Example usage for org.bouncycastle.cms CMSSignedData getSignerInfos

List of usage examples for org.bouncycastle.cms CMSSignedData getSignerInfos

Introduction

In this page you can find the example usage for org.bouncycastle.cms CMSSignedData getSignerInfos.

Prototype

public SignerInformationStore getSignerInfos() 

Source Link

Document

return the collection of signers that are associated with the signatures for the message.

Usage

From source file:eu.betaas.service.securitymanager.capability.utils.CapabilityUtils.java

License:Apache License

/**
 * Method to verify exCap's signature for the detached signature but the
 * signature is verified by the public key instead of the certificate
 * @param text: the original signed text
 * @param signature: the signature in byte[]
 * @param cert: issuer public key/*from w  w w. j  av a 2  s  .c  om*/
 * @return: true if signature is valid, false otherwise
 * @throws CMSException
 * @throws OperatorCreationException
 */
public static boolean validateCapSignature(String text, byte[] signature, AsymmetricKeyParameter pubKey)
        throws CMSException, OperatorCreationException {
    boolean ver = false;

    CMSSignedData signedData = new CMSSignedData(new CMSProcessableByteArray(text.getBytes()), signature);
    //      Store certs = signedData.getCertificates();
    SignerInformationStore signers = signedData.getSignerInfos();
    Iterator it = signers.getSigners().iterator();

    if (it.hasNext()) {
        SignerInformation signer = (SignerInformation) it.next();
        //     X509CertificateHolder cert = (X509CertificateHolder)certs.
        //           getMatches(signer.getSID()).iterator().next();

        SignerInformationVerifier verifier = new BcECDSASignerInfoVerifierBuilder(
                new DefaultCMSSignatureAlgorithmNameGenerator(),
                new DefaultSignatureAlgorithmIdentifierFinder(), new DefaultDigestAlgorithmIdentifierFinder(),
                new BcDigestCalculatorProvider()).build(pubKey);

        log.debug("will now verify the signature...");

        ver = signer.verify(verifier);
    }

    log.debug("Signature verification result: " + ver);

    return ver;
}

From source file:eu.europa.ec.markt.dss.signature.cades.CAdESService.java

License:Open Source License

/**
 * This method countersigns a signature identified through its SignerId
 *
 * @param toCounterSignDocument the original signature document containing the signature to countersign
 * @param parameters            the signature parameters
 * @param selector              the SignerId identifying the signature to countersign
 * @return the updated signature document, in which the countersignature has been embedded
 *///w  w  w.j a  v a2s .co  m
public DSSDocument counterSignDocument(final DSSDocument toCounterSignDocument,
        final SignatureParameters parameters, SignerId selector) {

    final SignatureTokenConnection token = parameters.getSigningToken();
    if (token == null) {

        throw new DSSNullException(SignatureTokenConnection.class, "",
                "The connection through available API to the SSCD must be set.");
    }

    try {
        //Retrieve the original signature
        final InputStream inputStream = toCounterSignDocument.openStream();
        final CMSSignedData cmsSignedData = new CMSSignedData(inputStream);
        DSSUtils.closeQuietly(inputStream);

        SignerInformationStore signerInfos = cmsSignedData.getSignerInfos();
        SignerInformation signerInformation = signerInfos.get(selector);

        //Generate a signed digest on the contents octets of the signature octet String in the identified SignerInfo value
        //of the original signature's SignedData
        byte[] dataToSign = signerInformation.getSignature();
        byte[] signatureValue = token.sign(dataToSign, parameters.getDigestAlgorithm(),
                parameters.getPrivateKeyEntry());

        //Set the countersignature builder
        CounterSignatureBuilder builder = new CounterSignatureBuilder(certificateVerifier);
        builder.setCmsSignedData(cmsSignedData);
        builder.setSelector(selector);

        final SignatureAlgorithm signatureAlgorithm = parameters.getSignatureAlgorithm();
        final CustomContentSigner customContentSigner = new CustomContentSigner(signatureAlgorithm.getJCEId(),
                signatureValue);

        SignerInfoGeneratorBuilder signerInformationGeneratorBuilder = builder
                .getSignerInfoGeneratorBuilder(parameters, true);
        CMSSignedDataGenerator cmsSignedDataGenerator = builder.createCMSSignedDataGenerator(parameters,
                customContentSigner, signerInformationGeneratorBuilder, null);
        CMSTypedData content = cmsSignedData.getSignedContent();
        CMSSignedData signedData = cmsSignedDataGenerator.generate(content);
        final CMSSignedData countersignedCMSData = builder.signDocument(signedData);
        final CMSSignedDocument signature = new CMSSignedDocument(countersignedCMSData);
        return signature;

    } catch (CMSException e) {
        throw new DSSException("Cannot parse CMS data", e);
    }
}

From source file:eu.europa.ec.markt.dss.signature.cades.CAdESSignatureExtension.java

License:Open Source License

/**
 * Loops on each signerInformation of the cmsSignedData and extends the signature
 *
 * @param cmsSignedData/*from  w  w  w  . j av a 2s  .c o m*/
 * @return
 */
private CMSSignedData extendAllCMSSignatures(CMSSignedData cmsSignedData, SignatureParameters parameters) {
    LOG.info("EXTEND ALL CMS SIGNATURES.");
    Collection<SignerInformation> signerInformationCollection = cmsSignedData.getSignerInfos().getSigners();
    for (SignerInformation signerInformation : signerInformationCollection) {
        cmsSignedData = preExtendCMSSignedData(cmsSignedData, parameters);
    }

    signerInformationCollection = cmsSignedData.getSignerInfos().getSigners();

    final List<SignerInformation> newSignerInformationList = new ArrayList<SignerInformation>();
    for (SignerInformation signerInformation : signerInformationCollection) {

        final CAdESSignature cadesSignature = new CAdESSignature(cmsSignedData, signerInformation);
        cadesSignature.setDetachedContents(parameters.getDetachedContent());
        assertSignatureValid(cadesSignature, parameters);
        final SignerInformation newSignerInformation = extendCMSSignature(cmsSignedData, signerInformation,
                parameters);
        newSignerInformationList.add(newSignerInformation);
    }

    final SignerInformationStore newSignerStore = new SignerInformationStore(newSignerInformationList);
    cmsSignedData = CMSSignedData.replaceSigners(cmsSignedData, newSignerStore);
    signerInformationCollection = cmsSignedData.getSignerInfos().getSigners();
    for (SignerInformation signerInformation : signerInformationCollection) {
        cmsSignedData = postExtendCMSSignedData(cmsSignedData, signerInformation, parameters);
    }
    return cmsSignedData;
}

From source file:eu.europa.ec.markt.dss.signature.cades.CAdESSignatureExtension.java

License:Open Source License

/**
 * Take the last signerInformation of the cmsSignedData and extends the signature
 *
 * @param cmsSignedData/*from   ww w .  jav  a2s  .c  o  m*/
 * @return
 */
private CMSSignedData extendLastCMSSignature(CMSSignedData cmsSignedData, SignatureParameters parameters) {

    LOG.info("EXTEND LAST CMS SIGNATURES.");
    cmsSignedData = preExtendCMSSignedData(cmsSignedData, parameters);

    Collection<SignerInformation> signerInformationCollection = cmsSignedData.getSignerInfos().getSigners();
    SignerInformation lastSignerInformation = getFirstSigner(cmsSignedData);
    final List<SignerInformation> newSignerInformationList = new ArrayList<SignerInformation>();
    for (SignerInformation signerInformation : signerInformationCollection) {

        if (lastSignerInformation == signerInformation) {

            final CAdESSignature cadesSignature = new CAdESSignature(cmsSignedData, signerInformation);
            cadesSignature.setDetachedContents(parameters.getDetachedContent());
            assertSignatureValid(cadesSignature, parameters);
            final SignerInformation newSignerInformation = extendCMSSignature(cmsSignedData, signerInformation,
                    parameters);
            newSignerInformationList.add(newSignerInformation);
        } else {
            newSignerInformationList.add(signerInformation);
        }
    }

    final SignerInformationStore newSignerStore = new SignerInformationStore(newSignerInformationList);
    cmsSignedData = CMSSignedData.replaceSigners(cmsSignedData, newSignerStore);

    lastSignerInformation = getFirstSigner(cmsSignedData);
    cmsSignedData = postExtendCMSSignedData(cmsSignedData, lastSignerInformation, parameters);
    return cmsSignedData;
}

From source file:eu.europa.ec.markt.dss.signature.cades.CAdESSignatureExtension.java

License:Open Source License

private SignerInformation getFirstSigner(CMSSignedData cmsSignedData) {
    final Collection<SignerInformation> signers = cmsSignedData.getSignerInfos().getSigners();
    SignerInformation lastSignerInformation;
    lastSignerInformation = null;/*  w  w w.j  a v a 2 s .  c  o  m*/
    for (SignerInformation signerInformation : signers) {
        lastSignerInformation = signerInformation;
        break;
    }
    return lastSignerInformation;
}

From source file:eu.europa.ec.markt.dss.signature.cades.CAdESSignatureExtension.java

License:Open Source License

public static ASN1Object getTimeStampAttributeValue(final TSPSource tspSource, final byte[] messageToTimestamp,
        final DigestAlgorithm timestampDigestAlgorithm, final Attribute... attributesForTimestampToken) {
    try {//from ww  w  . j ava2s  .  co  m

        if (LOG.isDebugEnabled()) {
            LOG.debug("Message to timestamp is: " + DSSUtils.encodeHexString(messageToTimestamp));
        }
        byte[] timestampDigest = DSSUtils.digest(timestampDigestAlgorithm, messageToTimestamp);
        if (LOG.isDebugEnabled()) {
            LOG.debug("Digested ({}) message to timestamp is {}",
                    new Object[] { timestampDigestAlgorithm, DSSUtils.encodeHexString(timestampDigest) });
        }

        final TimeStampToken timeStampToken = tspSource.getTimeStampResponse(timestampDigestAlgorithm,
                timestampDigest);

        if (timeStampToken == null) {
            throw new DSSNullReturnedException(TimeStampToken.class);
        }

        if (LOG.isDebugEnabled()) {
            final byte[] messageImprintDigest = timeStampToken.getTimeStampInfo().getMessageImprintDigest();
            LOG.debug("Digested ({}) message in timestamp is {}",
                    new Object[] { timestampDigestAlgorithm, DSSUtils.encodeHexString(messageImprintDigest) });
        }

        CMSSignedData cmsSignedDataTimeStampToken = new CMSSignedData(timeStampToken.getEncoded());

        // TODO (27/08/2014): attributesForTimestampToken cannot be null: to be modified
        if (attributesForTimestampToken != null) {
            // timeStampToken contains one and only one signer
            final SignerInformation signerInformation = (SignerInformation) cmsSignedDataTimeStampToken
                    .getSignerInfos().getSigners().iterator().next();
            AttributeTable unsignedAttributes = CAdESSignature.getUnsignedAttributes(signerInformation);
            for (final Attribute attributeToAdd : attributesForTimestampToken) {
                final ASN1ObjectIdentifier attrType = attributeToAdd.getAttrType();
                final ASN1Encodable objectAt = attributeToAdd.getAttrValues().getObjectAt(0);
                unsignedAttributes = unsignedAttributes.add(attrType, objectAt);
            }
            final SignerInformation newSignerInformation = SignerInformation
                    .replaceUnsignedAttributes(signerInformation, unsignedAttributes);
            final List<SignerInformation> signerInformationList = new ArrayList<SignerInformation>();
            signerInformationList.add(newSignerInformation);
            final SignerInformationStore newSignerStore = new SignerInformationStore(signerInformationList);
            cmsSignedDataTimeStampToken = CMSSignedData.replaceSigners(cmsSignedDataTimeStampToken,
                    newSignerStore);
        }
        final byte[] newTimeStampTokenBytes = cmsSignedDataTimeStampToken.getEncoded();
        return DSSASN1Utils.toASN1Primitive(newTimeStampTokenBytes);
    } catch (IOException e) {
        throw new DSSException(e);
    } catch (CMSException e) {
        throw new DSSException(e);
    }

}

From source file:eu.europa.ec.markt.dss.signature.cades.CMSSignedDataBuilder.java

License:Open Source License

/**
 * Note:/*from ww w  . jav a  2  s .  c o  m*/
 * Section 5.1 of RFC 3852 [4] requires that, the CMS SignedData version be set to 3 if certificates from
 * SignedData is present AND (any version 1 attribute certificates are present OR any SignerInfo structures
 * are version 3 OR eContentType from encapContentInfo is other than id-data). Otherwise, the CMS
 * SignedData version is required to be set to 1.
 * ---> CMS SignedData Version is handled automatically by BouncyCastle.
 *
 * @param parameters                 set of the driving signing parameters
 * @param contentSigner              the contentSigned to get the hash of the data to be signed
 * @param signerInfoGeneratorBuilder true if the unsigned attributes must be included
 * @param originalSignedData         the original signed data if extending an existing signature. null otherwise.  @return the bouncycastle signed data generator which will
 *                                   sign
 *                                   the document and add the required signed and unsigned CMS attributes
 * @throws eu.europa.ec.markt.dss.exception.DSSException
 */
protected CMSSignedDataGenerator createCMSSignedDataGenerator(final SignatureParameters parameters,
        final ContentSigner contentSigner, final SignerInfoGeneratorBuilder signerInfoGeneratorBuilder,
        final CMSSignedData originalSignedData) throws DSSException {
    try {

        final X509Certificate signingCertificate = parameters.getSigningCertificate();

        final CMSSignedDataGenerator generator = new CMSSignedDataGenerator();

        final X509CertificateHolder certHolder = DSSUtils.getX509CertificateHolder(signingCertificate);
        final SignerInfoGenerator signerInfoGenerator = signerInfoGeneratorBuilder.build(contentSigner,
                certHolder);

        generator.addSignerInfoGenerator(signerInfoGenerator);

        final Set<X509Certificate> newCertificateChain = new HashSet<X509Certificate>();

        if (originalSignedData != null) {

            generator.addSigners(originalSignedData.getSignerInfos());
            generator.addAttributeCertificates(originalSignedData.getAttributeCertificates());
            generator.addCRLs(originalSignedData.getCRLs());
            generator.addOtherRevocationInfo(OCSPObjectIdentifiers.id_pkix_ocsp_basic,
                    originalSignedData.getOtherRevocationInfo(OCSPObjectIdentifiers.id_pkix_ocsp_basic));
            generator.addOtherRevocationInfo(CMSObjectIdentifiers.id_ri_ocsp_response,
                    originalSignedData.getOtherRevocationInfo(CMSObjectIdentifiers.id_ri_ocsp_response));

            final Store certificates = originalSignedData.getCertificates();
            final Collection<X509CertificateHolder> certificatesMatches = certificates.getMatches(null);
            for (final X509CertificateHolder certificatesMatch : certificatesMatches) {
                newCertificateChain.add(DSSUtils.getCertificate(certificatesMatch));
            }
        }
        final List<X509Certificate> certificateChain = parameters.getCertificateChain();
        newCertificateChain.addAll(certificateChain);
        final Store jcaCertStore = getJcaCertStore(signingCertificate, newCertificateChain);
        generator.addCertificates(jcaCertStore);
        return generator;

    } catch (CMSException e) {
        throw new DSSException(e);
    } catch (OperatorCreationException e) {
        throw new DSSException(e);
    }
}

From source file:eu.europa.ec.markt.dss.signature.cades.CMSSignedDataBuilder.java

License:Open Source License

protected CMSSignedData regenerateCMSSignedData(CMSSignedData cmsSignedData, SignatureParameters parameters,
        Store certificatesStore, Store attributeCertificatesStore, Store crlsStore,
        Store otherRevocationInfoFormatStoreBasic, Store otherRevocationInfoFormatStoreOcsp) {
    try {/*from  w w  w .ja  v a2 s  .co  m*/

        final CMSSignedDataGenerator cmsSignedDataGenerator = new CMSSignedDataGenerator();
        cmsSignedDataGenerator.addSigners(cmsSignedData.getSignerInfos());
        cmsSignedDataGenerator.addAttributeCertificates(attributeCertificatesStore);
        cmsSignedDataGenerator.addCertificates(certificatesStore);
        cmsSignedDataGenerator.addCRLs(crlsStore);
        cmsSignedDataGenerator.addOtherRevocationInfo(OCSPObjectIdentifiers.id_pkix_ocsp_basic,
                otherRevocationInfoFormatStoreBasic);
        cmsSignedDataGenerator.addOtherRevocationInfo(CMSObjectIdentifiers.id_ri_ocsp_response,
                otherRevocationInfoFormatStoreOcsp);
        final boolean encapsulate = cmsSignedData.getSignedContent() != null;
        if (!encapsulate) {
            final InputStream inputStream = parameters.getDetachedContent().openStream();
            final CMSProcessableByteArray content = new CMSProcessableByteArray(
                    DSSUtils.toByteArray(inputStream));
            DSSUtils.closeQuietly(inputStream);
            cmsSignedData = cmsSignedDataGenerator.generate(content, encapsulate);
        } else {
            cmsSignedData = cmsSignedDataGenerator.generate(cmsSignedData.getSignedContent(), encapsulate);
        }
        return cmsSignedData;
    } catch (CMSException e) {
        throw new DSSException(e);
    }
}

From source file:eu.europa.ec.markt.dss.signature.cades.CounterSignatureBuilder.java

License:Open Source License

/**
 * This method applies a countersignature to an existing signature
 * @param signedData the countersignature
 * @return the updated signature, in which the countersignature has been embedded
 *///  w  w  w  .j a  v  a2 s  . co  m
public CMSSignedData signDocument(final CMSSignedData signedData) {

    final ASN1ObjectIdentifier csIdentifier = OID.id_countersignature;

    //Retrieve the SignerInformation from the countersigned signature
    final SignerInformationStore originalSignerInfos = cmsSignedData.getSignerInfos();
    //Retrieve the SignerInformation from the countersignature
    final SignerInformationStore signerInfos = signedData.getSignerInfos();

    //Add the countersignature
    SignerInformation updatedSI = cmsSignedData.getSignerInfos().get(selector)
            .addCounterSigners(originalSignerInfos.get(selector), signerInfos);

    //Create updated SignerInformationStore
    Collection<SignerInformation> counterSignatureInformationCollection = new ArrayList<SignerInformation>();
    counterSignatureInformationCollection.add(updatedSI);
    SignerInformationStore signerInformationStore = new SignerInformationStore(
            counterSignatureInformationCollection);

    //Return new, updated signature
    return CMSSignedData.replaceSigners(cmsSignedData, signerInformationStore);
}

From source file:eu.europa.ec.markt.dss.validation.cades.CAdESCertificateSource.java

License:Open Source License

/**
 * The default constructor for CAdESCertificateSource.
 * /*from  w ww  .  j a  v a 2s.  c om*/
 * @param encodedCMS
 * @throws CMSException
 */
public CAdESCertificateSource(CMSSignedData cms) {
    this(cms, ((SignerInformation) cms.getSignerInfos().getSigners().iterator().next()).getSID(), false);
}