Example usage for org.bouncycastle.cms CMSSignedData verifySignatures

Introduction

In this page you can find the example usage for org.bouncycastle.cms CMSSignedData verifySignatures.

Prototype

public boolean verifySignatures(SignerInformationVerifierProvider verifierProvider,
        boolean ignoreCounterSignatures) throws CMSException 

Source Link

Document

Verify all the SignerInformation objects and optionally their associated counter signatures attached to this CMS SignedData object.

Usage

From source file:known.issues.DSS642.CAdESCounterSignatureTest.java

License:Open Source License

@Test
public void test() throws Exception {
    CertificateService certificateService = new CertificateService();
    final MockPrivateKeyEntry entryUserA = certificateService
            .generateCertificateChain(SignatureAlgorithm.RSA_SHA256);
    final MockPrivateKeyEntry entryUserB = certificateService
            .generateCertificateChain(SignatureAlgorithm.RSA_SHA256);

    DSSDocument document = new FileDocument(new File("src/test/resources/sample.xml"));

    // Sign/*from   w  w  w.ja v a  2 s.  co  m*/
    CAdESSignatureParameters signatureParameters = new CAdESSignatureParameters();
    signatureParameters.setSigningCertificate(entryUserA.getCertificate());
    signatureParameters.setCertificateChain(entryUserA.getCertificateChain());
    signatureParameters.setSignatureLevel(SignatureLevel.CAdES_BASELINE_B);
    signatureParameters.setSignaturePackaging(SignaturePackaging.ENVELOPING);

    CertificateVerifier certificateVerifier = new CommonCertificateVerifier();
    CAdESService service = new CAdESService(certificateVerifier);

    ToBeSigned dataToSign = service.getDataToSign(document, signatureParameters);
    SignatureValue signatureValue = sign(signatureParameters.getSignatureAlgorithm(), entryUserA, dataToSign);
    DSSDocument signedDocument = service.signDocument(document, signatureParameters, signatureValue);

    // Countersign

    final InputStream inputStream = signedDocument.openStream();
    final CMSSignedData cmsSignedData = new CMSSignedData(inputStream);
    IOUtils.closeQuietly(inputStream);

    SignerInformationStore signerInfosStore = cmsSignedData.getSignerInfos();

    Collection<SignerInformation> signerInfos = signerInfosStore.getSigners();
    assertEquals(1, signerInfos.size());
    SignerInformation signerInfo = signerInfos.iterator().next();

    Thread.sleep(1000);

    CAdESSignatureParameters countersigningParameters = new CAdESSignatureParameters();
    countersigningParameters.setSignatureLevel(SignatureLevel.CAdES_BASELINE_B);
    countersigningParameters.setSignaturePackaging(SignaturePackaging.ENVELOPING);
    countersigningParameters.setSigningCertificate(entryUserB.getCertificate());
    countersigningParameters.setCertificateChain(entryUserB.getCertificateChain());

    DSSDocument counterSignDocument = service.counterSignDocument(signedDocument, countersigningParameters,
            signerInfo.getSID(), new MockSignatureTokenConnection(), entryUserB);
    assertNotNull(counterSignDocument);

    counterSignDocument.save("target/countersign.p7m");

    CMSSignedData data = new CMSSignedData(counterSignDocument.openStream());

    SignerInformationStore informationStore = data.getSignerInfos();
    Collection<SignerInformation> signers = informationStore.getSigners();
    for (SignerInformation signerInformation : signers) {
        AttributeTable signedAttributes = signerInformation.getSignedAttributes();
        Attribute attribute = signedAttributes.get(PKCSObjectIdentifiers.pkcs_9_at_contentType);
        assertNotNull(attribute);
        SignerInformationStore counterSignatures = signerInformation.getCounterSignatures();
        assertNotNull(counterSignatures);
        Collection<SignerInformation> signersCounter = counterSignatures.getSigners();
        for (SignerInformation signerCounter : signersCounter) {
            AttributeTable signedAttributes2 = signerCounter.getSignedAttributes();
            Attribute attribute2 = signedAttributes2.get(PKCSObjectIdentifiers.pkcs_9_at_contentType); // Counter-signatures don't allow content-type
            assertNull(attribute2);
        }
    }

    SignerInformationVerifierProvider vProv = new SignerInformationVerifierProvider() {
        @Override
        public SignerInformationVerifier get(SignerId signerId) throws OperatorCreationException {
            if (entryUserA.getCertificate().getSerialNumber().equals(signerId.getSerialNumber())) {
                return new JcaSimpleSignerInfoVerifierBuilder().setProvider(BouncyCastleProvider.PROVIDER_NAME)
                        .build(entryUserA.getCertificate().getCertificate());
            } else if (entryUserB.getCertificate().getSerialNumber().equals(signerId.getSerialNumber())) {
                return new JcaSimpleSignerInfoVerifierBuilder().setProvider(BouncyCastleProvider.PROVIDER_NAME)
                        .build(entryUserB.getCertificate().getCertificate());
            } else {
                throw new IllegalStateException("no signerID matched");
            }
        }
    };

    // Validate both signatures by BC
    assertTrue(data.verifySignatures(vProv, false));

    // Validate
    SignedDocumentValidator validator = SignedDocumentValidator.fromDocument(counterSignDocument);
    validator.setCertificateVerifier(new CommonCertificateVerifier());
    Reports reports = validator.validateDocument();

    reports.print();

    DiagnosticData diagnosticData = reports.getDiagnosticData();

    List<XmlDom> signatures = diagnosticData.getElements("/DiagnosticData/Signature");
    assertEquals(2, signatures.size());

    boolean foundCounterSignature = false;
    for (XmlDom xmlDom : signatures) {
        String type = xmlDom.getAttribute("Type");
        if (AttributeValue.COUNTERSIGNATURE.equals(type)) {
            foundCounterSignature = true;
        }
        assertTrue(diagnosticData.isBLevelTechnicallyValid(xmlDom.getAttribute("Id")));
    }
    assertTrue(foundCounterSignature);
}

---