Class PdfPKCS7

java.lang.Object
com.itextpdf.text.pdf.security.PdfPKCS7

public class PdfPKCS7 extends Object
This class does all the processing related to signing and verifying a PKCS#7 signature.
  • Field Details

    • provider

      private String provider
      The encryption provider, e.g. "BC" if you use BouncyCastle.
    • signaturePolicyIdentifier

      private org.bouncycastle.asn1.esf.SignaturePolicyIdentifier signaturePolicyIdentifier
    • signName

      private String signName
      Holds value of property signName.
    • reason

      private String reason
      Holds value of property reason.
    • location

      private String location
      Holds value of property location.
    • signDate

      private Calendar signDate
      Holds value of property signDate.
    • version

      private int version
      Version of the PKCS#7 object
    • signerversion

      private int signerversion
      Version of the PKCS#7 "SignerInfo" object.
    • digestAlgorithmOid

      private String digestAlgorithmOid
      The ID of the digest algorithm, e.g. "2.16.840.1.101.3.4.2.1".
    • messageDigest

      private MessageDigest messageDigest
      The object that will create the digest
    • digestalgos

      private Set<String> digestalgos
      The digest algorithms
    • digestAttr

      private byte[] digestAttr
      The digest attributes
    • filterSubtype

      private PdfName filterSubtype
    • digestEncryptionAlgorithmOid

      private String digestEncryptionAlgorithmOid
      The encryption algorithm.
    • interfaceDigest

      private ExternalDigest interfaceDigest
    • externalDigest

      private byte[] externalDigest
      The signed digest if created outside this class
    • externalRSAdata

      private byte[] externalRSAdata
      External RSA data
    • sig

      private Signature sig
      Class from the Java SDK that provides the functionality of a digital signature algorithm.
    • digest

      private byte[] digest
      The signed digest as calculated by this class (or extracted from an existing PDF)
    • RSAdata

      private byte[] RSAdata
      The RSA data
    • sigAttr

      private byte[] sigAttr
      Signature attributes
    • sigAttrDer

      private byte[] sigAttrDer
      Signature attributes (maybe not necessary, but we use it as fallback)
    • encContDigest

      private MessageDigest encContDigest
      encrypted digest
    • verified

      private boolean verified
      Indicates if a signature has already been verified
    • verifyResult

      private boolean verifyResult
      The result of the verification
    • certs

      private Collection<Certificate> certs
      All the X.509 certificates in no particular order.
    • signCerts

      private Collection<Certificate> signCerts
      All the X.509 certificates used for the main signature.
    • signCert

      private X509Certificate signCert
      The X.509 certificate that is used to sign the digest.
    • crls

      private Collection<CRL> crls
    • basicResp

      private org.bouncycastle.cert.ocsp.BasicOCSPResp basicResp
      BouncyCastle BasicOCSPResp
    • isTsp

      private boolean isTsp
      True if there's a PAdES LTV time stamp.
    • isCades

      private boolean isCades
      True if it's a CAdES signature type.
    • timeStampToken

      private org.bouncycastle.tsp.TimeStampToken timeStampToken
      BouncyCastle TimeStampToken.
  • Constructor Details

    • PdfPKCS7

      public PdfPKCS7(PrivateKey privKey, Certificate[] certChain, String hashAlgorithm, String provider, ExternalDigest interfaceDigest, boolean hasRSAdata) throws InvalidKeyException, NoSuchProviderException, NoSuchAlgorithmException
      Assembles all the elements needed to create a signature, except for the data.
      Parameters:
      privKey - the private key
      certChain - the certificate chain
      interfaceDigest - the interface digest
      hashAlgorithm - the hash algorithm
      provider - the provider or null for the default provider
      hasRSAdata - true if the sub-filter is adbe.pkcs7.sha1
      Throws:
      InvalidKeyException - on error
      NoSuchProviderException - on error
      NoSuchAlgorithmException - on error
    • PdfPKCS7

      public PdfPKCS7(byte[] contentsKey, byte[] certsKey, String provider)
      Use this constructor if you want to verify a signature using the sub-filter adbe.x509.rsa_sha1.
      Parameters:
      contentsKey - the /Contents key
      certsKey - the /Cert key
      provider - the provider or null for the default provider
    • PdfPKCS7

      public PdfPKCS7(byte[] contentsKey, PdfName filterSubtype, String provider)
      Use this constructor if you want to verify a signature.
      Parameters:
      contentsKey - the /Contents key
      filterSubtype - the filtersubtype
      provider - the provider or null for the default provider
  • Method Details

    • setSignaturePolicy

      public void setSignaturePolicy(SignaturePolicyInfo signaturePolicy)
    • setSignaturePolicy

      public void setSignaturePolicy(org.bouncycastle.asn1.esf.SignaturePolicyIdentifier signaturePolicy)
    • getSignName

      public String getSignName()
      Getter for property sigName.
      Returns:
      Value of property sigName.
    • setSignName

      public void setSignName(String signName)
      Setter for property sigName.
      Parameters:
      signName - New value of property sigName.
    • getReason

      public String getReason()
      Getter for property reason.
      Returns:
      Value of property reason.
    • setReason

      public void setReason(String reason)
      Setter for property reason.
      Parameters:
      reason - New value of property reason.
    • getLocation

      public String getLocation()
      Getter for property location.
      Returns:
      Value of property location.
    • setLocation

      public void setLocation(String location)
      Setter for property location.
      Parameters:
      location - New value of property location.
    • getSignDate

      public Calendar getSignDate()
      Getter for property signDate.
      Returns:
      Value of property signDate.
    • setSignDate

      public void setSignDate(Calendar signDate)
      Setter for property signDate.
      Parameters:
      signDate - New value of property signDate.
    • getVersion

      public int getVersion()
      Get the version of the PKCS#7 object.
      Returns:
      the version of the PKCS#7 object.
    • getSigningInfoVersion

      public int getSigningInfoVersion()
      Get the version of the PKCS#7 "SignerInfo" object.
      Returns:
      the version of the PKCS#7 "SignerInfo" object.
    • getDigestAlgorithmOid

      public String getDigestAlgorithmOid()
      Getter for the ID of the digest algorithm, e.g. "2.16.840.1.101.3.4.2.1"
    • getHashAlgorithm

      public String getHashAlgorithm()
      Returns the name of the digest algorithm, e.g. "SHA256".
      Returns:
      the digest algorithm name, e.g. "SHA256"
    • getDigestEncryptionAlgorithmOid

      public String getDigestEncryptionAlgorithmOid()
      Getter for the digest encryption algorithm
    • getDigestAlgorithm

      public String getDigestAlgorithm()
      Get the algorithm used to calculate the message digest, e.g. "SHA1withRSA".
      Returns:
      the algorithm used to calculate the message digest
    • setExternalDigest

      public void setExternalDigest(byte[] digest, byte[] RSAdata, String digestEncryptionAlgorithm)
      Sets the digest/signature to an external calculated value.
      Parameters:
      digest - the digest. This is the actual signature
      RSAdata - the extra data that goes into the data tag in PKCS#7
      digestEncryptionAlgorithm - the encryption algorithm. It may must be null if the digest is also null. If the digest is not null then it may be "RSA" or "DSA"
    • initSignature

      Throws:
      NoSuchAlgorithmException
      NoSuchProviderException
      InvalidKeyException
    • initSignature

      Throws:
      NoSuchAlgorithmException
      NoSuchProviderException
      InvalidKeyException
    • update

      public void update(byte[] buf, int off, int len) throws SignatureException
      Update the digest with the specified bytes. This method is used both for signing and verifying
      Parameters:
      buf - the data buffer
      off - the offset in the data buffer
      len - the data length
      Throws:
      SignatureException - on error
    • getEncodedPKCS1

      public byte[] getEncodedPKCS1()
      Gets the bytes for the PKCS#1 object.
      Returns:
      a byte array
    • getEncodedPKCS7

      public byte[] getEncodedPKCS7()
      Gets the bytes for the PKCS7SignedData object.
      Returns:
      the bytes for the PKCS7SignedData object
    • getEncodedPKCS7

      public byte[] getEncodedPKCS7(byte[] secondDigest)
      Gets the bytes for the PKCS7SignedData object. Optionally the authenticatedAttributes in the signerInfo can also be set. If either of the parameters is null, none will be used.
      Parameters:
      secondDigest - the digest in the authenticatedAttributes
      Returns:
      the bytes for the PKCS7SignedData object
    • getEncodedPKCS7

      public byte[] getEncodedPKCS7(byte[] secondDigest, TSAClient tsaClient, byte[] ocsp, Collection<byte[]> crlBytes, MakeSignature.CryptoStandard sigtype)
      Gets the bytes for the PKCS7SignedData object. Optionally the authenticatedAttributes in the signerInfo can also be set, OR a time-stamp-authority client may be provided.
      Parameters:
      secondDigest - the digest in the authenticatedAttributes
      tsaClient - TSAClient - null or an optional time stamp authority client
      Returns:
      byte[] the bytes for the PKCS7SignedData object
      Since:
      2.1.6
    • buildUnauthenticatedAttributes

      private org.bouncycastle.asn1.ASN1EncodableVector buildUnauthenticatedAttributes(byte[] timeStampToken) throws IOException
      Added by Aiken Sam, 2006-11-15, modifed by Martin Brunecky 07/12/2007 to start with the timeStampToken (signedData 1.2.840.113549.1.7.2). Token is the TSA response without response status, which is usually handled by the (vendor supplied) TSA request/response interface).
      Parameters:
      timeStampToken - byte[] - time stamp token, DER encoded signedData
      Returns:
      ASN1EncodableVector
      Throws:
      IOException
    • getAuthenticatedAttributeBytes

      public byte[] getAuthenticatedAttributeBytes(byte[] secondDigest, byte[] ocsp, Collection<byte[]> crlBytes, MakeSignature.CryptoStandard sigtype)
      When using authenticatedAttributes the authentication process is different. The document digest is generated and put inside the attribute. The signing is done over the DER encoded authenticatedAttributes. This method provides that encoding and the parameters must be exactly the same as in getEncodedPKCS7(byte[]).

      A simple example:

       Calendar cal = Calendar.getInstance();
       PdfPKCS7 pk7 = new PdfPKCS7(key, chain, null, "SHA1", null, false);
       MessageDigest messageDigest = MessageDigest.getInstance("SHA1");
       byte buf[] = new byte[8192];
       int n;
       InputStream inp = sap.getRangeStream();
       while ((n = inp.read(buf)) > 0) {
          messageDigest.update(buf, 0, n);
       }
       byte hash[] = messageDigest.digest();
       byte sh[] = pk7.getAuthenticatedAttributeBytes(hash, cal);
       pk7.update(sh, 0, sh.length);
       byte sg[] = pk7.getEncodedPKCS7(hash, cal);
       
      Parameters:
      secondDigest - the content digest
      Returns:
      the byte array representation of the authenticatedAttributes ready to be signed
    • getAuthenticatedAttributeSet

      private org.bouncycastle.asn1.DERSet getAuthenticatedAttributeSet(byte[] secondDigest, byte[] ocsp, Collection<byte[]> crlBytes, MakeSignature.CryptoStandard sigtype)
      This method provides that encoding and the parameters must be exactly the same as in getEncodedPKCS7(byte[]).
      Parameters:
      secondDigest - the content digest
      Returns:
      the byte array representation of the authenticatedAttributes ready to be signed
    • verify

      public boolean verify() throws GeneralSecurityException
      Verify the digest.
      Returns:
      true if the signature checks out, false otherwise
      Throws:
      SignatureException - on error
      GeneralSecurityException
    • verifySigAttributes

      private boolean verifySigAttributes(byte[] attr) throws GeneralSecurityException
      Throws:
      GeneralSecurityException
    • verifyTimestampImprint

      public boolean verifyTimestampImprint() throws GeneralSecurityException
      Checks if the timestamp refers to this document.
      Returns:
      true if it checks false otherwise
      Throws:
      GeneralSecurityException - on error
      Since:
      2.1.6
    • getCertificates

      public Certificate[] getCertificates()
      Get all the X.509 certificates associated with this PKCS#7 object in no particular order. Other certificates, from OCSP for example, will also be included.
      Returns:
      the X.509 certificates associated with this PKCS#7 object
    • getSignCertificateChain

      public Certificate[] getSignCertificateChain()
      Get the X.509 sign certificate chain associated with this PKCS#7 object. Only the certificates used for the main signature will be returned, with the signing certificate first.
      Returns:
      the X.509 certificates associated with this PKCS#7 object
      Since:
      2.1.6
    • getSigningCertificate

      public X509Certificate getSigningCertificate()
      Get the X.509 certificate actually used to sign the digest.
      Returns:
      the X.509 certificate actually used to sign the digest
    • signCertificateChain

      private void signCertificateChain()
      Helper method that creates the collection of certificates used for the main signature based on the complete list of certificates and the sign certificate.
    • getCRLs

      public Collection<CRL> getCRLs()
      Get the X.509 certificate revocation lists associated with this PKCS#7 object
      Returns:
      the X.509 certificate revocation lists associated with this PKCS#7 object
    • findCRL

      private void findCRL(org.bouncycastle.asn1.ASN1Sequence seq)
      Helper method that tries to construct the CRLs.
    • getOcsp

      public org.bouncycastle.cert.ocsp.BasicOCSPResp getOcsp()
      Gets the OCSP basic response if there is one.
      Returns:
      the OCSP basic response or null
      Since:
      2.1.6
    • isRevocationValid

      public boolean isRevocationValid()
      Checks if OCSP revocation refers to the document signing certificate.
      Returns:
      true if it checks, false otherwise
      Since:
      2.1.6
    • findOcsp

      private void findOcsp(org.bouncycastle.asn1.ASN1Sequence seq) throws IOException
      Helper method that creates the BasicOCSPResp object.
      Parameters:
      seq -
      Throws:
      IOException
    • isTsp

      public boolean isTsp()
      Check if it's a PAdES-LTV time stamp.
      Returns:
      true if it's a PAdES-LTV time stamp, false otherwise
    • getTimeStampToken

      public org.bouncycastle.tsp.TimeStampToken getTimeStampToken()
      Gets the timestamp token if there is one.
      Returns:
      the timestamp token or null
      Since:
      2.1.6
    • getTimeStampDate

      public Calendar getTimeStampDate()
      Gets the timestamp date
      Returns:
      a date
      Since:
      2.1.6
    • getFilterSubtype

      public PdfName getFilterSubtype()
      Returns the filter subtype.
    • getEncryptionAlgorithm

      public String getEncryptionAlgorithm()
      Returns the encryption algorithm
      Returns:
      the name of an encryption algorithm