com.itextpdf.text.pdf.security
Class PdfPKCS7

java.lang.Object
  com.itextpdf.text.pdf.security.PdfPKCS7

public class PdfPKCS7
extends java.lang.Object

This class does all the processing related to signing and verifying a PKCS#7 signature.

Constructor Summary

PdfPKCS7(byte[] contentsKey, byte[] certsKey, java.lang.String provider)
Use this constructor if you want to verify a signature using the sub-filter adbe.x509.rsa_sha1.

PdfPKCS7(byte[] contentsKey, PdfName filterSubtype, java.lang.String provider)
Use this constructor if you want to verify a signature.

PdfPKCS7(java.security.PrivateKey privKey, java.security.cert.Certificate[] certChain, java.lang.String hashAlgorithm, java.lang.String provider, ExternalDigest interfaceDigest, boolean hasRSAdata)
Assembles all the elements needed to create a signature, except for the data.

Method Summary

byte[]	getAuthenticatedAttributeBytes(byte[] secondDigest, java.util.Calendar signingTime, byte[] ocsp, java.util.Collection<byte[]> crlBytes, MakeSignature.CryptoStandard sigtype) When using authenticatedAttributes the authentication process is different.
java.security.cert.Certificate[]	getCertificates() Get all the X.509 certificates associated with this PKCS#7 object in no particular order.
java.util.Collection<java.security.cert.CRL>	getCRLs() Get the X.509 certificate revocation lists associated with this PKCS#7 object
java.lang.String	getDigestAlgorithm() Get the algorithm used to calculate the message digest, e.g.
java.lang.String	getDigestAlgorithmOid() Getter for the ID of the digest algorithm, e.g.
java.lang.String	getDigestEncryptionAlgorithmOid() Getter for the digest encryption algorithm
byte[]	getEncodedPKCS1() Gets the bytes for the PKCS#1 object.
byte[]	getEncodedPKCS7() Gets the bytes for the PKCS7SignedData object.
byte[]	getEncodedPKCS7(byte[] secondDigest, java.util.Calendar signingTime) Gets the bytes for the PKCS7SignedData object.
byte[]	getEncodedPKCS7(byte[] secondDigest, java.util.Calendar signingTime, TSAClient tsaClient, byte[] ocsp, java.util.Collection<byte[]> crlBytes, MakeSignature.CryptoStandard sigtype) Gets the bytes for the PKCS7SignedData object.
java.lang.String	getEncryptionAlgorithm() Returns the encryption algorithm
PdfName	getFilterSubtype() Returns the filter subtype.
java.lang.String	getHashAlgorithm() Returns the name of the digest algorithm, e.g.
java.lang.String	getLocation() Getter for property location.
org.bouncycastle.cert.ocsp.BasicOCSPResp	getOcsp() Gets the OCSP basic response if there is one.
java.lang.String	getReason() Getter for property reason.
java.security.cert.Certificate[]	getSignCertificateChain() Get the X.509 sign certificate chain associated with this PKCS#7 object.
java.util.Calendar	getSignDate() Getter for property signDate.
java.security.cert.X509Certificate	getSigningCertificate() Get the X.509 certificate actually used to sign the digest.
int	getSigningInfoVersion() Get the version of the PKCS#7 "SignerInfo" object.
java.lang.String	getSignName() Getter for property sigName.
java.util.Calendar	getTimeStampDate() Gets the timestamp date
org.bouncycastle.tsp.TimeStampToken	getTimeStampToken() Gets the timestamp token if there is one.
int	getVersion() Get the version of the PKCS#7 object.
boolean	isRevocationValid() Checks if OCSP revocation refers to the document signing certificate.
boolean	isTsp() Check if it's a PAdES-LTV time stamp.
void	setExternalDigest(byte[] digest, byte[] RSAdata, java.lang.String digestEncryptionAlgorithm) Sets the digest/signature to an external calculated value.
void	setLocation(java.lang.String location) Setter for property location.
void	setReason(java.lang.String reason) Setter for property reason.
void	setSignDate(java.util.Calendar signDate) Setter for property signDate.
void	setSignName(java.lang.String signName) Setter for property sigName.
void	update(byte[] buf, int off, int len) Update the digest with the specified bytes.
boolean	verify() Verify the digest.
boolean	verifyTimestampImprint() Checks if the timestamp refers to this document.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

PdfPKCS7

public PdfPKCS7(java.security.PrivateKey privKey,
                java.security.cert.Certificate[] certChain,
                java.lang.String hashAlgorithm,
                java.lang.String provider,
                ExternalDigest interfaceDigest,
                boolean hasRSAdata)
         throws java.security.InvalidKeyException,
                java.security.NoSuchProviderException,
                java.security.NoSuchAlgorithmException

Assembles all the elements needed to create a signature, except for the data.

Parameters:

privKey - the private key

certChain - the certificate chain

crlList - the certificate revocation list

hashAlgorithm - the hash algorithm

provider - the provider or null for the default provider

hasRSAdata - true if the sub-filter is adbe.pkcs7.sha1

Throws:

java.security.InvalidKeyException - on error

java.security.NoSuchProviderException - on error

java.security.NoSuchAlgorithmException - on error

PdfPKCS7

public PdfPKCS7(byte[] contentsKey,
                byte[] certsKey,
                java.lang.String provider)

Use this constructor if you want to verify a signature using the sub-filter adbe.x509.rsa_sha1.

Parameters:

contentsKey - the /Contents key

certsKey - the /Cert key

provider - the provider or null for the default provider

PdfPKCS7

public PdfPKCS7(byte[] contentsKey,
                PdfName filterSubtype,
                java.lang.String provider)

Use this constructor if you want to verify a signature.

Parameters:

contentsKey - the /Contents key

tsp - set to true if there's a PAdES LTV time stamp.

provider - the provider or null for the default provider

Method Detail

getSignName

public java.lang.String getSignName()

Getter for property sigName.

Returns:

Value of property sigName.

setSignName

public void setSignName(java.lang.String signName)

Setter for property sigName.

Parameters:

signName - New value of property sigName.

getReason

public java.lang.String getReason()

Getter for property reason.

Returns:

Value of property reason.

setReason

public void setReason(java.lang.String reason)

Setter for property reason.

Parameters:

reason - New value of property reason.

getLocation

public java.lang.String getLocation()

Getter for property location.

Returns:

Value of property location.

setLocation

public void setLocation(java.lang.String location)

Setter for property location.

Parameters:

location - New value of property location.

getSignDate

public java.util.Calendar getSignDate()

Getter for property signDate.

Returns:

Value of property signDate.

setSignDate

public void setSignDate(java.util.Calendar signDate)

Setter for property signDate.

Parameters:

signDate - New value of property signDate.

getVersion

public int getVersion()

Get the version of the PKCS#7 object.

Returns:

the version of the PKCS#7 object.

getSigningInfoVersion

public int getSigningInfoVersion()

Get the version of the PKCS#7 "SignerInfo" object.

Returns:

the version of the PKCS#7 "SignerInfo" object.

getDigestAlgorithmOid

public java.lang.String getDigestAlgorithmOid()

Getter for the ID of the digest algorithm, e.g. "2.16.840.1.101.3.4.2.1"

getHashAlgorithm

public java.lang.String getHashAlgorithm()

Returns the name of the digest algorithm, e.g. "SHA256".

Returns:

the digest algorithm name, e.g. "SHA256"

getDigestEncryptionAlgorithmOid

public java.lang.String getDigestEncryptionAlgorithmOid()

Getter for the digest encryption algorithm

getDigestAlgorithm

public java.lang.String getDigestAlgorithm()

Get the algorithm used to calculate the message digest, e.g. "SHA1withRSA".

Returns:

the algorithm used to calculate the message digest

setExternalDigest

public void setExternalDigest(byte[] digest,
                              byte[] RSAdata,
                              java.lang.String digestEncryptionAlgorithm)

Sets the digest/signature to an external calculated value.

Parameters:

digest - the digest. This is the actual signature

RSAdata - the extra data that goes into the data tag in PKCS#7

digestEncryptionAlgorithm - the encryption algorithm. It may must be null if the digest is also null. If the digest is not null then it may be "RSA" or "DSA"

update

public void update(byte[] buf,
                   int off,
                   int len)
            throws java.security.SignatureException

Update the digest with the specified bytes. This method is used both for signing and verifying

Parameters:

buf - the data buffer

off - the offset in the data buffer

len - the data length

Throws:

java.security.SignatureException - on error

getEncodedPKCS1

public byte[] getEncodedPKCS1()

Gets the bytes for the PKCS#1 object.

Returns:

a byte array

getEncodedPKCS7

public byte[] getEncodedPKCS7()

Gets the bytes for the PKCS7SignedData object.

Returns:

the bytes for the PKCS7SignedData object

getEncodedPKCS7

public byte[] getEncodedPKCS7(byte[] secondDigest,
                              java.util.Calendar signingTime)

Gets the bytes for the PKCS7SignedData object. Optionally the authenticatedAttributes in the signerInfo can also be set. If either of the parameters is null, none will be used.

Parameters:

secondDigest - the digest in the authenticatedAttributes

signingTime - the signing time in the authenticatedAttributes

Returns:

the bytes for the PKCS7SignedData object

getEncodedPKCS7

public byte[] getEncodedPKCS7(byte[] secondDigest,
                              java.util.Calendar signingTime,
                              TSAClient tsaClient,
                              byte[] ocsp,
                              java.util.Collection<byte[]> crlBytes,
                              MakeSignature.CryptoStandard sigtype)

Gets the bytes for the PKCS7SignedData object. Optionally the authenticatedAttributes in the signerInfo can also be set, OR a time-stamp-authority client may be provided.

Parameters:

secondDigest - the digest in the authenticatedAttributes

signingTime - the signing time in the authenticatedAttributes

tsaClient - TSAClient - null or an optional time stamp authority client

Returns:

byte[] the bytes for the PKCS7SignedData object

Since:

2.1.6

getAuthenticatedAttributeBytes

public byte[] getAuthenticatedAttributeBytes(byte[] secondDigest,
                                             java.util.Calendar signingTime,
                                             byte[] ocsp,
                                             java.util.Collection<byte[]> crlBytes,
                                             MakeSignature.CryptoStandard sigtype)

When using authenticatedAttributes the authentication process is different. The document digest is generated and put inside the attribute. The signing is done over the DER encoded authenticatedAttributes. This method provides that encoding and the parameters must be exactly the same as in getEncodedPKCS7(byte[],Calendar).

A simple example:

 Calendar cal = Calendar.getInstance();
 PdfPKCS7 pk7 = new PdfPKCS7(key, chain, null, "SHA1", null, false);
 MessageDigest messageDigest = MessageDigest.getInstance("SHA1");
 byte buf[] = new byte[8192];
 int n;
 InputStream inp = sap.getRangeStream();
 while ((n = inp.read(buf)) > 0) {
    messageDigest.update(buf, 0, n);
 }
 byte hash[] = messageDigest.digest();
 byte sh[] = pk7.getAuthenticatedAttributeBytes(hash, cal);
 pk7.update(sh, 0, sh.length);
 byte sg[] = pk7.getEncodedPKCS7(hash, cal);
 

Parameters:

secondDigest - the content digest

signingTime - the signing time

Returns:

the byte array representation of the authenticatedAttributes ready to be signed

verify

public boolean verify()
               throws java.security.SignatureException

Verify the digest.

Returns:

true if the signature checks out, false otherwise

Throws:

java.security.SignatureException - on error

verifyTimestampImprint

public boolean verifyTimestampImprint()
                               throws java.security.GeneralSecurityException

Checks if the timestamp refers to this document.

Returns:

true if it checks false otherwise

Throws:

java.security.GeneralSecurityException - on error

Since:

2.1.6

getCertificates

public java.security.cert.Certificate[] getCertificates()

Get all the X.509 certificates associated with this PKCS#7 object in no particular order. Other certificates, from OCSP for example, will also be included.

Returns:

the X.509 certificates associated with this PKCS#7 object

getSignCertificateChain

public java.security.cert.Certificate[] getSignCertificateChain()

Get the X.509 sign certificate chain associated with this PKCS#7 object. Only the certificates used for the main signature will be returned, with the signing certificate first.

Returns:

the X.509 certificates associated with this PKCS#7 object

Since:

2.1.6

getSigningCertificate

public java.security.cert.X509Certificate getSigningCertificate()

Get the X.509 certificate actually used to sign the digest.

Returns:

the X.509 certificate actually used to sign the digest

getCRLs

public java.util.Collection<java.security.cert.CRL> getCRLs()

Get the X.509 certificate revocation lists associated with this PKCS#7 object

Returns:

the X.509 certificate revocation lists associated with this PKCS#7 object

getOcsp

public org.bouncycastle.cert.ocsp.BasicOCSPResp getOcsp()

Gets the OCSP basic response if there is one.

Returns:

the OCSP basic response or null

Since:

2.1.6

isRevocationValid

public boolean isRevocationValid()

Checks if OCSP revocation refers to the document signing certificate.

Returns:

true if it checks, false otherwise

Since:

2.1.6

isTsp

public boolean isTsp()

Check if it's a PAdES-LTV time stamp.

Returns:

true if it's a PAdES-LTV time stamp, false otherwise

getTimeStampToken

public org.bouncycastle.tsp.TimeStampToken getTimeStampToken()

Gets the timestamp token if there is one.

Returns:

the timestamp token or null

Since:

2.1.6

getTimeStampDate

public java.util.Calendar getTimeStampDate()

Gets the timestamp date

Returns:

a date

Since:

2.1.6

getFilterSubtype

public PdfName getFilterSubtype()

Returns the filter subtype.

getEncryptionAlgorithm

public java.lang.String getEncryptionAlgorithm()

Returns the encryption algorithm

Returns:

the name of an encryption algorithm