Package com.itextpdf.text.pdf.security
Class PdfPKCS7
- java.lang.Object
-
- com.itextpdf.text.pdf.security.PdfPKCS7
-
public class PdfPKCS7 extends java.lang.Object
This class does all the processing related to signing and verifying a PKCS#7 signature.
-
-
Constructor Summary
Constructors Constructor Description PdfPKCS7(byte[] contentsKey, byte[] certsKey, java.lang.String provider)
Use this constructor if you want to verify a signature using the sub-filter adbe.x509.rsa_sha1.PdfPKCS7(byte[] contentsKey, PdfName filterSubtype, java.lang.String provider)
Use this constructor if you want to verify a signature.PdfPKCS7(java.security.PrivateKey privKey, java.security.cert.Certificate[] certChain, java.lang.String hashAlgorithm, java.lang.String provider, ExternalDigest interfaceDigest, boolean hasRSAdata)
Assembles all the elements needed to create a signature, except for the data.
-
Method Summary
All Methods Instance Methods Concrete Methods Modifier and Type Method Description byte[]
getAuthenticatedAttributeBytes(byte[] secondDigest, byte[] ocsp, java.util.Collection<byte[]> crlBytes, MakeSignature.CryptoStandard sigtype)
When using authenticatedAttributes the authentication process is different.java.security.cert.Certificate[]
getCertificates()
Get all the X.509 certificates associated with this PKCS#7 object in no particular order.java.util.Collection<java.security.cert.CRL>
getCRLs()
Get the X.509 certificate revocation lists associated with this PKCS#7 objectjava.lang.String
getDigestAlgorithm()
Get the algorithm used to calculate the message digest, e.g.java.lang.String
getDigestAlgorithmOid()
Getter for the ID of the digest algorithm, e.g.java.lang.String
getDigestEncryptionAlgorithmOid()
Getter for the digest encryption algorithmbyte[]
getEncodedPKCS1()
Gets the bytes for the PKCS#1 object.byte[]
getEncodedPKCS7()
Gets the bytes for the PKCS7SignedData object.byte[]
getEncodedPKCS7(byte[] secondDigest)
Gets the bytes for the PKCS7SignedData object.byte[]
getEncodedPKCS7(byte[] secondDigest, TSAClient tsaClient, byte[] ocsp, java.util.Collection<byte[]> crlBytes, MakeSignature.CryptoStandard sigtype)
Gets the bytes for the PKCS7SignedData object.java.lang.String
getEncryptionAlgorithm()
Returns the encryption algorithmPdfName
getFilterSubtype()
Returns the filter subtype.java.lang.String
getHashAlgorithm()
Returns the name of the digest algorithm, e.g.java.lang.String
getLocation()
Getter for property location.org.bouncycastle.cert.ocsp.BasicOCSPResp
getOcsp()
Gets the OCSP basic response if there is one.java.lang.String
getReason()
Getter for property reason.java.security.cert.Certificate[]
getSignCertificateChain()
Get the X.509 sign certificate chain associated with this PKCS#7 object.java.util.Calendar
getSignDate()
Getter for property signDate.java.security.cert.X509Certificate
getSigningCertificate()
Get the X.509 certificate actually used to sign the digest.int
getSigningInfoVersion()
Get the version of the PKCS#7 "SignerInfo" object.java.lang.String
getSignName()
Getter for property sigName.java.util.Calendar
getTimeStampDate()
Gets the timestamp dateorg.bouncycastle.tsp.TimeStampToken
getTimeStampToken()
Gets the timestamp token if there is one.int
getVersion()
Get the version of the PKCS#7 object.boolean
isRevocationValid()
Checks if OCSP revocation refers to the document signing certificate.boolean
isTsp()
Check if it's a PAdES-LTV time stamp.void
setExternalDigest(byte[] digest, byte[] RSAdata, java.lang.String digestEncryptionAlgorithm)
Sets the digest/signature to an external calculated value.void
setLocation(java.lang.String location)
Setter for property location.void
setReason(java.lang.String reason)
Setter for property reason.void
setSignaturePolicy(SignaturePolicyInfo signaturePolicy)
void
setSignaturePolicy(org.bouncycastle.asn1.esf.SignaturePolicyIdentifier signaturePolicy)
void
setSignDate(java.util.Calendar signDate)
Setter for property signDate.void
setSignName(java.lang.String signName)
Setter for property sigName.void
update(byte[] buf, int off, int len)
Update the digest with the specified bytes.boolean
verify()
Verify the digest.boolean
verifyTimestampImprint()
Checks if the timestamp refers to this document.
-
-
-
Constructor Detail
-
PdfPKCS7
public PdfPKCS7(java.security.PrivateKey privKey, java.security.cert.Certificate[] certChain, java.lang.String hashAlgorithm, java.lang.String provider, ExternalDigest interfaceDigest, boolean hasRSAdata) throws java.security.InvalidKeyException, java.security.NoSuchProviderException, java.security.NoSuchAlgorithmException
Assembles all the elements needed to create a signature, except for the data.- Parameters:
privKey
- the private keycertChain
- the certificate chaininterfaceDigest
- the interface digesthashAlgorithm
- the hash algorithmprovider
- the provider ornull
for the default providerhasRSAdata
-true
if the sub-filter is adbe.pkcs7.sha1- Throws:
java.security.InvalidKeyException
- on errorjava.security.NoSuchProviderException
- on errorjava.security.NoSuchAlgorithmException
- on error
-
PdfPKCS7
public PdfPKCS7(byte[] contentsKey, byte[] certsKey, java.lang.String provider)
Use this constructor if you want to verify a signature using the sub-filter adbe.x509.rsa_sha1.- Parameters:
contentsKey
- the /Contents keycertsKey
- the /Cert keyprovider
- the provider ornull
for the default provider
-
PdfPKCS7
public PdfPKCS7(byte[] contentsKey, PdfName filterSubtype, java.lang.String provider)
Use this constructor if you want to verify a signature.- Parameters:
contentsKey
- the /Contents keyfilterSubtype
- the filtersubtypeprovider
- the provider ornull
for the default provider
-
-
Method Detail
-
setSignaturePolicy
public void setSignaturePolicy(SignaturePolicyInfo signaturePolicy)
-
setSignaturePolicy
public void setSignaturePolicy(org.bouncycastle.asn1.esf.SignaturePolicyIdentifier signaturePolicy)
-
getSignName
public java.lang.String getSignName()
Getter for property sigName.- Returns:
- Value of property sigName.
-
setSignName
public void setSignName(java.lang.String signName)
Setter for property sigName.- Parameters:
signName
- New value of property sigName.
-
getReason
public java.lang.String getReason()
Getter for property reason.- Returns:
- Value of property reason.
-
setReason
public void setReason(java.lang.String reason)
Setter for property reason.- Parameters:
reason
- New value of property reason.
-
getLocation
public java.lang.String getLocation()
Getter for property location.- Returns:
- Value of property location.
-
setLocation
public void setLocation(java.lang.String location)
Setter for property location.- Parameters:
location
- New value of property location.
-
getSignDate
public java.util.Calendar getSignDate()
Getter for property signDate.- Returns:
- Value of property signDate.
-
setSignDate
public void setSignDate(java.util.Calendar signDate)
Setter for property signDate.- Parameters:
signDate
- New value of property signDate.
-
getVersion
public int getVersion()
Get the version of the PKCS#7 object.- Returns:
- the version of the PKCS#7 object.
-
getSigningInfoVersion
public int getSigningInfoVersion()
Get the version of the PKCS#7 "SignerInfo" object.- Returns:
- the version of the PKCS#7 "SignerInfo" object.
-
getDigestAlgorithmOid
public java.lang.String getDigestAlgorithmOid()
Getter for the ID of the digest algorithm, e.g. "2.16.840.1.101.3.4.2.1"
-
getHashAlgorithm
public java.lang.String getHashAlgorithm()
Returns the name of the digest algorithm, e.g. "SHA256".- Returns:
- the digest algorithm name, e.g. "SHA256"
-
getDigestEncryptionAlgorithmOid
public java.lang.String getDigestEncryptionAlgorithmOid()
Getter for the digest encryption algorithm
-
getDigestAlgorithm
public java.lang.String getDigestAlgorithm()
Get the algorithm used to calculate the message digest, e.g. "SHA1withRSA".- Returns:
- the algorithm used to calculate the message digest
-
setExternalDigest
public void setExternalDigest(byte[] digest, byte[] RSAdata, java.lang.String digestEncryptionAlgorithm)
Sets the digest/signature to an external calculated value.- Parameters:
digest
- the digest. This is the actual signatureRSAdata
- the extra data that goes into the data tag in PKCS#7digestEncryptionAlgorithm
- the encryption algorithm. It may must benull
if thedigest
is alsonull
. If thedigest
is notnull
then it may be "RSA" or "DSA"
-
update
public void update(byte[] buf, int off, int len) throws java.security.SignatureException
Update the digest with the specified bytes. This method is used both for signing and verifying- Parameters:
buf
- the data bufferoff
- the offset in the data bufferlen
- the data length- Throws:
java.security.SignatureException
- on error
-
getEncodedPKCS1
public byte[] getEncodedPKCS1()
Gets the bytes for the PKCS#1 object.- Returns:
- a byte array
-
getEncodedPKCS7
public byte[] getEncodedPKCS7()
Gets the bytes for the PKCS7SignedData object.- Returns:
- the bytes for the PKCS7SignedData object
-
getEncodedPKCS7
public byte[] getEncodedPKCS7(byte[] secondDigest)
Gets the bytes for the PKCS7SignedData object. Optionally the authenticatedAttributes in the signerInfo can also be set. If either of the parameters isnull
, none will be used.- Parameters:
secondDigest
- the digest in the authenticatedAttributes- Returns:
- the bytes for the PKCS7SignedData object
-
getEncodedPKCS7
public byte[] getEncodedPKCS7(byte[] secondDigest, TSAClient tsaClient, byte[] ocsp, java.util.Collection<byte[]> crlBytes, MakeSignature.CryptoStandard sigtype)
Gets the bytes for the PKCS7SignedData object. Optionally the authenticatedAttributes in the signerInfo can also be set, OR a time-stamp-authority client may be provided.- Parameters:
secondDigest
- the digest in the authenticatedAttributestsaClient
- TSAClient - null or an optional time stamp authority client- Returns:
- byte[] the bytes for the PKCS7SignedData object
- Since:
- 2.1.6
-
getAuthenticatedAttributeBytes
public byte[] getAuthenticatedAttributeBytes(byte[] secondDigest, byte[] ocsp, java.util.Collection<byte[]> crlBytes, MakeSignature.CryptoStandard sigtype)
When using authenticatedAttributes the authentication process is different. The document digest is generated and put inside the attribute. The signing is done over the DER encoded authenticatedAttributes. This method provides that encoding and the parameters must be exactly the same as ingetEncodedPKCS7(byte[])
.A simple example:
Calendar cal = Calendar.getInstance(); PdfPKCS7 pk7 = new PdfPKCS7(key, chain, null, "SHA1", null, false); MessageDigest messageDigest = MessageDigest.getInstance("SHA1"); byte buf[] = new byte[8192]; int n; InputStream inp = sap.getRangeStream(); while ((n = inp.read(buf)) > 0) { messageDigest.update(buf, 0, n); } byte hash[] = messageDigest.digest(); byte sh[] = pk7.getAuthenticatedAttributeBytes(hash, cal); pk7.update(sh, 0, sh.length); byte sg[] = pk7.getEncodedPKCS7(hash, cal);
- Parameters:
secondDigest
- the content digest- Returns:
- the byte array representation of the authenticatedAttributes ready to be signed
-
verify
public boolean verify() throws java.security.GeneralSecurityException
Verify the digest.- Returns:
true
if the signature checks out,false
otherwise- Throws:
java.security.SignatureException
- on errorjava.security.GeneralSecurityException
-
verifyTimestampImprint
public boolean verifyTimestampImprint() throws java.security.GeneralSecurityException
Checks if the timestamp refers to this document.- Returns:
- true if it checks false otherwise
- Throws:
java.security.GeneralSecurityException
- on error- Since:
- 2.1.6
-
getCertificates
public java.security.cert.Certificate[] getCertificates()
Get all the X.509 certificates associated with this PKCS#7 object in no particular order. Other certificates, from OCSP for example, will also be included.- Returns:
- the X.509 certificates associated with this PKCS#7 object
-
getSignCertificateChain
public java.security.cert.Certificate[] getSignCertificateChain()
Get the X.509 sign certificate chain associated with this PKCS#7 object. Only the certificates used for the main signature will be returned, with the signing certificate first.- Returns:
- the X.509 certificates associated with this PKCS#7 object
- Since:
- 2.1.6
-
getSigningCertificate
public java.security.cert.X509Certificate getSigningCertificate()
Get the X.509 certificate actually used to sign the digest.- Returns:
- the X.509 certificate actually used to sign the digest
-
getCRLs
public java.util.Collection<java.security.cert.CRL> getCRLs()
Get the X.509 certificate revocation lists associated with this PKCS#7 object- Returns:
- the X.509 certificate revocation lists associated with this PKCS#7 object
-
getOcsp
public org.bouncycastle.cert.ocsp.BasicOCSPResp getOcsp()
Gets the OCSP basic response if there is one.- Returns:
- the OCSP basic response or null
- Since:
- 2.1.6
-
isRevocationValid
public boolean isRevocationValid()
Checks if OCSP revocation refers to the document signing certificate.- Returns:
- true if it checks, false otherwise
- Since:
- 2.1.6
-
isTsp
public boolean isTsp()
Check if it's a PAdES-LTV time stamp.- Returns:
- true if it's a PAdES-LTV time stamp, false otherwise
-
getTimeStampToken
public org.bouncycastle.tsp.TimeStampToken getTimeStampToken()
Gets the timestamp token if there is one.- Returns:
- the timestamp token or null
- Since:
- 2.1.6
-
getTimeStampDate
public java.util.Calendar getTimeStampDate()
Gets the timestamp date- Returns:
- a date
- Since:
- 2.1.6
-
getFilterSubtype
public PdfName getFilterSubtype()
Returns the filter subtype.
-
getEncryptionAlgorithm
public java.lang.String getEncryptionAlgorithm()
Returns the encryption algorithm- Returns:
- the name of an encryption algorithm
-
-