Examples of org.bouncycastle.cms.CMSSignedData

org.bouncycastle.cms.CMSSignedData

general class for handling a pkcs7-signature message. A simple example of usage - note, in the example below the validity of the certificate isn't verified, just the fact that one of the certs matches the given signer...

 CertStore               certs = s.getCertificatesAndCRLs("Collection", "BC"); SignerInformationStore  signers = s.getSignerInfos(); Collection              c = signers.getSigners(); Iterator                it = c.iterator(); while (it.hasNext()) { SignerInformation   signer = (SignerInformation)it.next(); Collection          certCollection = certs.getCertificates(signer.getSID()); Iterator        certIt = certCollection.iterator(); X509Certificate cert = (X509Certificate)certIt.next(); if (signer.verify(cert.getPublicKey())) { verified++; }    }

             */
            private boolean checkScepResponse(byte[] retMsg, String senderNonce, String transId, boolean crlRep, String digestOid, boolean noca, ResponseStatus expectedResponseStatus, String userDN, boolean[] keyUsage) throws CMSException, NoSuchProviderException, NoSuchAlgorithmException, CertStoreException, InvalidKeyException, CertificateException, SignatureException, CRLException, IOException {
              //
              // Parse response message
              //
              CMSSignedData s = new CMSSignedData(retMsg);
              // The signer, i.e. the CA, check it's the right CA
              SignerInformationStore signers = s.getSignerInfos();
              Collection<?> col = signers.getSigners();
              if ( col.size() <= 0 ) {
                StressTest.this.performanceTest.getLog().error("Signers can not be 0");
                return false;
              }
              Iterator<?> iter = col.iterator();
              SignerInformation signerInfo = (SignerInformation)iter.next();
              // Check that the message is signed with the correct digest alg
              if ( !StringUtils.equals(digestOid, signerInfo.getDigestAlgOID()) ) {
                StressTest.this.performanceTest.getLog().error("Digest algorithms do not match: "+digestOid+", "+signerInfo.getDigestAlgOID());
                return false;
              }
              SignerId sinfo = signerInfo.getSID();
              // Check that the signer is the expected CA
              String raCertIssuer = CertTools.stringToBCDNString(this.sessionData.certchain[0].getIssuerDN().getName());
              String sinfoIssuer = CertTools.stringToBCDNString(sinfo.getIssuerAsString());
              if ( !StringUtils.equals(raCertIssuer, sinfoIssuer) ) {
                StressTest.this.performanceTest.getLog().error("Issuers does not match: "+raCertIssuer+", "+sinfoIssuer);
                return false;
              }


              // Verify the signature
              boolean ret = signerInfo.verify(this.sessionData.certchain[0].getPublicKey(), "BC");
              if ( !ret ) {
                StressTest.this.performanceTest.getLog().error("Can not verify signerInfo");
                return false;
              }
              // Get authenticated attributes
              AttributeTable tab = signerInfo.getSignedAttributes();        
              // --Fail info
              Attribute attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_failInfo));
              // No failInfo on this success message
              if(expectedResponseStatus == ResponseStatus.SUCCESS){
                if ( attr != null ) {
                  StressTest.this.performanceTest.getLog().error("Success message should have attr == null");
                  return false;
                }
              }  


              // --Message type
              attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_messageType));
              if ( attr == null ) {
                StressTest.this.performanceTest.getLog().error("MessageType should not be null for responseStatus: "+expectedResponseStatus);
                return false;
              }
              ASN1Set values = attr.getAttrValues();
              if ( values.size() != 1 ) {
                StressTest.this.performanceTest.getLog().error("MessageType.AttrValues should be 1: "+values.size());
                return false;
              }
              DERString str = DERPrintableString.getInstance((values.getObjectAt(0)));
              String messageType = str.getString();
              if ( !StringUtils.equals(messageType, "3") ) {
                StressTest.this.performanceTest.getLog().error("MessageType should be 3: "+messageType);
                return false;
              }
              // --Success status
              attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_pkiStatus));
              if ( attr == null ) {
                StressTest.this.performanceTest.getLog().error("PKIStatus should not be null");
                return false;
              }
              values = attr.getAttrValues();
              if ( values.size() != 1 ) {
                StressTest.this.performanceTest.getLog().error("PKIStatus.AttrValues should be 1: "+values.size());
                return false;
              }
              str = DERPrintableString.getInstance((values.getObjectAt(0)));
              String responsestatus =  str.getString();
              if ( !StringUtils.equals(expectedResponseStatus.getValue(), responsestatus) ) {
                StressTest.this.performanceTest.getLog().error("ResponseStatus should be "+expectedResponseStatus.getValue()+" but was: "+responsestatus);
                return false;
              }
              // --SenderNonce
              attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_senderNonce));
              if ( attr == null ) {
                StressTest.this.performanceTest.getLog().error("SenderNonce should not be null");
                return false;
              }
              values = attr.getAttrValues();
              if ( values.size() != 1 ) {
                StressTest.this.performanceTest.getLog().error("SenderNonce.AttrValues should be 1: "+values.size());
                return false;
              }
              ASN1OctetString octstr = ASN1OctetString.getInstance(values.getObjectAt(0));
              // SenderNonce is something the server came up with, but it should be 16 chars
              if ( octstr.getOctets().length != 16 ) {
                StressTest.this.performanceTest.getLog().error("SenderNonce should be 16 bytes: "+octstr.getOctets().length);
                return false;
              }
              // --Recipient Nonce
              attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_recipientNonce));
              if ( attr == null ) {
                StressTest.this.performanceTest.getLog().error("RecipientNonce should not be null");
                return false;
              }
              values = attr.getAttrValues();
              if ( values.size() != 1 ) {
                StressTest.this.performanceTest.getLog().error("RecipientNonce.AttrValues should be 1: "+values.size());
                return false;
              }
              octstr = ASN1OctetString.getInstance(values.getObjectAt(0));
              // recipient nonce should be the same as we sent away as sender nonce
              String nonce = new String(Base64.encode(octstr.getOctets()));
              if ( !StringUtils.equals(senderNonce, nonce) ) {
                StressTest.this.performanceTest.getLog().error("RecipientNonce should be "+senderNonce+" but was: "+nonce);
                return false;
              }
              // --Transaction ID
              attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_transId));
              if ( attr == null ) {
                StressTest.this.performanceTest.getLog().error("TransId should not be null");
                return false;
              }
              values = attr.getAttrValues();
              if ( values.size() != 1 ) {
                StressTest.this.performanceTest.getLog().error("TransId.AttrValues should be 1: "+values.size());
                return false;
              }
              str = DERPrintableString.getInstance((values.getObjectAt(0)));
              // transid should be the same as the one we sent
              if ( !StringUtils.equals(transId, str.getString()) ) {
                StressTest.this.performanceTest.getLog().error("TransId should be "+transId+" but was: "+str.getString());
                return false;
              }


              //
              // Check different message types
              //        
              if ( responsestatus.equals(ResponseStatus.PENDING.getValue()) || !messageType.equals("3") ) {
                return true;
              }
              // First we extract the encrypted data from the CMS enveloped data contained
              // within the CMS signed data
              final CMSProcessable sp = s.getSignedContent();
              final byte content[] = (byte[])sp.getContent();
              final CMSEnvelopedData ed = new CMSEnvelopedData(content);
              final RecipientInformationStore recipients = ed.getRecipientInfos();
              final RecipientInformation recipient;
              {
                final Collection<?> c = recipients.getRecipients();
                if ( c.size() != 1 ) {
                  StressTest.this.performanceTest.getLog().error("recipients should be 1: "+c.size());
                  return false;
                }
                final Iterator<?> it = c.iterator();
                recipient = (RecipientInformation) it.next();
              }
              final byte decBytes[] = recipient.getContent(StressTest.this.keyPair.getPrivate(), "BC");
              // This is yet another CMS signed data
              final CMSSignedData sd = new CMSSignedData(decBytes);
              // Get certificates from the signed data
              final CertStore certstore = sd.getCertificatesAndCRLs("Collection","BC");
              if (crlRep) {
                // We got a reply with a requested CRL
                final Collection<?> crls = certstore.getCRLs(null);
                if ( crls.size() != 1 ) {
                  StressTest.this.performanceTest.getLog().error("CRLS should be 1: "+crls.size());

View Full Code Here


            private boolean isScepResponseMessageOfType(byte[] retMsg, ResponseStatus extectedResponseStatus) throws CMSException {
                //
                // Parse response message
                //
                CMSSignedData s = new CMSSignedData(retMsg);
                SignerInformationStore signers = s.getSignerInfos();
                Collection<?> col = signers.getSigners();
                Iterator<?> iter = col.iterator();
                SignerInformation signerInfo = (SignerInformation)iter.next();
                // Get authenticated attributes
                AttributeTable tab = signerInfo.getSignedAttributes();

View Full Code Here

            throws CMSException, NoSuchProviderException, NoSuchAlgorithmException, CertStoreException, InvalidKeyException, CertificateException,
            SignatureException, CRLException {
        //
        // Parse response message
        //
        CMSSignedData s = new CMSSignedData(retMsg);
        // The signer, i.e. the CA, check it's the right CA
        SignerInformationStore signers = s.getSignerInfos();
        Collection<SignerInformation> col = signers.getSigners();
        assertTrue(col.size() > 0);
        Iterator<SignerInformation> iter = col.iterator();
        SignerInformation signerInfo = iter.next();
        // Check that the message is signed with the correct digest alg
        assertEquals(signerInfo.getDigestAlgOID(), digestOid);
        SignerId sinfo = signerInfo.getSID();
        // Check that the signer is the expected CA
        assertEquals(CertTools.stringToBCDNString(cacert.getIssuerDN().getName()), CertTools.stringToBCDNString(sinfo.getIssuerAsString()));
        // Verify the signature
        boolean ret = signerInfo.verify(cacert.getPublicKey(), "BC");
        assertTrue(ret);
        // Get authenticated attributes
        AttributeTable tab = signerInfo.getSignedAttributes();
        // --Fail info
        Attribute attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_failInfo));
        // No failInfo on this success message
        assertNull(attr);
        // --Message type
        attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_messageType));
        assertNotNull(attr);
        ASN1Set values = attr.getAttrValues();
        assertEquals(values.size(), 1);
        DERString str = DERPrintableString.getInstance((values.getObjectAt(0)));
        String messageType = str.getString();
        assertEquals("3", messageType);
        // --Success status
        attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_pkiStatus));
        assertNotNull(attr);
        values = attr.getAttrValues();
        assertEquals(values.size(), 1);
        str = DERPrintableString.getInstance((values.getObjectAt(0)));
        assertEquals(ResponseStatus.SUCCESS.getValue(), str.getString());
        // --SenderNonce
        attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_senderNonce));
        assertNotNull(attr);
        values = attr.getAttrValues();
        assertEquals(values.size(), 1);
        ASN1OctetString octstr = ASN1OctetString.getInstance(values.getObjectAt(0));
        // SenderNonce is something the server came up with, but it should be 16
        // chars
        assertTrue(octstr.getOctets().length == 16);
        // --Recipient Nonce
        attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_recipientNonce));
        assertNotNull(attr);
        values = attr.getAttrValues();
        assertEquals(values.size(), 1);
        octstr = ASN1OctetString.getInstance(values.getObjectAt(0));
        // recipient nonce should be the same as we sent away as sender nonce
        assertEquals(_senderNonce, new String(Base64.encode(octstr.getOctets())));
        // --Transaction ID
        attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_transId));
        assertNotNull(attr);
        values = attr.getAttrValues();
        assertEquals(values.size(), 1);
        str = DERPrintableString.getInstance((values.getObjectAt(0)));
        // transid should be the same as the one we sent
        assertEquals(_transId, str.getString());


        //
        // Check different message types
        //
        if (messageType.equals("3")) {
            // First we extract the encrypted data from the CMS enveloped data
            // contained
            // within the CMS signed data
            final CMSProcessable sp = s.getSignedContent();
            final byte[] content = (byte[]) sp.getContent();
            final CMSEnvelopedData ed = new CMSEnvelopedData(content);
            final RecipientInformationStore recipients = ed.getRecipientInfos();
            CertStore certstore;
            {
                Collection<RecipientInformation> c = recipients.getRecipients();
                assertEquals(c.size(), 1);
                Iterator<RecipientInformation> it = c.iterator();
                byte[] decBytes = null;
                RecipientInformation recipient = it.next();
                decBytes = recipient.getContent(key1.getPrivate(), "BC");
                // This is yet another CMS signed data
                CMSSignedData sd = new CMSSignedData(decBytes);
                // Get certificates from the signed data
                certstore = sd.getCertificatesAndCRLs("Collection", "BC");
            }
            if (crlRep) {
                // We got a reply with a requested CRL
                final Collection<X509CRL> crls = (Collection<X509CRL>) certstore.getCRLs(null);
                assertEquals(crls.size(), 1);

View Full Code Here

        in.close();
        byte[] respBytes = baos.toByteArray();
        assertNotNull("Response can not be null.", respBytes);
        assertTrue(respBytes.length > 0);
        
        CMSSignedData s = new CMSSignedData(respBytes);
        assertNotNull(s);
        SignerInformationStore signers = s.getSignerInfos();
        Collection col = signers.getSigners();
        assertTrue(col.size() == 0);
        CertStore certstore = s.getCertificatesAndCRLs("Collection","BC");
        Collection certs = certstore.getCertificates(null);
        // Length two if the Scep RA server is signed directly by a Root CA
        // Length three if the Scep RA server is signed by a CA which is signed by a Root CA
        assertEquals(3, certs.size());                    
        Iterator it = certs.iterator();

View Full Code Here

    
    private boolean isScepResponseMessageOfType(byte[] retMsg, ResponseStatus extectedResponseStatus) throws CMSException, NoSuchAlgorithmException, NoSuchProviderException {
        //
        // Parse response message
        //
        CMSSignedData s = new CMSSignedData(retMsg);
        // The signer, i.e. the CA, check it's the right CA
        SignerInformationStore signers = s.getSignerInfos();
        Collection col = signers.getSigners();
        assertTrue(col.size() > 0);
        Iterator iter = col.iterator();
        SignerInformation signerInfo = (SignerInformation)iter.next();
        SignerId sinfo = signerInfo.getSID();

View Full Code Here


    private void checkScepResponse(byte[] retMsg, String senderNonce, String transId, boolean crlRep, String digestOid, boolean noca, ResponseStatus expectedResponseStatus) throws CMSException, NoSuchProviderException, NoSuchAlgorithmException, CertStoreException, InvalidKeyException, CertificateException, SignatureException, CRLException, IOException {
        //
        // Parse response message
        //
        CMSSignedData s = new CMSSignedData(retMsg);
        // The signer, i.e. the CA, check it's the right CA
        SignerInformationStore signers = s.getSignerInfos();
        Collection col = signers.getSigners();
        assertTrue(col.size() > 0);
        Iterator iter = col.iterator();
        SignerInformation signerInfo = (SignerInformation)iter.next();
        // Check that the message is signed with the correct digest alg
        assertEquals(signerInfo.getDigestAlgOID(), digestOid);
        SignerId sinfo = signerInfo.getSID();
        // Check that the signer is the expected CA
        assertEquals(CertTools.stringToBCDNString(racert.getIssuerDN().getName()), CertTools.stringToBCDNString(sinfo.getIssuerAsString()));
        // Verify the signature
        boolean ret = signerInfo.verify(racert.getPublicKey(), "BC");
        assertTrue(ret);
        // Get authenticated attributes
        AttributeTable tab = signerInfo.getSignedAttributes();        
        // --Fail info
        Attribute attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_failInfo));
        // No failInfo on this success message
        if(expectedResponseStatus == ResponseStatus.SUCCESS){
          assertNull(attr);
        }  
          
        // --Message type
        attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_messageType));
        assertNotNull(attr);
        ASN1Set values = attr.getAttrValues();
        assertEquals(values.size(), 1);
        DERString str = DERPrintableString.getInstance((values.getObjectAt(0)));
        String messageType = str.getString();
        assertEquals("3", messageType);
        // --Success status
        attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_pkiStatus));
        assertNotNull(attr);
        values = attr.getAttrValues();
        assertEquals(values.size(), 1);
        str = DERPrintableString.getInstance((values.getObjectAt(0)));
        String responsestatus =  str.getString();
        assertEquals(expectedResponseStatus.getValue(), responsestatus);
        // --SenderNonce
        attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_senderNonce));
        assertNotNull(attr);
        values = attr.getAttrValues();
        assertEquals(values.size(), 1);
        ASN1OctetString octstr = ASN1OctetString.getInstance(values.getObjectAt(0));
        // SenderNonce is something the server came up with, but it should be 16 chars
        assertTrue(octstr.getOctets().length == 16);
        // --Recipient Nonce
        attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_recipientNonce));
        assertNotNull(attr);
        values = attr.getAttrValues();
        assertEquals(values.size(), 1);
        octstr = ASN1OctetString.getInstance(values.getObjectAt(0));
        // recipient nonce should be the same as we sent away as sender nonce
        assertEquals(senderNonce, new String(Base64.encode(octstr.getOctets())));
        // --Transaction ID
        attr = tab.get(new DERObjectIdentifier(ScepRequestMessage.id_transId));
        assertNotNull(attr);
        values = attr.getAttrValues();
        assertEquals(values.size(), 1);
        str = DERPrintableString.getInstance((values.getObjectAt(0)));
        // transid should be the same as the one we sent
        assertEquals(transId, str.getString());
        
        //
        // Check different message types
        //        
        if (!responsestatus.equals(ResponseStatus.PENDING.getValue()) && messageType.equals("3")) {
            // First we extract the encrypted data from the CMS enveloped data contained
            // within the CMS signed data
            CMSProcessable sp = s.getSignedContent();
            byte[] content = (byte[])sp.getContent();
            CMSEnvelopedData ed = new CMSEnvelopedData(content);
            RecipientInformationStore recipients = ed.getRecipientInfos();
            Collection c = recipients.getRecipients();
            assertEquals(c.size(), 1);
            Iterator it = c.iterator();
            byte[] decBytes = null;
            RecipientInformation recipient = (RecipientInformation) it.next();
            decBytes = recipient.getContent(keys.getPrivate(), "BC");
            // This is yet another CMS signed data
            CMSSignedData sd = new CMSSignedData(decBytes);
            // Get certificates from the signed data
            CertStore certstore = sd.getCertificatesAndCRLs("Collection","BC");
            if (crlRep) {
                // We got a reply with a requested CRL
                Collection crls = certstore.getCRLs(null);
                assertEquals(crls.size(), 1);
                it = crls.iterator();

View Full Code Here

        CertStore certs = CertStore.getInstance("Collection", new CollectionCertStoreParameters(certList), "BC");
        gen1.addCertificatesAndCRLs(certs);
        gen1.addSigner(keys.getPrivate(), cert, digestOid,
                new AttributeTable(attributes), null);
        // The signed data to be enveloped
        CMSSignedData s = gen1.generate(signThis, true, "BC");
        return s;
    }

View Full Code Here

        log.debug("Enveloped data is " + ed.getEncoded().length + " bytes long");
        CMSProcessable msg = new CMSProcessableByteArray(ed.getEncoded());
        //
        // Create the outer signed data
        //
        CMSSignedData s = sign(msg, messageType);
        
        byte[] ret = s.getEncoded();
        return ret;
        
    }

View Full Code Here

              log.debug(msg1);
              throw new SignRequestSignatureException(msg1);
            }
            gen.addSigner(getCAToken().getPrivateKey(SecConst.CAKEYPURPOSE_CERTSIGN), (X509Certificate)getCACertificate(), CMSSignedGenerator.DIGEST_SHA1);
            gen.addCertificatesAndCRLs(certs);
            CMSSignedData s = null;
            CATokenContainer catoken = getCAToken();
            CATokenInfo tokeninfo = getCAInfo().getCATokenInfo();
            if (catoken != null && !(tokeninfo instanceof NullCATokenInfo)) {
              log.debug("createPKCS7: Provider="+catoken.getProvider()+" using algorithm "+getCAToken().getPrivateKey(SecConst.CAKEYPURPOSE_CERTSIGN).getAlgorithm());
              s = gen.generate(msg, true, catoken.getProvider());
            } else {
              String msg1 = "CA Token does not exist!";
              log.debug(msg);
              throw new SignRequestSignatureException(msg1);
            }
            return s.getEncoded();
        } catch (CATokenOfflineException e) {
          throw new RuntimeException(e);          
        } catch (Exception e) {
            throw new RuntimeException(e);
        }

View Full Code Here

        CertStore certs = CertStore.getInstance("Collection", new CollectionCertStoreParameters(certList), "BC");
        gen1.addCertificatesAndCRLs(certs);
        gen1.addSigner(keys.getPrivate(), cert, digestOid,
                new AttributeTable(attributes), null);
        // The signed data to be enveloped
        CMSSignedData s = gen1.generate(signThis, true, "BC");
        return s;
    }

View Full Code Here

0 1 2 3 4 5 6 7 8 9

TOP

Related Classes of org.bouncycastle.cms.CMSSignedData

br.net.woodstock.rockframework.security.cert.impl.BouncyCastlePKCS7CertificateReader

br.net.woodstock.rockframework.security.cert.impl.BouncyCastlePKCS7CertificateWriter

br.net.woodstock.rockframework.security.sign.impl.BouncyCastlePKCS7Signer

br.net.woodstock.rockframework.security.timestamp.impl.BouncyCastleTimeStampHelper

ca.uhn.hl7v2.hoh.sign.BouncyCastleCmsMessageSigner

com.android.builder.signing.SignedJarBuilder

com.android.sdklib.internal.build.SignedJarBuilder

com.android.signapk.SignApk

io.nodyn.crypto.Verify

org.apache.pdfbox.examples.signature.CreateSignature

All source code are property of their respective owners. Java is a trademark of Sun Microsystems, Inc and owned by ORACLE Inc. Contact coftware#gmail.com.