* SignedData ::= SEQUENCE {
* version Version, -- always 1 for PKCS7 v1.5
* digestAlgorithms DigestAlgorithmIdentifiers,
* contentInfo ContentInfo,
* certificates [0] IMPLICIT ExtendedCertificatesAndCertificates OPTIONAL,
* crls [1] IMPLICIT CertificateRevocationLists OPTIONAL,
* signerInfos SignerInfos }
*
* Version ::= INTEGER
*
* DigestAlgorithmIdentifiers ::= SET OF DigestAlgorithmIdentifier
*
* DigestAlgorithmIdentifier ::= AlgorithmIdentifier
*
* ContentInfo ::= SEQUENCE {
* contentType ContentType,
* content [0] EXPLICIT ANY DEFINED BY contentType OPTIONAL }
*
* ContentType ::= OBJECT IDENTIFIER
*
* ExtendedCertificatesAndCertificates ::=
* SET OF ExtendedCertificatesAndCertificate
*
* ExtendedCertificatesAndCertificate ::= CHOICE {
* certificate Certificate, -- from X.509
* extendedCertificate [0] IMPLICIT ExtendedCertificate }
*
* CertificateRevocationLists ::= SET OF CertificateRevocationList
* -- from X.509
*
* SignerInfos ::= SET OF SignerInfo
*
* SignerInfo ::= SEQUENCE {
* version Version, -- always 1 for PKCS7 v1.5
* issuerAndSerialNumber IssuerAndSerialNumber,
* digestAlgorithm DigestAlgorithmIdentifier,
* authenticatedAttributes [0] IMPLICIT Attributes OPTIONAL,
* digestEncryptionAlgorithm DigestEncryptionAlgorithmIdentifier,
* encryptedDigest EncryptedDigest,
* unauthenticatedAttributes [1] IMPLICIT Attributes OPTIONAL }
*
* EncryptedDigest ::= OCTET STRING
*
*
* (Readers who are confused as to why it takes 40 levels of indirection * to specify "data with a signature", rest assured that the present author * is as confused as you are).
*/ public PKCS7SignedData(BERReader ber) throws CRLException, CertificateException, IOException { CertificateFactory x509 = CertificateFactory.getInstance("X509"); DERValue val = ber.read(); if (!val.isConstructed()) throw new BEREncodingException("malformed ContentInfo"); val = ber.read(); if (val.getTag() != BER.OBJECT_IDENTIFIER) throw new BEREncodingException("malformed ContentType"); if (!PKCS7_SIGNED_DATA.equals(val.getValue())) throw new BEREncodingException("content is not SignedData"); val = ber.read(); if (val.getTag() != 0) throw new BEREncodingException("malformed Content"); val = ber.read(); if (!val.isConstructed()) throw new BEREncodingException("malformed SignedData"); if (Configuration.DEBUG) log.fine("SignedData: " + val); val = ber.read(); if (val.getTag() != BER.INTEGER) throw new BEREncodingException("expecting Version"); version = (BigInteger) val.getValue(); if (Configuration.DEBUG) log.fine(" Version: " + version); digestAlgorithms = new HashSet(); val = ber.read(); if (!val.isConstructed()) throw new BEREncodingException("malformed DigestAlgorithmIdentifiers"); if (Configuration.DEBUG) log.fine(" DigestAlgorithmIdentifiers: " + val); int count = 0; DERValue val2 = ber.read(); while (val2 != BER.END_OF_SEQUENCE && (val.getLength() > 0 && val.getLength() > count)) { if (!val2.isConstructed()) throw new BEREncodingException("malformed AlgorithmIdentifier"); if (Configuration.DEBUG) log.fine(" AlgorithmIdentifier: " + val2); count += val2.getEncodedLength(); val2 = ber.read(); if (val2.getTag() != BER.OBJECT_IDENTIFIER) throw new BEREncodingException("malformed AlgorithmIdentifier"); if (Configuration.DEBUG) log.fine(" digestAlgorithmIdentifiers OID: " + val2.getValue()); List algId = new ArrayList(2); algId.add(val2.getValue()); val2 = ber.read(); if (val2 != BER.END_OF_SEQUENCE) { count += val2.getEncodedLength(); if (val2.getTag() == BER.NULL) algId.add(null); else algId.add(val2.getEncoded()); if (val2.isConstructed()) ber.skip(val2.getLength()); if (BERValue.isIndefinite(val)) val2 = ber.read(); } else algId.add(null); if (Configuration.DEBUG) { log.fine(" digestAlgorithmIdentifiers params: "); log.fine(Util.dumpString((byte[]) algId.get(1), " digestAlgorithmIdentifiers params: ")); } digestAlgorithms.add(algId); } val = ber.read(); if (!val.isConstructed()) throw new BEREncodingException("malformed ContentInfo"); if (Configuration.DEBUG) log.fine(" ContentInfo: " + val); val2 = ber.read(); if (val2.getTag() != BER.OBJECT_IDENTIFIER) throw new BEREncodingException("malformed ContentType"); contentType = (OID) val2.getValue(); if (Configuration.DEBUG) log.fine(" ContentType OID: " + contentType); if (BERValue.isIndefinite(val) || (val.getLength() > 0 && val.getLength() > val2.getEncodedLength())) { val2 = ber.read(); if (val2 != BER.END_OF_SEQUENCE) { content = val2.getEncoded(); if (BERValue.isIndefinite(val)) val2 = ber.read(); } } if (Configuration.DEBUG) { log.fine(" Content: "); log.fine(Util.dumpString(content, " Content: ")); } val = ber.read(); if (val.getTag() == 0) { if (!val.isConstructed()) throw new BEREncodingException("malformed ExtendedCertificatesAndCertificates"); if (Configuration.DEBUG) log.fine(" ExtendedCertificatesAndCertificates: " + val); count = 0; val2 = ber.read(); List certs = new LinkedList(); while (val2 != BER.END_OF_SEQUENCE && (val.getLength() > 0 && val.getLength() > count)) { Certificate cert = x509.generateCertificate(new ByteArrayInputStream(val2.getEncoded())); if (Configuration.DEBUG) log.fine(" Certificate: " + cert); certs.add(cert); count += val2.getEncodedLength(); ber.skip(val2.getLength()); if (BERValue.isIndefinite(val) || val.getLength() > count) val2 = ber.read(); } certificates = (Certificate[]) certs.toArray(new Certificate[certs.size()]); val = ber.read(); } if (val.getTag() == 1) { if (!val.isConstructed()) throw new BEREncodingException("malformed CertificateRevocationLists"); if (Configuration.DEBUG) log.fine(" CertificateRevocationLists: " + val); count = 0; val2 = ber.read(); List crls = new LinkedList(); while (val2 != BER.END_OF_SEQUENCE && (val.getLength() > 0 && val.getLength() > count)) { CRL crl = x509.generateCRL(new ByteArrayInputStream(val2.getEncoded())); if (Configuration.DEBUG) log.fine(" CRL: " + crl); crls.add(crl); count += val2.getEncodedLength(); ber.skip(val2.getLength()); if (BERValue.isIndefinite(val) || val.getLength() > count) val2 = ber.read(); } this.crls = (CRL[]) crls.toArray(new CRL[crls.size()]); val = ber.read(); } signerInfos = new HashSet(); if (!val.isConstructed()) throw new BEREncodingException("malformed SignerInfos"); if (Configuration.DEBUG) log.fine(" SignerInfos: " + val); // FIXME read this more carefully. // Since we are just reading a file (probably) we just read until we // reach the end. while (true) { int i = ber.peek(); if (i == 0 || i == -1) break; signerInfos.add(new SignerInfo(ber)); } } /** * Constructs a new instance ofPKCS7SignedData given a
* designated set of fields.
*
* @param digestAlgorithms the collection of DigestAlgorithm elements. Each
* DigestAlgorithm is a {@link List} of two elements, the first is an
* OID while the second is dependent on the value of the OID element.
* @param data an instance of a PKCS#7 (non-signed) data. In its simplest form
* such an ASN.1 structure would consist of just the OID of a
* non-signed PKCS#7 Data.
* @param certificates the array of Certificates used to authenticate the
* enclosed (or referenced, in case the content is null) data.
* @param crls the array of certificate-revocation lists of the used
* certificates.
* @param signerInfos a set of {@link SignerInfo} elements, one per signer of
* the data referenced by this PKCS7SignedData
* instance.
*/
public PKCS7SignedData(Set digestAlgorithms, PKCS7Data data,
Certificate[] certificates, X509CRL[] crls,
Set signerInfos)
{
super();
this.version = BigInteger.ONE;
this.digestAlgorithms = digestAlgorithms;
this.contentType = PKCS7_SIGNED_DATA;
this.content = data == null ? null : data.getEncoded();
this.certificates = certificates;
this.crls = crls;
this.signerInfos = signerInfos;
}
public BigInteger getVersion()
{
return version;
}
public Certificate[] getCertificates()
{
return (certificates != null ? (Certificate[]) certificates.clone()
: null);
}
public OID getContentType()
{
return contentType;
}
public byte[] getContent()
{
return (content != null ? (byte[]) content.clone() : null);
}
public Set getDigestAlgorithms()
{
// FIXME copy contents too, they are mutable!!!
return Collections.unmodifiableSet(digestAlgorithms);
}
public Set getSignerInfos()
{
Set copy = new HashSet();
for (Iterator it = signerInfos.iterator(); it.hasNext(); )
copy.add(it.next());
return Collections.unmodifiableSet(copy);
}
/**
* Writes to the designated output stream the DER encoding of the current
* contents of this instance.
*
* @param out the destination output stream.
* @throws IOException if an I/O related exception occurs during the process.
* @throws CRLException if an exception occurs while encoding the certificate
* revocation lists associated with this instance.
* @throws CertificateEncodingException if an exception occurs while encoding
* the certificate chains associated with this instance.
*/
public void encode(OutputStream out) throws IOException, CRLException,
CertificateEncodingException
{
DERValue derVersion = new DERValue(DER.INTEGER, version);
DERValue derDigestAlgorithms = new DERValue(DER.CONSTRUCTED | DER.SET,
digestAlgorithms);
DERValue derContentType = new DERValue(DER.OBJECT_IDENTIFIER,
PKCS7Data.PKCS7_DATA);
ArrayList contentInfo = new ArrayList(2);
contentInfo.add(derContentType);
if (content == null)
contentInfo.add(new DERValue(DER.NULL, null));
else
contentInfo.add(content);
DERValue derContentInfo = new DERValue(DER.CONSTRUCTED | DER.SEQUENCE,
contentInfo);
ByteArrayOutputStream baos = new ByteArrayOutputStream(4096);
for (int i = 0; i < certificates.length; i++)
baos.write(certificates[i].getEncoded());
baos.flush();
byte[] b = baos.toByteArray();
DERValue derExtendedCertificatesAndCertificates =
new DERValue(DER.CONSTRUCTED | DER.CONTEXT | 0, b.length, b, null);
DERValue derCertificateRevocationLists = null;
if (crls != null && crls.length > 0)
{
baos.reset();
for (int i = 0; i < crls.length; i++)
baos.write(((X509CRL) crls[i]).getEncoded());
baos.flush();
byte[] b2 = baos.toByteArray();
derCertificateRevocationLists =
new DERValue(DER.CONSTRUCTED | DER.CONTEXT | 1, b2.length, b2, null);
}
baos.reset();
for (Iterator it = signerInfos.iterator(); it.hasNext();)
{
SignerInfo signerInfo = (SignerInfo) it.next();
signerInfo.encode(baos);
}
baos.flush();
byte[] b3 = baos.toByteArray();
DERValue derSignerInfos = new DERValue(DER.CONSTRUCTED | DER.SET,
b3.length, b3, null);
ArrayList signedData = new ArrayList(6);
signedData.add(derVersion);
signedData.add(derDigestAlgorithms);
signedData.add(derContentInfo);
signedData.add(derExtendedCertificatesAndCertificates);
if (derCertificateRevocationLists != null)
signedData.add(derCertificateRevocationLists);
signedData.add(derSignerInfos);
DERValue derSignedData = new DERValue(DER.CONSTRUCTED | DER.SEQUENCE,
signedData);
// now the outer contents
ArrayList outer = new ArrayList(3);
outer.add(new DERValue(DER.OBJECT_IDENTIFIER, PKCS7_SIGNED_DATA));
outer.add(new DERValue(DER.CONTEXT | 0, null));
outer.add(derSignedData);
DERValue derOuter = new DERValue(DER.CONSTRUCTED | DER.SEQUENCE, outer);
DERWriter.write(out, derOuter);
}
}