- the provider ornull
for the default provider- Throws:
SecurityException
- on errorCRLException
- on errorInvalidKeyException
- on errorCertificateException
- on errorNoSuchProviderException
- on errorNoSuchAlgorithmException
- on error
-
PdfPKCS7
public PdfPKCS7(PrivateKey privKey, Certificate[] certChain, CRL[] crlList, String hashAlgorithm, String provider, boolean hasRSAdata) throws SecurityException, InvalidKeyException, NoSuchProviderException, NoSuchAlgorithmException Generates a signature.- Parameters:
privKey
- the private keycertChain
- the certificate chaincrlList
- the certificate revocation listhashAlgorithm
- the hash algorithmprovider
- the provider ornull
for the default providerhasRSAdata
-true
if the sub-filter is adbe.pkcs7.sha1- Throws:
SecurityException
- on errorInvalidKeyException
- on errorNoSuchProviderException
- on errorNoSuchAlgorithmException
- on error
-
-
Method Details
-
update
Update the digest with the specified bytes. This method is used both for signing and verifying- Parameters:
buf
- the data bufferoff
- the offset in the data bufferlen
- the data length- Throws:
SignatureException
- on error
-
verify
Verify the digest.- Returns:
true
if the signature checks out,false
otherwise- Throws:
SignatureException
- on error
-
getCertificates
Get the X.509 certificates associated with this PKCS#7 object- Returns:
- the X.509 certificates associated with this PKCS#7 object
-
getCRLs
Get the X.509 certificate revocation lists associated with this PKCS#7 object- Returns:
- the X.509 certificate revocation lists associated with this PKCS#7 object
-
getSigningCertificate
Get the X.509 certificate actually used to sign the digest.- Returns:
- the X.509 certificate actually used to sign the digest
-
getVersion
public int getVersion()Get the version of the PKCS#7 object. Always 1- Returns:
- the version of the PKCS#7 object. Always 1
-
getSigningInfoVersion
public int getSigningInfoVersion()Get the version of the PKCS#7 "SignerInfo" object. Always 1- Returns:
- the version of the PKCS#7 "SignerInfo" object. Always 1
-
getDigestAlgorithm
Get the algorithm used to calculate the message digest- Returns:
- the algorithm used to calculate the message digest
-
getHashAlgorithm
Returns the algorithm.- Returns:
- the digest algorithm
-
loadCacertsKeyStore
Loads the default root certificates at <java.home>/lib/security/cacerts with the default provider.- Returns:
- a
KeyStore
-
loadCacertsKeyStore
Loads the default root certificates at <java.home>/lib/security/cacerts.- Parameters:
provider
- the provider ornull
for the default provider- Returns:
- a
KeyStore
-
verifyCertificate
Verifies a single certificate.- Parameters:
cert
- the certificate to verifycrls
- the certificate revocation list ornull
calendar
- the date ornull
for the current date- Returns:
- a
String
with the error description ornull
if no error
-
verifyCertificates
public static Object[] verifyCertificates(Certificate[] certs, KeyStore keystore, Collection crls, Calendar calendar) Verifies a certificate chain against a KeyStore.- Parameters:
certs
- the certificate chainkeystore
- theKeyStore
crls
- the certificate revocation list ornull
calendar
- the date ornull
for the current date- Returns:
null
if the certificate chain could be validade or aObject[]{cert,error}
wherecert
is the failed certificate anderror
is the error message
-
getIssuer
private static org.bouncycastle.asn1.ASN1Primitive getIssuer(byte[] enc) Get the "issuer" from the TBSCertificate bytes that are passed in- Parameters:
enc
- a TBSCertificate in a byte array- Returns:
- a ASN1Primitive
-
getSubject
private static org.bouncycastle.asn1.ASN1Primitive getSubject(byte[] enc) Get the "subject" from the TBSCertificate bytes that are passed in- Parameters:
enc
- A TBSCertificate in a byte array- Returns:
- a ASN1Primitive
-
getIssuerFields
Get the issuer fields from an X509 Certificate- Parameters:
cert
- an X509Certificate- Returns:
- an X500Name
-
getSubjectFields
Get the subject fields from an X509 Certificate- Parameters:
cert
- an X509Certificate- Returns:
- an X500Name
-
getEncodedPKCS1
public byte[] getEncodedPKCS1()Gets the bytes for the PKCS#1 object.- Returns:
- a byte array
-
setExternalDigest
Sets the digest/signature to an external calculated value.- Parameters:
digest
- the digest. This is the actual signatureRSAdata
- the extra data that goes into the data tag in PKCS#7digestEncryptionAlgorithm
- the encryption algorithm. It may must benull
if thedigest
is alsonull
. If thedigest
is notnull
then it may be "RSA" or "DSA"
-
getEncodedPKCS7
public byte[] getEncodedPKCS7()Gets the bytes for the PKCS7SignedData object.- Returns:
- the bytes for the PKCS7SignedData object
-
getEncodedPKCS7
Gets the bytes for the PKCS7SignedData object. Optionally the authenticatedAttributes in the signerInfo can also be set. If either of the parameters isnull
, none will be used.- Parameters:
secondDigest
- the digest in the authenticatedAttributessigningTime
- the signing time in the authenticatedAttributes- Returns:
- the bytes for the PKCS7SignedData object
-
getAuthenticatedAttributeBytes
When using authenticatedAttributes the authentication process is different. The document digest is generated and put inside the attribute. The signing is done over the DER encoded authenticatedAttributes. This method provides that encoding and the parameters must be exactly the same as ingetEncodedPKCS7(byte[],Calendar)
.A simple example:
Calendar cal = Calendar.getInstance(); PdfPKCS7 pk7 = new PdfPKCS7(key, chain, null, "SHA1", null, false); MessageDigest messageDigest = MessageDigest.getInstance("SHA1"); byte buf[] = new byte[8192]; int n; InputStream inp = sap.getRangeStream(); while ((n = inp.read(buf)) > 0) { messageDigest.update(buf, 0, n); } byte hash[] = messageDigest.digest(); byte sh[] = pk7.getAuthenticatedAttributeBytes(hash, cal); pk7.update(sh, 0, sh.length); byte sg[] = pk7.getEncodedPKCS7(hash, cal);
- Parameters:
secondDigest
- the content digestsigningTime
- the signing time- Returns:
- the byte array representation of the authenticatedAttributes ready to be signed
-
getReason
Getter for property reason.- Returns:
- Value of property reason.
-
setReason
Setter for property reason.- Parameters:
reason
- New value of property reason.
-
getLocation
Getter for property location.- Returns:
- Value of property location.
-
setLocation
Setter for property location.- Parameters:
location
- New value of property location.
-
getSignDate
Getter for property signDate.- Returns:
- Value of property signDate.
-
setSignDate
Setter for property signDate.- Parameters:
signDate
- New value of property signDate.
-
getSignName
Getter for property sigName.- Returns:
- Value of property sigName.
-
setSignName
Setter for property sigName.- Parameters:
signName
- New value of property sigName.
-