Class PdfPKCS7


  • public class PdfPKCS7
    extends Object
    This class does all the processing related to signing and verifying a PKCS#7 signature.
    • Constructor Detail

      • PdfPKCS7

        public PdfPKCS7​(byte[] contentsKey,
                        byte[] certsKey,
                        String provider)
        Use this constructor if you want to verify a signature using the sub-filter adbe.x509.rsa_sha1.
        Parameters:
        contentsKey - the /Contents key
        certsKey - the /Cert key
        provider - the provider or null for the default provider
      • PdfPKCS7

        public PdfPKCS7​(byte[] contentsKey,
                        PdfName filterSubtype,
                        String provider)
        Use this constructor if you want to verify a signature.
        Parameters:
        contentsKey - the /Contents key
        filterSubtype - the filtersubtype
        provider - the provider or null for the default provider
    • Method Detail

      • setSignaturePolicy

        public void setSignaturePolicy​(org.bouncycastle.asn1.esf.SignaturePolicyIdentifier signaturePolicy)
      • getSignName

        public String getSignName()
        Getter for property sigName.
        Returns:
        Value of property sigName.
      • setSignName

        public void setSignName​(String signName)
        Setter for property sigName.
        Parameters:
        signName - New value of property sigName.
      • getReason

        public String getReason()
        Getter for property reason.
        Returns:
        Value of property reason.
      • setReason

        public void setReason​(String reason)
        Setter for property reason.
        Parameters:
        reason - New value of property reason.
      • getLocation

        public String getLocation()
        Getter for property location.
        Returns:
        Value of property location.
      • setLocation

        public void setLocation​(String location)
        Setter for property location.
        Parameters:
        location - New value of property location.
      • getSignDate

        public Calendar getSignDate()
        Getter for property signDate.
        Returns:
        Value of property signDate.
      • setSignDate

        public void setSignDate​(Calendar signDate)
        Setter for property signDate.
        Parameters:
        signDate - New value of property signDate.
      • getVersion

        public int getVersion()
        Get the version of the PKCS#7 object.
        Returns:
        the version of the PKCS#7 object.
      • getSigningInfoVersion

        public int getSigningInfoVersion()
        Get the version of the PKCS#7 "SignerInfo" object.
        Returns:
        the version of the PKCS#7 "SignerInfo" object.
      • getDigestAlgorithmOid

        public String getDigestAlgorithmOid()
        Getter for the ID of the digest algorithm, e.g. "2.16.840.1.101.3.4.2.1"
      • getHashAlgorithm

        public String getHashAlgorithm()
        Returns the name of the digest algorithm, e.g. "SHA256".
        Returns:
        the digest algorithm name, e.g. "SHA256"
      • getDigestEncryptionAlgorithmOid

        public String getDigestEncryptionAlgorithmOid()
        Getter for the digest encryption algorithm
      • getDigestAlgorithm

        public String getDigestAlgorithm()
        Get the algorithm used to calculate the message digest, e.g. "SHA1withRSA".
        Returns:
        the algorithm used to calculate the message digest
      • setExternalDigest

        public void setExternalDigest​(byte[] digest,
                                      byte[] RSAdata,
                                      String digestEncryptionAlgorithm)
        Sets the digest/signature to an external calculated value.
        Parameters:
        digest - the digest. This is the actual signature
        RSAdata - the extra data that goes into the data tag in PKCS#7
        digestEncryptionAlgorithm - the encryption algorithm. It may must be null if the digest is also null. If the digest is not null then it may be "RSA" or "DSA"
      • update

        public void update​(byte[] buf,
                           int off,
                           int len)
                    throws SignatureException
        Update the digest with the specified bytes. This method is used both for signing and verifying
        Parameters:
        buf - the data buffer
        off - the offset in the data buffer
        len - the data length
        Throws:
        SignatureException - on error
      • getEncodedPKCS1

        public byte[] getEncodedPKCS1()
        Gets the bytes for the PKCS#1 object.
        Returns:
        a byte array
      • getEncodedPKCS7

        public byte[] getEncodedPKCS7()
        Gets the bytes for the PKCS7SignedData object.
        Returns:
        the bytes for the PKCS7SignedData object
      • getEncodedPKCS7

        public byte[] getEncodedPKCS7​(byte[] secondDigest)
        Gets the bytes for the PKCS7SignedData object. Optionally the authenticatedAttributes in the signerInfo can also be set. If either of the parameters is null, none will be used.
        Parameters:
        secondDigest - the digest in the authenticatedAttributes
        Returns:
        the bytes for the PKCS7SignedData object
      • getEncodedPKCS7

        public byte[] getEncodedPKCS7​(byte[] secondDigest,
                                      TSAClient tsaClient,
                                      byte[] ocsp,
                                      Collection<byte[]> crlBytes,
                                      MakeSignature.CryptoStandard sigtype)
        Gets the bytes for the PKCS7SignedData object. Optionally the authenticatedAttributes in the signerInfo can also be set, OR a time-stamp-authority client may be provided.
        Parameters:
        secondDigest - the digest in the authenticatedAttributes
        tsaClient - TSAClient - null or an optional time stamp authority client
        Returns:
        byte[] the bytes for the PKCS7SignedData object
        Since:
        2.1.6
      • getAuthenticatedAttributeBytes

        public byte[] getAuthenticatedAttributeBytes​(byte[] secondDigest,
                                                     byte[] ocsp,
                                                     Collection<byte[]> crlBytes,
                                                     MakeSignature.CryptoStandard sigtype)
        When using authenticatedAttributes the authentication process is different. The document digest is generated and put inside the attribute. The signing is done over the DER encoded authenticatedAttributes. This method provides that encoding and the parameters must be exactly the same as in getEncodedPKCS7(byte[]).

        A simple example:

         Calendar cal = Calendar.getInstance();
         PdfPKCS7 pk7 = new PdfPKCS7(key, chain, null, "SHA1", null, false);
         MessageDigest messageDigest = MessageDigest.getInstance("SHA1");
         byte buf[] = new byte[8192];
         int n;
         InputStream inp = sap.getRangeStream();
         while ((n = inp.read(buf)) > 0) {
            messageDigest.update(buf, 0, n);
         }
         byte hash[] = messageDigest.digest();
         byte sh[] = pk7.getAuthenticatedAttributeBytes(hash, cal);
         pk7.update(sh, 0, sh.length);
         byte sg[] = pk7.getEncodedPKCS7(hash, cal);
         
        Parameters:
        secondDigest - the content digest
        Returns:
        the byte array representation of the authenticatedAttributes ready to be signed
      • verifyTimestampImprint

        public boolean verifyTimestampImprint()
                                       throws GeneralSecurityException
        Checks if the timestamp refers to this document.
        Returns:
        true if it checks false otherwise
        Throws:
        GeneralSecurityException - on error
        Since:
        2.1.6
      • getCertificates

        public Certificate[] getCertificates()
        Get all the X.509 certificates associated with this PKCS#7 object in no particular order. Other certificates, from OCSP for example, will also be included.
        Returns:
        the X.509 certificates associated with this PKCS#7 object
      • getSignCertificateChain

        public Certificate[] getSignCertificateChain()
        Get the X.509 sign certificate chain associated with this PKCS#7 object. Only the certificates used for the main signature will be returned, with the signing certificate first.
        Returns:
        the X.509 certificates associated with this PKCS#7 object
        Since:
        2.1.6
      • getSigningCertificate

        public X509Certificate getSigningCertificate()
        Get the X.509 certificate actually used to sign the digest.
        Returns:
        the X.509 certificate actually used to sign the digest
      • getCRLs

        public Collection<CRL> getCRLs()
        Get the X.509 certificate revocation lists associated with this PKCS#7 object
        Returns:
        the X.509 certificate revocation lists associated with this PKCS#7 object
      • getOcsp

        public org.bouncycastle.cert.ocsp.BasicOCSPResp getOcsp()
        Gets the OCSP basic response if there is one.
        Returns:
        the OCSP basic response or null
        Since:
        2.1.6
      • isRevocationValid

        public boolean isRevocationValid()
        Checks if OCSP revocation refers to the document signing certificate.
        Returns:
        true if it checks, false otherwise
        Since:
        2.1.6
      • isTsp

        public boolean isTsp()
        Check if it's a PAdES-LTV time stamp.
        Returns:
        true if it's a PAdES-LTV time stamp, false otherwise
      • getTimeStampToken

        public org.bouncycastle.tsp.TimeStampToken getTimeStampToken()
        Gets the timestamp token if there is one.
        Returns:
        the timestamp token or null
        Since:
        2.1.6
      • getTimeStampDate

        public Calendar getTimeStampDate()
        Gets the timestamp date
        Returns:
        a date
        Since:
        2.1.6
      • getFilterSubtype

        public PdfName getFilterSubtype()
        Returns the filter subtype.
      • getEncryptionAlgorithm

        public String getEncryptionAlgorithm()
        Returns the encryption algorithm
        Returns:
        the name of an encryption algorithm