es.gob.afirma.utils

Class UtilsSignature

java.lang.Object

es.gob.afirma.utils.UtilsSignature

All Implemented Interfaces:

IUtilsSignature

public final class UtilsSignature
extends java.lang.Object
implements IUtilsSignature

Class that contains methods related to the manage of signatures.

Project:

Library for the integration with the services of @Firma, eVisor and TS@.

Version:

1.5, 04/03/2020.

Field Summary

Fields inherited from interface es.gob.afirma.utils.IUtilsSignature

DETACHED_SIGNATURE_MODE, ENVELOPED_SIGNATURE_MODE, ENVELOPING_SIGNATURE_MODE, EXPLICIT_SIGNATURE_MODE, IMPLICIT_SIGNATURE_MODE, VALIDATION_LEVEL_COMPLETE, VALIDATION_LEVEL_NONE, VALIDATION_LEVEL_SIMPLE

Method Summary

Modifier and Type	Method and Description
static void	checkPDFCertificationLevel(java.util.Map<java.lang.Integer,java.io.InputStream> mapRevisions) Method that validates if some approval signature was added to a PDF document after that it was defined as certified.
static void	checkSubFilterConditionsISO320001(PDFSignatureDictionary dictionarySignature, org.bouncycastle.cms.CMSSignedData signedData) The ISO 32000-1 specifies in section 12.8.3.3.1: - adbe.pkcs7.detached: The original signed message digest over the document’s byte range shall be incorporated as the normal PKCS#7 SignedData field.
static boolean	equalsHash(com.lowagie.text.pdf.PdfArray pdfArrayByteRange, java.security.MessageDigest messageDigestSignature, byte[] pdfDocument, byte[] hashSignature) Method that compares two bytes arrays and indicates if the hash of each is equals (true) or not (false).
static java.util.List<CAdESSignerInfo>	getCAdESListSigners(org.bouncycastle.cms.CMSSignedData signedData) Method that obtains a list with the principal information related to the signers of a CAdES signature.
static org.bouncycastle.cms.CMSSignedData	getCMSSignature(PDFSignatureDictionary signatureDictionary) Method that obtains the SignedData contained inside of a signature dictionary of a PDF document.
static org.w3c.dom.Document	getDocumentFromXML(byte[] xmlDocument) Method that obtains an object as a representation of a XML document.
static java.security.cert.X509Certificate	getSigningCertificate(org.bouncycastle.cms.CMSSignedData signedData, org.bouncycastle.cms.SignerInformation signerInformation) Method that obtains the singing certificate of a signer of a signature.
static org.bouncycastle.cert.X509CertificateHolder	getX509CertificateHolderBySignerId(org.bouncycastle.util.Store certificatesStore, org.bouncycastle.cms.SignerId signerId) Method that obtains the structure of a certificate from a certificates store.
static java.util.List<XAdESSignerInfo>	getXAdESListSigners(org.w3c.dom.Document doc) Method that obtains a list with the principal information related to the signers of a XAdES signature.
static boolean	isImplicit(org.bouncycastle.cms.CMSSignedData cmsSignedData) Method that indicates whether the signature includes the original document (true) or not (false).
static boolean	isNotPAdESEnhancedPDF(com.lowagie.text.pdf.PdfDictionary pdfDic) Method that indicates whether a signature dictionary refers to a PDF or PAdES-Basic signature (true) or to a PAdES-BES or PAdES-EPES signature (false).
static com.lowagie.text.pdf.PdfReader	obtainLatestRevision(com.lowagie.text.pdf.PdfReader reader) Method that obtains the revision of the signature dictionary most recent.
static PDFSignatureDictionary	obtainLatestSignatureFromPDF(com.lowagie.text.pdf.PdfReader reader) Method that obtains the signature dictionary with major review.
static void	validateCertificate(java.security.cert.X509Certificate certificate, java.util.Date validationDate, boolean isUpgradeOperation) Method that validates the validity period of a certificate and the revocation status of a certificate (if the validation level for the certificates is defined with the value es.gob.afirma.integraFacade.IntegraFacadeConstants#VALIDATION_LEVEL_COMPLETE).
static void	validatePAdESEnhancedMandatoryAttributes(PDFSignatureDictionary signatureDictionary, org.bouncycastle.cms.CMSSignedData signedData) Method that validates the mandatory attributes for a PAdES enhanced signature.
static void	validatePAdESOptionalAttributes(PDFSignatureDictionary signatureDictionary, org.bouncycastle.cms.CMSSignedData signedData, boolean isEPES, boolean isBasic) Method that validates the optional attributes for a PAdES signature.
static void	validatePDFSigner(org.bouncycastle.cms.CMSSignedData signedData, org.bouncycastle.cms.SignerInformation signerInformation, com.lowagie.text.pdf.PdfDictionary pdfSignatureDictionary, java.util.Date validationDate) Method that validates the signer of a signature contained inside of a PDF document.
static void	validateXAdESSigner(org.apache.xml.security.signature.XMLSignature xmlSignature, java.security.cert.X509Certificate signingCertificate, org.bouncycastle.tsp.TimeStampToken tst, org.w3c.dom.Element xmlTst, java.lang.String signingMode, byte[] signedFile, java.lang.String signedFileName) Method that validates the signer of a XAdES signature.

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

validateCertificate

public static void validateCertificate(java.security.cert.X509Certificate certificate,
                                       java.util.Date validationDate,
                                       boolean isUpgradeOperation)
                                throws SigningException

Method that validates the validity period of a certificate and the revocation status of a certificate (if the validation level for the certificates is defined with the value es.gob.afirma.integraFacade.IntegraFacadeConstants#VALIDATION_LEVEL_COMPLETE). If the validation level for the certificates is defined with the value es.gob.afirma.integraFacade.IntegraFacadeConstants#VALIDATION_LEVEL_COMPLETE the validation of the revocation status will be via OCSP.

Parameters:

certificate - Parameter that represents the certificate to validate.

validationDate - Parameter that represents the validation date.

isUpgradeOperation - Parameter that indicates if the origin operation is an upgrade signature operation (true) or not (false).

Throws:

SigningException - If the certificate isn't valid or the method fails.

obtainLatestSignatureFromPDF

public static PDFSignatureDictionary obtainLatestSignatureFromPDF(com.lowagie.text.pdf.PdfReader reader)

Method that obtains the signature dictionary with major review.

Parameters:

reader - Parameter that represents the reader for the PDF document.

Returns:

the signature dictionary with major review.

isNotPAdESEnhancedPDF

public static boolean isNotPAdESEnhancedPDF(com.lowagie.text.pdf.PdfDictionary pdfDic)

Method that indicates whether a signature dictionary refers to a PDF or PAdES-Basic signature (true) or to a PAdES-BES or PAdES-EPES signature (false).

Parameters:

pdfDic - Parameter that represents the signature dictionary.

Returns:

a boolean that indicates whether a signature dictionary refers to a PDF or PAdES-Basic signature (true) or to a PAdES-BES or PAdES-EPES signature (false).

getCMSSignature

public static org.bouncycastle.cms.CMSSignedData getCMSSignature(PDFSignatureDictionary signatureDictionary)
                                                          throws SigningException

Method that obtains the SignedData contained inside of a signature dictionary of a PDF document.

Parameters:

signatureDictionary - Parameter that represents the signature dictionary.

Returns:

an object that represents the SignedData.

Throws:

SigningException - If the method fails.

isImplicit

public static boolean isImplicit(org.bouncycastle.cms.CMSSignedData cmsSignedData)

Method that indicates whether the signature includes the original document (true) or not (false).

Parameters:

cmsSignedData - Parameter that represents the pkcs7-signature message.

Returns:

a boolean that indicates whether the signature includes the original document (true) or not (false).

equalsHash

public static boolean equalsHash(com.lowagie.text.pdf.PdfArray pdfArrayByteRange,
                                 java.security.MessageDigest messageDigestSignature,
                                 byte[] pdfDocument,
                                 byte[] hashSignature)

Method that compares two bytes arrays and indicates if the hash of each is equals (true) or not (false).

Parameters:

pdfArrayByteRange - Parameter that represents the exact byte range for the digest calculation.

messageDigestSignature - Parameter that represents the message digest algorithm.

pdfDocument - Parameter that represents the first bytes array to compare.

hashSignature - Parameter that represents the second bytes array to compare.

Returns:

a boolean that indicates if the hash of each is equals (true) or not (false).

checkSubFilterConditionsISO320001

public static void checkSubFilterConditionsISO320001(PDFSignatureDictionary dictionarySignature,
                                                     org.bouncycastle.cms.CMSSignedData signedData)
                                              throws SigningException

The ISO 32000-1 specifies in section 12.8.3.3.1: - adbe.pkcs7.detached: The original signed message digest over the document’s byte range shall be incorporated as the normal PKCS#7 SignedData field. No data shall be encapsulated in the PKCS#7 SignedData field. - adbe.pkcs7.sha1: The SHA1 digest of the document’s byte range shall be encapsulated in the PKCS#7 SignedData field with ContentInfo of type Data. The digest of that SignedData shall be incorporated as the normal PKCS#7 digest. This method checks if that conditions are valid.

Parameters:

dictionarySignature - Parameter that represents the signature dictionary.

signedData - Parameter that represents the signed data.

Throws:

SigningException - If one of the conditiones isn't valid.

validatePAdESEnhancedMandatoryAttributes

public static void validatePAdESEnhancedMandatoryAttributes(PDFSignatureDictionary signatureDictionary,
                                                            org.bouncycastle.cms.CMSSignedData signedData)
                                                     throws SigningException

Method that validates the mandatory attributes for a PAdES enhanced signature. The method verifies that:

• The content-type attribute cannot be null and must have the value id-data.
• The entry with the key Cert in the signature dictionary isn't used.

Parameters:

signatureDictionary - Parameter that represents the signature dictionary.

signedData - Parameter that represents the signed data.

Throws:

SigningException - If the validation fails.

validatePAdESOptionalAttributes

public static void validatePAdESOptionalAttributes(PDFSignatureDictionary signatureDictionary,
                                                   org.bouncycastle.cms.CMSSignedData signedData,
                                                   boolean isEPES,
                                                   boolean isBasic)
                                            throws SigningException

Method that validates the optional attributes for a PAdES signature. The method verifies that:

• The counter-signature attribute isn't used if the signature has PAdES-EPES or PAdES-BES profile.
• The content-reference attribute isn't used if the signature has PAdES-EPES or PAdES-BES profile.
• The content-identifier attribute isn't used if the signature has PAdES-EPES or PAdES-BES profile.
• The Reason key isn't present in the signature dictionary if the signature has PAdES-EPES profile.
• The commitment-type-indication attribute isn't used if the signature has PAdES-BES profile.
• The signer-location attribute isn't used if the signature has PAdES-EPES or PAdES-BES profile.
• The signing-time attribute isn't used if the signature has PAdES-EPES or PAdES-BES profile.
• The content-hints attribute isn't used if the signature has PAdES-EPES or PAdES-BES profile.
• If the signature dictionary has /M entry that entry must be a date with a valid format by PDF Reference and that date must be before of the validation date if the signature has PAdES-Basic, PAdES-EPES or PAdES-BES profile.

Parameters:

signatureDictionary - Parameter that represents the signature dictionary.

signedData - Parameter that represents the signed data.

isEPES - Parameter that indicates if the signature has PAdES-EPES profile (true) or PAdES-BES profile (false).

isBasic - Parameter that indicates if the signature has PAdES-Basic profile (true) or PAdES Enhanced profile (false).

Throws:

SigningException - If the validation fails.

getX509CertificateHolderBySignerId

public static org.bouncycastle.cert.X509CertificateHolder getX509CertificateHolderBySignerId(org.bouncycastle.util.Store certificatesStore,
                                                                                             org.bouncycastle.cms.SignerId signerId)

Method that obtains the structure of a certificate from a certificates store.

Parameters:

certificatesStore - Parameter that represents the certificates store.

signerId - Parameter that represents the identifier of the signer used to find the certificate.

Returns:

an object that represents the structure of the certificate.

validatePDFSigner

public static void validatePDFSigner(org.bouncycastle.cms.CMSSignedData signedData,
                                     org.bouncycastle.cms.SignerInformation signerInformation,
                                     com.lowagie.text.pdf.PdfDictionary pdfSignatureDictionary,
                                     java.util.Date validationDate)
                              throws SigningException

Method that validates the signer of a signature contained inside of a PDF document.

Parameters:

signedData - Parameter that represents the signed data.

signerInformation - Parameter that represents the signer information.

pdfSignatureDictionary - Parameter that represents the PDF signature dictionary.

validationDate - Parameter that represents the validation date.

Throws:

SigningException - If the validation fails.

getXAdESListSigners

public static java.util.List<XAdESSignerInfo> getXAdESListSigners(org.w3c.dom.Document doc)

Method that obtains a list with the principal information related to the signers of a XAdES signature.

Parameters:

doc - Parameter that represents the XML document.

Returns:

a list with the principal information related to the signers of a XAdES signature.

getCAdESListSigners

public static java.util.List<CAdESSignerInfo> getCAdESListSigners(org.bouncycastle.cms.CMSSignedData signedData)

Method that obtains a list with the principal information related to the signers of a CAdES signature.

Parameters:

signedData - Parameter that represents the signed data.

Returns:

a list with the principal information related to the signers of a CAdES signature.

validateXAdESSigner

public static void validateXAdESSigner(org.apache.xml.security.signature.XMLSignature xmlSignature,
                                       java.security.cert.X509Certificate signingCertificate,
                                       org.bouncycastle.tsp.TimeStampToken tst,
                                       org.w3c.dom.Element xmlTst,
                                       java.lang.String signingMode,
                                       byte[] signedFile,
                                       java.lang.String signedFileName)
                                throws SigningException

Method that validates the signer of a XAdES signature.

Parameters:

xmlSignature - Parameter that represents the XAdES signature.

signingCertificate - Parameter that represents the signing certificate

tst - Parameter that represents the RFC 3161 timestamp associated to the signer.

xmlTst - Parameter that represents the XML timestamp associated to the signer.

signingMode - Parameter that represents the signing mode of the XAdES signature. The possible values are:

• IUtilsSignature.DETACHED_SIGNATURE_MODE
• IUtilsSignature##ENVELOPED_SIGNATURE_MODE
• IUtilsSignature##ENVELOPING_SIGNATURE_MODE

signedFile - Parameter that represents the file signed by the XML signature when the signed data isn't included into the signed XML document.

signedFileName - Parameter that represents the name of the file signed by the XML signature when the signed data isn't included into the signed XML document.

Throws:

SigningException - If the validation fails.

getSigningCertificate

public static java.security.cert.X509Certificate getSigningCertificate(org.bouncycastle.cms.CMSSignedData signedData,
                                                                       org.bouncycastle.cms.SignerInformation signerInformation)
                                                                throws SigningException

Method that obtains the singing certificate of a signer of a signature.

Parameters:

signedData - Parameter that represents the signed data.

signerInformation - Parameter that represents the information about the signer of the signature.

Returns:

an object that represents the signing certificate.

Throws:

SigningException - If the certificate hasn't could be retrieved.

getDocumentFromXML

public static org.w3c.dom.Document getDocumentFromXML(byte[] xmlDocument)
                                               throws SigningException

Method that obtains an object as a representation of a XML document.

Parameters:

xmlDocument - Parameter that represents the XML document.

Returns:

an object as a representation of the XML document.

Throws:

SigningException - If the XML document has a bad format.

obtainLatestRevision

public static com.lowagie.text.pdf.PdfReader obtainLatestRevision(com.lowagie.text.pdf.PdfReader reader)
                                                           throws SigningException

Method that obtains the revision of the signature dictionary most recent.

Parameters:

reader - Parameter that represents the reader for the PDF document.

Returns:

an input stream that represents the revision, or null if the PDF document doesn't contain any signature dictionary.

Throws:

SigningException - If cannot access to some revision.

checkPDFCertificationLevel

public static void checkPDFCertificationLevel(java.util.Map<java.lang.Integer,java.io.InputStream> mapRevisions)
                                       throws SigningException

Method that validates if some approval signature was added to a PDF document after that it was defined as certified.

Parameters:

mapRevisions - Parameter that represents a map with the revisions of the PDF document. Each revision represents a signature dictionary. The key is the revision number, and the value is the revision.

Throws:

SigningException - If the method fails or some approval signature was added to a PDF document after that it was defined as certified.