/*
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation. Oracle designates this
* particular file as subject to the "Classpath" exception as provided
* by Oracle in the LICENSE file that accompanied this code.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* A SignerInfo, as defined in PKCS#7's signedData type.
*
* @author Benjamin Renaud
*/
byte[] encryptedDigest;
byte[] encryptedDigest) {
this.issuerName = issuerName;
this.certificateSerialNumber = serial;
this.digestAlgorithmId = digestAlgorithmId;
this.encryptedDigest = encryptedDigest;
}
byte[] encryptedDigest,
this.issuerName = issuerName;
this.certificateSerialNumber = serial;
this.digestAlgorithmId = digestAlgorithmId;
this.encryptedDigest = encryptedDigest;
}
/**
* Parses a PKCS#7 signer info.
*/
throws IOException, ParsingException
{
this(derin, false);
}
/**
* Parses a PKCS#7 signer info.
*
* <p>This constructor is used only for backwards compatibility with
* PKCS#7 blocks that were generated using JDK1.1.x.
*
* @param derin the ASN.1 encoding of the signer info.
* @param oldStyle flag indicating whether or not the given signer info
* is encoded according to JDK1.1.x.
*/
throws IOException, ParsingException
{
// version
// issuerAndSerialNumber
issuerBytes));
// digestAlgorithmId
// authenticatedAttributes
if (oldStyle) {
// In JDK1.1.x, the authenticatedAttributes are always present,
// encoded as an empty Set (Set of length zero)
} else {
// check if set of auth attributes (implicit tag) is provided
// (auth attributes are OPTIONAL)
}
}
// digestEncryptionAlgorithmId - little RSA naming scheme -
// signature == encryption...
// encryptedDigest
// unauthenticatedAttributes
if (oldStyle) {
// In JDK1.1.x, the unauthenticatedAttributes are always present,
// encoded as an empty Set (Set of length zero)
} else {
// check if set of unauth attributes (implicit tag) is provided
// (unauth attributes are OPTIONAL)
}
}
// all done
throw new ParsingException("extra data at the end");
}
}
}
/**
* DER encode this object onto an output stream.
* Implements the <code>DerEncoder</code> interface.
*
* @param out
* the output stream on which to write the DER encoding.
*
* @exception IOException on encoding error.
*/
// encode authenticated attributes if there are any
if (authenticatedAttributes != null)
// encode unauthenticated attributes if there are any
if (unauthenticatedAttributes != null)
}
/*
* Returns the (user) certificate pertaining to this SignerInfo.
*/
throws IOException
{
}
/*
* Returns the certificate chain pertaining to this SignerInfo.
*/
throws IOException
{
return null;
return certList;
}
int start = 0;
while (true) {
boolean match = false;
int i = start;
// next cert in chain found
// if selected cert is self-signed, we're done
// constructing the chain
pkcsCerts[i].getIssuerDN())) {
} else {
start++;
}
match = true;
break;
} else {
i++;
}
}
if (!match)
break;
}
return certList;
}
// Copied from com.sun.crypto.provider.OAEPParameters.
return "SHA-1";
return "SHA-224";
return "SHA-256";
return "SHA-384";
return "SHA-512";
} else {
return internalName;
}
}
/* Returns null if verify fails, this signerInfo if
verify succeeds. */
throws NoSuchAlgorithmException, SignatureException {
try {
}
byte[] dataSigned;
// if there are authenticate attributes, get the message
// digest and compare it with the digest of data
if (authenticatedAttributes == null) {
dataSigned = data;
} else {
// first, check content type
if (contentType == null ||
return null; // contentType does not match, bad SignerInfo
// now, check message digest
byte[] messageDigest = (byte[])
return null;
return null;
if (messageDigest[i] != computedMessageDigest[i])
return null;
}
// message digest attribute matched
// digest of original data
// the data actually signed is the DER encoding of
// the authenticated attributes (tagged with
// the "SET OF" tag, not 0xA0).
}
// put together digest algorithm and encryption algorithm
// to form signing algorithm
// Workaround: sometimes the encryptionAlgname is actually
// a signature name
return null;
}
if (cert.hasUnsupportedCriticalExtension()) {
throw new SignatureException("Certificate has unsupported "
+ "critical extension(s)");
}
// Make sure that if the usage of the key in the certificate is
// restricted, it can be used for digital signatures.
// XXX We may want to check for additional extensions in the
// future.
if (keyUsageBits != null) {
try {
// We don't care whether or not this extension was marked
// critical in the certificate.
// We're interested only in its value (i.e., the bits set)
// and treat the extension as critical.
} catch (IOException ioe) {
throw new SignatureException("Failed to parse keyUsage "
+ "extension");
}
if (!digSigAllowed && !nonRepuAllowed) {
throw new SignatureException("Key usage restricted: "
+ "cannot be used for "
+ "digital signatures");
}
}
return this;
}
} catch (IOException e) {
throw new SignatureException("IO error verifying signature:\n" +
e.getMessage());
} catch (InvalidKeyException e) {
}
return null;
}
/* Verify the content of the pkcs7 block. */
throws NoSuchAlgorithmException, SignatureException {
}
return version;
}
return issuerName;
}
return certificateSerialNumber;
}
return digestAlgorithmId;
}
return authenticatedAttributes;
}
return digestEncryptionAlgorithmId;
}
public byte[] getEncryptedDigest() {
return encryptedDigest;
}
return unauthenticatedAttributes;
}
out += "\tcertificateSerialNumber: " +
if (authenticatedAttributes != null) {
"\n";
}
"\n";
if (unauthenticatedAttributes != null) {
out += "\tunauthenticatedAttributes: " +
unauthenticatedAttributes + "\n";
}
return out;
}
}