Class AbstractMacIntegrityProtector

java.lang.Object

com.itextpdf.kernel.mac.AbstractMacIntegrityProtector

Direct Known Subclasses:

SignatureMacIntegrityProtector, StandaloneMacIntegrityProtector

public abstract class AbstractMacIntegrityProtector
extends Object

Class responsible for integrity protection in encrypted documents, which uses MAC container.

Field Summary

Fields

Modifier and Type	Field	Description
private static final IBouncyCastleFactory	BC_FACTORY
protected final PdfDocument	document
protected byte[]	fileEncryptionKey
protected byte[]	kdfSalt
private final MacContainerReader	macContainerReader
protected final MacProperties	macProperties
private static final String	PDF_MAC

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	AbstractMacIntegrityProtector(PdfDocument document, MacProperties macProperties)	Creates AbstractMacIntegrityProtector instance from the provided MacProperties.
protected	AbstractMacIntegrityProtector(PdfDocument document, PdfDictionary authDictionary)	Creates AbstractMacIntegrityProtector instance from the Auth dictionary.

Method Summary

Modifier and Type	Method	Description
private IDERSet	createAuthAttributes(byte[] messageBytes)
protected IDERSequence	createMacContainer(byte[] dataDigest, byte[] macKey, byte[] signature)	Creates MAC container as ASN1 object based on data digest, MAC key and signature parameters.
private IDERSequence	createMessageDigestSequence(byte[] messageBytes)
private static byte[]	createPdfMacIntegrityInfo(byte[] dataDigest, byte[] signatureDigest)
protected byte[]	digestBytes(byte[] bytes)	Digests provided bytes based on hash algorithm, specified for this class instance.
protected byte[]	digestBytes(InputStream inputStream)	Digests provided input stream based on hash algorithm, specified for this class instance.
private byte[]	generateDecryptedKey(byte[] encryptedMacKey)
private byte[]	generateEncryptedKey(byte[] macKey, byte[] macKek)
private byte[]	generateMac(byte[] macKey, byte[] data)
protected static byte[]	generateRandomBytes(int length)
byte[]	getKdfSalt()	Gets KDF salt bytes, which are used during MAC key encryption.
private String	getKeyWrappingAlgorithmOid()
private String	getMacAlgorithmOid()
private static MacProperties.MacDigestAlgorithm	getMacDigestAlgorithm(String oid)
void	setFileEncryptionKey(byte[] fileEncryptionKey)	Sets file encryption key to be used during MAC calculation.
void	setKdfSalt(byte[] kdfSalt)	Sets KDF salt bytes, to be used during MAC key encryption.
void	validateMacToken()	Validates MAC container integrity.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

BC_FACTORY

private static final IBouncyCastleFactory BC_FACTORY

PDF_MAC

private static final String PDF_MAC

See Also:

• Constant Field Values

document

protected final PdfDocument document

macProperties

protected final MacProperties macProperties

kdfSalt

protected byte[] kdfSalt

fileEncryptionKey

protected byte[] fileEncryptionKey

macContainerReader

private final MacContainerReader macContainerReader

Constructor Details

AbstractMacIntegrityProtector

protected AbstractMacIntegrityProtector(PdfDocument document,
 MacProperties macProperties)

Creates AbstractMacIntegrityProtector instance from the provided MacProperties.

Parameters:

document - PdfDocument for which integrity protection is required

macProperties - MacProperties used to provide MAC algorithm properties

AbstractMacIntegrityProtector

protected AbstractMacIntegrityProtector(PdfDocument document,
 PdfDictionary authDictionary)

Creates AbstractMacIntegrityProtector instance from the Auth dictionary.

Parameters:

document - PdfDocument for which integrity protection is required

authDictionary - PdfDictionary representing Auth dictionary in which MAC container is stored

Method Details

setFileEncryptionKey

public void setFileEncryptionKey(byte[] fileEncryptionKey)

Sets file encryption key to be used during MAC calculation.

Parameters:

fileEncryptionKey - byte[] file encryption key bytes

getKdfSalt

public byte[] getKdfSalt()

Gets KDF salt bytes, which are used during MAC key encryption.

Returns:

byte[] KDF salt bytes.

setKdfSalt

public void setKdfSalt(byte[] kdfSalt)

Sets KDF salt bytes, to be used during MAC key encryption.

Parameters:

kdfSalt - byte[] KDF salt bytes.

validateMacToken

public void validateMacToken()

Validates MAC container integrity. This method throws PdfException in case of any modifications, introduced to the document in question, after MAC container is integrated.

digestBytes

protected byte[] digestBytes(byte[] bytes)
                      throws NoSuchAlgorithmException,
IOException,
NoSuchProviderException

Digests provided bytes based on hash algorithm, specified for this class instance.

Parameters:

bytes - byte[] to be digested

Returns:

digested bytes.

Throws:

NoSuchAlgorithmException - in case of digesting algorithm related exceptions

IOException - in case of input-output related exceptions

NoSuchProviderException - thrown when a particular security provider is requested but is not available in the environment

digestBytes

protected byte[] digestBytes(InputStream inputStream)
                      throws NoSuchAlgorithmException,
IOException,
NoSuchProviderException

Digests provided input stream based on hash algorithm, specified for this class instance.

Parameters:

inputStream - InputStream to be digested

Returns:

digested bytes.

Throws:

NoSuchAlgorithmException - in case of digesting algorithm related exceptions

IOException - in case of input-output related exceptions

NoSuchProviderException - thrown when a particular security provider is requested but is not available in the environment

createMacContainer

protected IDERSequence createMacContainer(byte[] dataDigest,
 byte[] macKey,
 byte[] signature)
                                   throws GeneralSecurityException,
IOException

Creates MAC container as ASN1 object based on data digest, MAC key and signature parameters.

Parameters:

dataDigest - data digest as byte[] to be used during MAC container creation

macKey - MAC key as byte[] to be used during MAC container creation

signature - signature value as byte[] to be used during MAC container creation

Returns:

MAC container as IDERSequence.

Throws:

GeneralSecurityException - in case of security related exceptions

IOException - in case of input-output related exceptions

generateMac

private byte[] generateMac(byte[] macKey,
 byte[] data)
                    throws NoSuchAlgorithmException,
InvalidKeyException

Throws:

NoSuchAlgorithmException

InvalidKeyException

generateEncryptedKey

private byte[] generateEncryptedKey(byte[] macKey,
 byte[] macKek)
                             throws GeneralSecurityException

Throws:

GeneralSecurityException

generateDecryptedKey

private byte[] generateDecryptedKey(byte[] encryptedMacKey)
                             throws GeneralSecurityException

Throws:

GeneralSecurityException

getMacAlgorithmOid

private String getMacAlgorithmOid()

getKeyWrappingAlgorithmOid

private String getKeyWrappingAlgorithmOid()

createMessageDigestSequence

private IDERSequence createMessageDigestSequence(byte[] messageBytes)
                                          throws NoSuchAlgorithmException,
IOException,
NoSuchProviderException

Throws:

NoSuchAlgorithmException

IOException

NoSuchProviderException

createAuthAttributes

private IDERSet createAuthAttributes(byte[] messageBytes)
                              throws NoSuchAlgorithmException,
IOException,
NoSuchProviderException

Throws:

NoSuchAlgorithmException

IOException

NoSuchProviderException

createPdfMacIntegrityInfo

private static byte[] createPdfMacIntegrityInfo(byte[] dataDigest,
 byte[] signatureDigest)
                                         throws IOException

Throws:

IOException

generateRandomBytes

protected static byte[] generateRandomBytes(int length)

getMacDigestAlgorithm

private static MacProperties.MacDigestAlgorithm getMacDigestAlgorithm(String oid)