APIdia Launch Partner
Top Description Inners Fields Constructors Methods
sun.security.pkcs

public Class SignerInfo

extends Object
implements DerEncoder
Class Inheritance
All Implemented Interfaces
sun.security.util.DerEncoder
Imports
java.io.IOException, java.math.BigInteger, java.security.*, java.security.cert.*, java.security.spec.PSSParameterSpec, java.util.*, sun.security.provider.SHA3.SHAKE256, sun.security.timestamp.TimestampToken, sun.security.util.*, sun.security.x509.AlgorithmId, .KeyUsageExtension, .X500Name
A SignerInfo, as defined in PKCS#7's signedData type.
Author
Benjamin Renaud

Nested and Inner Type Summary

Modifier and TypeClass and Description
private static record
SignerInfo.AlgorithmInfo

A map containing the algorithms in this SignerInfo.

Field Summary

Modifier and TypeField and Description
private final Map<AlgorithmId, SignerInfo.AlgorithmInfo>
algorithms

pack-priv PKCS9Attributes
authenticatedAttributes

pack-priv BigInteger
certificateSerialNumber

private static final Debug
debug

pack-priv AlgorithmId
digestAlgorithmId

pack-priv AlgorithmId
digestEncryptionAlgorithmId

pack-priv byte[]
encryptedDigest

private boolean
hasTimestamp

pack-priv X500Name
issuerName

private static final DisabledAlgorithmConstraints
JAR_DISABLED_CHECK

pack-priv Timestamp
timestamp

pack-priv PKCS9Attributes
unauthenticatedAttributes

pack-priv BigInteger
version

Constructor Summary

AccessConstructor and Description
public
SignerInfo(X500Name issuerName, BigInteger serial, AlgorithmId digestAlgorithmId, AlgorithmId digestEncryptionAlgorithmId, byte[] encryptedDigest)

public
SignerInfo(X500Name issuerName, BigInteger serial, AlgorithmId digestAlgorithmId, PKCS9Attributes authenticatedAttributes, AlgorithmId digestEncryptionAlgorithmId, byte[] encryptedDigest, PKCS9Attributes unauthenticatedAttributes)

public
SignerInfo(DerInputStream derin)

Parses a PKCS#7 signer info.

public
SignerInfo(DerInputStream
the ASN.1 encoding of the signer info.
derin, boolean
flag indicating whether the given signer info is encoded according to JDK1.1.x.
oldStyle)

Parses a PKCS#7 signer info.

Method Summary

Modifier and TypeMethod and Description
private static void
algorithmsConformanceCheck(AlgorithmId
the digest algorithm
digAlgId, AlgorithmId
the encryption algorithm
encAlgId, PublicKey
the public key for verification
key, boolean
whether the signature is calculated on the content directly. This makes difference for Ed448.
directSign)

Checks if the digest algorithm and encryption algorithm combination inside a PKCS7 SignerInfo is legal.

private void
checkCMSAlgorithmProtection()

public void
encode(DerOutputStream
the output stream on which to write the DER encoding.
out)

Implements sun.security.util.DerEncoder.encode.

DER encode this object onto an output stream.

public PKCS9Attributes
getAuthenticatedAttributes()

public X509Certificate
getCertificate(PKCS7 block)

public ArrayList<X509Certificate>
getCertificateChain(PKCS7 block)

public BigInteger
getCertificateSerialNumber()

public AlgorithmId
getDigestAlgorithmId()

public AlgorithmId
getDigestEncryptionAlgorithmId()

public byte[]
getEncryptedDigest()

public X500Name
getIssuerName()

public Timestamp
getTimestamp()

public PKCS7

Returns:

a PKCS7 object
getTsToken()

Returns the timestamp PKCS7 data unverified.

public PKCS9Attributes
getUnauthenticatedAttributes()

public BigInteger
getVersion()

public static String
makeSigAlg(AlgorithmId
the digest algorithm
digAlgId, AlgorithmId
the encryption algorithm
encAlgId)

Derives the signature algorithm name from the digest algorithm and the encryption algorithm inside a PKCS7 SignerInfo.

public String
toString()

Overrides java.lang.Object.toString.

Returns a string representation of the object.

pack-priv SignerInfo

Returns:

null if verify fails, this signerInfo if verify succeeds.
verify(PKCS7
the PKCS7 object
block, byte[]
the content to verify against; read from block if null
data, X509Certificate
certificate to verify with; read from block if null
cert)

Verify this signerInfo in a PKCS7 block.

pack-priv SignerInfo
verify(PKCS7 block)

public static Set<String>

Returns:

a set of algorithms that passed the checks and are not disabled
verifyAlgorithms(SignerInfo[]
array of SignerInfos
infos, JarConstraintsParameters
constraint parameters
params, String
the name of the signer's PKCS7 file
name)

Verify all the algorithms in the array of SignerInfos against the constraints in the jdk.jar.disabledAlgorithms security property.

private void
verifyTimestamp(TimestampToken token)

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAllwaitwaitwait

Field Detail

algorithmsback to summary
private final Map<AlgorithmId, SignerInfo.AlgorithmInfo> algorithms
authenticatedAttributesback to summary
pack-priv PKCS9Attributes authenticatedAttributes
certificateSerialNumberback to summary
pack-priv BigInteger certificateSerialNumber
debugback to summary
private static final Debug debug
digestAlgorithmIdback to summary
pack-priv AlgorithmId digestAlgorithmId
digestEncryptionAlgorithmIdback to summary
pack-priv AlgorithmId digestEncryptionAlgorithmId
encryptedDigestback to summary
pack-priv byte[] encryptedDigest
hasTimestampback to summary
private boolean hasTimestamp
issuerNameback to summary
pack-priv X500Name issuerName
JAR_DISABLED_CHECKback to summary
private static final DisabledAlgorithmConstraints JAR_DISABLED_CHECK
timestampback to summary
pack-priv Timestamp timestamp
unauthenticatedAttributesback to summary
pack-priv PKCS9Attributes unauthenticatedAttributes
versionback to summary
pack-priv BigInteger version

Constructor Detail

SignerInfoback to summary
public SignerInfo(X500Name issuerName, BigInteger serial, AlgorithmId digestAlgorithmId, AlgorithmId digestEncryptionAlgorithmId, byte[] encryptedDigest)
SignerInfoback to summary
public SignerInfo(X500Name issuerName, BigInteger serial, AlgorithmId digestAlgorithmId, PKCS9Attributes authenticatedAttributes, AlgorithmId digestEncryptionAlgorithmId, byte[] encryptedDigest, PKCS9Attributes unauthenticatedAttributes)
SignerInfoback to summary
public SignerInfo(DerInputStream derin) throws IOException

Parses a PKCS#7 signer info.

SignerInfoback to summary
public SignerInfo(DerInputStream derin, boolean oldStyle) throws IOException

Parses a PKCS#7 signer info.

This constructor is used only for backwards compatibility with PKCS#7 blocks that were generated using JDK1.1.x.

Parameters
derin:DerInputStream

the ASN.1 encoding of the signer info.

oldStyle:boolean

flag indicating whether the given signer info is encoded according to JDK1.1.x.

Method Detail

algorithmsConformanceCheckback to summary
private static void algorithmsConformanceCheck(AlgorithmId digAlgId, AlgorithmId encAlgId, PublicKey key, boolean directSign) throws NoSuchAlgorithmException

Checks if the digest algorithm and encryption algorithm combination inside a PKCS7 SignerInfo is legal.

Parameters
digAlgId:AlgorithmId

the digest algorithm

encAlgId:AlgorithmId

the encryption algorithm

key:PublicKey

the public key for verification

directSign:boolean

whether the signature is calculated on the content directly. This makes difference for Ed448.

checkCMSAlgorithmProtectionback to summary
private void checkCMSAlgorithmProtection() throws IOException
encodeback to summary
public void encode(DerOutputStream out)

Implements sun.security.util.DerEncoder.encode.

DER encode this object onto an output stream. Implements the DerEncoder interface.

Parameters
out:DerOutputStream

the output stream on which to write the DER encoding.

Annotations
@Override
getAuthenticatedAttributesback to summary
public PKCS9Attributes getAuthenticatedAttributes()
getCertificateback to summary
public X509Certificate getCertificate(PKCS7 block) throws IOException
getCertificateChainback to summary
public ArrayList<X509Certificate> getCertificateChain(PKCS7 block) throws IOException
getCertificateSerialNumberback to summary
public BigInteger getCertificateSerialNumber()
getDigestAlgorithmIdback to summary
public AlgorithmId getDigestAlgorithmId()
getDigestEncryptionAlgorithmIdback to summary
public AlgorithmId getDigestEncryptionAlgorithmId()
getEncryptedDigestback to summary
public byte[] getEncryptedDigest()
getIssuerNameback to summary
public X500Name getIssuerName()
getTimestampback to summary
public Timestamp getTimestamp() throws IOException, NoSuchAlgorithmException, SignatureException, CertificateException
getTsTokenback to summary
public PKCS7 getTsToken() throws IOException

Returns the timestamp PKCS7 data unverified.

Returns:PKCS7

a PKCS7 object

getUnauthenticatedAttributesback to summary
public PKCS9Attributes getUnauthenticatedAttributes()
getVersionback to summary
public BigInteger getVersion()
makeSigAlgback to summary
public static String makeSigAlg(AlgorithmId digAlgId, AlgorithmId encAlgId)

Derives the signature algorithm name from the digest algorithm and the encryption algorithm inside a PKCS7 SignerInfo. The digest algorithm is in the form "DIG", and the encryption algorithm can be in any of the 3 forms: 1. Simple key algorithm like RSA, DSA, EC, this method returns DIGwithKEY. 2. Traditional signature algorithm in the form of HASHwithKEY, this method returns DIGwithKEY. Please note this is not HASHwithKEY. 3. Modern signature algorithm like RSASSA-PSS and EdDSA, this method returns the signature algorithm itself.

Parameters
digAlgId:AlgorithmId

the digest algorithm

encAlgId:AlgorithmId

the encryption algorithm

toStringback to summary
public String toString()

Overrides java.lang.Object.toString.

Doc from java.lang.Object.toString.

Returns a string representation of the object. Satisfying this method's contract implies a non-null result must be returned.

verifyback to summary
pack-priv SignerInfo verify(PKCS7 block, byte[] data, X509Certificate cert) throws NoSuchAlgorithmException, SignatureException

Verify this signerInfo in a PKCS7 block.

Parameters
block:PKCS7

the PKCS7 object

data:byte[]

the content to verify against; read from block if null

cert:X509Certificate

certificate to verify with; read from block if null

Returns:SignerInfo

null if verify fails, this signerInfo if verify succeeds.

verifyback to summary
pack-priv SignerInfo verify(PKCS7 block) throws NoSuchAlgorithmException, SignatureException
verifyAlgorithmsback to summary
public static Set<String> verifyAlgorithms(SignerInfo[] infos, JarConstraintsParameters params, String name) throws SignatureException

Verify all the algorithms in the array of SignerInfos against the constraints in the jdk.jar.disabledAlgorithms security property.

Parameters
infos:SignerInfo[]

array of SignerInfos

params:JarConstraintsParameters

constraint parameters

name:String

the name of the signer's PKCS7 file

Returns:Set<String>

a set of algorithms that passed the checks and are not disabled

verifyTimestampback to summary
private void verifyTimestamp(TimestampToken token) throws NoSuchAlgorithmException, SignatureException
sun.security.pkcs back to summary

private final Record SignerInfo.AlgorithmInfo

extends Record
Class Inheritance
Record Components
field:String 
checkKey:boolean 
A map containing the algorithms in this SignerInfo. This is used to avoid checking algorithms to see if they are disabled more than once. The key is the AlgorithmId of the algorithm, and the value is a record containing the name of the field or attribute and whether the key should also be checked (ex: if it is a signature algorithm).

Field Summary

Modifier and TypeField and Description
private final boolean
checkKey

Record Component accessed by checkKey().

private final String
field

Record Component accessed by field().

Constructor Summary

AccessConstructor and Description
private
AlgorithmInfo(String field, boolean checkKey)

Method Summary

Modifier and TypeMethod and Description
public boolean
checkKey()

Record Component getter of checkKey.

public final boolean
equals(Object o)

Implements abstract java.lang.Record.equals.

Indicates whether some other object is "equal to" this one.

public String
field()

Record Component getter of field.

public final int
hashCode()

Implements abstract java.lang.Record.hashCode.

Returns a hash code value for the record.

public final String
toString()

Implements abstract java.lang.Record.toString.

Returns a string representation of the record.

Field Detail

checkKeyback to summary
private final boolean checkKey

Record Component accessed by checkKey().

fieldback to summary
private final String field

Record Component accessed by field().

Constructor Detail

AlgorithmInfoback to summary
private AlgorithmInfo(String field, boolean checkKey)

Method Detail

checkKeyback to summary
public boolean checkKey()

Record Component getter of checkKey.

equalsback to summary
public final boolean equals(Object o)

Implements abstract java.lang.Record.equals.

Doc from java.lang.Record.equals.

Indicates whether some other object is "equal to" this one. In addition to the general contract of Object.equals, record classes must further obey the invariant that when a record instance is "copied" by passing the result of the record component accessor methods to the canonical constructor, as follows: 

    R copy = new R(r.c1(), r.c2(), ..., r.cn());
then it must be the case that r.equals(copy).
fieldback to summary
public String field()

Record Component getter of field.

hashCodeback to summary
public final int hashCode()

Implements abstract java.lang.Record.hashCode.

Doc from java.lang.Record.hashCode.

Returns a hash code value for the record. Obeys the general contract of Object.hashCode. For records, hashing behavior is constrained by the refined contract of Record.equals, so that any two records created from the same components must have the same hash code.

toStringback to summary
public final String toString()

Implements abstract java.lang.Record.toString.

Doc from java.lang.Record.toString.

Returns a string representation of the record. In accordance with the general contract of Object#toString(), the toString method returns a string that "textually represents" this record. The result should be a concise but informative representation that is easy for a person to read.

In addition to this general contract, record classes must further participate in the invariant that any two records which are equal must produce equal strings. This invariant is necessarily relaxed in the rare case where corresponding equal component values might fail to produce equal strings for themselves.