Java CMSTypedData.getContent方法代码示例

import org.bouncycastle.cms.CMSTypedData; //导入方法依赖的package包/类
/**
 * This method returns the signed content of CMSSignedData.
 *
 * @param cmsSignedData
 *            the already signed {@code CMSSignedData}
 * @return the original toSignDocument or null
 */
private DSSDocument getSignedContent(final CMSSignedData cmsSignedData) {
	if (cmsSignedData != null) {
		final CMSTypedData signedContent = cmsSignedData.getSignedContent();
		final byte[] documentBytes = (signedContent != null) ? (byte[]) signedContent.getContent() : null;
		final InMemoryDocument inMemoryDocument = new InMemoryDocument(documentBytes);
		return inMemoryDocument;
	}
	return null;
}
 

import org.bouncycastle.cms.CMSTypedData; //导入方法依赖的package包/类
private byte[] getCmsData(byte[] cms) throws Exception {
	CMSSignedData cmsSignedData = new CMSSignedData(cms);
	SignerInformationStore signers = cmsSignedData.getSignerInfos();
	SignerInformation signer = (SignerInformation) signers.getSigners().iterator().next();
	SignerId signerId = signer.getSID();

	Store certificateStore = cmsSignedData.getCertificates();
	Collection<X509CertificateHolder> certificateCollection = certificateStore.getMatches(signerId);

	X509CertificateHolder certificateHolder = certificateCollection.iterator().next();
	CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
	X509Certificate certificate = (X509Certificate) certificateFactory
			.generateCertificate(new ByteArrayInputStream(certificateHolder.getEncoded()));
	// we trust SSL here, no need for explicit verification of CMS signing
	// certificate

	LOG.debug("CMS signing certificate subject: " + certificate.getSubjectX500Principal());

	SignerInformationVerifier signerInformationVerifier = new JcaSimpleSignerInfoVerifierBuilder()
			.build(certificate);
	boolean signatureResult = signer.verify(signerInformationVerifier);
	if (false == signatureResult) {
		throw new SecurityException("woops");
	}

	CMSTypedData signedContent = cmsSignedData.getSignedContent();
	byte[] responseData = (byte[]) signedContent.getContent();

	return responseData;
}
 

import org.bouncycastle.cms.CMSTypedData; //导入方法依赖的package包/类
private byte[] getVerifiedContent(byte[] cmsData)
		throws CertificateException, CMSException, IOException,
		OperatorCreationException {
	CMSSignedData cmsSignedData = new CMSSignedData(cmsData);
	SignerInformationStore signers = cmsSignedData.getSignerInfos();
	SignerInformation signer = (SignerInformation) signers.getSigners()
			.iterator().next();
	SignerId signerId = signer.getSID();

	Store certificateStore = cmsSignedData.getCertificates();
	Collection<X509CertificateHolder> certificateCollection = certificateStore
			.getMatches(signerId);
	if (false == certificateCollection.isEmpty()) {
		X509CertificateHolder certificateHolder = certificateCollection
				.iterator().next();
		CertificateFactory certificateFactory = CertificateFactory
				.getInstance("X.509");
		X509Certificate certificate = (X509Certificate) certificateFactory
				.generateCertificate(new ByteArrayInputStream(
						certificateHolder.getEncoded()));

		SignerInformationVerifier signerInformationVerifier = new JcaSimpleSignerInfoVerifierBuilder()
				.build(certificate);
		boolean signatureResult = signer.verify(signerInformationVerifier);
		assertTrue(signatureResult);

		LOG.debug("signer certificate: " + certificate);
	} else {
		LOG.warn("no signer matched");
	}

	CMSTypedData signedContent = cmsSignedData.getSignedContent();
	byte[] data = (byte[]) signedContent.getContent();
	return data;
}
 

import org.bouncycastle.cms.CMSTypedData; //导入方法依赖的package包/类
@Test
public void testReadEncryptionToken() throws Exception {
	InputStream etkInputStream = EncryptionTokenTest.class
			.getResourceAsStream("/etk-fcorneli.der");
	assertNotNull(etkInputStream);

	CMSSignedData cmsSignedData = new CMSSignedData(etkInputStream);
	LOG.debug("SignedData version: " + cmsSignedData.getVersion());

	SignerInformationStore signers = cmsSignedData.getSignerInfos();
	LOG.debug("signers: " + signers.size());
	SignerInformation signer = (SignerInformation) signers.getSigners()
			.iterator().next();
	SignerId signerId = signer.getSID();
	LOG.debug("signer Id: " + signerId.getIssuer());

	Store certificateStore = cmsSignedData.getCertificates();
	@SuppressWarnings("unchecked")
	Collection<X509CertificateHolder> certificateCollection = certificateStore
			.getMatches(signerId);
	X509CertificateHolder certificateHolder = certificateCollection
			.iterator().next();

	LOG.debug("certificate collection size: "
			+ certificateCollection.size());

	CertificateFactory certificateFactory = CertificateFactory
			.getInstance("X.509");
	X509Certificate certificate = (X509Certificate) certificateFactory
			.generateCertificate(new ByteArrayInputStream(certificateHolder
					.getEncoded()));
	LOG.debug("signer certificate: " + certificate);

	CMSTypedData signedContent = cmsSignedData.getSignedContent();
	byte[] data = (byte[]) signedContent.getContent();

	X509Certificate encryptionCertificate = (X509Certificate) certificateFactory
			.generateCertificate(new ByteArrayInputStream(data));
	LOG.debug("encryption certificate: " + encryptionCertificate);
}
 

import org.bouncycastle.cms.CMSTypedData; //导入方法依赖的package包/类
private X509Certificate parseEncryptionCertificate(byte[] encodedEncryptionToken)
		throws CMSException, CertificateException, IOException, OperatorCreationException {
	CMSSignedData cmsSignedData = new CMSSignedData(encodedEncryptionToken);

	// get signer identifier
	SignerInformationStore signers = cmsSignedData.getSignerInfos();
	SignerInformation signer = (SignerInformation) signers.getSigners().iterator().next();
	SignerId signerId = signer.getSID();

	// get signer certificate
	Store certificateStore = cmsSignedData.getCertificates();
	LOG.debug("certificate store type: " + certificateStore.getClass().getName());
	@SuppressWarnings("unchecked")
	Collection<X509CertificateHolder> signingCertificateCollection = certificateStore.getMatches(signerId);
	X509CertificateHolder signingCertificateHolder = signingCertificateCollection.iterator().next();
	CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
	X509Certificate signingCertificate = (X509Certificate) certificateFactory
			.generateCertificate(new ByteArrayInputStream(signingCertificateHolder.getEncoded()));
	LOG.debug("signing certificate: " + signingCertificate.getSubjectX500Principal());

	// verify CMS signature
	SignerInformationVerifier signerInformationVerifier = new JcaSimpleSignerInfoVerifierBuilder()
			.build(signingCertificate);
	boolean signatureResult = signer.verify(signerInformationVerifier);
	if (false == signatureResult) {
		throw new SecurityException("ETK signature invalid");
	}

	// get encryption certificate
	CMSTypedData signedContent = cmsSignedData.getSignedContent();
	byte[] data = (byte[]) signedContent.getContent();
	X509Certificate encryptionCertificate = (X509Certificate) certificateFactory
			.generateCertificate(new ByteArrayInputStream(data));

	LOG.debug("all available certificates:");
	logCertificates(certificateStore, null);

	// get authentication certificate
	CustomSelector authenticationSelector = new CustomSelector();
	authenticationSelector.setSubject(encryptionCertificate.getIssuerX500Principal());
	@SuppressWarnings("unchecked")
	Collection<X509CertificateHolder> authenticationCertificates = certificateStore
			.getMatches(authenticationSelector);
	if (authenticationCertificates.size() != 1) {
		LOG.debug("no authentication certificate match");
	}
	X509CertificateHolder authenticationCertificateHolder = authenticationCertificates.iterator().next();
	this.authenticationCertificate = (X509Certificate) certificateFactory
			.generateCertificate(new ByteArrayInputStream(authenticationCertificateHolder.getEncoded()));

	verifyProxyCertificate(encryptionCertificate, this.authenticationCertificate);

	return encryptionCertificate;
}
 

import org.bouncycastle.cms.CMSTypedData; //导入方法依赖的package包/类
private byte[] getVerifiedContent(byte[] cmsData)
		throws CertificateException, CMSException, IOException,
		OperatorCreationException {
	CMSSignedData cmsSignedData = new CMSSignedData(cmsData);
	SignerInformationStore signers = cmsSignedData.getSignerInfos();
	SignerInformation signer = (SignerInformation) signers.getSigners()
			.iterator().next();
	SignerId signerId = signer.getSID();

	Store certificateStore = cmsSignedData.getCertificates();
	@SuppressWarnings("unchecked")
	Collection<X509CertificateHolder> certificateCollection = certificateStore
			.getMatches(signerId);
	if (null == this.senderCertificate) {
		if (certificateCollection.isEmpty()) {
			throw new SecurityException("no sender certificate present");
		}
		X509CertificateHolder certificateHolder = certificateCollection
				.iterator().next();
		CertificateFactory certificateFactory = CertificateFactory
				.getInstance("X.509");
		X509Certificate certificate = (X509Certificate) certificateFactory
				.generateCertificate(new ByteArrayInputStream(
						certificateHolder.getEncoded()));

		this.senderCertificate = certificate;
		LOG.debug("signer certificate subject: "
				+ certificate.getSubjectX500Principal());
	}

	/*
	 * By reusing the sender certificate we have the guarantee that the
	 * outer signature and inner signature share the same origin.
	 */
	SignerInformationVerifier signerInformationVerifier = new JcaSimpleSignerInfoVerifierBuilder()
			.build(this.senderCertificate);
	boolean signatureResult = signer.verify(signerInformationVerifier);
	if (false == signatureResult) {
		throw new SecurityException("woops");
	}

	CMSTypedData signedContent = cmsSignedData.getSignedContent();
	byte[] data = (byte[]) signedContent.getContent();
	return data;
}
 

import org.bouncycastle.cms.CMSTypedData; //导入方法依赖的package包/类
@Test
public void testSeal() throws Exception {
	InputStream sealInputStream = SealTest.class
			.getResourceAsStream("/seal-fcorneli.der");
	assertNotNull(sealInputStream);

	// check outer signature

	CMSSignedData cmsSignedData = new CMSSignedData(sealInputStream);
	SignerInformationStore signers = cmsSignedData.getSignerInfos();
	SignerInformation signer = (SignerInformation) signers.getSigners()
			.iterator().next();
	SignerId signerId = signer.getSID();

	Store certificateStore = cmsSignedData.getCertificates();
	@SuppressWarnings("unchecked")
	Collection<X509CertificateHolder> certificateCollection = certificateStore
			.getMatches(signerId);
	X509CertificateHolder certificateHolder = certificateCollection
			.iterator().next();
	CertificateFactory certificateFactory = CertificateFactory
			.getInstance("X.509");
	X509Certificate certificate = (X509Certificate) certificateFactory
			.generateCertificate(new ByteArrayInputStream(certificateHolder
					.getEncoded()));

	Security.addProvider(new BouncyCastleProvider());
	SignerInformationVerifier signerInformationVerifier = new JcaSimpleSignerInfoVerifierBuilder()
			.build(certificate);
	boolean signatureResult = signer.verify(signerInformationVerifier);
	assertTrue(signatureResult);

	LOG.debug("signer certificate: " + certificate);

	CMSTypedData signedContent = cmsSignedData.getSignedContent();
	byte[] data = (byte[]) signedContent.getContent();

	// decrypt content

	CMSEnvelopedDataParser cmsEnvelopedDataParser = new CMSEnvelopedDataParser(
			data);
	LOG.debug("content encryption algo: "
			+ cmsEnvelopedDataParser.getContentEncryptionAlgorithm()
					.getAlgorithm().getId());

	RecipientInformationStore recipientInformationStore = cmsEnvelopedDataParser
			.getRecipientInfos();
	@SuppressWarnings("unchecked")
	Collection<RecipientInformation> recipients = recipientInformationStore
			.getRecipients();
	RecipientInformation recipientInformation = recipients.iterator()
			.next();
	LOG.debug("recipient info type: "
			+ recipientInformation.getClass().getName());
	KeyTransRecipientInformation keyTransRecipientInformation = (KeyTransRecipientInformation) recipientInformation;

}