APIdia Launch Partner
Top Description Fields Constructors Methods
sun.security.pkcs

public Class PKCS7

extends Object
Class Inheritance
Imports
java.io.*, java.math.BigInteger, java.net.URI, java.util.*, java.security.cert.X509Certificate, .CertificateException, .X509CRL, .CRLException, .CertificateFactory, java.security.*, java.util.function.Function, sun.security.jca.JCAUtil, sun.security.provider.SHA3.SHAKE256, sun.security.timestamp.*, sun.security.util.*, sun.security.x509.*
PKCS7 as defined in RSA Laboratories PKCS7 Technical Note. Profile Supports only SignedData ContentInfo type, where to the type of data signed is plain Data. For signedData, crls, attributes and PKCS#6 Extended Certificates are not supported.
Author
Benjamin Renaud

Field Summary

Modifier and TypeField and Description
private X509Certificate[]
certificates

private Principal[]
certIssuerNames

private ContentInfo
contentInfo

private X509CRL[]
crls

private AlgorithmId[]
digestAlgorithmIds

private boolean
oldStyle

private SignerInfo[]
signerInfos

private BigInteger
version

Constructor Summary

AccessConstructor and Description
public
PKCS7(InputStream
an input stream holding at least one PKCS7 block.
in)

Unmarshals a PKCS7 block from its encoded form, parsing the encoded bytes from the InputStream.

public
PKCS7(DerInputStream
a DerInputStream holding at least one PKCS7 block.
derin)

Unmarshals a PKCS7 block from its encoded form, parsing the encoded bytes from the DerInputStream.

public
PKCS7(byte[]
the encoded bytes.
bytes)

Unmarshals a PKCS7 block from its encoded form, parsing the encoded bytes.

public
PKCS7(AlgorithmId[]
the message digest algorithm identifiers.
digestAlgorithmIds, ContentInfo
the content information.
contentInfo, X509Certificate[]
an array of X.509 certificates.
certificates, X509CRL[]
an array of CRLs
crls, SignerInfo[]
an array of signer information.
signerInfos)

Construct an initialized PKCS7 block.

public
PKCS7(AlgorithmId[] digestAlgorithmIds, ContentInfo contentInfo, X509Certificate[] certificates, SignerInfo[] signerInfos)

Method Summary

Modifier and TypeMethod and Description
private static byte[]

Returns:

the token in a byte array
constructToken(byte[]
the signature
signature, X509Certificate[]
the signer's certificate chain
signerChain, byte[]
(optional) encapsulated content
content, PKCS9Attributes
(optional) authenticated attributes
authAttrs, PKCS9Attributes
(optional) unauthenticated attributes
unauthAttrs, AlgorithmId
digest algorithm identifier
digAlgID, AlgorithmId
encryption algorithm identifier
encAlgID)

Assemble a PKCS7 token from its components

public void
encodeSignedData(DerOutputStream
the DerOutputStream to write the encoded data to.
out)

Encodes the signed data to a DerOutputStream.

public static byte[]
generateSignedData(String sigalg, Provider sigProvider, PrivateKey privateKey, X509Certificate[] signerChain, byte[] content, boolean internalsf, boolean directsign, Function<byte[], PKCS9Attributes> ts)

public static byte[]

Returns:

the pkcs7 output in an array
generateSignedData(String
signature algorithm to be used
sigalg, Provider
(optional) provider
sigProvider, PrivateKey
signer's private key
privateKey, X509Certificate[]
signer's certificate chain
signerChain, byte[]
the content to sign
content, boolean
whether the content should be included in output
internalsf, boolean
if the content is signed directly or through authattrs
directsign, AlgorithmId
digest alg to use; derive from other arguments if null
digAlgID, Function<byte[], PKCS9Attributes>
(optional) timestamper
ts)

Generate a PKCS7 data block.

public static byte[]

Returns:

the encoded timestamp token
generateTimestampToken(Timestamper
the timestamping authority to use
tsa, String
the TSAPolicyID of the Timestamping Authority as a numerical object identifier; or null if we leave the TSA server to choose one
tSAPolicyID, String tSADigestAlg, byte[]
the token that is to be timestamped
toBeTimestamped)

Requests, processes and validates a timestamp token from a TSA using common defaults.

public X509Certificate
getCertificate(BigInteger
the serial number of the certificate to retrieve.
serial, X500Name
the Distinguished Name of the Issuer.
issuerName)

Returns the X.509 certificate listed in this PKCS7 block which has a matching serial number and Issuer name, or null if one is not found.

public X509Certificate[]

Returns:

a clone of the array of X.509 certificates or null if none are specified for the content type.
getCertificates()

Returns the X.509 certificates listed in this PKCS7 block.

public ContentInfo
getContentInfo()

Returns the content information specified in this PKCS7 block.

public X509CRL[]

Returns:

a clone of the array of X.509 crls or null if none are specified for the content type.
getCRLs()

Returns the X.509 crls listed in this PKCS7 block.

public AlgorithmId[]

Returns:

the array of Digest Algorithms or null if none are specified for the content type.
getDigestAlgorithmIds()

Returns the message digest algorithms specified in this PKCS7 block.

public SignerInfo[]

Returns:

the array of Signer Infos or null if none are specified for the content type.
getSignerInfos()

Returns the signer's information specified in this PKCS7 block.

public static URI

Returns:

An HTTP or HTTPS URI or null if none was found.
getTimestampingURI(X509Certificate
(optional) X.509 certificate for the TSA.
tsaCertificate)

Examine the certificate for a Subject Information Access extension (RFC 5280).

public BigInteger

Returns:

the version or null if version is not specified for the content type.
getVersion()

Returns the version number of this PKCS7 block.

public boolean
isOldStyle()

Returns true if this is a JDK1.1.x-style PKCS#7 block, and false otherwise.

private void
parse(DerInputStream derin)

private void
parse(DerInputStream
the ASN.1 encoding of the PKCS#7 block.
derin, boolean
flag indicating whether the given PKCS#7 block is encoded according to JDK1.1.x.
oldStyle)

Parses a PKCS#7 block.

private void
parseNetscapeCertChain(DerValue val)

private void
parseOldSignedData(DerValue val)

private void
parseSignedData(DerValue val)

private void
populateCertIssuerNames()

Populate array of Issuer DNs from certificates and convert each Principal to type X500Name if necessary.

public String
toString()

Overrides java.lang.Object.toString.

Returns the PKCS7 block in a printable string form.

public SignerInfo
verify(SignerInfo
the signer information.
info, byte[]
the DER encoded content information.
bytes)

This verifies a given SignerInfo.

public SignerInfo
verify(SignerInfo
the signer information.
info, byte[]
the DER encoded content information.
bytes, X509Certificate
certificate used to verify; find one inside the block if null
cert)

This verifies a given SignerInfo.

public SignerInfo[]
verify(byte[]
the DER encoded content information.
bytes)

Returns all signerInfos which self-verify.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAllwaitwaitwait

Field Detail

certificatesback to summary
private X509Certificate[] certificates
certIssuerNamesback to summary
private Principal[] certIssuerNames
contentInfoback to summary
private ContentInfo contentInfo
crlsback to summary
private X509CRL[] crls
digestAlgorithmIdsback to summary
private AlgorithmId[] digestAlgorithmIds
oldStyleback to summary
private boolean oldStyle
signerInfosback to summary
private SignerInfo[] signerInfos
versionback to summary
private BigInteger version

Constructor Detail

PKCS7back to summary
public PKCS7(InputStream in) throws IOException

Unmarshals a PKCS7 block from its encoded form, parsing the encoded bytes from the InputStream.

Parameters
in:InputStream

an input stream holding at least one PKCS7 block.

Exceptions
IOException:
on other errors.
ParsingException:
on parsing errors.
PKCS7back to summary
public PKCS7(DerInputStream derin) throws ParsingException

Unmarshals a PKCS7 block from its encoded form, parsing the encoded bytes from the DerInputStream.

Parameters
derin:DerInputStream

a DerInputStream holding at least one PKCS7 block.

Exceptions
ParsingException:
on parsing errors.
PKCS7back to summary
public PKCS7(byte[] bytes) throws ParsingException

Unmarshals a PKCS7 block from its encoded form, parsing the encoded bytes.

Parameters
bytes:byte[]

the encoded bytes.

Exceptions
ParsingException:
on parsing errors.
PKCS7back to summary
public PKCS7(AlgorithmId[] digestAlgorithmIds, ContentInfo contentInfo, X509Certificate[] certificates, X509CRL[] crls, SignerInfo[] signerInfos)

Construct an initialized PKCS7 block.

Parameters
digestAlgorithmIds:AlgorithmId[]

the message digest algorithm identifiers.

contentInfo:ContentInfo

the content information.

certificates:X509Certificate[]

an array of X.509 certificates.

crls:X509CRL[]

an array of CRLs

signerInfos:SignerInfo[]

an array of signer information.

PKCS7back to summary
public PKCS7(AlgorithmId[] digestAlgorithmIds, ContentInfo contentInfo, X509Certificate[] certificates, SignerInfo[] signerInfos)

Method Detail

constructTokenback to summary
private static byte[] constructToken(byte[] signature, X509Certificate[] signerChain, byte[] content, PKCS9Attributes authAttrs, PKCS9Attributes unauthAttrs, AlgorithmId digAlgID, AlgorithmId encAlgID) throws IOException

Assemble a PKCS7 token from its components

Parameters
signature:byte[]

the signature

signerChain:X509Certificate[]

the signer's certificate chain

content:byte[]

(optional) encapsulated content

authAttrs:PKCS9Attributes

(optional) authenticated attributes

unauthAttrs:PKCS9Attributes

(optional) unauthenticated attributes

digAlgID:AlgorithmId

digest algorithm identifier

encAlgID:AlgorithmId

encryption algorithm identifier

Returns:byte[]

the token in a byte array

Exceptions
IOException:
should not happen here, all byte array
encodeSignedDataback to summary
public void encodeSignedData(DerOutputStream out) throws IOException

Encodes the signed data to a DerOutputStream.

Parameters
out:DerOutputStream

the DerOutputStream to write the encoded data to.

Exceptions
IOException:
on encoding errors.
generateSignedDataback to summary
public static byte[] generateSignedData(String sigalg, Provider sigProvider, PrivateKey privateKey, X509Certificate[] signerChain, byte[] content, boolean internalsf, boolean directsign, Function<byte[], PKCS9Attributes> ts) throws SignatureException, InvalidKeyException, IOException, NoSuchAlgorithmException
generateSignedDataback to summary
public static byte[] generateSignedData(String sigalg, Provider sigProvider, PrivateKey privateKey, X509Certificate[] signerChain, byte[] content, boolean internalsf, boolean directsign, AlgorithmId digAlgID, Function<byte[], PKCS9Attributes> ts) throws SignatureException, InvalidKeyException, IOException, NoSuchAlgorithmException

Generate a PKCS7 data block.

Parameters
sigalg:String

signature algorithm to be used

sigProvider:Provider

(optional) provider

privateKey:PrivateKey

signer's private key

signerChain:X509Certificate[]

signer's certificate chain

content:byte[]

the content to sign

internalsf:boolean

whether the content should be included in output

directsign:boolean

if the content is signed directly or through authattrs

digAlgID:AlgorithmId

digest alg to use; derive from other arguments if null

ts:Function<byte[], PKCS9Attributes>

(optional) timestamper

Returns:byte[]

the pkcs7 output in an array

Exceptions
SignatureException:
if signing failed
InvalidKeyException:
if key cannot be used
IOException:
should not happen here, all byte array
NoSuchAlgorithmException:
if siglag is bad
generateTimestampTokenback to summary
public static byte[] generateTimestampToken(Timestamper tsa, String tSAPolicyID, String tSADigestAlg, byte[] toBeTimestamped) throws IOException, CertificateException

Requests, processes and validates a timestamp token from a TSA using common defaults. Uses the following defaults in the timestamp request: SHA-1 for the hash algorithm, a 64-bit nonce, and request certificate set to true.

Parameters
tsa:Timestamper

the timestamping authority to use

tSAPolicyID:String

the TSAPolicyID of the Timestamping Authority as a numerical object identifier; or null if we leave the TSA server to choose one

toBeTimestamped:byte[]

the token that is to be timestamped

Returns:byte[]

the encoded timestamp token

Exceptions
IOException:
The exception is thrown if an error occurs while communicating with the TSA, or a non-null TSAPolicyID is specified in the request but it does not match the one in the reply
CertificateException:
The exception is thrown if the TSA's certificate is not permitted for timestamping.
getCertificateback to summary
public X509Certificate getCertificate(BigInteger serial, X500Name issuerName)

Returns the X.509 certificate listed in this PKCS7 block which has a matching serial number and Issuer name, or null if one is not found.

Parameters
serial:BigInteger

the serial number of the certificate to retrieve.

issuerName:X500Name

the Distinguished Name of the Issuer.

getCertificatesback to summary
public X509Certificate[] getCertificates()

Returns the X.509 certificates listed in this PKCS7 block.

Returns:X509Certificate[]

a clone of the array of X.509 certificates or null if none are specified for the content type.

getContentInfoback to summary
public ContentInfo getContentInfo()

Returns the content information specified in this PKCS7 block.

getCRLsback to summary
public X509CRL[] getCRLs()

Returns the X.509 crls listed in this PKCS7 block.

Returns:X509CRL[]

a clone of the array of X.509 crls or null if none are specified for the content type.

getDigestAlgorithmIdsback to summary
public AlgorithmId[] getDigestAlgorithmIds()

Returns the message digest algorithms specified in this PKCS7 block.

Returns:AlgorithmId[]

the array of Digest Algorithms or null if none are specified for the content type.

getSignerInfosback to summary
public SignerInfo[] getSignerInfos()

Returns the signer's information specified in this PKCS7 block.

Returns:SignerInfo[]

the array of Signer Infos or null if none are specified for the content type.

getTimestampingURIback to summary
public static URI getTimestampingURI(X509Certificate tsaCertificate)

Examine the certificate for a Subject Information Access extension (RFC 5280). The extension's accessMethod field should contain the object identifier defined for timestamping: 1.3.6.1.5.5.7.48.3 and its accessLocation field should contain an HTTP or HTTPS URL.

Parameters
tsaCertificate:X509Certificate

(optional) X.509 certificate for the TSA.

Returns:URI

An HTTP or HTTPS URI or null if none was found.

getVersionback to summary
public BigInteger getVersion()

Returns the version number of this PKCS7 block.

Returns:BigInteger

the version or null if version is not specified for the content type.

isOldStyleback to summary
public boolean isOldStyle()

Returns true if this is a JDK1.1.x-style PKCS#7 block, and false otherwise.

parseback to summary
private void parse(DerInputStream derin) throws ParsingException
parseback to summary
private void parse(DerInputStream derin, boolean oldStyle) throws IOException

Parses a PKCS#7 block.

Parameters
derin:DerInputStream

the ASN.1 encoding of the PKCS#7 block.

oldStyle:boolean

flag indicating whether the given PKCS#7 block is encoded according to JDK1.1.x.

parseNetscapeCertChainback to summary
private void parseNetscapeCertChain(DerValue val) throws IOException
parseOldSignedDataback to summary
private void parseOldSignedData(DerValue val) throws IOException
parseSignedDataback to summary
private void parseSignedData(DerValue val) throws IOException
populateCertIssuerNamesback to summary
private void populateCertIssuerNames()

Populate array of Issuer DNs from certificates and convert each Principal to type X500Name if necessary.

Annotations
@SuppressWarnings:deprecation
toStringback to summary
public String toString()

Overrides java.lang.Object.toString.

Returns the PKCS7 block in a printable string form.

verifyback to summary
public SignerInfo verify(SignerInfo info, byte[] bytes) throws NoSuchAlgorithmException, SignatureException

This verifies a given SignerInfo.

Parameters
info:SignerInfo

the signer information.

bytes:byte[]

the DER encoded content information.

Exceptions
NoSuchAlgorithmException:
on unrecognized algorithms.
SignatureException:
on signature handling errors.
verifyback to summary
public SignerInfo verify(SignerInfo info, byte[] bytes, X509Certificate cert) throws NoSuchAlgorithmException, SignatureException

This verifies a given SignerInfo.

Parameters
info:SignerInfo

the signer information.

bytes:byte[]

the DER encoded content information.

cert:X509Certificate

certificate used to verify; find one inside the block if null

Exceptions
NoSuchAlgorithmException:
on unrecognized algorithms.
SignatureException:
on signature handling errors.
verifyback to summary
public SignerInfo[] verify(byte[] bytes) throws NoSuchAlgorithmException, SignatureException

Returns all signerInfos which self-verify.

Parameters
bytes:byte[]

the DER encoded content information.

Exceptions
NoSuchAlgorithmException:
on unrecognized algorithms.
SignatureException:
on signature handling errors.