Package com.itextpdf.signatures
Class LtvVerification
- java.lang.Object
-
- com.itextpdf.signatures.LtvVerification
-
public class LtvVerification extends java.lang.Object
Add verification according to PAdES-LTV (part 4).
-
-
Nested Class Summary
Nested Classes Modifier and Type Class Description static class
LtvVerification.CertificateInclusion
Certificate inclusion in the DSS and VRI dictionaries in the CERT and CERTS keys.static class
LtvVerification.CertificateOption
Options for how many certificates to include.static class
LtvVerification.Level
What type of verification to include.static class
LtvVerification.RevocationDataNecessity
Option to determine whether revocation information is required for the signing certificate.private static class
LtvVerification.ValidationData
-
Field Summary
Fields Modifier and Type Field Description private static IBouncyCastleFactory
BOUNCY_CASTLE_FACTORY
private PdfDocument
document
private IIssuingCertificateRetriever
issuingCertificateRetriever
private static org.slf4j.Logger
LOGGER
private LtvVerification.RevocationDataNecessity
revocationDataNecessity
private java.lang.String
securityProviderCode
private SignatureUtil
sgnUtil
private boolean
used
private java.util.Map<PdfName,LtvVerification.ValidationData>
validated
-
Constructor Summary
Constructors Constructor Description LtvVerification(PdfDocument document)
The verification constructor.LtvVerification(PdfDocument document, java.lang.String securityProviderCode)
The verification constructor.
-
Method Summary
All Methods Static Methods Instance Methods Concrete Methods Modifier and Type Method Description private void
addRevocationDataForCertificate(java.security.cert.X509Certificate signingCert, java.security.cert.Certificate[] certificateChain, java.security.cert.X509Certificate cert, IOcspClient ocsp, ICrlClient crl, LtvVerification.Level level, LtvVerification.CertificateInclusion certInclude, LtvVerification.CertificateOption certOption, LtvVerification.ValidationData validationData, java.util.Set<java.security.cert.X509Certificate> processedCerts)
private void
addRevocationDataForChain(java.security.cert.X509Certificate signingCert, java.security.cert.Certificate[] certChain, IOcspClient ocsp, ICrlClient crl, LtvVerification.Level level, LtvVerification.CertificateInclusion certInclude, LtvVerification.CertificateOption certOption, LtvVerification.ValidationData validationData, java.util.Set<java.security.cert.X509Certificate> processedCerts)
private void
addRevocationDataForOcspCert(byte[] ocspEnc, java.security.cert.X509Certificate signingCert, IOcspClient ocsp, ICrlClient crl, LtvVerification.Level level, LtvVerification.CertificateInclusion certInclude, LtvVerification.CertificateOption certOption, LtvVerification.ValidationData validationData, java.util.Set<java.security.cert.X509Certificate> processedCerts)
boolean
addVerification(java.lang.String signatureName, IOcspClient ocsp, ICrlClient crl, LtvVerification.CertificateOption certOption, LtvVerification.Level level, LtvVerification.CertificateInclusion certInclude)
Add verification for a particular signature.boolean
addVerification(java.lang.String signatureName, java.util.Collection<byte[]> ocsps, java.util.Collection<byte[]> crls, java.util.Collection<byte[]> certs)
Adds verification to the signature.private static byte[]
buildOCSPResponse(byte[] basicOcspResponse)
static java.lang.String
convertToHex(byte[] bytes)
Converts an array of bytes to a String of hexadecimal valuesprivate void
createDss()
private static void
deleteOldReferences(PdfArray all, PdfArray toDelete)
(package private) java.security.cert.X509Certificate
getParent(java.security.cert.X509Certificate cert, java.security.cert.Certificate[] certs)
Get the issuing certificate for a child certificate.private PdfName
getSignatureHashKey(java.lang.String signatureName)
private static byte[]
hashBytesSha1(byte[] b)
private static java.util.List<java.security.cert.X509Certificate>
iterableToList(java.lang.Iterable<java.security.cert.X509Certificate> iterable)
void
merge()
Merges the validation with any validation already in the document or creates a new one.private void
outputDss(PdfDictionary dss, PdfDictionary vrim, PdfArray ocsps, PdfArray crls, PdfArray certs)
private java.security.cert.Certificate[]
retrieveMissingCertificates(java.security.cert.Certificate[] certChain)
LtvVerification
setIssuingCertificateRetriever(IIssuingCertificateRetriever issuingCertificateRetriever)
SetsIIssuingCertificateRetriever
instance needed to get CRL issuer certificates (using AIA extension).LtvVerification
setRevocationDataNecessity(LtvVerification.RevocationDataNecessity revocationDataNecessity)
SetsLtvVerification.RevocationDataNecessity
option to specify the necessity of revocation data.private void
updateDss()
-
-
-
Field Detail
-
BOUNCY_CASTLE_FACTORY
private static final IBouncyCastleFactory BOUNCY_CASTLE_FACTORY
-
LOGGER
private static final org.slf4j.Logger LOGGER
-
document
private final PdfDocument document
-
sgnUtil
private final SignatureUtil sgnUtil
-
validated
private final java.util.Map<PdfName,LtvVerification.ValidationData> validated
-
used
private boolean used
-
securityProviderCode
private java.lang.String securityProviderCode
-
revocationDataNecessity
private LtvVerification.RevocationDataNecessity revocationDataNecessity
-
issuingCertificateRetriever
private IIssuingCertificateRetriever issuingCertificateRetriever
-
-
Constructor Detail
-
LtvVerification
public LtvVerification(PdfDocument document)
The verification constructor. This class should only be created with PdfStamper.getLtvVerification() otherwise the information will not be added to the Pdf.- Parameters:
document
- ThePdfDocument
to apply the validation to.
-
LtvVerification
public LtvVerification(PdfDocument document, java.lang.String securityProviderCode)
The verification constructor. This class should only be created with PdfStamper.getLtvVerification() otherwise the information will not be added to the Pdf.- Parameters:
document
- ThePdfDocument
to apply the validation to.securityProviderCode
- Security provider to use
-
-
Method Detail
-
setRevocationDataNecessity
public LtvVerification setRevocationDataNecessity(LtvVerification.RevocationDataNecessity revocationDataNecessity)
SetsLtvVerification.RevocationDataNecessity
option to specify the necessity of revocation data.Default value is
LtvVerification.RevocationDataNecessity.OPTIONAL
.- Parameters:
revocationDataNecessity
-LtvVerification.RevocationDataNecessity
value to set- Returns:
- this
LtvVerification
instance.
-
setIssuingCertificateRetriever
public LtvVerification setIssuingCertificateRetriever(IIssuingCertificateRetriever issuingCertificateRetriever)
SetsIIssuingCertificateRetriever
instance needed to get CRL issuer certificates (using AIA extension).Default value is
DefaultIssuingCertificateRetriever
.- Parameters:
issuingCertificateRetriever
-IIssuingCertificateRetriever
instance to set- Returns:
- this
LtvVerification
instance.
-
addVerification
public boolean addVerification(java.lang.String signatureName, IOcspClient ocsp, ICrlClient crl, LtvVerification.CertificateOption certOption, LtvVerification.Level level, LtvVerification.CertificateInclusion certInclude) throws java.io.IOException, java.security.GeneralSecurityException
Add verification for a particular signature.- Parameters:
signatureName
- the signature to validate (it may be a timestamp)ocsp
- the interface to get the OCSPcrl
- the interface to get the CRLcertOption
- options as to how many certificates to includelevel
- the validation options to includecertInclude
- certificate inclusion options- Returns:
- true if a validation was generated, false otherwise
- Throws:
java.security.GeneralSecurityException
- when requested cryptographic algorithm or security provider is not availablejava.io.IOException
- signals that an I/O exception has occurred
-
addVerification
public boolean addVerification(java.lang.String signatureName, java.util.Collection<byte[]> ocsps, java.util.Collection<byte[]> crls, java.util.Collection<byte[]> certs) throws java.io.IOException, java.security.GeneralSecurityException
Adds verification to the signature.- Parameters:
signatureName
- name of the signatureocsps
- collection of DER-encoded BasicOCSPResponsescrls
- collection of DER-encoded CRLscerts
- collection of DER-encoded certificates- Returns:
- boolean
- Throws:
java.io.IOException
- signals that an I/O exception has occurredjava.security.GeneralSecurityException
- when requested cryptographic algorithm or security provider is not available
-
merge
public void merge()
Merges the validation with any validation already in the document or creates a new one.
-
convertToHex
public static java.lang.String convertToHex(byte[] bytes)
Converts an array of bytes to a String of hexadecimal values- Parameters:
bytes
- a byte array- Returns:
- the same bytes expressed as hexadecimal values
-
getParent
java.security.cert.X509Certificate getParent(java.security.cert.X509Certificate cert, java.security.cert.Certificate[] certs)
Get the issuing certificate for a child certificate.- Parameters:
cert
- the certificate for which we search the parentcerts
- an array with certificates that contains the parent- Returns:
- the parent certificate
-
addRevocationDataForChain
private void addRevocationDataForChain(java.security.cert.X509Certificate signingCert, java.security.cert.Certificate[] certChain, IOcspClient ocsp, ICrlClient crl, LtvVerification.Level level, LtvVerification.CertificateInclusion certInclude, LtvVerification.CertificateOption certOption, LtvVerification.ValidationData validationData, java.util.Set<java.security.cert.X509Certificate> processedCerts) throws java.security.cert.CertificateException, java.io.IOException, java.security.cert.CRLException
- Throws:
java.security.cert.CertificateException
java.io.IOException
java.security.cert.CRLException
-
addRevocationDataForCertificate
private void addRevocationDataForCertificate(java.security.cert.X509Certificate signingCert, java.security.cert.Certificate[] certificateChain, java.security.cert.X509Certificate cert, IOcspClient ocsp, ICrlClient crl, LtvVerification.Level level, LtvVerification.CertificateInclusion certInclude, LtvVerification.CertificateOption certOption, LtvVerification.ValidationData validationData, java.util.Set<java.security.cert.X509Certificate> processedCerts) throws java.io.IOException, java.security.cert.CertificateException, java.security.cert.CRLException
- Throws:
java.io.IOException
java.security.cert.CertificateException
java.security.cert.CRLException
-
addRevocationDataForOcspCert
private void addRevocationDataForOcspCert(byte[] ocspEnc, java.security.cert.X509Certificate signingCert, IOcspClient ocsp, ICrlClient crl, LtvVerification.Level level, LtvVerification.CertificateInclusion certInclude, LtvVerification.CertificateOption certOption, LtvVerification.ValidationData validationData, java.util.Set<java.security.cert.X509Certificate> processedCerts) throws java.security.cert.CertificateException, java.io.IOException, java.security.cert.CRLException
- Throws:
java.security.cert.CertificateException
java.io.IOException
java.security.cert.CRLException
-
iterableToList
private static java.util.List<java.security.cert.X509Certificate> iterableToList(java.lang.Iterable<java.security.cert.X509Certificate> iterable)
-
buildOCSPResponse
private static byte[] buildOCSPResponse(byte[] basicOcspResponse) throws java.io.IOException
- Throws:
java.io.IOException
-
getSignatureHashKey
private PdfName getSignatureHashKey(java.lang.String signatureName) throws java.security.NoSuchAlgorithmException
- Throws:
java.security.NoSuchAlgorithmException
-
hashBytesSha1
private static byte[] hashBytesSha1(byte[] b) throws java.security.NoSuchAlgorithmException
- Throws:
java.security.NoSuchAlgorithmException
-
updateDss
private void updateDss()
-
createDss
private void createDss()
-
outputDss
private void outputDss(PdfDictionary dss, PdfDictionary vrim, PdfArray ocsps, PdfArray crls, PdfArray certs)
-
retrieveMissingCertificates
private java.security.cert.Certificate[] retrieveMissingCertificates(java.security.cert.Certificate[] certChain)
-
-