es.gob.afirma.signature.cades

Class CMSBuilder

java.lang.Object

es.gob.afirma.signature.cades.CMSBuilder

public final class CMSBuilder
extends java.lang.Object

Class that manages the generation of CMS elements as defined on RFC 3852.

Project:

Library for the integration with the services of @Firma, eVisor and TS@.

Version:

1.4, 18/04/2022.

Constructor Summary

Constructors

Constructor and Description
CMSBuilder()

Method Summary

Modifier and Type	Method and Description
org.bouncycastle.cms.SignerInformationStore	counterSignLeaf(org.bouncycastle.cms.SignerInformationStore signerInfos, P7ContentSignerParameters parameters, boolean includeTimestamp, java.lang.String signatureForm, java.lang.String signaturePolicyID, boolean includeContent) Method that signs the leaft of each signer (end node of each signerInfo).
org.bouncycastle.cms.SignerInformationStore	counterSignLeaf(org.bouncycastle.cms.SignerInformationStore signerInfos, P7ContentSignerParameters parameters, boolean includeTimestamp, java.lang.String signatureForm, java.lang.String signaturePolicyID, boolean includeContent, java.lang.String idClient) Method that signs the leaft of each signer (end node of each signerInfo).
byte[]	generateSignedData(P7ContentSignerParameters parameters, boolean includeContent, org.ietf.jgss.Oid dataType, java.util.Properties extraParams, boolean includeTimestamp, java.lang.String signatureForm, java.lang.String signaturePolicyID) Builds a signedData object used in CAdES signatures.
byte[]	generateSignedData(P7ContentSignerParameters parameters, boolean includeContent, org.ietf.jgss.Oid dataType, java.util.Properties extraParams, boolean includeTimestamp, java.lang.String signatureForm, java.lang.String signaturePolicyID, java.lang.String idClient) Builds a signedData object used in CAdES signatures.
org.bouncycastle.asn1.cms.SignerInfo	generateSignerInfo(P7ContentSignerParameters parameters, es.gob.afirma.signature.cades.CMSBuilder.SignerInfoTypes signType, boolean includeTimestamp, java.lang.String signatureForm, java.lang.String signaturePolicyID, boolean includeContent) Builds a SignerInfo object used in CAdES.
org.bouncycastle.asn1.cms.SignerInfo	generateSignerInfo(P7ContentSignerParameters parameters, es.gob.afirma.signature.cades.CMSBuilder.SignerInfoTypes signType, boolean includeTimestamp, java.lang.String signatureForm, java.lang.String signaturePolicyID, boolean includeContent, java.lang.String idClient) Builds a SignerInfo object used in CAdES.
org.bouncycastle.tsp.TimeStampToken	generateTimestamp(byte[] dataToStamp) Method that generates a timestamp.
org.bouncycastle.tsp.TimeStampToken	generateTimestamp(byte[] dataToStamp, java.lang.String idClient) Method that generates a timestamp.
java.lang.String	getPolicyID() Gets the value of the attribute policyID.
boolean	isEPES() Gets the value of the attribute isEPES.
java.util.List<org.bouncycastle.cms.SignerInformation>	upgradeSignersWithTimestamp(org.bouncycastle.cms.CMSSignedData signedData, java.util.List<java.security.cert.X509Certificate> listCertificates, java.util.List<org.bouncycastle.cms.SignerInformation> listSignersSignature, java.lang.String idClient) Method that upgrades a list of signers by adding a timestamp to each one.

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

CMSBuilder

public CMSBuilder()

Method Detail

generateSignedData

public byte[] generateSignedData(P7ContentSignerParameters parameters,
                                 boolean includeContent,
                                 org.ietf.jgss.Oid dataType,
                                 java.util.Properties extraParams,
                                 boolean includeTimestamp,
                                 java.lang.String signatureForm,
                                 java.lang.String signaturePolicyID,
                                 java.lang.String idClient)
                          throws SigningException

Builds a signedData object used in CAdES signatures. SignedData is defined in the rfc3852:

 id-signedData OBJECT IDENTIFIER ::= { iso(1) member-body(2)
         us(840) rsadsi(113549) pkcs(1) pkcs7(7) 2 }
    
      SignedData ::= SEQUENCE {
        version CMSVersion,
        digestAlgorithms DigestAlgorithmIdentifiers,
        encapContentInfo EncapsulatedContentInfo,
        certificates [0] IMPLICIT CertificateSet OPTIONAL,
        crls [1] IMPLICIT RevocationInfoChoices OPTIONAL,
        signerInfos SignerInfos }
    
    

Parameters:

parameters - parameters used in the signature.

includeContent - indicates whether the document content is included in the signature or is only referenced.

dataType - type of content to sign.

extraParams - optional parameters.

includeTimestamp - Parameter that indicates if the signature will have a timestamp (true) or not (false).

signatureForm - Parameter that represents the signature form. The allowed values for CAdES signature are:

• ISignatureFormatDetector.FORMAT_CADES_BES
• ISignatureFormatDetector.FORMAT_CADES_EPES

The allowed values for PAdES signature are:

• ISignatureFormatDetector.FORMAT_PADES_BES
• ISignatureFormatDetector.FORMAT_PADES_EPES

signaturePolicyID - Parameter that represents the identifier of the signature policy used for generate the signature with signature policies. The identifier must be defined on the properties file where to configure the validation and generation of signatures with signature policies.

idClient - Parameter that represents the client application identifier.

Returns:

a sinedData object.

Throws:

SigningException - in error case.

generateSignedData

public byte[] generateSignedData(P7ContentSignerParameters parameters,
                                 boolean includeContent,
                                 org.ietf.jgss.Oid dataType,
                                 java.util.Properties extraParams,
                                 boolean includeTimestamp,
                                 java.lang.String signatureForm,
                                 java.lang.String signaturePolicyID)
                          throws SigningException

Builds a signedData object used in CAdES signatures. SignedData is defined in the rfc3852:

 id-signedData OBJECT IDENTIFIER ::= { iso(1) member-body(2)
         us(840) rsadsi(113549) pkcs(1) pkcs7(7) 2 }
    
      SignedData ::= SEQUENCE {
        version CMSVersion,
        digestAlgorithms DigestAlgorithmIdentifiers,
        encapContentInfo EncapsulatedContentInfo,
        certificates [0] IMPLICIT CertificateSet OPTIONAL,
        crls [1] IMPLICIT RevocationInfoChoices OPTIONAL,
        signerInfos SignerInfos }
    
    

Parameters:

parameters - parameters used in the signature.

includeContent - indicates whether the document content is included in the signature or is only referenced.

dataType - type of content to sign.

extraParams - optional parameters.

includeTimestamp - Parameter that indicates if the signature will have a timestamp (true) or not (false).

signatureForm - Parameter that represents the signature form. The allowed values for CAdES signature are:

• ISignatureFormatDetector.FORMAT_CADES_BES
• ISignatureFormatDetector.FORMAT_CADES_EPES

The allowed values for PAdES signature are:

• ISignatureFormatDetector.FORMAT_PADES_BES
• ISignatureFormatDetector.FORMAT_PADES_EPES

signaturePolicyID - Parameter that represents the identifier of the signature policy used for generate the signature with signature policies. The identifier must be defined on the properties file where to configure the validation and generation of signatures with signature policies.

Returns:

a sinedData object.

Throws:

SigningException - in error case.

generateTimestamp

public org.bouncycastle.tsp.TimeStampToken generateTimestamp(byte[] dataToStamp)
                                                      throws SigningException

Method that generates a timestamp.

Parameters:

dataToStamp - Parameter that represents the data to stamp.

Returns:

an object that represents the timestamp.

Throws:

SigningException - If the method fails.

generateTimestamp

public org.bouncycastle.tsp.TimeStampToken generateTimestamp(byte[] dataToStamp,
                                                             java.lang.String idClient)
                                                      throws SigningException

Method that generates a timestamp.

Parameters:

dataToStamp - Parameter that represents the data to stamp.

idClient - Parameter that represents client id.

Returns:

an object that represents the timestamp.

Throws:

SigningException - If the method fails.

generateSignerInfo

public org.bouncycastle.asn1.cms.SignerInfo generateSignerInfo(P7ContentSignerParameters parameters,
                                                               es.gob.afirma.signature.cades.CMSBuilder.SignerInfoTypes signType,
                                                               boolean includeTimestamp,
                                                               java.lang.String signatureForm,
                                                               java.lang.String signaturePolicyID,
                                                               boolean includeContent,
                                                               java.lang.String idClient)
                                                        throws SigningException

Builds a SignerInfo object used in CAdES. SignerInfo is defined in the RFC 3852:

SignerInfo ::= SEQUENCE {
        version CMSVersion,
        sid SignerIdentifier,
        digestAlgorithm DigestAlgorithmIdentifier,
        signedAttrs [0] IMPLICIT SignedAttributes OPTIONAL,
        signatureAlgorithm SignatureAlgorithmIdentifier,
        signature SignatureValue,
        unsignedAttrs [1] IMPLICIT UnsignedAttributes OPTIONAL }
    
      SignerIdentifier ::= CHOICE {
        issuerAndSerialNumber IssuerAndSerialNumber,
        subjectKeyIdentifier [0] SubjectKeyIdentifier }
    
      SignedAttributes ::= SET SIZE (1..MAX) OF Attribute
    
      UnsignedAttributes ::= SET SIZE (1..MAX) OF Attribute
    
      Attribute ::= SEQUENCE {
        attrType OBJECT IDENTIFIER,
        attrValues SET OF AttributeValue }
    
      AttributeValue ::= ANY
    
      SignatureValue ::= OCTET STRING
      

Parameters:

parameters - object that includes all data to generate SignerInfo object.

signType - SignerInfo type to generate.

includeTimestamp - Parameter that indicates if the signature will have a timestamp (true) or not (false).

signatureForm - Parameter that represents the signature form. The allowed values for CAdES signature are:

• ISignatureFormatDetector.FORMAT_CADES_BES
• ISignatureFormatDetector.FORMAT_CADES_EPES

The allowed values for PAdES signature are:

• ISignatureFormatDetector.FORMAT_PADES_BES
• ISignatureFormatDetector.FORMAT_PADES_EPES

signaturePolicyID - Parameter that represents the identifier of the signature policy used for generate the signature with signature policies. The identifier must be defined on the properties file where to configure the validation and generation of signatures with signature policies.

includeContent - Parameter that indicates whether the document content is included in the signature (true) or is only referenced (false).

idClient - Parameter that represents the client application identifier.

Returns:

a new SignerInfo instance.

Throws:

SigningException - in error case.

generateSignerInfo

public org.bouncycastle.asn1.cms.SignerInfo generateSignerInfo(P7ContentSignerParameters parameters,
                                                               es.gob.afirma.signature.cades.CMSBuilder.SignerInfoTypes signType,
                                                               boolean includeTimestamp,
                                                               java.lang.String signatureForm,
                                                               java.lang.String signaturePolicyID,
                                                               boolean includeContent)
                                                        throws SigningException

Builds a SignerInfo object used in CAdES. SignerInfo is defined in the RFC 3852:

SignerInfo ::= SEQUENCE {
        version CMSVersion,
        sid SignerIdentifier,
        digestAlgorithm DigestAlgorithmIdentifier,
        signedAttrs [0] IMPLICIT SignedAttributes OPTIONAL,
        signatureAlgorithm SignatureAlgorithmIdentifier,
        signature SignatureValue,
        unsignedAttrs [1] IMPLICIT UnsignedAttributes OPTIONAL }
    
      SignerIdentifier ::= CHOICE {
        issuerAndSerialNumber IssuerAndSerialNumber,
        subjectKeyIdentifier [0] SubjectKeyIdentifier }
    
      SignedAttributes ::= SET SIZE (1..MAX) OF Attribute
    
      UnsignedAttributes ::= SET SIZE (1..MAX) OF Attribute
    
      Attribute ::= SEQUENCE {
        attrType OBJECT IDENTIFIER,
        attrValues SET OF AttributeValue }
    
      AttributeValue ::= ANY
    
      SignatureValue ::= OCTET STRING
      

Parameters:

parameters - object that includes all data to generate SignerInfo object.

signType - SignerInfo type to generate.

includeTimestamp - Parameter that indicates if the signature will have a timestamp (true) or not (false).

signatureForm - Parameter that represents the signature form. The allowed values for CAdES signature are:

• ISignatureFormatDetector.FORMAT_CADES_BES
• ISignatureFormatDetector.FORMAT_CADES_EPES

The allowed values for PAdES signature are:

• ISignatureFormatDetector.FORMAT_PADES_BES
• ISignatureFormatDetector.FORMAT_PADES_EPES

signaturePolicyID - Parameter that represents the identifier of the signature policy used for generate the signature with signature policies. The identifier must be defined on the properties file where to configure the validation and generation of signatures with signature policies.

includeContent - Parameter that indicates whether the document content is included in the signature (true) or is only referenced (false).

Returns:

a new SignerInfo instance.

Throws:

SigningException - in error case.

upgradeSignersWithTimestamp

public java.util.List<org.bouncycastle.cms.SignerInformation> upgradeSignersWithTimestamp(org.bouncycastle.cms.CMSSignedData signedData,
                                                                                          java.util.List<java.security.cert.X509Certificate> listCertificates,
                                                                                          java.util.List<org.bouncycastle.cms.SignerInformation> listSignersSignature,
                                                                                          java.lang.String idClient)
                                                                                   throws SigningException

Method that upgrades a list of signers by adding a timestamp to each one. The timestamp will be added only to those signers that don't have a previous timestamp.

Parameters:

signedData - Parameter that represents the signature which contain the signers.

listCertificates - Parameter that represents the list of signers of the signature to upgrade with a timestamp. If the list is null or empty, all of the signers will be updated.

listSignersSignature - Parameter that represents the list of signers to upgrade.

idClient - Parameter that represents the client application identifier.

Returns:

the list with all the signers, upgraded or not.

Throws:

SigningException - If the method fails.

isEPES

public boolean isEPES()

Gets the value of the attribute isEPES.

Returns:

the value of the attribute isEPES.

getPolicyID

public java.lang.String getPolicyID()

Gets the value of the attribute policyID.

Returns:

the value of the attribute policyID.

counterSignLeaf

public org.bouncycastle.cms.SignerInformationStore counterSignLeaf(org.bouncycastle.cms.SignerInformationStore signerInfos,
                                                                   P7ContentSignerParameters parameters,
                                                                   boolean includeTimestamp,
                                                                   java.lang.String signatureForm,
                                                                   java.lang.String signaturePolicyID,
                                                                   boolean includeContent,
                                                                   java.lang.String idClient)
                                                            throws SigningException

Method that signs the leaft of each signer (end node of each signerInfo).

Parameters:

signerInfos - store with all SignerInfomation to sign.

parameters - countersigner parameters.

includeTimestamp - Parameter that indicates if the signature will have a timestamp (true) or not (false).

signatureForm - Parameter that represents the signature form. The allowed values for CAdES signature are:

• ISignatureFormatDetector.FORMAT_CADES_BES
• ISignatureFormatDetector.FORMAT_CADES_EPES

signaturePolicyID - Parameter that represents the identifier of the signature policy used for generate the signature with signature policies. The identifier must be defined on the properties file where to configure the validation and generation of signatures with signature policies.

includeContent - Parameter that indicates whether the document content is included in the signature (true) or is only referenced (false).

idClient - Parameter that represents the client application identifier.

Returns:

a store with all instance of SignerInformation signed.

Throws:

SigningException - If the method fails.

counterSignLeaf

public org.bouncycastle.cms.SignerInformationStore counterSignLeaf(org.bouncycastle.cms.SignerInformationStore signerInfos,
                                                                   P7ContentSignerParameters parameters,
                                                                   boolean includeTimestamp,
                                                                   java.lang.String signatureForm,
                                                                   java.lang.String signaturePolicyID,
                                                                   boolean includeContent)
                                                            throws SigningException

Method that signs the leaft of each signer (end node of each signerInfo).

Parameters:

signerInfos - store with all SignerInfomation to sign.

parameters - countersigner parameters.

includeTimestamp - Parameter that indicates if the signature will have a timestamp (true) or not (false).

signatureForm - Parameter that represents the signature form. The allowed values for CAdES signature are:

• ISignatureFormatDetector.FORMAT_CADES_BES
• ISignatureFormatDetector.FORMAT_CADES_EPES

signaturePolicyID - Parameter that represents the identifier of the signature policy used for generate the signature with signature policies. The identifier must be defined on the properties file where to configure the validation and generation of signatures with signature policies.

includeContent - Parameter that indicates whether the document content is included in the signature (true) or is only referenced (false).

Returns:

a store with all instance of SignerInformation signed.

Throws:

SigningException - If the method fails.