summary refs log tree commit diff
path: root/crypto/src/cms/CMSSignedData.cs
blob: a14a4dadb00e500d1504f2d17d712c61b44e89e5 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
using System;
using System.Collections.Generic;
using System.IO;

using Org.BouncyCastle.Asn1;
using Org.BouncyCastle.Asn1.Cms;
using Org.BouncyCastle.Asn1.X509;
using Org.BouncyCastle.Operators.Utilities;
using Org.BouncyCastle.Utilities.Collections;
using Org.BouncyCastle.X509;

namespace Org.BouncyCastle.Cms
{
	/**
	* general class for handling a pkcs7-signature message.
	*
	* A simple example of usage - note, in the example below the validity of
	* the certificate isn't verified, just the fact that one of the certs
	* matches the given signer...
	*
	* <pre>
	*  IX509Store              certs = s.GetCertificates();
	*  SignerInformationStore  signers = s.GetSignerInfos();
	*
	*  foreach (SignerInformation signer in signers.GetSigners())
	*  {
	*      ArrayList       certList = new ArrayList(certs.GetMatches(signer.SignerID));
	*      X509Certificate cert = (X509Certificate) certList[0];
	*
	*      if (signer.Verify(cert.GetPublicKey()))
	*      {
	*          verified++;
	*      }
	*  }
	* </pre>
	*/
	public class CmsSignedData
	{
		private static readonly CmsSignedHelper Helper = CmsSignedHelper.Instance;

		private readonly CmsProcessable	signedContent;
		private SignedData				signedData;
		private ContentInfo				contentInfo;
		private SignerInformationStore	signerInfoStore;
		private IDictionary<string, byte[]> m_hashes;

		private CmsSignedData(CmsSignedData c)
		{
			this.signedData = c.signedData;
			this.contentInfo = c.contentInfo;
			this.signedContent = c.signedContent;
			this.signerInfoStore = c.signerInfoStore;
		}

		public CmsSignedData(byte[] sigBlock)
			: this(CmsUtilities.ReadContentInfo(new MemoryStream(sigBlock, false)))
		{
		}

		public CmsSignedData(CmsProcessable signedContent, byte[] sigBlock)
			: this(signedContent, CmsUtilities.ReadContentInfo(new MemoryStream(sigBlock, false)))
		{
		}

		/**
		 * Content with detached signature, digests precomputed
		 *
		 * @param hashes a map of precomputed digests for content indexed by name of hash.
		 * @param sigBlock the signature object.
		 */
		public CmsSignedData(IDictionary<string, byte[]> hashes, byte[] sigBlock)
			: this(hashes, CmsUtilities.ReadContentInfo(sigBlock))
		{
		}

		/**
		* base constructor - content with detached signature.
		*
		* @param signedContent the content that was signed.
		* @param sigData the signature object.
		*/
		public CmsSignedData(CmsProcessable signedContent, Stream sigData)
			: this(signedContent, CmsUtilities.ReadContentInfo(sigData))
		{
		}

		/**
		* base constructor - with encapsulated content
		*/
		public CmsSignedData(Stream sigData)
			: this(CmsUtilities.ReadContentInfo(sigData))
		{
		}

		public CmsSignedData(CmsProcessable signedContent, ContentInfo sigData)
		{
			this.signedContent = signedContent;
			this.contentInfo = sigData;
			this.signedData = SignedData.GetInstance(contentInfo.Content);
		}

		public CmsSignedData(IDictionary<string, byte[]> hashes, ContentInfo sigData)
		{
			this.m_hashes = hashes;
			this.contentInfo = sigData;
			this.signedData = SignedData.GetInstance(contentInfo.Content);
		}

		public CmsSignedData(ContentInfo sigData)
		{
			this.contentInfo = sigData;
			this.signedData = SignedData.GetInstance(contentInfo.Content);

			//
			// this can happen if the signed message is sent simply to send a
			// certificate chain.
			//
			if (signedData.EncapContentInfo.Content != null)
			{
				this.signedContent = new CmsProcessableByteArray(
					((Asn1OctetString)signedData.EncapContentInfo.Content).GetOctets());
			}
//			else
//			{
//				this.signedContent = null;
//			}
		}

		/// <summary>Return the version number for this object.</summary>
		public int Version
		{
			get { return signedData.Version.IntValueExact; }
		}

        /**
		* return the collection of signers that are associated with the
		* signatures for the message.
		*/
        public SignerInformationStore GetSignerInfos()
		{
			if (signerInfoStore == null)
			{
				var signerInfos = new List<SignerInformation>();
				Asn1Set s = signedData.SignerInfos;

				foreach (object obj in s)
				{
					SignerInfo info = SignerInfo.GetInstance(obj);
					DerObjectIdentifier contentType = signedData.EncapContentInfo.ContentType;

					if (m_hashes == null)
					{
						signerInfos.Add(new SignerInformation(info, contentType, signedContent, null));
					}
					else if (m_hashes.TryGetValue(info.DigestAlgorithm.Algorithm.Id, out var hash))
					{
						signerInfos.Add(new SignerInformation(info, contentType, null, hash));
					}
					else
                    {
						throw new InvalidOperationException();
                    }
				}

				signerInfoStore = new SignerInformationStore(signerInfos);
			}

			return signerInfoStore;
		}

		/**
		 * return a X509Store containing the attribute certificates, if any, contained
		 * in this message.
		 *
		 * @param type type of store to create
		 * @return a store of attribute certificates
		 * @exception NoSuchStoreException if the store type isn't available.
		 * @exception CmsException if a general exception prevents creation of the X509Store
		 */
		public IStore<X509V2AttributeCertificate> GetAttributeCertificates()
		{
			return Helper.GetAttributeCertificates(signedData.Certificates);
		}

		/**
		 * return a X509Store containing the public key certificates, if any, contained in this message.
		 *
		 * @return a store of public key certificates
		 * @exception NoSuchStoreException if the store type isn't available.
		 * @exception CmsException if a general exception prevents creation of the X509Store
		 */
		public IStore<X509Certificate> GetCertificates()
		{
			return Helper.GetCertificates(signedData.Certificates);
		}

		/**
		* return a X509Store containing CRLs, if any, contained in this message.
		*
		* @return a store of CRLs
		* @exception NoSuchStoreException if the store type isn't available.
		* @exception CmsException if a general exception prevents creation of the X509Store
		*/
		public IStore<X509Crl> GetCrls()
		{
			return Helper.GetCrls(signedData.CRLs);
		}

        public IStore<Asn1Encodable> GetOtherRevInfos(DerObjectIdentifier otherRevInfoFormat)
		{
			return Helper.GetOtherRevInfos(signedData.CRLs, otherRevInfoFormat);
		}

        /**
         * Return the digest algorithm identifiers for the SignedData object
         *
         * @return the set of digest algorithm identifiers
         */
        public ISet<AlgorithmIdentifier> GetDigestAlgorithmIDs()
        {
			var digestAlgorithms = signedData.DigestAlgorithms;

            HashSet<AlgorithmIdentifier> result = new HashSet<AlgorithmIdentifier>();

			foreach (var entry in digestAlgorithms)
			{
                result.Add(AlgorithmIdentifier.GetInstance(entry));
			}

			return CollectionUtilities.ReadOnly(result);
        }

        /// <summary>
        /// Return the <c>DerObjectIdentifier</c> associated with the encapsulated
        /// content info structure carried in the signed data.
        /// </summary>
        public DerObjectIdentifier SignedContentType
		{
			get { return signedData.EncapContentInfo.ContentType; }
		}

		public CmsProcessable SignedContent
		{
			get { return signedContent; }
		}

		/**
		 * return the ContentInfo
		 */
		public ContentInfo ContentInfo
		{
			get { return contentInfo; }
		}

		/**
		* return the ASN.1 encoded representation of this object.
		*/
		public byte[] GetEncoded()
		{
			return contentInfo.GetEncoded();
		}

        /**
         * return the ASN.1 encoded representation of this object using the specified encoding.
         *
         * @param encoding the ASN.1 encoding format to use ("BER" or "DER").
         */
        public byte[] GetEncoded(string encoding)
        {
            return contentInfo.GetEncoded(encoding);
        }

        /**
         * Return a new CMSSignedData which guarantees to have the passed in digestAlgorithm
         * in it. Uses the DefaultDigestAlgorithmFinder for creating the digest sets.
         *
         * @param signedData      the signed data object to be used as a base.
         * @param digestAlgorithm the digest algorithm to be added to the signed data.
         * @return a new signed data object.
         */
        public static CmsSignedData AddDigestAlgorithm(CmsSignedData signedData, AlgorithmIdentifier digestAlgorithm) =>
            AddDigestAlgorithm(signedData, digestAlgorithm, DefaultDigestAlgorithmFinder.Instance);

        /**
         * Return a new CMSSignedData which guarantees to have the passed in digestAlgorithm
         * in it. Uses the passed in IDigestAlgorithmFinder for creating the digest sets.
         *
         * @param signedData      the signed data object to be used as a base.
         * @param digestAlgorithm the digest algorithm to be added to the signed data.
         * @param digestAlgorithmFinder the digest algorithm finder to generate the digest set with.
         * @return a new signed data object.
         */
        public static CmsSignedData AddDigestAlgorithm(CmsSignedData signedData, AlgorithmIdentifier digestAlgorithm,
			IDigestAlgorithmFinder digestAlgorithmFinder)
		{
			ISet<AlgorithmIdentifier> digestAlgorithms = signedData.GetDigestAlgorithmIDs();
			AlgorithmIdentifier digestAlg = Helper.FixDigestAlgID(digestAlgorithm, digestAlgorithmFinder);

			//
			// if the algorithm is already present there is no need to add it.
			//
			if (digestAlgorithms.Contains(digestAlg))
				return signedData;

			//
			// copy
			//
			CmsSignedData cms = new CmsSignedData(signedData);

            //
            // build up the new set
            //
            HashSet<AlgorithmIdentifier> digestAlgs = new HashSet<AlgorithmIdentifier>();

            foreach (var entry in digestAlgs)
			{
				digestAlgs.Add(Helper.FixDigestAlgID(entry, digestAlgorithmFinder));
			}
			digestAlgs.Add(digestAlg);

			Asn1Set digests = CmsUtilities.ConvertToDLSet(digestAlgs);
			Asn1Sequence sD = (Asn1Sequence)signedData.signedData.ToAsn1Object();

            //
            // signers are the last item in the sequence.
            //
            Asn1EncodableVector vec = new Asn1EncodableVector(sD.Count);
            vec.Add(sD[0]); // version
			vec.Add(digests);

			for (int i = 2; i != sD.Count; i++)
			{
				vec.Add(sD[i]);
			}

			cms.signedData = SignedData.GetInstance(new BerSequence(vec));

			//
			// replace the contentInfo with the new one
			//
			cms.contentInfo = new ContentInfo(cms.contentInfo.ContentType, cms.signedData);

			return cms;
		}

        /**
		 * Replace the SignerInformation store associated with this CMSSignedData object with the new one passed in
		 * using the DefaultDigestAlgorithmFinder for creating the digest sets. You would probably only want
		 * to do this if you wanted to change the unsigned attributes associated with a signer, or perhaps delete one.
		 *
		 * @param signedData             the signed data object to be used as a base.
		 * @param signerInformationStore the new signer information store to use.
		 * @return a new signed data object.
		 */
        public static CmsSignedData ReplaceSigners(CmsSignedData signedData,
			SignerInformationStore signerInformationStore) =>
				ReplaceSigners(signedData, signerInformationStore, DefaultDigestAlgorithmFinder.Instance);

        /**
         * Replace the SignerInformation store associated with this CMSSignedData object with the new one passed in
         * using the passed in IDigestAlgorithmFinder for creating the digest sets. You would probably only
         * want to do this if you wanted to change the unsigned attributes associated with a signer, or perhaps delete
         * one.
         *
         * @param signedData             the signed data object to be used as a base.
         * @param signerInformationStore the new signer information store to use.
         * @param digestAlgorithmFinder the digest algorithm finder to generate the digest set with.
         * @return a new signed data object.
         */
        public static CmsSignedData ReplaceSigners(CmsSignedData signedData,
			SignerInformationStore signerInformationStore, IDigestAlgorithmFinder digestAlgorithmFinder)
		{
            //
            // copy
            //
            CmsSignedData cms = new CmsSignedData(signedData);

            //
            // replace the store
            //
            cms.signerInfoStore = signerInformationStore;

            //
            // replace the signers in the SignedData object
            //
            HashSet<AlgorithmIdentifier> digestAlgs = new HashSet<AlgorithmIdentifier>();

			var signers = signerInformationStore.GetSigners();
			Asn1EncodableVector vec = new Asn1EncodableVector(signers.Count);

			foreach (var signer in signers)
			{
				CmsUtilities.AddDigestAlgs(digestAlgs, signer, digestAlgorithmFinder);
				vec.Add(signer.ToSignerInfo());
			}

			Asn1Set digestSet = CmsUtilities.ConvertToDLSet(digestAlgs);
			Asn1Set signerSet = DLSet.FromVector(vec);
			Asn1Sequence sD = (Asn1Sequence)signedData.signedData.ToAsn1Object();

            //
            // signers are the last item in the sequence.
            //
            vec = new Asn1EncodableVector(sD.Count);
            vec.Add(sD[0]); // version
			vec.Add(digestSet);

			for (int i = 2; i != sD.Count - 1; i++)
			{
				vec.Add(sD[i]);
			}

			vec.Add(signerSet);

			cms.signedData = SignedData.GetInstance(new BerSequence(vec));

			//
			// replace the contentInfo with the new one
			//
			cms.contentInfo = new ContentInfo(cms.contentInfo.ContentType, cms.signedData);

			return cms;
		}

        /**
		* Replace the certificate and CRL information associated with this
		* CmsSignedData object with the new one passed in.
		*
		* @param signedData the signed data object to be used as a base.
		* @param x509Certs the new certificates to be used.
		* @param x509Crls the new CRLs to be used.
		* @return a new signed data object.
		* @exception CmsException if there is an error processing the stores
		*/
        public static CmsSignedData ReplaceCertificatesAndCrls(CmsSignedData signedData,
            IStore<X509Certificate> x509Certs, IStore<X509Crl> x509Crls)
		{
            return ReplaceCertificatesAndRevocations(signedData, x509Certs, x509Crls, null, null);
		}

        public static CmsSignedData ReplaceCertificatesAndCrls(CmsSignedData signedData,
			IStore<X509Certificate> x509Certs, IStore<X509Crl> x509Crls,
			IStore<X509V2AttributeCertificate> x509AttrCerts)
		{
            return ReplaceCertificatesAndRevocations(signedData, x509Certs, x509Crls, x509AttrCerts, null);
        }

        public static CmsSignedData ReplaceCertificatesAndRevocations(CmsSignedData signedData,
            IStore<X509Certificate> x509Certs, IStore<X509Crl> x509Crls,
            IStore<X509V2AttributeCertificate> x509AttrCerts, IStore<OtherRevocationInfoFormat> otherRevocationInfos)
        {
            //
            // copy
            //
            CmsSignedData cms = new CmsSignedData(signedData);

			//
			// replace the certs and crls in the SignedData object
			//
			Asn1Set certSet = null;
			Asn1Set revocationSet = null;

			if (x509Certs != null || x509AttrCerts != null)
			{
				var certificates = new List<Asn1Encodable>();
				if (x509Certs != null)
				{
					certificates.AddRange(CmsUtilities.GetCertificatesFromStore(x509Certs));
				}
				if (x509AttrCerts != null)
				{
					certificates.AddRange(CmsUtilities.GetAttributeCertificatesFromStore(x509AttrCerts));
				}

				Asn1Set berSet = CmsUtilities.CreateBerSetFromList(certificates);
				if (berSet.Count > 0)
				{
					certSet = berSet;
				}
			}

			if (x509Crls != null || otherRevocationInfos != null)
			{
				var revocations = new List<Asn1Encodable>();
				if (x509Crls != null)
				{
					revocations.AddRange(CmsUtilities.GetCrlsFromStore(x509Crls));
				}
				if (otherRevocationInfos != null)
				{
                    revocations.AddRange(CmsUtilities.GetOtherRevocationInfosFromStore(otherRevocationInfos));
                }

				Asn1Set berSet = CmsUtilities.CreateBerSetFromList(revocations);
				if (berSet.Count > 0)
				{
					revocationSet = berSet;
				}
			}

			//
			// replace the CMS structure.
			//
			SignedData old = signedData.signedData;
			cms.signedData = new SignedData(
				old.DigestAlgorithms,
				old.EncapContentInfo,
				certSet,
				revocationSet,
				old.SignerInfos);

			//
			// replace the contentInfo with the new one
			//
			cms.contentInfo = new ContentInfo(cms.contentInfo.ContentType, cms.signedData);

			return cms;
		}
	}
}