|
||||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |
java.lang.Objectcom.itextpdf.text.pdf.PdfPKCS7
public class PdfPKCS7
This class does all the processing related to signing and verifying a PKCS#7 signature.
It's based in code found at org.bouncycastle.
Nested Class Summary | |
---|---|
static class |
PdfPKCS7.X509Name
a class that holds an X509 name |
static class |
PdfPKCS7.X509NameTokenizer
class for breaking up an X500 Name into it's component tokens, ala java.util.StringTokenizer. |
Constructor Summary | |
---|---|
PdfPKCS7(byte[] contentsKey,
byte[] certsKey,
String provider)
Verifies a signature using the sub-filter adbe.x509.rsa_sha1. |
|
PdfPKCS7(byte[] contentsKey,
String provider)
Verifies a signature using the sub-filter adbe.pkcs7.detached or adbe.pkcs7.sha1. |
|
PdfPKCS7(PrivateKey privKey,
Certificate[] certChain,
CRL[] crlList,
String hashAlgorithm,
String provider,
boolean hasRSAdata)
Generates a signature. |
Method Summary | |
---|---|
static String |
getAlgorithm(String oid)
Gets the algorithm name for a certain id. |
static String |
getAllowedDigests(String name)
|
byte[] |
getAuthenticatedAttributeBytes(byte[] secondDigest,
Calendar signingTime,
byte[] ocsp)
When using authenticatedAttributes the authentication process is different. |
Certificate[] |
getCertificates()
Get all the X.509 certificates associated with this PKCS#7 object in no particular order. |
Collection<CRL> |
getCRLs()
Get the X.509 certificate revocation lists associated with this PKCS#7 object |
static String |
getCrlUrl(X509Certificate certificate)
|
static String |
getDigest(String oid)
Gets the digest name for a certain id |
String |
getDigestAlgorithm()
Get the algorithm used to calculate the message digest |
String |
getDigestAlgorithmOid()
Getter for the digest algorithm |
String |
getDigestEncryptionAlgorithmOid()
Getter for the digest encryption algorithm |
byte[] |
getEncodedPKCS1()
Gets the bytes for the PKCS#1 object. |
byte[] |
getEncodedPKCS7()
Gets the bytes for the PKCS7SignedData object. |
byte[] |
getEncodedPKCS7(byte[] secondDigest,
Calendar signingTime)
Gets the bytes for the PKCS7SignedData object. |
byte[] |
getEncodedPKCS7(byte[] secondDigest,
Calendar signingTime,
TSAClient tsaClient,
byte[] ocsp)
Gets the bytes for the PKCS7SignedData object. |
String |
getHashAlgorithm()
Returns the algorithm. |
static PdfPKCS7.X509Name |
getIssuerFields(X509Certificate cert)
Get the issuer fields from an X509 Certificate |
String |
getLocation()
Getter for property location. |
org.bouncycastle.ocsp.BasicOCSPResp |
getOcsp()
Gets the OCSP basic response if there is one. |
static String |
getOCSPURL(X509Certificate certificate)
Retrieves the OCSP URL from the given certificate. |
String |
getReason()
Getter for property reason. |
Certificate[] |
getSignCertificateChain()
Get the X.509 sign certificate chain associated with this PKCS#7 object. |
Calendar |
getSignDate()
Getter for property signDate. |
X509Certificate |
getSigningCertificate()
Get the X.509 certificate actually used to sign the digest. |
int |
getSigningInfoVersion()
Get the version of the PKCS#7 "SignerInfo" object. |
String |
getSignName()
Getter for property sigName. |
static PdfPKCS7.X509Name |
getSubjectFields(X509Certificate cert)
Get the subject fields from an X509 Certificate |
Calendar |
getTimeStampDate()
Gets the timestamp date |
org.bouncycastle.tsp.TimeStampToken |
getTimeStampToken()
Gets the timestamp token if there is one. |
int |
getVersion()
Get the version of the PKCS#7 object. |
boolean |
isRevocationValid()
Checks if OCSP revocation refers to the document signing certificate. |
static KeyStore |
loadCacertsKeyStore()
Loads the default root certificates at <java.home>/lib/security/cacerts with the default provider. |
static KeyStore |
loadCacertsKeyStore(String provider)
Loads the default root certificates at <java.home>/lib/security/cacerts. |
void |
setExternalDigest(byte[] digest,
byte[] RSAdata,
String digestEncryptionAlgorithm)
Sets the digest/signature to an external calculated value. |
void |
setLocation(String location)
Setter for property location. |
void |
setReason(String reason)
Setter for property reason. |
void |
setSignDate(Calendar signDate)
Setter for property signDate. |
void |
setSignName(String signName)
Setter for property sigName. |
void |
update(byte[] buf,
int off,
int len)
Update the digest with the specified bytes. |
boolean |
verify()
Verify the digest. |
static String |
verifyCertificate(X509Certificate cert,
Collection<CRL> crls,
Calendar calendar)
Verifies a single certificate. |
static Object[] |
verifyCertificates(Certificate[] certs,
KeyStore keystore,
Collection<CRL> crls,
Calendar calendar)
Verifies a certificate chain against a KeyStore. |
static boolean |
verifyOcspCertificates(org.bouncycastle.ocsp.BasicOCSPResp ocsp,
KeyStore keystore,
String provider)
Verifies an OCSP response against a KeyStore. |
static boolean |
verifyTimestampCertificates(org.bouncycastle.tsp.TimeStampToken ts,
KeyStore keystore,
String provider)
Verifies a timestamp against a KeyStore. |
boolean |
verifyTimestampImprint()
Checks if the timestamp refers to this document. |
Methods inherited from class java.lang.Object |
---|
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait |
Constructor Detail |
---|
public PdfPKCS7(byte[] contentsKey, byte[] certsKey, String provider)
contentsKey
- the /Contents keycertsKey
- the /Cert keyprovider
- the provider or null
for the default providerpublic PdfPKCS7(byte[] contentsKey, String provider)
contentsKey
- the /Contents keyprovider
- the provider or null
for the default providerpublic PdfPKCS7(PrivateKey privKey, Certificate[] certChain, CRL[] crlList, String hashAlgorithm, String provider, boolean hasRSAdata) throws InvalidKeyException, NoSuchProviderException, NoSuchAlgorithmException
privKey
- the private keycertChain
- the certificate chaincrlList
- the certificate revocation listhashAlgorithm
- the hash algorithmprovider
- the provider or null
for the default providerhasRSAdata
- true
if the sub-filter is adbe.pkcs7.sha1
InvalidKeyException
- on error
NoSuchProviderException
- on error
NoSuchAlgorithmException
- on errorMethod Detail |
---|
public static String getDigest(String oid)
oid
- an id (for instance "1.2.840.113549.2.5")
public static String getAlgorithm(String oid)
oid
- an id (for instance "1.2.840.113549.1.1.1")
public static String getAllowedDigests(String name)
public org.bouncycastle.tsp.TimeStampToken getTimeStampToken()
public Calendar getTimeStampDate()
public org.bouncycastle.ocsp.BasicOCSPResp getOcsp()
public void update(byte[] buf, int off, int len) throws SignatureException
buf
- the data bufferoff
- the offset in the data bufferlen
- the data length
SignatureException
- on errorpublic boolean verify() throws SignatureException
true
if the signature checks out, false
otherwise
SignatureException
- on errorpublic boolean verifyTimestampImprint() throws NoSuchAlgorithmException
NoSuchAlgorithmException
- on errorpublic Certificate[] getCertificates()
public Certificate[] getSignCertificateChain()
public Collection<CRL> getCRLs()
public X509Certificate getSigningCertificate()
public int getVersion()
public int getSigningInfoVersion()
public String getDigestEncryptionAlgorithmOid()
public String getDigestAlgorithmOid()
public String getDigestAlgorithm()
public String getHashAlgorithm()
public static KeyStore loadCacertsKeyStore()
KeyStore
public static KeyStore loadCacertsKeyStore(String provider)
provider
- the provider or null
for the default provider
KeyStore
public static String verifyCertificate(X509Certificate cert, Collection<CRL> crls, Calendar calendar)
cert
- the certificate to verifycrls
- the certificate revocation list or null
calendar
- the date or null
for the current date
String
with the error description or null
if no errorpublic static Object[] verifyCertificates(Certificate[] certs, KeyStore keystore, Collection<CRL> crls, Calendar calendar)
certs
- the certificate chainkeystore
- the KeyStore
crls
- the certificate revocation list or null
calendar
- the date or null
for the current date
null
if the certificate chain could be validated or a
Object[]{cert,error}
where cert
is the
failed certificate and error
is the error messagepublic static boolean verifyOcspCertificates(org.bouncycastle.ocsp.BasicOCSPResp ocsp, KeyStore keystore, String provider)
ocsp
- the OCSP responsekeystore
- the KeyStore
provider
- the provider or null
to use the BouncyCastle provider
true
is a certificate was foundpublic static boolean verifyTimestampCertificates(org.bouncycastle.tsp.TimeStampToken ts, KeyStore keystore, String provider)
ts
- the timestampkeystore
- the KeyStore
provider
- the provider or null
to use the BouncyCastle provider
true
is a certificate was foundpublic static String getOCSPURL(X509Certificate certificate) throws CertificateParsingException
certificate
- the certificate
CertificateParsingException
- on errorpublic static String getCrlUrl(X509Certificate certificate) throws CertificateParsingException
CertificateParsingException
public boolean isRevocationValid()
public static PdfPKCS7.X509Name getIssuerFields(X509Certificate cert)
cert
- an X509Certificate
public static PdfPKCS7.X509Name getSubjectFields(X509Certificate cert)
cert
- an X509Certificate
public byte[] getEncodedPKCS1()
public void setExternalDigest(byte[] digest, byte[] RSAdata, String digestEncryptionAlgorithm)
digest
- the digest. This is the actual signatureRSAdata
- the extra data that goes into the data tag in PKCS#7digestEncryptionAlgorithm
- the encryption algorithm. It may must be null
if the digest
is also null
. If the digest
is not null
then it may be "RSA" or "DSA"public byte[] getEncodedPKCS7()
public byte[] getEncodedPKCS7(byte[] secondDigest, Calendar signingTime)
null
, none will be used.
secondDigest
- the digest in the authenticatedAttributessigningTime
- the signing time in the authenticatedAttributes
public byte[] getEncodedPKCS7(byte[] secondDigest, Calendar signingTime, TSAClient tsaClient, byte[] ocsp)
secondDigest
- the digest in the authenticatedAttributessigningTime
- the signing time in the authenticatedAttributestsaClient
- TSAClient - null or an optional time stamp authority client
public byte[] getAuthenticatedAttributeBytes(byte[] secondDigest, Calendar signingTime, byte[] ocsp)
getEncodedPKCS7(byte[],Calendar)
.
A simple example:
Calendar cal = Calendar.getInstance(); PdfPKCS7 pk7 = new PdfPKCS7(key, chain, null, "SHA1", null, false); MessageDigest messageDigest = MessageDigest.getInstance("SHA1"); byte buf[] = new byte[8192]; int n; InputStream inp = sap.getRangeStream(); while ((n = inp.read(buf)) > 0) { messageDigest.update(buf, 0, n); } byte hash[] = messageDigest.digest(); byte sh[] = pk7.getAuthenticatedAttributeBytes(hash, cal); pk7.update(sh, 0, sh.length); byte sg[] = pk7.getEncodedPKCS7(hash, cal);
secondDigest
- the content digestsigningTime
- the signing time
public String getReason()
public void setReason(String reason)
reason
- New value of property reason.public String getLocation()
public void setLocation(String location)
location
- New value of property location.public Calendar getSignDate()
public void setSignDate(Calendar signDate)
signDate
- New value of property signDate.public String getSignName()
public void setSignName(String signName)
signName
- New value of property sigName.
|
||||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |