Package com.itextpdf.signatures

Class LtvVerification

java.lang.Object

com.itextpdf.signatures.LtvVerification

public class LtvVerification
extends java.lang.Object

Add verification according to PAdES-LTV (part 4).

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	LtvVerification.CertificateInclusion	Certificate inclusion in the DSS and VRI dictionaries in the CERT and CERTS keys.
static class	LtvVerification.CertificateOption	Options for how many certificates to include.
static class	LtvVerification.Level	What type of verification to include.
static class	LtvVerification.RevocationDataNecessity	Option to determine whether revocation information is required for the signing certificate.
private static class	LtvVerification.ValidationData

Field Summary

Fields

Modifier and Type	Field	Description
private static IBouncyCastleFactory	BOUNCY_CASTLE_FACTORY
private PdfDocument	document
private IIssuingCertificateRetriever	issuingCertificateRetriever
private static org.slf4j.Logger	LOGGER
private LtvVerification.RevocationDataNecessity	revocationDataNecessity
private java.lang.String	securityProviderCode
private SignatureUtil	sgnUtil
private boolean	used
private java.util.Map<PdfName,LtvVerification.ValidationData>	validated

Constructor Summary

Constructors

Constructor	Description
LtvVerification(PdfDocument document)	The verification constructor.
LtvVerification(PdfDocument document, java.lang.String securityProviderCode)	The verification constructor.

Method Summary

Modifier and Type	Method	Description
private void	addRevocationDataForCertificate(java.security.cert.X509Certificate signingCert, java.security.cert.Certificate[] certificateChain, java.security.cert.X509Certificate cert, IOcspClient ocsp, ICrlClient crl, LtvVerification.Level level, LtvVerification.CertificateInclusion certInclude, LtvVerification.CertificateOption certOption, LtvVerification.ValidationData validationData, java.util.Set<java.security.cert.X509Certificate> processedCerts)
private void	addRevocationDataForChain(java.security.cert.X509Certificate signingCert, java.security.cert.Certificate[] certChain, IOcspClient ocsp, ICrlClient crl, LtvVerification.Level level, LtvVerification.CertificateInclusion certInclude, LtvVerification.CertificateOption certOption, LtvVerification.ValidationData validationData, java.util.Set<java.security.cert.X509Certificate> processedCerts)
private void	addRevocationDataForOcspCert(byte[] ocspEnc, java.security.cert.X509Certificate signingCert, IOcspClient ocsp, ICrlClient crl, LtvVerification.Level level, LtvVerification.CertificateInclusion certInclude, LtvVerification.CertificateOption certOption, LtvVerification.ValidationData validationData, java.util.Set<java.security.cert.X509Certificate> processedCerts)
boolean	addVerification(java.lang.String signatureName, IOcspClient ocsp, ICrlClient crl, LtvVerification.CertificateOption certOption, LtvVerification.Level level, LtvVerification.CertificateInclusion certInclude)	Add verification for a particular signature.
boolean	addVerification(java.lang.String signatureName, java.util.Collection<byte[]> ocsps, java.util.Collection<byte[]> crls, java.util.Collection<byte[]> certs)	Adds verification to the signature.
private static byte[]	buildOCSPResponse(byte[] basicOcspResponse)
static java.lang.String	convertToHex(byte[] bytes)	Converts an array of bytes to a String of hexadecimal values
private void	createDss()
private static void	deleteOldReferences(PdfArray all, PdfArray toDelete)
(package private) java.security.cert.X509Certificate	getParent(java.security.cert.X509Certificate cert, java.security.cert.Certificate[] certs)	Get the issuing certificate for a child certificate.
private PdfName	getSignatureHashKey(java.lang.String signatureName)
private static byte[]	hashBytesSha1(byte[] b)
private static java.util.List<java.security.cert.X509Certificate>	iterableToList(java.lang.Iterable<java.security.cert.X509Certificate> iterable)
void	merge()	Merges the validation with any validation already in the document or creates a new one.
private void	outputDss(PdfDictionary dss, PdfDictionary vrim, PdfArray ocsps, PdfArray crls, PdfArray certs)
private java.security.cert.Certificate[]	retrieveMissingCertificates(java.security.cert.Certificate[] certChain)
LtvVerification	setIssuingCertificateRetriever(IIssuingCertificateRetriever issuingCertificateRetriever)	Sets IIssuingCertificateRetriever instance needed to get CRL issuer certificates (using AIA extension).
LtvVerification	setRevocationDataNecessity(LtvVerification.RevocationDataNecessity revocationDataNecessity)	Sets LtvVerification.RevocationDataNecessity option to specify the necessity of revocation data.
private void	updateDss()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

BOUNCY_CASTLE_FACTORY

private static final IBouncyCastleFactory BOUNCY_CASTLE_FACTORY

LOGGER

private static final org.slf4j.Logger LOGGER

document

private final PdfDocument document

sgnUtil

private final SignatureUtil sgnUtil

validated

private final java.util.Map<PdfName,LtvVerification.ValidationData> validated

used

private boolean used

securityProviderCode

private java.lang.String securityProviderCode

revocationDataNecessity

private LtvVerification.RevocationDataNecessity revocationDataNecessity

issuingCertificateRetriever

private IIssuingCertificateRetriever issuingCertificateRetriever

Constructor Detail

LtvVerification

public LtvVerification(PdfDocument document)

The verification constructor. This class should only be created with PdfStamper.getLtvVerification() otherwise the information will not be added to the Pdf.

Parameters:

document - The PdfDocument to apply the validation to.

LtvVerification

public LtvVerification(PdfDocument document,
                       java.lang.String securityProviderCode)

The verification constructor. This class should only be created with PdfStamper.getLtvVerification() otherwise the information will not be added to the Pdf.

Parameters:

document - The PdfDocument to apply the validation to.

securityProviderCode - Security provider to use

Method Detail

setRevocationDataNecessity

public LtvVerification setRevocationDataNecessity(LtvVerification.RevocationDataNecessity revocationDataNecessity)

Sets LtvVerification.RevocationDataNecessity option to specify the necessity of revocation data.

Default value is LtvVerification.RevocationDataNecessity.OPTIONAL.

Parameters:

revocationDataNecessity - LtvVerification.RevocationDataNecessity value to set

Returns:

this LtvVerification instance.

setIssuingCertificateRetriever

public LtvVerification setIssuingCertificateRetriever(IIssuingCertificateRetriever issuingCertificateRetriever)

Sets IIssuingCertificateRetriever instance needed to get CRL issuer certificates (using AIA extension).

Default value is DefaultIssuingCertificateRetriever.

Parameters:

issuingCertificateRetriever - IIssuingCertificateRetriever instance to set

Returns:

this LtvVerification instance.

addVerification

public boolean addVerification(java.lang.String signatureName,
                               IOcspClient ocsp,
                               ICrlClient crl,
                               LtvVerification.CertificateOption certOption,
                               LtvVerification.Level level,
                               LtvVerification.CertificateInclusion certInclude)
                        throws java.io.IOException,
                               java.security.GeneralSecurityException

Add verification for a particular signature.

Parameters:

signatureName - the signature to validate (it may be a timestamp)

ocsp - the interface to get the OCSP

crl - the interface to get the CRL

certOption - options as to how many certificates to include

level - the validation options to include

certInclude - certificate inclusion options

Returns:

true if a validation was generated, false otherwise

Throws:

java.security.GeneralSecurityException - when requested cryptographic algorithm or security provider is not available

java.io.IOException - signals that an I/O exception has occurred

addVerification

public boolean addVerification(java.lang.String signatureName,
                               java.util.Collection<byte[]> ocsps,
                               java.util.Collection<byte[]> crls,
                               java.util.Collection<byte[]> certs)
                        throws java.io.IOException,
                               java.security.GeneralSecurityException

Adds verification to the signature.

Parameters:

signatureName - name of the signature

ocsps - collection of DER-encoded BasicOCSPResponses

crls - collection of DER-encoded CRLs

certs - collection of DER-encoded certificates

Returns:

boolean

Throws:

java.io.IOException - signals that an I/O exception has occurred

java.security.GeneralSecurityException - when requested cryptographic algorithm or security provider is not available

merge

public void merge()

Merges the validation with any validation already in the document or creates a new one.

convertToHex

public static java.lang.String convertToHex(byte[] bytes)

Converts an array of bytes to a String of hexadecimal values

Parameters:

bytes - a byte array

Returns:

the same bytes expressed as hexadecimal values

getParent

java.security.cert.X509Certificate getParent(java.security.cert.X509Certificate cert,
                                             java.security.cert.Certificate[] certs)

Get the issuing certificate for a child certificate.

Parameters:

cert - the certificate for which we search the parent

certs - an array with certificates that contains the parent

Returns:

the parent certificate

addRevocationDataForChain

private void addRevocationDataForChain(java.security.cert.X509Certificate signingCert,
                                       java.security.cert.Certificate[] certChain,
                                       IOcspClient ocsp,
                                       ICrlClient crl,
                                       LtvVerification.Level level,
                                       LtvVerification.CertificateInclusion certInclude,
                                       LtvVerification.CertificateOption certOption,
                                       LtvVerification.ValidationData validationData,
                                       java.util.Set<java.security.cert.X509Certificate> processedCerts)
                                throws java.security.cert.CertificateException,
                                       java.io.IOException,
                                       java.security.cert.CRLException

Throws:

java.security.cert.CertificateException

java.io.IOException

java.security.cert.CRLException

addRevocationDataForCertificate

private void addRevocationDataForCertificate(java.security.cert.X509Certificate signingCert,
                                             java.security.cert.Certificate[] certificateChain,
                                             java.security.cert.X509Certificate cert,
                                             IOcspClient ocsp,
                                             ICrlClient crl,
                                             LtvVerification.Level level,
                                             LtvVerification.CertificateInclusion certInclude,
                                             LtvVerification.CertificateOption certOption,
                                             LtvVerification.ValidationData validationData,
                                             java.util.Set<java.security.cert.X509Certificate> processedCerts)
                                      throws java.io.IOException,
                                             java.security.cert.CertificateException,
                                             java.security.cert.CRLException

Throws:

java.io.IOException

java.security.cert.CertificateException

java.security.cert.CRLException

addRevocationDataForOcspCert

private void addRevocationDataForOcspCert(byte[] ocspEnc,
                                          java.security.cert.X509Certificate signingCert,
                                          IOcspClient ocsp,
                                          ICrlClient crl,
                                          LtvVerification.Level level,
                                          LtvVerification.CertificateInclusion certInclude,
                                          LtvVerification.CertificateOption certOption,
                                          LtvVerification.ValidationData validationData,
                                          java.util.Set<java.security.cert.X509Certificate> processedCerts)
                                   throws java.security.cert.CertificateException,
                                          java.io.IOException,
                                          java.security.cert.CRLException

Throws:

java.security.cert.CertificateException

java.io.IOException

java.security.cert.CRLException

iterableToList

private static java.util.List<java.security.cert.X509Certificate> iterableToList(java.lang.Iterable<java.security.cert.X509Certificate> iterable)

buildOCSPResponse

private static byte[] buildOCSPResponse(byte[] basicOcspResponse)
                                 throws java.io.IOException

Throws:

java.io.IOException

getSignatureHashKey

private PdfName getSignatureHashKey(java.lang.String signatureName)
                             throws java.security.NoSuchAlgorithmException

Throws:

java.security.NoSuchAlgorithmException

hashBytesSha1

private static byte[] hashBytesSha1(byte[] b)
                             throws java.security.NoSuchAlgorithmException

Throws:

java.security.NoSuchAlgorithmException

updateDss

private void updateDss()

deleteOldReferences

private static void deleteOldReferences(PdfArray all,
                                        PdfArray toDelete)

createDss

private void createDss()

outputDss

private void outputDss(PdfDictionary dss,
                       PdfDictionary vrim,
                       PdfArray ocsps,
                       PdfArray crls,
                       PdfArray certs)

retrieveMissingCertificates

private java.security.cert.Certificate[] retrieveMissingCertificates(java.security.cert.Certificate[] certChain)