List of usage examples for org.bouncycastle.cms CMSSignedData CMSSignedData
public CMSSignedData(Map hashes, ContentInfo sigData) throws CMSException
From source file:org.apache.pdfbox.examples.signature.ShowSignature.java
License:Apache License
/** * Verify a PKCS7 signature.// ww w . j a va 2s .c o m * * @param byteArray the byte sequence that has been signed * @param contents the /Contents field as a COSString * @param sig the PDF signature (the /V dictionary) * @throws CertificateException * @throws CMSException * @throws StoreException * @throws OperatorCreationException */ private void verifyPKCS7(byte[] byteArray, COSString contents, PDSignature sig) throws CMSException, CertificateException, StoreException, OperatorCreationException { // inspiration: // http://stackoverflow.com/a/26702631/535646 // http://stackoverflow.com/a/9261365/535646 CMSProcessable signedContent = new CMSProcessableByteArray(byteArray); CMSSignedData signedData = new CMSSignedData(signedContent, contents.getBytes()); Store certificatesStore = signedData.getCertificates(); Collection<SignerInformation> signers = signedData.getSignerInfos().getSigners(); SignerInformation signerInformation = signers.iterator().next(); Collection matches = certificatesStore.getMatches(signerInformation.getSID()); X509CertificateHolder certificateHolder = (X509CertificateHolder) matches.iterator().next(); X509Certificate certFromSignedData = new JcaX509CertificateConverter().getCertificate(certificateHolder); System.out.println("certFromSignedData: " + certFromSignedData); certFromSignedData.checkValidity(sig.getSignDate().getTime()); if (signerInformation.verify(new JcaSimpleSignerInfoVerifierBuilder().build(certFromSignedData))) { System.out.println("Signature verified"); } else { System.out.println("Signature verification failed"); } }
From source file:org.bitrepository.protocol.security.BasicMessageAuthenticator.java
License:Open Source License
@Override public SignerId authenticateMessage(byte[] messageData, byte[] signatureData) throws MessageAuthenticationException { try {/*w w w . j a v a 2 s.co m*/ CMSSignedData s = new CMSSignedData(new CMSProcessableByteArray(messageData), signatureData); SignerInformation signer = (SignerInformation) s.getSignerInfos().getSigners().iterator().next(); X509Certificate signingCert = permissionStore.getCertificate(signer.getSID()); SignerInformationVerifier verifier = new JcaSimpleSignerInfoVerifierBuilder() .setProvider(SecurityModuleConstants.BC).build(signingCert); if (!signer.verify(verifier)) { throw new MessageAuthenticationException("Signature does not match the message. Indicated " + "certificate did not sign message. Certificate issuer: " + signingCert.getIssuerX500Principal().getName() + ", serial: " + signingCert.getSerialNumber()); } return signer.getSID(); } catch (PermissionStoreException e) { throw new MessageAuthenticationException(e.getMessage(), e); } catch (CMSException e) { throw new SecurityException(e.getMessage(), e); } catch (OperatorCreationException e) { throw new SecurityException(e.getMessage(), e); } }
From source file:org.bitrepository.protocol.security.BasicSecurityManager.java
License:Open Source License
/** * Method to authorize the use of a certificate * @param certificateUser the user who signed the message * @param messageData the data of the message request. * @param signature the signature belonging to the message request. * @throws CertificateUseException in case the certificate use could not be authorized. *//*from ww w .j a va 2 s. c om*/ public void authorizeCertificateUse(String certificateUser, String messageData, String signature) throws CertificateUseException { if (repositorySettings.getProtocolSettings().isRequireOperationAuthorization()) { byte[] decodeSig = Base64.decode(signature.getBytes()); CMSSignedData s; try { s = new CMSSignedData(new CMSProcessableByteArray(messageData.getBytes()), decodeSig); } catch (CMSException e) { throw new SecurityException(e.getMessage(), e); } SignerInformation signer = (SignerInformation) s.getSignerInfos().getSigners().iterator().next(); authorizer.authorizeCertificateUse(certificateUser, signer.getSID()); } }
From source file:org.bitrepository.protocol.security.BasicSecurityManager.java
License:Open Source License
/** * Method to authorize an operation // w w w . ja va 2 s . co m * @param operationType the type of operation that is to be authorized. * @param messageData the data of the message request. * @param signature the signature belonging to the message request. * @throws OperationAuthorizationException in case of failure. */ public void authorizeOperation(String operationType, String messageData, String signature) throws OperationAuthorizationException { if (repositorySettings.getProtocolSettings().isRequireOperationAuthorization()) { byte[] decodeSig = Base64.decode(signature.getBytes()); CMSSignedData s; try { s = new CMSSignedData(new CMSProcessableByteArray(messageData.getBytes()), decodeSig); } catch (CMSException e) { throw new SecurityException(e.getMessage(), e); } SignerInformation signer = (SignerInformation) s.getSignerInfos().getSigners().iterator().next(); try { authorizer.authorizeOperation(operationType, signer.getSID()); } catch (UnregisteredPermissionException e) { log.info(e.getMessage()); } } }
From source file:org.bitrepository.protocol.security.CertificateIDTest.java
License:Open Source License
@Test(groups = { "regressiontest" })
public void positiveCertificateIdentificationTest() throws Exception {
addDescription("Tests that a certificate can be identified based on the correct signature.");
addStep("Create CertificateID object based on the certificate used to sign the data",
"CertificateID object not null");
Security.addProvider(new BouncyCastleProvider());
ByteArrayInputStream bs = new ByteArrayInputStream(SecurityTestConstants.getPositiveCertificate()
.getBytes(SecurityModuleConstants.defaultEncodingType));
X509Certificate myCertificate = (X509Certificate) CertificateFactory
.getInstance(SecurityModuleConstants.CertificateType).generateCertificate(bs);
CertificateID certificateIDfromCertificate = new CertificateID(myCertificate.getIssuerX500Principal(),
myCertificate.getSerialNumber());
addStep("Create CertificateID object based on signature", "Certificate object not null");
byte[] decodeSig = Base64.decode(SecurityTestConstants.getSignature().getBytes());
CMSSignedData s = new CMSSignedData(
new CMSProcessableByteArray(
SecurityTestConstants.getTestData().getBytes(SecurityModuleConstants.defaultEncodingType)),
decodeSig);// w w w . jav a 2 s.co m
SignerInformation signer = (SignerInformation) s.getSignerInfos().getSigners().iterator().next();
CertificateID certificateIDfromSignature = new CertificateID(signer.getSID().getIssuer(),
signer.getSID().getSerialNumber());
addStep("Assert that the two CertificateID objects are equal", "Assert succeeds");
Assert.assertEquals(certificateIDfromCertificate, certificateIDfromSignature);
}
From source file:org.bitrepository.protocol.security.CertificateIDTest.java
License:Open Source License
@Test(groups = { "regressiontest" })
public void negativeCertificateIdentificationTest() throws Exception {
addDescription("Tests that a certificate is not identified based on a incorrect signature.");
addStep("Create CertificateID object based on a certificate not used for signing the data",
"CertificateID object not null");
Security.addProvider(new BouncyCastleProvider());
ByteArrayInputStream bs = new ByteArrayInputStream(SecurityTestConstants.getNegativeCertificate()
.getBytes(SecurityModuleConstants.defaultEncodingType));
X509Certificate myCertificate = (X509Certificate) CertificateFactory
.getInstance(SecurityModuleConstants.CertificateType).generateCertificate(bs);
CertificateID certificateIDfromCertificate = new CertificateID(myCertificate.getIssuerX500Principal(),
myCertificate.getSerialNumber());
addStep("Create CertificateID object based on signature", "Certificate object not null");
byte[] decodeSig = Base64.decode(SecurityTestConstants.getSignature().getBytes());
CMSSignedData s = new CMSSignedData(
new CMSProcessableByteArray(
SecurityTestConstants.getTestData().getBytes(SecurityModuleConstants.defaultEncodingType)),
decodeSig);/*from w w w . j a v a 2 s . co m*/
SignerInformation signer = (SignerInformation) s.getSignerInfos().getSigners().iterator().next();
CertificateID certificateIDfromSignature = new CertificateID(signer.getSID().getIssuer(),
signer.getSID().getSerialNumber());
addStep("Assert that the two CertificateID objects are equal", "Assert succeeds");
Assert.assertNotSame((Object) certificateIDfromCertificate, (Object) certificateIDfromSignature);
}
From source file:org.bitrepository.protocol.security.PermissionStoreTest.java
License:Open Source License
@Test(groups = { "regressiontest" })
public void positiveCertificateRetrievalTest() throws Exception {
addDescription("Tests that a certificate can be retrieved based on the correct signerId.");
addStep("Create signer to lookup certificate", "No exceptions");
byte[] decodeSig = Base64
.decode(SecurityTestConstants.getSignature().getBytes(SecurityModuleConstants.defaultEncodingType));
CMSSignedData s = new CMSSignedData(
new CMSProcessableByteArray(
SecurityTestConstants.getTestData().getBytes(SecurityModuleConstants.defaultEncodingType)),
decodeSig);//w w w. ja va 2 s . c o m
SignerInformation signer = (SignerInformation) s.getSignerInfos().getSigners().iterator().next();
addStep("Lookup certificate based on signerId", "No exceptions");
X509Certificate certificateFromStore = permissionStore.getCertificate(signer.getSID());
ByteArrayInputStream bs = new ByteArrayInputStream(SecurityTestConstants.getPositiveCertificate()
.getBytes(SecurityModuleConstants.defaultEncodingType));
X509Certificate positiveCertificate = (X509Certificate) CertificateFactory
.getInstance(SecurityModuleConstants.CertificateType).generateCertificate(bs);
assertEquals(positiveCertificate, certificateFromStore);
}
From source file:org.bitrepository.protocol.security.PermissionStoreTest.java
License:Open Source License
@Test(groups = { "regressiontest" })
public void negativeCertificateRetrievalTest() throws Exception {
addDescription("Tests that a certificate cannot be retrieved based on the wrong signerId.");
addStep("Create signer and modify its ID so lookup will fail", "No exceptions");
byte[] decodeSig = Base64
.decode(SecurityTestConstants.getSignature().getBytes(SecurityModuleConstants.defaultEncodingType));
CMSSignedData s = new CMSSignedData(
new CMSProcessableByteArray(
SecurityTestConstants.getTestData().getBytes(SecurityModuleConstants.defaultEncodingType)),
decodeSig);//w ww .jav a 2 s. co m
SignerInformation signer = (SignerInformation) s.getSignerInfos().getSigners().iterator().next();
SignerId signerId = signer.getSID();
BigInteger serial = signerId.getSerialNumber();
serial.add(new BigInteger("2"));
signerId = new SignerId(signerId.getIssuer(), serial);
addStep("Lookup certificate based on signerId", "No exceptions");
X509Certificate certificateFromStore = permissionStore.getCertificate(signerId);
ByteArrayInputStream bs = new ByteArrayInputStream(SecurityTestConstants.getPositiveCertificate()
.getBytes(SecurityModuleConstants.defaultEncodingType));
X509Certificate positiveCertificate = (X509Certificate) CertificateFactory
.getInstance(SecurityModuleConstants.CertificateType).generateCertificate(bs);
assertEquals(positiveCertificate, certificateFromStore);
}
From source file:org.bitrepository.protocol.security.PermissionStoreTest.java
License:Open Source License
@Test(groups = { "regressiontest" })
public void certificateFingerprintTest() throws Exception {
addDescription("Tests that a certificate fingerprint can correctly be retrived for a signer.");
addFixture("Create signer to lookup fingerprint");
byte[] decodeSig = Base64
.decode(SecurityTestConstants.getSignature().getBytes(SecurityModuleConstants.defaultEncodingType));
CMSSignedData s = new CMSSignedData(
new CMSProcessableByteArray(
SecurityTestConstants.getTestData().getBytes(SecurityModuleConstants.defaultEncodingType)),
decodeSig);// w w w.ja v a2s . com
SignerInformation signer = (SignerInformation) s.getSignerInfos().getSigners().iterator().next();
addStep("Lookup fingerprint based on signerId", "The correct finger print should be returned with openssl"
+ "used to generate reference finger print");
String certificateFingerprintFromStore = permissionStore.getCertificateFingerprint(signer.getSID());
String referenceCertificateFingerprint = "68:21:C4:C2:B9:AE:9F:AE:A1:F1:F9:93:35:3C:9F:C4:63:CC:92:59";
assertEquals(referenceCertificateFingerprint.toLowerCase().replaceAll(":", ""),
certificateFingerprintFromStore);
}
From source file:org.demoiselle.signer.policy.impl.cades.pkcs7.impl.CAdESChecker.java
License:Open Source License
/** * Validation is done only on digital signatures with a single signer. Valid * only with content of type DATA.: OID ContentType 1.2.840.113549.1.9.3 = * OID Data 1.2.840.113549.1.7.1/*w w w. ja v a2 s . co m*/ * * @param content Is only necessary to inform if the PKCS7 package is NOT * ATTACHED type. If it is of type attached, this parameter will be * replaced by the contents of the PKCS7 package. * @param signedData Value in bytes of the PKCS7 package, such as the * contents of a ".p7s" file. It is not only signature as in the * case of PKCS1. */ // TODO: Implementar validao de co-assinaturas public boolean check(byte[] content, byte[] signedData) throws SignerException { Security.addProvider(new BouncyCastleProvider()); CMSSignedData cmsSignedData = null; try { if (content == null) { if (this.checkHash) { cmsSignedData = new CMSSignedData(this.hashes, signedData); this.checkHash = false; } else { cmsSignedData = new CMSSignedData(signedData); } } else { if (this.getAttached(signedData, false) != null) { cmsSignedData = new CMSSignedData(signedData); } else { cmsSignedData = new CMSSignedData(new CMSProcessableByteArray(content), signedData); } } } catch (CMSException ex) { throw new SignerException(cadesMessagesBundle.getString("error.invalid.bytes.pkcs7"), ex); } // Quantidade inicial de assinaturas validadas int verified = 0; Store<?> certStore = cmsSignedData.getCertificates(); SignerInformationStore signers = cmsSignedData.getSignerInfos(); Iterator<?> it = signers.getSigners().iterator(); // Realizao da verificao bsica de todas as assinaturas while (it.hasNext()) { SignatureInformations signatureInfo = new SignatureInformations(); try { SignerInformation signerInfo = (SignerInformation) it.next(); SignerInformationStore signerInfoStore = signerInfo.getCounterSignatures(); logger.info("Foi(ram) encontrada(s) " + signerInfoStore.size() + " contra-assinatura(s)."); @SuppressWarnings("unchecked") Collection<?> certCollection = certStore.getMatches(signerInfo.getSID()); Iterator<?> certIt = certCollection.iterator(); X509CertificateHolder certificateHolder = (X509CertificateHolder) certIt.next(); X509Certificate varCert = new JcaX509CertificateConverter().getCertificate(certificateHolder); CRLValidator cV = new CRLValidator(); try { cV.validate(varCert); } catch (CertificateValidatorCRLException cvce) { signatureInfo.getValidatorErrors().add(cvce.getMessage()); logger.info(cvce.getMessage()); } catch (CertificateRevocationException cre) { signatureInfo.getValidatorErrors().add(cre.getMessage()); logger.info("certificado revogado"); } PeriodValidator pV = new PeriodValidator(); try { pV.validate(varCert); } catch (CertificateValidatorException cve) { signatureInfo.getValidatorErrors().add(cve.getMessage()); } if (signerInfo.verify( new JcaSimpleSignerInfoVerifierBuilder().setProvider("BC").build(certificateHolder))) { verified++; logger.info(cadesMessagesBundle.getString("info.signature.valid.seq", verified)); } // recupera atributos assinados logger.info(cadesMessagesBundle.getString("info.signed.attribute")); String varOIDPolicy = PKCSObjectIdentifiers.id_aa_ets_sigPolicyId.getId(); AttributeTable signedAttributes = signerInfo.getSignedAttributes(); if ((signedAttributes == null) || (signedAttributes != null && signedAttributes.size() == 0)) { signatureInfo.getValidatorErrors() .add(cadesMessagesBundle.getString("error.signed.attribute.table.not.found")); logger.info(cadesMessagesBundle.getString("error.signed.attribute.table.not.found")); //throw new SignerException(cadesMessagesBundle.getString("error.signed.attribute.table.not.found")); } else { //Validando atributos assinados de acordo com a politica Attribute idSigningPolicy = null; idSigningPolicy = signedAttributes.get(new ASN1ObjectIdentifier(varOIDPolicy)); if (idSigningPolicy == null) { signatureInfo.getValidatorErrors().add( cadesMessagesBundle.getString("error.pcks7.attribute.not.found", varOIDPolicy)); } else { for (Enumeration<?> p = idSigningPolicy.getAttrValues().getObjects(); p .hasMoreElements();) { String policyOnSignature = p.nextElement().toString(); for (PolicyFactory.Policies pv : PolicyFactory.Policies.values()) { if (policyOnSignature.contains(pv.getUrl())) { setSignaturePolicy(pv); break; } } } } } Date dataHora = null; if (signedAttributes != null) { // Valida o atributo ContentType Attribute attributeContentType = signedAttributes.get(CMSAttributes.contentType); if (attributeContentType == null) { signatureInfo.getValidatorErrors().add( cadesMessagesBundle.getString("error.pcks7.attribute.not.found", "ContentType")); //throw new SignerException(cadesMessagesBundle.getString("error.pcks7.attribute.not.found", "ContentType")); logger.info( cadesMessagesBundle.getString("error.pcks7.attribute.not.found", "ContentType")); } if (!attributeContentType.getAttrValues().getObjectAt(0).equals(ContentInfo.data)) { signatureInfo.getValidatorErrors() .add(cadesMessagesBundle.getString("error.content.not.data")); //throw new SignerException(cadesMessagesBundle.getString("error.content.not.data")); logger.info(cadesMessagesBundle.getString("error.content.not.data")); } // Validando o atributo MessageDigest Attribute attributeMessageDigest = signedAttributes.get(CMSAttributes.messageDigest); if (attributeMessageDigest == null) { throw new SignerException( cadesMessagesBundle.getString("error.pcks7.attribute.not.found", "MessageDigest")); } // Mostra data e hora da assinatura, no carimbo de tempo Attribute timeAttribute = signedAttributes.get(CMSAttributes.signingTime); if (timeAttribute != null) { dataHora = (((ASN1UTCTime) timeAttribute.getAttrValues().getObjectAt(0)).getDate()); logger.info(cadesMessagesBundle.getString("info.date.utc", dataHora)); } else { logger.info(cadesMessagesBundle.getString("info.date.utc", "N/D")); } } if (signaturePolicy == null) { signatureInfo.getValidatorErrors().add( cadesMessagesBundle.getString("error.policy.on.component.not.found", varOIDPolicy)); logger.info(cadesMessagesBundle.getString("error.policy.on.component.not.found")); } else { if (signaturePolicy.getSignPolicyInfo().getSignatureValidationPolicy().getCommonRules() .getSignerAndVeriferRules().getSignerRules().getMandatedSignedAttr() .getObjectIdentifiers() != null) { for (ObjectIdentifier objectIdentifier : signaturePolicy.getSignPolicyInfo() .getSignatureValidationPolicy().getCommonRules().getSignerAndVeriferRules() .getSignerRules().getMandatedSignedAttr().getObjectIdentifiers()) { String oi = objectIdentifier.getValue(); Attribute signedAtt = signedAttributes.get(new ASN1ObjectIdentifier(oi)); logger.info(oi); if (signedAtt == null) { signatureInfo.getValidatorErrors().add(cadesMessagesBundle.getString( "error.signed.attribute.not.found", oi, signaturePolicy.getSignPolicyInfo().getSignPolicyIdentifier().getValue())); } } } } // recupera os atributos NO assinados logger.info(cadesMessagesBundle.getString("info.unsigned.attribute")); AttributeTable unsignedAttributes = signerInfo.getUnsignedAttributes(); if ((unsignedAttributes == null) || (unsignedAttributes != null && unsignedAttributes.size() == 0)) { // Apenas info pois a RB no tem atributos no assinados logger.info(cadesMessagesBundle.getString("error.unsigned.attribute.table.not.found")); } if (signaturePolicy != null) { // Validando atributos NO assinados de acordo com a politica if (signaturePolicy.getSignPolicyInfo().getSignatureValidationPolicy().getCommonRules() .getSignerAndVeriferRules().getSignerRules().getMandatedUnsignedAttr() .getObjectIdentifiers() != null) { for (ObjectIdentifier objectIdentifier : signaturePolicy.getSignPolicyInfo() .getSignatureValidationPolicy().getCommonRules().getSignerAndVeriferRules() .getSignerRules().getMandatedUnsignedAttr().getObjectIdentifiers()) { String oi = objectIdentifier.getValue(); Attribute unSignedAtt = unsignedAttributes.get(new ASN1ObjectIdentifier(oi)); logger.info(oi); if (unSignedAtt == null) { signatureInfo.getValidatorErrors().add(cadesMessagesBundle.getString( "error.unsigned.attribute.not.found", oi, signaturePolicy.getSignPolicyInfo().getSignPolicyIdentifier().getValue())); } if (oi.equalsIgnoreCase(PKCSObjectIdentifiers.id_aa_signatureTimeStampToken.getId())) { //Verificando timeStamp try { byte[] varSignature = signerInfo.getSignature(); Timestamp varTimeStampSigner = validateTimestamp(unSignedAtt, varSignature); signatureInfo.setTimeStampSigner(varTimeStampSigner); } catch (Exception ex) { signatureInfo.getValidatorErrors().add(ex.getMessage()); // nas assinaturas feitas na applet o unsignedAttributes.get gera exceo. } } if (oi.equalsIgnoreCase("1.2.840.113549.1.9.16.2.25")) { logger.info("++++++++++ EscTimeStamp ++++++++++++"); } } } } LinkedList<X509Certificate> varChain = (LinkedList<X509Certificate>) CAManager.getInstance() .getCertificateChain(varCert); if (varChain.size() < 3) { signatureInfo.getValidatorErrors() .add(cadesMessagesBundle.getString("error.no.ca", varCert.getIssuerDN())); logger.info(cadesMessagesBundle.getString("error.no.ca", varCert.getIssuerDN())); } signatureInfo.setSignDate(dataHora); signatureInfo.setChain(varChain); signatureInfo.setSignaturePolicy(signaturePolicy); this.getSignaturesInfo().add(signatureInfo); } catch (OperatorCreationException | java.security.cert.CertificateException ex) { signatureInfo.getValidatorErrors().add(ex.getMessage()); logger.info(ex.getMessage()); } catch (CMSException ex) { // When file is mismatch with sign if (ex instanceof CMSSignerDigestMismatchException) { signatureInfo.getValidatorErrors() .add(cadesMessagesBundle.getString("error.signature.mismatch")); logger.info(cadesMessagesBundle.getString("error.signature.mismatch")); throw new SignerException(cadesMessagesBundle.getString("error.signature.mismatch"), ex); } else { signatureInfo.getValidatorErrors() .add(cadesMessagesBundle.getString("error.signature.invalid")); logger.info(cadesMessagesBundle.getString("error.signature.invalid")); throw new SignerException(cadesMessagesBundle.getString("error.signature.invalid"), ex); } } catch (ParseException e) { signatureInfo.getValidatorErrors().add(e.getMessage()); logger.info(e.getMessage()); } } logger.info(cadesMessagesBundle.getString("info.signature.verified", verified)); // TODO Efetuar o parsing da estrutura CMS return true; }