Newsgroup: it.comp.java
Titolo: [Vi prego urgente!!!] Documento firmato PKCS#7

Ciao a tutti!!!!!
Ho un problema (e chi non ha problemi) allora....
Non riesco a creare un documento firmato nello standard PKCS#7 tanto per
intenderci i files che hanno l'estensione .p7m vi spiego meglio in
dettaglio.
in pratica fino ad oggi riesco tranquillamente ad ricavarmi l'impronta di
messaggio(hash) dal file che devo firmare, cifralro con la chiave privata ed
estrapolare il certificato con la chiave publica, e fino quì tutto ok, ho il
materiale per poter creare questo documento ma il mio problema è che non
riesco a creare la cosiddetta busta(PKCS#7), Aiutooooo, sto sclerando non
sono riuscito a trovare un esempio che permette di fare ciò, ho anche
provato a scaricare alcune API ma la creazione di questa busta niente da
fare.
Spero almeno in voi.....Ciaooooo........
.......................Axel
--------------------------------
Inviato via 
http://usenet.libero.it

 ha scritto nel messaggio
news:213Z82Z15Z162Y1...@usenet.libero.it...


 scusa con quale provider stai lavorando? IAIK, Baltimore, etc...
Bouncycastle ma sembra che supporti questo formato solo per leggere ma non
per crearle.
E comunque grazie..........


 ha scritto nel messaggio
news:213Z82Z15Z162Y1...@usenet.libero.it...


 generato.
 
Mi potresti dare l'url?
se hai un esempio stupido da farmi vedere per generarlo mi fai un grosso
piacere.....a buon rendere...
grasssie......
................Axel


 ha scritto nel messaggio
news:213Z82Z15Z162Y...@usenet.libero.it...


 nella documentazione ci sono gli esempi...che cerchi...
Dammi pure del deficente ma non sono riuscito a trovare queste librerie, non
mi è sembrato un sito molto chiaro, cmq grazie lo stesso per la pazienza,
Ciaooo....


con le opportune modifiche puoi dare un'occhiata qui:
/*
 * Copyright (c) 1997-1999 Baltimore Technologies, Ltd. All Rights Reserved.
 *
 * Permission to use, copy, modify, and distribute this software
 * in source and binary form for all purposes and without
 * fee is hereby granted provided that this copyright notice
 * appears in all copies. This software is supplied "as is" without
 * a warranty of any kind.
 */
package examples.jpkiplus.pkcs7;
import com.baltimore.jcrypto.coders.*;
import com.baltimore.jcrypto.pkcs.*;
import com.baltimore.jcrypto.provider.*;
import com.baltimore.jcrypto.utils.*;
import com.baltimore.jpkiplus.pkcs12.*;
import com.baltimore.jpkiplus.pkcs7.*;
import com.baltimore.jpkiplus.pkcs7.content.*;
import com.baltimore.jpkiplus.x509.*;
import com.baltimore.jpkiplus.x509.extensions.*;
import com.baltimore.jpkiplus.x509.utils.*;
import java.security.*;
import java.security.cert.*;
import java.util.*;
/**
 * This example generates and saves a signed data object. It verifies the
signed data object also.
 * <p>
 * It loads up a key and a cert chain (.p7c) from data/misc directory. The
end-entity cert in the
 * chain corresponds to the private key. An inner content Data object is
created and supplied with
 * some data. We add some extra attributes to the SigningInfo object before
signing namely an
 * e-mail address and the signing time. At this stage we could choose
whether to omit the data
 * that was been signed (it would be up to the receiver to provide this data
when verifying the
 * signature).
 * <p>
 * When verifying we perform two-stage verification
 * <ul>
 * <li> First of all we check the certificate that has been used to sign the
SignedData. This entails
 * getting the relevent cert chain from the Signed Data object, and seeing
if the signign cert is trusted when
 * we add a trusted root ca certificate.
 * <li> The second check is on the Signed Data object itself of course.
 * </ul>
 * We supply some ocde which details getting the cert policies out of the
signing cert. There are two
 * types of cert policies - cps pointer and user notice. We print both if
they exist. Last of all
 * we check the signing time of the signed data object.
 * The source code is <a href="SignedDataTest.txt">here</a>.
 */
public class SignedDataTest
{
    public static void main(String args[])
    {
        try {
            if (args.length != 3)
            {
                System.out.println(" Incorrect number of parameters
passed.");
                System.out.println(" SignededDataTest <passwd> <file1>
<file2> ");
                System.out.println(" where <passwd> is used to passphrase
protect the private key");
                System.out.println(" where <file1> is to load the file
containing private key. e.g., a der file");
                System.out.println(" where <file2> is to load the file
containing certificateChain. e.g., a p7c file");
                System.exit(0);
            }
            Security.insertProviderAt(new JCRYPTO(), 1);
            //e.g.,PrivateKey priv = PKCS_8.decode(new Buffer("baltimore"),
DERCoder.decode(Utils.loadMessage("misc/priv.der")));
            PrivateKey key = PKCS_8.decode(new Buffer(args[0]),
Utils.loadMessage(args[1]));
            //e.g.,CertificateChain certChain =
CertificateChain.fromP7C(Utils.loadMessage("misc/cert.p7c"));
            CertificateChain certChain =
CertificateChain.fromP7C(Utils.loadMessage(args[2]));
            // get the end entity cert out of the chain, get the signer root
CA cert also
            JCRYPTO_X509Certificate cert = certChain.getCertificate();
            JCRYPTO_X509Certificate rootCert =
certChain.getRootCertificate(cert);
            // Data to be signed
            Data data = new Data();
            //  create a new SignedData object
            SignedData signedData = new SignedData("SHA1");
            signedData.setContent(data);
            // put some data in
            data.addData(Utils.toBytes("This is the data to be signed!"));
            // set the cert chain associated with the SignedData object (it
had better lead up to the cert that signs this object)
            signedData.setCertificates(certChain);
            // Create new SignerInfo object, associate it with a
certificate, set an PKCS#9 email address attribute
            SignerInfo signerInfo = new
SignerInfo(certChain.getCertificate());
            signerInfo.setEmailAddress("
ema...@baltimore.ie
");
            // Associate the SignedData with the SignerInfo (will get the
digest algorithm across)
            signedData.setSignerInfo(signerInfo);
            // sign it (include the signing time)
            signerInfo.setSigningTime();
            signedData.sign(key);
            // specific method that makes sure the content is not encoded
(i.e. it will be signed but will be ommitted from the SignedData object)
            // it will thus become a degenerate form of signed data -
Clearsigned
            //signedData.setClearSigned(true);
            // get the SignedData as bytes (finally)!
            byte[] signedDataByte = BERCoder.encode(signedData);
            Utils.saveMessage(signedDataByte, "signedData.ber");
            // at the receiving end
            SignedData newSignedData = new SignedData(signedDataByte);
            // two stage verification i) verify the cert that signed the
data ii) verify the signedData
            JCRYPTO_X509Certificate signingCert =
newSignedData.getSigningCertificate();
            CertificateChain newCertChain = newSignedData.getCertificates();
            newCertChain.addRootCertificate(rootCert);
            int trusted = newCertChain.contains(signingCert);         //
note cert validity is automatically checked here as well
            if (trusted == -1)
                System.out.println("Signing cert does not verify");
            else if (trusted == 0)
                System.out.println("Signing cert ambiguous. It is in the
cert chain but a oath of trust to it cannot be established!");
            else if (trusted == 1)
                System.out.println("Signing cert verifies");
            // either data has been included or not (with
signedData.setContentNull())
            //boolean result = newSignedData.verify(new Data(globalArray1);
            boolean result = newSignedData.verify();
            if(result)
                System.out.println("PKCS #7 verifies");
            else
                System.out.println("PKCS #7 fails");
            // get cert policies (CPS Pointer & User Notice)
            CertificatePolicies certPolicies =
(CertificatePolicies)signingCert.getExtension(OIDs.certificatePolicies);
            if (certPolicies != null) {
                String certPolicyId = certPolicies.getCertPolicyId();
                String cpsPointer = certPolicies.getCPSPointer();
                UserNotice userNotice = certPolicies.getUserNotice();
                System.out.println(" CertPolicy ID " + certPolicyId);
                System.out.println(" CPS Pointer " + cpsPointer);
                if (userNotice != null) {
                    String explicit = userNotice.getExplicitText();
                    String organization = userNotice.getOrganization();
                    int[] noticeNumbers = userNotice.getNoticeNumbers();
                    System.out.println(" Explicit Text (User Notice) " +
explicit);
                    System.out.println(" Organization (User Notice)  " +
organization);
                }
            }
            // signing time
            Date date = newSignedData.getSignerInfo().getSigningTime();
            if (date != null)
                System.out.println(" The data was signed at " + date);
            // get the data that was signed
            Data newData = (Data)newSignedData.getContent();
            byte[] tmpBytes = newData.getData();
            if(!Utils.cmpByteArrays(Utils.toBytes("This is the data to be
signed!"), tmpBytes))
                System.out.println(" The inner data has not been
maintained.");
        }
        catch(Exception e) {
            System.out.println(e.getMessage());
        }
    }
}

 con le opportune modifiche puoi dare un'occhiata qui:
[CUT]
Ti ringrazio lo stesso ma ho usato il provider "IAIK" che mi č sembrato pių
chiaro.
Ciaoo alla prox.........
