// Check that we can parse a request from Novosec (patched by EJBCA).
// Read an initialization request with a signature POP and signature protection to see that we can process it
{
ASN1InputStream in = new ASN1InputStream(novosecsigpopir);
DERObject derObject = in.readObject();
PKIMessage req = PKIMessage.getInstance(derObject);
//log.info(req.toString());
// Verify should be ok if we do not allow RA verify POP here
CrmfRequestMessage msg = new CrmfRequestMessage(req, "CN=AdminCA1", false, "CN");
assertTrue(msg.verify());
// Since we don't have RA POP we can't test for that...
assertEquals("CN=AdminCA1,O=EJBCA Sample,C=SE", msg.getIssuerDN());
assertEquals("CN=abc123rry2942812801980668853,O=PrimeKey Solutions AB,C=SE", msg.getRequestDN());
assertEquals("abc123rry2942812801980668853", msg.getUsername());
assertEquals("foo123", msg.getPassword());
// Verify signature protection
AlgorithmIdentifier algId = msg.getMessage().getProtectedPart().getHeader().getProtectionAlg();
String oid = algId.getObjectId().getId();
assertEquals(PKCSObjectIdentifiers.sha1WithRSAEncryption.getId(), oid);
// Check that this is an old message, created before ECA-2104, using null instead of DERNull as algorithm parameters.
DEREncodable pp = algId.getParameters();
assertNull(pp);
// Try to verify, it should work good even though the small bug in ECA-2104, since we don't use algorithm parameters for RSA-PKCS signatures
PublicKey pubKey = msg.getRequestPublicKey();
assertTrue(CmpMessageHelper.verifyCertBasedPKIProtection(msg.getMessage(), pubKey));
// Verify that our verification routine does not give positive result for any other keys
KeyPair keys = KeyTools.genKeys("512", "RSA");
assertFalse(CmpMessageHelper.verifyCertBasedPKIProtection(msg.getMessage(), keys.getPublic()));
}
// Re-protect the message, now fixed by ECA-2104
{
ASN1InputStream in = new ASN1InputStream(novosecsigpopir);
DERObject derObject = in.readObject();
PKIMessage myPKIMessage = PKIMessage.getInstance(derObject);
KeyPair keys = KeyTools.genKeys("512", "RSA");
X509Certificate signCert = CertTools.genSelfCert("CN=CMP Sign Test", 3650, null, keys.getPrivate(), keys.getPublic(), "SHA1WithRSA", false);
// Re-sign the message
byte[] newmsg = CmpMessageHelper.signPKIMessage(myPKIMessage, signCert, keys.getPrivate(), CMSSignedGenerator.DIGEST_SHA1, "BC");
in = new ASN1InputStream(newmsg);
derObject = in.readObject();
PKIMessage pkimsg = PKIMessage.getInstance(derObject);
// We have to do this twice, because Novosec caches ProtectedBytes in the PKIMessage object, so we need to
// encode it and re-decode it again to get the changes from ECA-2104 encoded correctly.
// Not needed when simply signing a new message that you create, only when re-signing
newmsg = CmpMessageHelper.signPKIMessage(pkimsg, signCert, keys.getPrivate(), CMSSignedGenerator.DIGEST_SHA1, "BC");
in = new ASN1InputStream(newmsg);
derObject = in.readObject();
pkimsg = PKIMessage.getInstance(derObject);
AlgorithmIdentifier algId = pkimsg.getProtectedPart().getHeader().getProtectionAlg();
String oid = algId.getObjectId().getId();
assertEquals(PKCSObjectIdentifiers.sha1WithRSAEncryption.getId(), oid);
// Check that we have DERNull and not plain java null as algorithm parameters.
DEREncodable pp = algId.getParameters();
assertNotNull(pp);