Class PdfPKCS7


  • public class PdfPKCS7
    extends java.lang.Object
    This class does all the processing related to signing and verifying a PKCS#7 signature.

    It's based in code found at org.bouncycastle.

    • Nested Class Summary

      Nested Classes 
      Modifier and Type Class Description
      static class  PdfPKCS7.X509Name
      a class that holds an X509 name
      static class  PdfPKCS7.X509NameTokenizer
      class for breaking up an X500 Name into it's component tokens, ala java.util.StringTokenizer.
    • Field Summary

      Fields 
      Modifier and Type Field Description
      private static java.util.Map<java.lang.String,​java.lang.String> algorithmNames  
      private static java.util.Map<java.lang.String,​java.lang.String> allowedDigests  
      private org.bouncycastle.cert.ocsp.BasicOCSPResp basicResp  
      private java.util.List<java.security.cert.Certificate> certs  
      private java.util.List<java.security.cert.CRL> crls  
      private byte[] digest  
      private java.lang.String digestAlgorithm  
      private java.util.Set<java.lang.String> digestalgos  
      private byte[] digestAttr  
      private java.lang.String digestEncryptionAlgorithm  
      private static java.util.Map<java.lang.String,​java.lang.String> digestNames  
      private static java.util.HashMap<java.lang.String,​java.lang.String> dsaOids  
      private static java.util.HashMap<java.lang.String,​java.lang.String> ecdsaOids  
      private byte[] externalDigest  
      private byte[] externalRSAdata  
      private static java.lang.String ID_ADBE_REVOCATION  
      private static java.lang.String ID_CONTENT_TYPE  
      private static java.lang.String ID_DSA  
      private static java.lang.String ID_ECDSA  
      private static java.lang.String ID_MESSAGE_DIGEST  
      private static java.lang.String ID_PKCS7_DATA  
      private static java.lang.String ID_PKCS7_SIGNED_DATA  
      private static java.lang.String ID_RSA  
      private static java.lang.String ID_SIGNING_TIME  
      private java.lang.String location
      Holds value of property location.
      private java.security.MessageDigest messageDigest  
      private java.security.PrivateKey privKey  
      private java.lang.String provider  
      private java.lang.String reason
      Holds value of property reason.
      private byte[] RSAdata  
      private static java.util.HashMap<java.lang.String,​java.lang.String> rsaOids  
      private java.security.Signature sig  
      private byte[] sigAttr  
      private java.security.cert.X509Certificate signCert  
      private java.util.List<java.security.cert.Certificate> signCerts  
      private java.util.Calendar signDate
      Holds value of property signDate.
      private int signerversion  
      private java.lang.String signName
      Holds value of property signName.
      private org.bouncycastle.tsp.TimeStampToken timeStampToken  
      private boolean verified  
      private boolean verifyResult  
      private int version  
    • Constructor Summary

      Constructors 
      Constructor Description
      PdfPKCS7​(byte[] contentsKey, byte[] certsKey, java.lang.String provider)
      Verifies a signature using the sub-filter adbe.x509.rsa_sha1.
      PdfPKCS7​(byte[] contentsKey, java.lang.String provider)
      Verifies a signature using the sub-filter adbe.pkcs7.detached or adbe.pkcs7.sha1.
      PdfPKCS7​(java.security.PrivateKey privKey, java.security.cert.Certificate[] certChain, java.security.cert.CRL[] crlList, java.lang.String hashAlgorithm, java.lang.String provider, boolean hasRSAdata)
      Generates a signature.
    • Method Summary

      All Methods Static Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      private org.bouncycastle.asn1.ASN1EncodableVector buildUnauthenticatedAttributes​(byte[] timeStampToken)
      Added by Aiken Sam, 2006-11-15, modifed by Martin Brunecky 07/12/2007 to start with the timeStampToken (signedData 1.2.840.113549.1.7.2).
      private void findOcsp​(org.bouncycastle.asn1.ASN1Sequence seq)  
      static java.lang.String getAlgorithm​(java.lang.String oid)
      Gets the algorithm name for a certain id.
      byte[] getAuthenticatedAttributeBytes​(byte[] secondDigest, java.util.Calendar signingTime, byte[] ocsp)
      When using authenticatedAttributes the authentication process is different.
      private org.bouncycastle.asn1.DERSet getAuthenticatedAttributeSet​(byte[] secondDigest, java.util.Calendar signingTime, byte[] ocsp)  
      java.security.cert.Certificate[] getCertificates()
      Get all the X.509 certificates associated with this PKCS#7 object in no particular order.
      java.util.Collection getCRLs()
      Get the X.509 certificate revocation lists associated with this PKCS#7 object
      static java.lang.String getDigest​(java.lang.String oid)
      Gets the digest name for a certain id
      java.lang.String getDigestAlgorithm()
      Get the algorithm used to calculate the message digest
      static java.lang.String getDigestOid​(java.lang.String digestName)
      Gets the oid for given digest name.
      byte[] getEncodedPKCS1()
      Gets the bytes for the PKCS#1 object.
      byte[] getEncodedPKCS7()
      Gets the bytes for the PKCS7SignedData object.
      byte[] getEncodedPKCS7​(byte[] secondDigest, java.util.Calendar signingTime)
      Gets the bytes for the PKCS7SignedData object.
      byte[] getEncodedPKCS7​(byte[] secondDigest, java.util.Calendar signingTime, TSAClient tsaClient, byte[] ocsp)
      Gets the bytes for the PKCS7SignedData object.
      private static org.bouncycastle.asn1.ASN1Primitive getExtensionValue​(java.security.cert.X509Certificate cert, java.lang.String oid)  
      java.lang.String getHashAlgorithm()
      Returns the algorithm.
      private static org.bouncycastle.asn1.ASN1Primitive getIssuer​(byte[] enc)
      Get the "issuer" from the TBSCertificate bytes that are passed in
      static PdfPKCS7.X509Name getIssuerFields​(java.security.cert.X509Certificate cert)
      Get the issuer fields from an X509 Certificate
      java.lang.String getLocation()
      Getter for property location.
      org.bouncycastle.cert.ocsp.BasicOCSPResp getOcsp()
      Gets the OCSP basic response if there is one.
      static java.lang.String getOCSPURL​(java.security.cert.X509Certificate certificate)
      Retrieves the OCSP URL from the given certificate.
      private static java.lang.String getOidForAlgorithmAndHash​(java.lang.String signingAlgorithm, java.lang.String hashAlgorithm)
      Determines an OID by signing and hash algorithm.
      java.lang.String getReason()
      Getter for property reason.
      java.security.cert.Certificate[] getSignCertificateChain()
      Get the X.509 sign certificate chain associated with this PKCS#7 object.
      java.util.Calendar getSignDate()
      Getter for property signDate.
      java.security.cert.X509Certificate getSigningCertificate()
      Get the X.509 certificate actually used to sign the digest.
      int getSigningInfoVersion()
      Get the version of the PKCS#7 "SignerInfo" object.
      java.lang.String getSignName()
      Getter for property sigName.
      private static java.lang.String getStandardJavaName​(java.lang.String algName)  
      private static java.lang.String getStringFromGeneralName​(org.bouncycastle.asn1.ASN1Primitive names)  
      private static org.bouncycastle.asn1.ASN1Primitive getSubject​(byte[] enc)
      Get the "subject" from the TBSCertificate bytes that are passed in
      static PdfPKCS7.X509Name getSubjectFields​(java.security.cert.X509Certificate cert)
      Get the subject fields from an X509 Certificate
      java.util.Calendar getTimeStampDate()
      Gets the timestamp date
      org.bouncycastle.tsp.TimeStampToken getTimeStampToken()
      Gets the timestamp token if there is one.
      int getVersion()
      Get the version of the PKCS#7 object.
      boolean isRevocationValid()
      Checks if OCSP revocation refers to the document signing certificate.
      static java.security.KeyStore loadCacertsKeyStore()
      Loads the default root certificates at <java.home>/lib/security/cacerts with the default provider.
      static java.security.KeyStore loadCacertsKeyStore​(java.lang.String provider)
      Loads the default root certificates at <java.home>/lib/security/cacerts.
      void setExternalDigest​(byte[] digest, byte[] RSAdata, java.lang.String digestEncryptionAlgorithm)
      Sets the digest/signature to an external calculated value.
      void setLocation​(java.lang.String location)
      Setter for property location.
      void setReason​(java.lang.String reason)
      Setter for property reason.
      void setSignDate​(java.util.Calendar signDate)
      Setter for property signDate.
      void setSignName​(java.lang.String signName)
      Setter for property sigName.
      private void signCertificateChain()  
      void update​(byte[] buf, int off, int len)
      Update the digest with the specified bytes.
      boolean verify()
      Verify the digest.
      static java.lang.String verifyCertificate​(java.security.cert.X509Certificate cert, java.util.Collection crls, java.util.Calendar calendar)
      Verifies a single certificate.
      static java.lang.Object[] verifyCertificates​(java.security.cert.Certificate[] certs, java.security.KeyStore keystore, java.util.Collection crls, java.util.Calendar calendar)
      Verifies a certificate chain against a KeyStore.
      boolean verifyTimestampImprint()
      Checks if the timestamp refers to this document.
      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
    • Field Detail

      • ID_PKCS7_SIGNED_DATA

        private static final java.lang.String ID_PKCS7_SIGNED_DATA
        See Also:
        Constant Field Values
      • ID_MESSAGE_DIGEST

        private static final java.lang.String ID_MESSAGE_DIGEST
        See Also:
        Constant Field Values
      • ID_ADBE_REVOCATION

        private static final java.lang.String ID_ADBE_REVOCATION
        See Also:
        Constant Field Values
      • digestNames

        private static final java.util.Map<java.lang.String,​java.lang.String> digestNames
      • algorithmNames

        private static final java.util.Map<java.lang.String,​java.lang.String> algorithmNames
      • allowedDigests

        private static final java.util.Map<java.lang.String,​java.lang.String> allowedDigests
      • rsaOids

        private static final java.util.HashMap<java.lang.String,​java.lang.String> rsaOids
      • dsaOids

        private static final java.util.HashMap<java.lang.String,​java.lang.String> dsaOids
      • ecdsaOids

        private static final java.util.HashMap<java.lang.String,​java.lang.String> ecdsaOids
      • certs

        private final java.util.List<java.security.cert.Certificate> certs
      • crls

        private final java.util.List<java.security.cert.CRL> crls
      • provider

        private final java.lang.String provider
      • sigAttr

        private byte[] sigAttr
      • digestAttr

        private byte[] digestAttr
      • version

        private int version
      • signerversion

        private int signerversion
      • digestalgos

        private java.util.Set<java.lang.String> digestalgos
      • signCerts

        private java.util.List<java.security.cert.Certificate> signCerts
      • signCert

        private java.security.cert.X509Certificate signCert
      • digest

        private byte[] digest
      • messageDigest

        private java.security.MessageDigest messageDigest
      • digestAlgorithm

        private java.lang.String digestAlgorithm
      • digestEncryptionAlgorithm

        private java.lang.String digestEncryptionAlgorithm
      • sig

        private java.security.Signature sig
      • privKey

        private transient java.security.PrivateKey privKey
      • RSAdata

        private byte[] RSAdata
      • verified

        private boolean verified
      • verifyResult

        private boolean verifyResult
      • externalDigest

        private byte[] externalDigest
      • externalRSAdata

        private byte[] externalRSAdata
      • reason

        private java.lang.String reason
        Holds value of property reason.
      • location

        private java.lang.String location
        Holds value of property location.
      • signDate

        private java.util.Calendar signDate
        Holds value of property signDate.
      • signName

        private java.lang.String signName
        Holds value of property signName.
      • timeStampToken

        private org.bouncycastle.tsp.TimeStampToken timeStampToken
      • basicResp

        private org.bouncycastle.cert.ocsp.BasicOCSPResp basicResp
    • Constructor Detail

      • PdfPKCS7

        public PdfPKCS7​(byte[] contentsKey,
                        byte[] certsKey,
                        java.lang.String provider)
        Verifies a signature using the sub-filter adbe.x509.rsa_sha1.
        Parameters:
        contentsKey - the /Contents key
        certsKey - the /Cert key
        provider - the provider or null for the default provider
      • PdfPKCS7

        public PdfPKCS7​(byte[] contentsKey,
                        java.lang.String provider)
        Verifies a signature using the sub-filter adbe.pkcs7.detached or adbe.pkcs7.sha1.
        Parameters:
        contentsKey - the /Contents key
        provider - the provider or null for the default provider
      • PdfPKCS7

        public PdfPKCS7​(java.security.PrivateKey privKey,
                        java.security.cert.Certificate[] certChain,
                        java.security.cert.CRL[] crlList,
                        java.lang.String hashAlgorithm,
                        java.lang.String provider,
                        boolean hasRSAdata)
                 throws java.security.InvalidKeyException,
                        java.security.NoSuchProviderException,
                        java.security.NoSuchAlgorithmException
        Generates a signature.
        Parameters:
        privKey - the private key
        certChain - the certificate chain
        crlList - the certificate revocation list
        hashAlgorithm - the hash algorithm
        provider - the provider or null for the default provider
        hasRSAdata - true if the sub-filter is adbe.pkcs7.sha1
        Throws:
        java.security.InvalidKeyException - on error
        java.security.NoSuchProviderException - on error
        java.security.NoSuchAlgorithmException - on error
    • Method Detail

      • getOidForAlgorithmAndHash

        private static java.lang.String getOidForAlgorithmAndHash​(java.lang.String signingAlgorithm,
                                                                  java.lang.String hashAlgorithm)
        Determines an OID by signing and hash algorithm. If nothing is found null will be returned.
        Parameters:
        signingAlgorithm - - currently RSA, DSA and ECDSA are supported.
        hashAlgorithm - like SHA1, SHA2 or SHA3
      • getDigest

        public static java.lang.String getDigest​(java.lang.String oid)
        Gets the digest name for a certain id
        Parameters:
        oid - an id (for instance "1.2.840.113549.2.5")
        Returns:
        a digest name (for instance "MD5")
        Since:
        2.1.6
      • getAlgorithm

        public static java.lang.String getAlgorithm​(java.lang.String oid)
        Gets the algorithm name for a certain id.
        Parameters:
        oid - an id (for instance "1.2.840.113549.1.1.1")
        Returns:
        an algorithm name (for instance "RSA")
        Since:
        2.1.6
      • getDigestOid

        public static java.lang.String getDigestOid​(java.lang.String digestName)
        Gets the oid for given digest name.
        Parameters:
        digestName - digest name (for instance "SHA-256")
        Returns:
        a digest OID (for instance "2.16.840.1.101.3.4.2.1") or null if the oid for provided name is not found
      • loadCacertsKeyStore

        public static java.security.KeyStore loadCacertsKeyStore()
        Loads the default root certificates at <java.home>/lib/security/cacerts with the default provider.
        Returns:
        a KeyStore
      • loadCacertsKeyStore

        public static java.security.KeyStore loadCacertsKeyStore​(java.lang.String provider)
        Loads the default root certificates at <java.home>/lib/security/cacerts.
        Parameters:
        provider - the provider or null for the default provider
        Returns:
        a KeyStore
      • verifyCertificate

        public static java.lang.String verifyCertificate​(java.security.cert.X509Certificate cert,
                                                         java.util.Collection crls,
                                                         java.util.Calendar calendar)
        Verifies a single certificate.
        Parameters:
        cert - the certificate to verify
        crls - the certificate revocation list or null
        calendar - the date or null for the current date
        Returns:
        a String with the error description or null if no error
      • verifyCertificates

        public static java.lang.Object[] verifyCertificates​(java.security.cert.Certificate[] certs,
                                                            java.security.KeyStore keystore,
                                                            java.util.Collection crls,
                                                            java.util.Calendar calendar)
        Verifies a certificate chain against a KeyStore.
        Parameters:
        certs - the certificate chain
        keystore - the KeyStore
        crls - the certificate revocation list or null
        calendar - the date or null for the current date
        Returns:
        null if the certificate chain could be validated or a Object[]{cert,error} where cert is the failed certificate and error is the error message
      • getOCSPURL

        public static java.lang.String getOCSPURL​(java.security.cert.X509Certificate certificate)
        Retrieves the OCSP URL from the given certificate.
        Parameters:
        certificate - the certificate
        Returns:
        the URL or null
        Since:
        2.1.6
      • getExtensionValue

        private static org.bouncycastle.asn1.ASN1Primitive getExtensionValue​(java.security.cert.X509Certificate cert,
                                                                             java.lang.String oid)
                                                                      throws java.io.IOException
        Throws:
        java.io.IOException
      • getStringFromGeneralName

        private static java.lang.String getStringFromGeneralName​(org.bouncycastle.asn1.ASN1Primitive names)
      • getIssuer

        private static org.bouncycastle.asn1.ASN1Primitive getIssuer​(byte[] enc)
        Get the "issuer" from the TBSCertificate bytes that are passed in
        Parameters:
        enc - a TBSCertificate in a byte array
        Returns:
        a ASN1Primitive
      • getSubject

        private static org.bouncycastle.asn1.ASN1Primitive getSubject​(byte[] enc)
        Get the "subject" from the TBSCertificate bytes that are passed in
        Parameters:
        enc - A TBSCertificate in a byte array
        Returns:
        a ASN1Primitive
      • getIssuerFields

        public static PdfPKCS7.X509Name getIssuerFields​(java.security.cert.X509Certificate cert)
        Get the issuer fields from an X509 Certificate
        Parameters:
        cert - an X509Certificate
        Returns:
        an X509Name
      • getSubjectFields

        public static PdfPKCS7.X509Name getSubjectFields​(java.security.cert.X509Certificate cert)
        Get the subject fields from an X509 Certificate
        Parameters:
        cert - an X509Certificate
        Returns:
        an X509Name
      • getStandardJavaName

        private static java.lang.String getStandardJavaName​(java.lang.String algName)
      • getTimeStampToken

        public org.bouncycastle.tsp.TimeStampToken getTimeStampToken()
        Gets the timestamp token if there is one.
        Returns:
        the timestamp token or null
        Since:
        2.1.6
      • getTimeStampDate

        public java.util.Calendar getTimeStampDate()
        Gets the timestamp date
        Returns:
        a date
        Since:
        2.1.6
      • getOcsp

        public org.bouncycastle.cert.ocsp.BasicOCSPResp getOcsp()
        Gets the OCSP basic response if there is one.
        Returns:
        the OCSP basic response or null
        Since:
        2.1.6
      • findOcsp

        private void findOcsp​(org.bouncycastle.asn1.ASN1Sequence seq)
                       throws java.io.IOException
        Throws:
        java.io.IOException
      • update

        public void update​(byte[] buf,
                           int off,
                           int len)
                    throws java.security.SignatureException
        Update the digest with the specified bytes. This method is used both for signing and verifying
        Parameters:
        buf - the data buffer
        off - the offset in the data buffer
        len - the data length
        Throws:
        java.security.SignatureException - on error
      • verify

        public boolean verify()
                       throws java.security.SignatureException
        Verify the digest.
        Returns:
        true if the signature checks out, false otherwise
        Throws:
        java.security.SignatureException - on error
      • verifyTimestampImprint

        public boolean verifyTimestampImprint()
                                       throws java.security.NoSuchAlgorithmException
        Checks if the timestamp refers to this document.
        Returns:
        true if it checks false otherwise
        Throws:
        java.security.NoSuchAlgorithmException - on error
        Since:
        2.1.6
      • getCertificates

        public java.security.cert.Certificate[] getCertificates()
        Get all the X.509 certificates associated with this PKCS#7 object in no particular order. Other certificates, from OCSP for example, will also be included.
        Returns:
        the X.509 certificates associated with this PKCS#7 object
      • getSignCertificateChain

        public java.security.cert.Certificate[] getSignCertificateChain()
        Get the X.509 sign certificate chain associated with this PKCS#7 object. Only the certificates used for the main signature will be returned, with the signing certificate first.
        Returns:
        the X.509 certificates associated with this PKCS#7 object
        Since:
        2.1.6
      • signCertificateChain

        private void signCertificateChain()
      • getCRLs

        public java.util.Collection getCRLs()
        Get the X.509 certificate revocation lists associated with this PKCS#7 object
        Returns:
        the X.509 certificate revocation lists associated with this PKCS#7 object
      • getSigningCertificate

        public java.security.cert.X509Certificate getSigningCertificate()
        Get the X.509 certificate actually used to sign the digest.
        Returns:
        the X.509 certificate actually used to sign the digest
      • getVersion

        public int getVersion()
        Get the version of the PKCS#7 object. Always 1
        Returns:
        the version of the PKCS#7 object. Always 1
      • getSigningInfoVersion

        public int getSigningInfoVersion()
        Get the version of the PKCS#7 "SignerInfo" object. Always 1
        Returns:
        the version of the PKCS#7 "SignerInfo" object. Always 1
      • getDigestAlgorithm

        public java.lang.String getDigestAlgorithm()
        Get the algorithm used to calculate the message digest
        Returns:
        the algorithm used to calculate the message digest
      • getHashAlgorithm

        public java.lang.String getHashAlgorithm()
        Returns the algorithm.
        Returns:
        the digest algorithm
      • isRevocationValid

        public boolean isRevocationValid()
        Checks if OCSP revocation refers to the document signing certificate.
        Returns:
        true if it checks false otherwise
        Since:
        2.1.6
      • getEncodedPKCS1

        public byte[] getEncodedPKCS1()
        Gets the bytes for the PKCS#1 object.
        Returns:
        a byte array
      • setExternalDigest

        public void setExternalDigest​(byte[] digest,
                                      byte[] RSAdata,
                                      java.lang.String digestEncryptionAlgorithm)
        Sets the digest/signature to an external calculated value.
        Parameters:
        digest - the digest. This is the actual signature
        RSAdata - the extra data that goes into the data tag in PKCS#7
        digestEncryptionAlgorithm - the encryption algorithm. It may must be null if the digest is also null. If the digest is not null then it may be "RSA" or "DSA"
      • getEncodedPKCS7

        public byte[] getEncodedPKCS7()
        Gets the bytes for the PKCS7SignedData object.
        Returns:
        the bytes for the PKCS7SignedData object
      • getEncodedPKCS7

        public byte[] getEncodedPKCS7​(byte[] secondDigest,
                                      java.util.Calendar signingTime)
        Gets the bytes for the PKCS7SignedData object. Optionally the authenticatedAttributes in the signerInfo can also be set. If either of the parameters is null, none will be used.
        Parameters:
        secondDigest - the digest in the authenticatedAttributes
        signingTime - the signing time in the authenticatedAttributes
        Returns:
        the bytes for the PKCS7SignedData object
      • getEncodedPKCS7

        public byte[] getEncodedPKCS7​(byte[] secondDigest,
                                      java.util.Calendar signingTime,
                                      TSAClient tsaClient,
                                      byte[] ocsp)
        Gets the bytes for the PKCS7SignedData object. Optionally the authenticatedAttributes in the signerInfo can also be set, OR a time-stamp-authority client may be provided.
        Parameters:
        secondDigest - the digest in the authenticatedAttributes
        signingTime - the signing time in the authenticatedAttributes
        tsaClient - TSAClient - null or an optional time stamp authority client
        ocsp - a byte array
        Returns:
        byte[] the bytes for the PKCS7SignedData object
        Since:
        2.1.6
      • buildUnauthenticatedAttributes

        private org.bouncycastle.asn1.ASN1EncodableVector buildUnauthenticatedAttributes​(byte[] timeStampToken)
                                                                                  throws java.io.IOException
        Added by Aiken Sam, 2006-11-15, modifed by Martin Brunecky 07/12/2007 to start with the timeStampToken (signedData 1.2.840.113549.1.7.2). Token is the TSA response without response status, which is usually handled by the (vendor supplied) TSA request/response interface).
        Parameters:
        timeStampToken - byte[] - time stamp token, DER encoded signedData
        Returns:
        ASN1EncodableVector
        Throws:
        java.io.IOException
      • getAuthenticatedAttributeBytes

        public byte[] getAuthenticatedAttributeBytes​(byte[] secondDigest,
                                                     java.util.Calendar signingTime,
                                                     byte[] ocsp)
        When using authenticatedAttributes the authentication process is different. The document digest is generated and put inside the attribute. The signing is done over the DER encoded authenticatedAttributes. This method provides that encoding and the parameters must be exactly the same as in getEncodedPKCS7(byte[], Calendar). A simple example:
         Calendar cal = Calendar.getInstance();
         PdfPKCS7 pk7 = new PdfPKCS7(key, chain, null, "SHA1", null, false);
         MessageDigest messageDigest = MessageDigest.getInstance("SHA1");
         byte buf[] = new byte[8192];
         int n;
         InputStream inp = sap.getRangeStream();
         while ((n = inp.read(buf)) > 0) {
           messageDigest.update(buf, 0, n);
         }
         byte hash[] = messageDigest.digest();
         byte sh[] = pk7.getAuthenticatedAttributeBytes(hash, cal);
         pk7.update(sh, 0, sh.length);
         byte sg[] = pk7.getEncodedPKCS7(hash, cal);
         
        Parameters:
        secondDigest - the content digest
        signingTime - the signing time
        ocsp - a byte array
        Returns:
        the byte array representation of the authenticatedAttributes ready to be signed
      • getAuthenticatedAttributeSet

        private org.bouncycastle.asn1.DERSet getAuthenticatedAttributeSet​(byte[] secondDigest,
                                                                          java.util.Calendar signingTime,
                                                                          byte[] ocsp)
      • getReason

        public java.lang.String getReason()
        Getter for property reason.
        Returns:
        Value of property reason.
      • setReason

        public void setReason​(java.lang.String reason)
        Setter for property reason.
        Parameters:
        reason - New value of property reason.
      • getLocation

        public java.lang.String getLocation()
        Getter for property location.
        Returns:
        Value of property location.
      • setLocation

        public void setLocation​(java.lang.String location)
        Setter for property location.
        Parameters:
        location - New value of property location.
      • getSignDate

        public java.util.Calendar getSignDate()
        Getter for property signDate.
        Returns:
        Value of property signDate.
      • setSignDate

        public void setSignDate​(java.util.Calendar signDate)
        Setter for property signDate.
        Parameters:
        signDate - New value of property signDate.
      • getSignName

        public java.lang.String getSignName()
        Getter for property sigName.
        Returns:
        Value of property sigName.
      • setSignName

        public void setSignName​(java.lang.String signName)
        Setter for property sigName.
        Parameters:
        signName - New value of property sigName.