Example usage for org.bouncycastle.jce.provider BouncyCastleProvider PROVIDER

Introduction

In this page you can find the example usage for org.bouncycastle.jce.provider BouncyCastleProvider PROVIDER_NAME.

Prototype

String PROVIDER_NAME

To view the source code for org.bouncycastle.jce.provider BouncyCastleProvider PROVIDER_NAME.

Click Source Link

Usage

From source file:eu.emi.security.authn.x509.helpers.pkipath.NonValidatingCertPathBuilder.java

License:Open Source License

protected void build(X509Certificate tbvCert, ExtendedPKIXBuilderParameters pkixParams,
        List<X509Certificate> tbvPath, final X509Certificate[] origChain) {
    // If tbvCert is readily present in tbvPath, it indicates having
    // run into a cycle in the PKI graph.
    if (tbvPath.contains(tbvCert)) {
        return;/*from  w w w.ja v  a2s.c  o  m*/
    }
    // step out, the certificate is not allowed to appear in a
    // certification chain.
    if (pkixParams.getExcludedCerts().contains(tbvCert)) {
        return;
    }
    // test if certificate path exceeds maximum length
    if (pkixParams.getMaxPathLength() != -1) {
        if (tbvPath.size() - 1 > pkixParams.getMaxPathLength()) {
            return;
        }
    }

    tbvPath.add(tbvCert);

    CertificateFactory cFact;

    try {
        cFact = CertificateFactory.getInstance("X.509", BouncyCastleProvider.PROVIDER_NAME);
    } catch (Exception e) {
        // cannot happen
        throw new RuntimeException("Exception creating support classes.");
    }

    try {
        // check whether the issuer of <tbvCert> is a TrustAnchor
        TrustAnchor ta;
        try {
            ta = CertPathValidatorUtilities.findTrustAnchor2(tbvCert, pkixParams.getTrustAnchors(),
                    pkixParams.getSigProvider());
        } catch (AnnotatedException e1) {
            throw new ValidationErrorException(
                    new ValidationError(origChain, -1, ValidationErrorCode.noTrustAnchorFound));
        }

        if (ta != null) {
            try {
                CertPath generated = cFact.generateCertPath(tbvPath);
                result.add(generated);
                tbvPath.remove(tbvCert);
                return;
            } catch (Exception e) {
                throw new ValidationErrorException(
                        new ValidationError(origChain, -1, ValidationErrorCode.unknownMsg,
                                "Certification path could not be constructed from certificate list: " + e));
            }
        } else {
            // add additional X.509 stores from locations in
            // certificate
            try {
                CertPathValidatorUtilities.addAdditionalStoresFromAltNames(tbvCert, pkixParams);
            } catch (CertificateParsingException e) {
                throw new ValidationErrorException(
                        new ValidationError(origChain, -1, ValidationErrorCode.inputError,
                                "No additiontal X.509 stores can be added from certificate locations as "
                                        + "issuer alternative name extension can not be parsed: "
                                        + e.toString()));
            }
            Collection<Object> issuers = new HashSet<Object>();
            // try to get the issuer certificate from one
            // of the stores
            try {
                issuers.addAll(CertPathValidatorUtilities.findIssuerCerts(tbvCert, pkixParams));
            } catch (org.bouncycastle.jce.provider.AnnotatedException e) {
                throw new ValidationErrorException(
                        new ValidationError(origChain, -1, ValidationErrorCode.unknownMsg,
                                "Low level error occured: Cannot find issuer certificate "
                                        + "for certificate in certification path: " + e));
            }
            if (issuers.isEmpty()) {
                throw new ValidationErrorException(
                        new ValidationError(origChain, -1, ValidationErrorCode.invalidCertificatePath,
                                CertificateUtils.format(tbvCert, FormatMode.COMPACT_ONE_LINE)));
            }
            Iterator<?> it = issuers.iterator();

            while (it.hasNext()) {
                X509Certificate issuer = (X509Certificate) it.next();
                build(issuer, pkixParams, tbvPath, origChain);
            }
        }
    } catch (ValidationErrorException e) {
        if (certPathException == null)
            certPathException = new ValidationErrorException();
        certPathException.addErrors(e.getErrors());
    }
    tbvPath.remove(tbvCert);
}

From source file:eu.europa.esig.dss.cades.signature.CAdESLevelBTest.java

License:Open Source License

@Override
protected void onDocumentSigned(byte[] byteArray) {
    try {/*w  w w  .j  a v  a 2 s .  com*/

        CAdESSignature signature = new CAdESSignature(byteArray);
        assertNotNull(signature.getCmsSignedData());

        ASN1InputStream asn1sInput = new ASN1InputStream(byteArray);
        ASN1Sequence asn1Seq = (ASN1Sequence) asn1sInput.readObject();

        logger.info("SEQ : " + asn1Seq.toString());

        assertEquals(2, asn1Seq.size());

        ASN1ObjectIdentifier oid = ASN1ObjectIdentifier.getInstance(asn1Seq.getObjectAt(0));
        assertEquals(PKCSObjectIdentifiers.signedData, oid);
        logger.info("OID : " + oid.toString());

        ASN1TaggedObject taggedObj = DERTaggedObject.getInstance(asn1Seq.getObjectAt(1));

        logger.info("TAGGED OBJ : " + taggedObj.toString());

        ASN1Primitive object = taggedObj.getObject();
        logger.info("OBJ : " + object.toString());

        SignedData signedData = SignedData.getInstance(object);
        logger.info("SIGNED DATA : " + signedData.toString());

        ASN1Set digestAlgorithms = signedData.getDigestAlgorithms();
        logger.info("DIGEST ALGOS : " + digestAlgorithms.toString());

        ContentInfo encapContentInfo = signedData.getEncapContentInfo();
        logger.info("ENCAPSULATED CONTENT INFO : " + encapContentInfo.getContentType() + " "
                + encapContentInfo.getContent());

        ASN1Set certificates = signedData.getCertificates();
        logger.info("CERTIFICATES (" + certificates.size() + ") : " + certificates);

        List<X509Certificate> foundCertificates = new ArrayList<X509Certificate>();
        for (int i = 0; i < certificates.size(); i++) {
            ASN1Sequence seqCertif = ASN1Sequence.getInstance(certificates.getObjectAt(i));
            logger.info("SEQ cert " + i + " : " + seqCertif);

            X509CertificateHolder certificateHolder = new X509CertificateHolder(seqCertif.getEncoded());
            X509Certificate certificate = new JcaX509CertificateConverter()
                    .setProvider(BouncyCastleProvider.PROVIDER_NAME).getCertificate(certificateHolder);

            certificate.checkValidity();

            logger.info("Cert " + i + " : " + certificate);

            foundCertificates.add(certificate);
        }

        ASN1Set crLs = signedData.getCRLs();
        logger.info("CRLs : " + crLs);

        ASN1Set signerInfosAsn1 = signedData.getSignerInfos();
        logger.info("SIGNER INFO ASN1 : " + signerInfosAsn1.toString());
        assertEquals(1, signerInfosAsn1.size());

        ASN1Sequence seqSignedInfo = ASN1Sequence.getInstance(signerInfosAsn1.getObjectAt(0));

        SignerInfo signedInfo = SignerInfo.getInstance(seqSignedInfo);
        logger.info("SIGNER INFO : " + signedInfo.toString());

        SignerIdentifier sid = signedInfo.getSID();
        logger.info("SIGNER IDENTIFIER : " + sid.getId());

        IssuerAndSerialNumber issuerAndSerialNumber = IssuerAndSerialNumber.getInstance(signedInfo.getSID());
        logger.info("ISSUER AND SN : " + issuerAndSerialNumber.toString());

        BigInteger serial = issuerAndSerialNumber.getSerialNumber().getValue();

        X509Certificate signerCertificate = null;
        for (X509Certificate x509Certificate : foundCertificates) {
            // TODO check issuer name
            if (serial.equals(x509Certificate.getSerialNumber())) {
                signerCertificate = x509Certificate;
            }
        }
        assertNotNull(signerCertificate);

        ASN1OctetString encryptedDigest = signedInfo.getEncryptedDigest();
        logger.info("ENCRYPT DIGEST : " + encryptedDigest.toString());

        ASN1Sequence seq = ASN1Sequence.getInstance(object);

        ASN1Integer version = ASN1Integer.getInstance(seq.getObjectAt(0));
        logger.info("VERSION : " + version.toString());

        ASN1Set digestManualSet = ASN1Set.getInstance(seq.getObjectAt(1));
        logger.info("DIGEST SET : " + digestManualSet.toString());
        assertEquals(digestAlgorithms, digestManualSet);

        ASN1Sequence seqDigest = ASN1Sequence.getInstance(digestManualSet.getObjectAt(0));
        // assertEquals(1, seqDigest.size());

        ASN1ObjectIdentifier oidDigestAlgo = ASN1ObjectIdentifier.getInstance(seqDigest.getObjectAt(0));
        assertEquals(new ASN1ObjectIdentifier(DigestAlgorithm.SHA256.getOid()), oidDigestAlgo);

        ASN1Sequence seqEncapsulatedInfo = ASN1Sequence.getInstance(seq.getObjectAt(2));
        logger.info("ENCAPSULATED INFO : " + seqEncapsulatedInfo.toString());

        ASN1ObjectIdentifier oidContentType = ASN1ObjectIdentifier
                .getInstance(seqEncapsulatedInfo.getObjectAt(0));
        logger.info("OID CONTENT TYPE : " + oidContentType.toString());

        ASN1TaggedObject taggedContent = DERTaggedObject.getInstance(seqEncapsulatedInfo.getObjectAt(1));

        ASN1OctetString contentOctetString = ASN1OctetString.getInstance(taggedContent.getObject());
        String content = new String(contentOctetString.getOctets());
        assertEquals(HELLO_WORLD, content);
        logger.info("CONTENT : " + content);

        byte[] digest = DSSUtils.digest(DigestAlgorithm.SHA256, HELLO_WORLD.getBytes());
        String encodeHexDigest = Hex.toHexString(digest);
        logger.info("CONTENT DIGEST COMPUTED : " + encodeHexDigest);

        ASN1Set authenticatedAttributes = signedInfo.getAuthenticatedAttributes();
        logger.info("AUTHENTICATED ATTRIBUTES : " + authenticatedAttributes.toString());

        // ASN1Sequence seqAuthAttrib = ASN1Sequence.getInstance(authenticatedAttributes.getObjectAt(0));

        logger.info("Nb Auth Attributes : " + authenticatedAttributes.size());

        String embeddedDigest = StringUtils.EMPTY;
        for (int i = 0; i < authenticatedAttributes.size(); i++) {
            ASN1Sequence authAttrSeq = ASN1Sequence.getInstance(authenticatedAttributes.getObjectAt(i));
            logger.info(authAttrSeq.toString());
            ASN1ObjectIdentifier attrOid = ASN1ObjectIdentifier.getInstance(authAttrSeq.getObjectAt(0));
            if (PKCSObjectIdentifiers.pkcs_9_at_messageDigest.equals(attrOid)) {
                ASN1Set setMessageDigest = ASN1Set.getInstance(authAttrSeq.getObjectAt(1));
                ASN1OctetString asn1ObjString = ASN1OctetString.getInstance(setMessageDigest.getObjectAt(0));
                embeddedDigest = Hex.toHexString(asn1ObjString.getOctets());
            }
        }
        assertEquals(encodeHexDigest, embeddedDigest);

        ASN1OctetString encryptedInfoOctedString = signedInfo.getEncryptedDigest();
        String signatureValue = Hex.toHexString(encryptedInfoOctedString.getOctets());

        logger.info("SIGNATURE VALUE : " + signatureValue);

        Cipher cipher = Cipher.getInstance("RSA");
        cipher.init(Cipher.DECRYPT_MODE, signerCertificate);
        byte[] decrypted = cipher.doFinal(encryptedInfoOctedString.getOctets());

        ASN1InputStream inputDecrypted = new ASN1InputStream(decrypted);

        ASN1Sequence seqDecrypt = (ASN1Sequence) inputDecrypted.readObject();
        logger.info("Decrypted : " + seqDecrypt);

        DigestInfo digestInfo = new DigestInfo(seqDecrypt);
        assertEquals(oidDigestAlgo, digestInfo.getAlgorithmId().getAlgorithm());

        String decryptedDigestEncodeBase64 = Base64.encodeBase64String(digestInfo.getDigest());
        logger.info("Decrypted Base64 : " + decryptedDigestEncodeBase64);

        byte[] encoded = signedInfo.getAuthenticatedAttributes().getEncoded();
        MessageDigest messageDigest = MessageDigest.getInstance(DigestAlgorithm.SHA256.getName());
        byte[] digestOfAuthenticatedAttributes = messageDigest.digest(encoded);

        String computedDigestEncodeBase64 = Base64.encodeBase64String(digestOfAuthenticatedAttributes);
        logger.info("Computed Base64 : " + computedDigestEncodeBase64);

        assertEquals(decryptedDigestEncodeBase64, computedDigestEncodeBase64);

        IOUtils.closeQuietly(asn1sInput);
        IOUtils.closeQuietly(inputDecrypted);
    } catch (Exception e) {
        logger.error(e.getMessage(), e);
        fail(e.getMessage());
    }
}

From source file:eu.europa.esig.dss.pades.InfiniteLoopDSS621Test.java

License:Open Source License

private List<X509Certificate> extractCertificates(SignedData signedData) throws Exception {
    ASN1Set certificates = signedData.getCertificates();
    logger.info("CERTIFICATES (" + certificates.size() + ") : " + certificates);

    List<X509Certificate> foundCertificates = new ArrayList<X509Certificate>();
    for (int i = 0; i < certificates.size(); i++) {
        ASN1Sequence seqCertif = ASN1Sequence.getInstance(certificates.getObjectAt(i));

        X509CertificateHolder certificateHolder = new X509CertificateHolder(seqCertif.getEncoded());
        X509Certificate certificate = new JcaX509CertificateConverter()
                .setProvider(BouncyCastleProvider.PROVIDER_NAME).getCertificate(certificateHolder);

        foundCertificates.add(certificate);
    }/*from   w w  w . j  a  v  a  2 s  .  c o m*/
    return foundCertificates;
}

From source file:eu.europa.esig.dss.test.gen.CertificateService.java

License:Open Source License

/**
 * Generate a CertificateToken suitable for a TSA
 *
 * @param algorithm/*  w  ww  . j  a  v a  2 s  .  co  m*/
 * @param keyPair
 * @param issuer
 * @param subject
 * @param notBefore
 * @param notAfter
 * @return
 * @throws CertIOException
 * @throws OperatorCreationException
 * @throws CertificateException
 * @throws IOException
 */
public CertificateToken generateTspCertificate(final SignatureAlgorithm algorithm, KeyPair keyPair,
        X500Name issuer, X500Name subject, final Date notBefore, final Date notAfter)
        throws CertIOException, OperatorCreationException, CertificateException, IOException {
    final SubjectPublicKeyInfo keyInfo = SubjectPublicKeyInfo.getInstance(keyPair.getPublic().getEncoded());

    final X509v3CertificateBuilder certBuilder = new X509v3CertificateBuilder(issuer,
            new BigInteger("" + new Random().nextInt(10) + System.currentTimeMillis()), notBefore, notAfter,
            subject, keyInfo);

    certBuilder.addExtension(Extension.extendedKeyUsage, true,
            new ExtendedKeyUsage(KeyPurposeId.id_kp_timeStamping));

    final ContentSigner signer = new JcaContentSignerBuilder(algorithm.getJCEId())
            .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(keyPair.getPrivate());
    final X509CertificateHolder holder = certBuilder.build(signer);

    final X509Certificate cert = (X509Certificate) CertificateFactory.getInstance("X509")
            .generateCertificate(new ByteArrayInputStream(holder.getEncoded()));

    return new CertificateToken(cert);
}

From source file:eu.europa.esig.dss.test.gen.CertificateService.java

License:Open Source License

public CertificateToken generateRootCertificateWithCrl(SignatureAlgorithm algorithm, X500Name subject,
        X500Name issuer, PrivateKey issuerPrivateKey, PublicKey publicKey, Date notBefore, Date notAfter)
        throws Exception {

    // generate certificate
    final SubjectPublicKeyInfo keyInfo = SubjectPublicKeyInfo.getInstance(publicKey.getEncoded());

    final X509v3CertificateBuilder certBuilder = new X509v3CertificateBuilder(issuer,
            new BigInteger("" + new Random().nextInt(10) + System.currentTimeMillis()), notBefore, notAfter,
            subject, keyInfo);/*from w w  w . jav a  2  s. com*/

    certBuilder.addExtension(Extension.keyUsage, true, new KeyUsage(KeyUsage.keyCertSign | KeyUsage.cRLSign));

    // Sign the new certificate with the private key of the trusted third
    final ContentSigner signer = new JcaContentSignerBuilder(algorithm.getJCEId())
            .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(issuerPrivateKey);
    final X509CertificateHolder holder = certBuilder.build(signer);

    final X509Certificate cert = (X509Certificate) CertificateFactory.getInstance("X509")
            .generateCertificate(new ByteArrayInputStream(holder.getEncoded()));

    return new CertificateToken(cert);
}

From source file:eu.europa.esig.dss.test.gen.CertificateService.java

License:Open Source License

public CertificateToken generateRootCertificateWithoutCrl(SignatureAlgorithm algorithm, X500Name subject,
        X500Name issuer, PrivateKey issuerPrivateKey, PublicKey publicKey, Date notBefore, Date notAfter)
        throws Exception {

    // generate certificate
    final SubjectPublicKeyInfo keyInfo = SubjectPublicKeyInfo.getInstance(publicKey.getEncoded());

    final X509v3CertificateBuilder certBuilder = new X509v3CertificateBuilder(issuer,
            new BigInteger("" + new Random().nextInt(10) + System.currentTimeMillis()), notBefore, notAfter,
            subject, keyInfo);/*from  w ww.  j a  va 2  s .c o  m*/

    certBuilder.addExtension(Extension.keyUsage, true, new KeyUsage(KeyUsage.keyCertSign));

    // Sign the new certificate with the private key of the trusted third
    final ContentSigner signer = new JcaContentSignerBuilder(algorithm.getJCEId())
            .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(issuerPrivateKey);
    final X509CertificateHolder holder = certBuilder.build(signer);

    final X509Certificate cert = (X509Certificate) CertificateFactory.getInstance("X509")
            .generateCertificate(new ByteArrayInputStream(holder.getEncoded()));

    return new CertificateToken(cert);
}

From source file:eu.europa.esig.dss.test.gen.CRLGenerator.java

License:Open Source License

public X509CRL generateCRL(X509Certificate certToRevoke, MockPrivateKeyEntry issuerEntry, Date dateOfRevoke,
        int reason) throws Exception {

    Date now = new Date();
    X500Name x500nameIssuer = new JcaX509CertificateHolder(issuerEntry.getCertificate().getCertificate())
            .getSubject();/* ww w .j a  v a  2s.  c o  m*/
    X509v2CRLBuilder crlGen = new X509v2CRLBuilder(x500nameIssuer, now);

    crlGen.setNextUpdate(new Date(now.getTime() + (60 * 60 * 1000)));

    crlGen.addCRLEntry(certToRevoke.getSerialNumber(), dateOfRevoke, reason);

    JcaX509ExtensionUtils extUtils = new JcaX509ExtensionUtils();

    crlGen.addExtension(Extension.authorityKeyIdentifier, false,
            extUtils.createAuthorityKeyIdentifier(issuerEntry.getCertificate().getPublicKey()));

    X509CRLHolder crlHolder = crlGen
            .build(new JcaContentSignerBuilder(issuerEntry.getCertificate().getCertificate().getSigAlgName())
                    .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(issuerEntry.getPrivateKey()));

    JcaX509CRLConverter converter = new JcaX509CRLConverter();
    return converter.getCRL(crlHolder);
}

From source file:eu.europa.esig.dss.x509.ocsp.OCSPToken.java

License:Open Source License

@Override
public boolean isSignedBy(final CertificateToken issuerToken) {
    if (this.issuerToken != null) {
        return this.issuerToken.equals(issuerToken);
    }//  w w  w  .  j a  v a2  s.  co  m
    try {
        signatureInvalidityReason = "";
        JcaContentVerifierProviderBuilder jcaContentVerifierProviderBuilder = new JcaContentVerifierProviderBuilder();
        jcaContentVerifierProviderBuilder.setProvider(BouncyCastleProvider.PROVIDER_NAME);
        final PublicKey publicKey = issuerToken.getCertificate().getPublicKey();
        ContentVerifierProvider contentVerifierProvider = jcaContentVerifierProviderBuilder.build(publicKey);
        signatureValid = basicOCSPResp.isSignatureValid(contentVerifierProvider);
        if (signatureValid) {
            this.issuerToken = issuerToken;
        }
        issuerX500Principal = issuerToken.getSubjectX500Principal();
    } catch (Exception e) {
        signatureInvalidityReason = e.getClass().getSimpleName() + " - " + e.getMessage();
        signatureValid = false;
    }
    return signatureValid;
}

From source file:eu.europa.esig.dss.x509.OCSPToken.java

License:Open Source License

@Override
public boolean isSignedBy(final CertificateToken issuerToken) {
    if (this.issuerToken != null) {
        return this.issuerToken.equals(issuerToken);
    }/*from w  w w. ja va 2s . c  om*/

    try {

        signatureInvalidityReason = "";
        JcaContentVerifierProviderBuilder jcaContentVerifierProviderBuilder = new JcaContentVerifierProviderBuilder();
        jcaContentVerifierProviderBuilder.setProvider(BouncyCastleProvider.PROVIDER_NAME);
        final PublicKey publicKey = issuerToken.getCertificate().getPublicKey();
        ContentVerifierProvider contentVerifierProvider = jcaContentVerifierProviderBuilder.build(publicKey);
        signatureValid = basicOCSPResp.isSignatureValid(contentVerifierProvider);
        if (signatureValid) {
            this.issuerToken = issuerToken;
        }
        issuerX500Principal = issuerToken.getSubjectX500Principal();
    } catch (Exception e) {
        signatureInvalidityReason = e.getClass().getSimpleName() + " - " + e.getMessage();
        signatureValid = false;
    }
    return signatureValid;
}

From source file:eu.peppol.security.x509.CertificateTest.java

License:EUPL

/**
 * Creates a X509 V3 certificate using Bouncy Castle
 *
 * @throws NoSuchAlgorithmException//from   ww w  .  j a  v  a  2s.  c om
 * @throws OperatorCreationException
 * @throws CertificateException
 * @throws NoSuchProviderException
 */
@Test(enabled = false)
public void createSampleCertificate() throws NoSuchAlgorithmException, OperatorCreationException,
        CertificateException, NoSuchProviderException {
    KeyPair keyPair = generateKeyPair();

    ContentSigner sigGen = new JcaContentSignerBuilder("SHA256WithRSAEncryption")
            .setProvider(BouncyCastleProvider.PROVIDER_NAME).build(keyPair.getPrivate());

    Date startDate = new Date(System.currentTimeMillis() - 24 * 60 * 60 * 1000);
    Date endDate = new Date(System.currentTimeMillis() + 365 * 24 * 60 * 60 * 1000);

    SubjectPublicKeyInfo subjectPublicKeyInfo = SubjectPublicKeyInfo
            .getInstance(keyPair.getPublic().getEncoded());

    X509v3CertificateBuilder x509v3CertificateBuilder = new X509v3CertificateBuilder(
            new X500Name("CN=AP_UNIT_TEST"), BigInteger.ONE, startDate, endDate,
            new X500Name("CN=AP_UNIT_TEST"), subjectPublicKeyInfo);
    X509CertificateHolder x509CertificateHolder = x509v3CertificateBuilder.build(sigGen);
    X509Certificate cert = new JcaX509CertificateConverter().setProvider(BouncyCastleProvider.PROVIDER_NAME)
            .getCertificate(x509CertificateHolder);

}

Example usage for org.bouncycastle.jce.provider BouncyCastleProvider PROVIDER_NAME

Introduction

Prototype

Usage