Java BouncyCastle属性messageDigest验证失败
我在使用BouncyCastle1.59签名/veryfing CADES签名时遇到问题。 我必须添加messageDigest属性,但当我添加它时,我的程序失败了 这是我的密码:Java BouncyCastle属性messageDigest验证失败,java,bouncycastle,Java,Bouncycastle,我在使用BouncyCastle1.59签名/veryfing CADES签名时遇到问题。 我必须添加messageDigest属性,但当我添加它时,我的程序失败了 这是我的密码: Signature signature = Signature.getInstance("SHA256withRSA", new BouncyCastleProvider()); byte[] test_data = "test".getBytes(); MessageDigest dig = MessageDige
Signature signature = Signature.getInstance("SHA256withRSA", new BouncyCastleProvider());
byte[] test_data = "test".getBytes();
MessageDigest dig = MessageDigest.getInstance("SHA256", new BouncyCastleProvider());
byte[] digest = dig.digest(test_data);
byte[] privateKeyContent = archivePrivateKey.getBytes();
BufferedReader br = new BufferedReader(new InputStreamReader(new ByteArrayInputStream(privateKeyContent)));
Security.addProvider(new BouncyCastleProvider());
PEMParser pp = new PEMParser(br);
PEMKeyPair pemKeyPair = (PEMKeyPair) pp.readObject();
KeyPair kp = new JcaPEMKeyConverter().getKeyPair(pemKeyPair);
pp.close();
signature.initSign(kp.getPrivate());
signature.update(test_data);
byte[] certContent = archiveCertificateContent.getBytes();
PemFile pemFile = new PemFile(certContent);
X509CertificateHolder cert = new X509CertificateHolder(pemFile.getPemObject().getContent());
X509Certificate certificate = new JcaX509CertificateConverter().getCertificate(cert);
// Build CMS
List certList = new ArrayList();
CMSTypedData data = new CMSProcessableByteArray(signature.sign());
certList.add(certificate);
Store certs = new JcaCertStore(certList);
byte[] certHash = dig.digest(certificate.getEncoded());
AlgorithmIdentifier algId = new AlgorithmIdentifier(NISTObjectIdentifiers.id_sha256);
ESSCertIDv2 essCert = new ESSCertIDv2(algId, certHash);
SigningCertificateV2 scv2 = new SigningCertificateV2(new ESSCertIDv2[] { essCert });
ASN1EncodableVector signedAttributes = new ASN1EncodableVector();
signedAttributes.add(new Attribute(PKCSObjectIdentifiers.id_aa_signingCertificateV2, new DERSet(scv2)));
//signedAttributes.add(new Attribute(CMSAttributes.messageDigest, new DERSet(new DEROctetString(digest))));
signedAttributes.add(new Attribute(CMSAttributes.contentType, new DERSet(PKCSObjectIdentifiers.data)));
AttributeTable signedAttributesTable = new AttributeTable(signedAttributes);
signedAttributesTable.toASN1EncodableVector();
CMSSignedDataGenerator gen = new CMSSignedDataGenerator();
JcaContentSignerBuilder contentSigner = new JcaContentSignerBuilder("SHA256withRSA");
contentSigner.setProvider(BC_PROVIDER);
SignerInfoGeneratorBuilder signerInfoBuilder = new SignerInfoGeneratorBuilder(new JcaDigestCalculatorProviderBuilder().setProvider(BC_PROVIDER).build());
signerInfoBuilder.setSignedAttributeGenerator(new DefaultSignedAttributeTableGenerator(signedAttributesTable));
gen.addSignerInfoGenerator(signerInfoBuilder.build(contentSigner.build(kp.getPrivate()), cert));
gen.addCertificates(certs);
CMSSignedData signedData = gen.generate(data, true);
// Verify signature
Store store = signedData.getCertificates();
SignerInformationStore signers = signedData.getSignerInfos();
Collection c = signers.getSigners();
Iterator it = c.iterator();
while (it.hasNext()) {
SignerInformation signer = (SignerInformation) it.next();
Collection certCollection = store.getMatches(signer.getSID());
Iterator certIt = certCollection.iterator();
X509CertificateHolder certHolder = (X509CertificateHolder) certIt.next();
X509Certificate certFromSignedData = new JcaX509CertificateConverter().setProvider(BC_PROVIDER).getCertificate(certHolder);
if (signer.verify(new JcaSimpleSignerInfoVerifierBuilder().setProvider(BC_PROVIDER).build(certFromSignedData))) {
System.out.println("Signature verified");
} else {
System.out.println("Signature verification failed");
}
}
当我取消注释第35行时:signedAttributes.add(新属性(CMSAttributes.messageDigest,新DERSet(新DEROctetString(digest)))代码>然后我得到错误:
org.bouncycastle.cms.CMSSignerDigestMismatchException:消息摘要属性值与计算值不匹配
我尝试了很多选项和配置,但问题仍然存在。任何帮助都是非常有用的。
谢谢我自己还没有尝试过你的代码,但我认为问题在于你添加的消息摘要作为MessageDigest属性并不是你真正在SignedData中添加的内容。我看到您首先使用JCA对数据进行签名
Signature signature = Signature.getInstance("SHA256withRSA", new BouncyCastleProvider());
byte[] test_data = "test".getBytes();
signature.initSign(kp.getPrivate());
signature.update(test_data);
CMSTypedData data = new CMSProcessableByteArray(signature.sign());
...
CMSSignedData signedData = gen.generate(data, true);
在这里,您要放置签名(而不是数据,这很奇怪)来生成CMSSignedData。因此,对于contentSigner,您的签名就是要签名的实际数据。但是,在MessageDigest属性中,您要放置实际数据的摘要。这很可能是造成问题的原因
现在来谈谈更重要的问题。首先,为什么要使用上述代码对数据进行签名?这在我看来是错误的,可能不是你想要的。如果您的目的是为“测试”数据生成CMS signedData,则应直接在signedData Generator中使用该数据,这将处理签名部分
如果您还没有这样做,请检查
希望这有帮助。我删除了签名。initSign。。。part并允许signedDataGenerator对数据进行签名。然后它开始工作了。谢谢