如何从 PKCS#1 Zeal id 集成中获取 CMS (PKCS#7)

Answer 1

我不知道 CSC 2QR API，更不用说完成解决它的代码了。因此，在这个答案中，我将展示一个框架来集成任意远程签名 API。

将远程签名服务与 iText 7 签名 API 集成的最简单方法是相应地实现 IExternalSignature。这可能看起来像这样（特定于 CSC 2QR API 的代码，由伪代码表示）：

public class CSC2QRSignature implements IExternalSignature {

    Certificate[] chain;
    String hashAlgorithm = "SHA256";
    String encryptionAlgorithm = "RSA";

    public CSC2QRSignature([... parameters you need for CSC 2QR communication ...]) {
        [... request your CSC 2QR Credentials Info and initialize      ...]
        [... chain, hashAlgorithm, and encryptionAlgorithm accordingly ...]
    }

    @Override
    public String getEncryptionAlgorithm() {
        return encryptionAlgorithm;
    }

    @Override
    public String getHashAlgorithm() {
        return hashAlgorithm;
    }

    public Certificate[] getChain() {
        return chain;
    }

    @Override
    public byte[] sign(byte[] message) throws GeneralSecurityException {
        byte[] digest = MessageDigest.getInstance(hashAlgorithm).digest(message);
        [... call CSC 2QR Sign Hash for the base64 encoded digest ...]
        [... and return the base64 decoded signature from the response ...]
    }
}

使用该类，您可以像这样签署 PDF：

PdfReader reader = new PdfReader(SOURCE_PDF);
OutputStream os = new FileOutputStream(RESULT_PDF);

CSC2QRSignature signature = new CSC2QRSignature(...);
IExternalDigest digest = new BouncyCastleDigest();

PdfSigner signer = new PdfSigner(reader, os, new StampingProperties());
signer.signDetached(digest, signature, signature.getChain() , null, null, null, 0, CryptoStandard.CMS);

Answer 2

这是我从 zeal 获得签名后的代码。签名有效，但仍显示 PDF-NOT-ETSI。

public static  String  prepareSignature(InputStream in, ByteArrayOutputStream preparedArrayStream ) throws FileNotFoundException, IOException,GeneralSecurityException {
            PdfReader reader = new PdfReader(in);
             Rectangle rect = new Rectangle(36, 648, 200, 100);
            PdfSigner signer = new PdfSigner(reader, preparedArrayStream,  new StampingProperties().useAppendMode());
                
PdfSignatureAppearance appearance = signer.getSignatureAppearance();
                appearance.setPageRect(rect)
                .setPageNumber(1)
                .setLocation("EU")
                .setReason("Test");
               signer.setFieldName("testing");
                
                PreSignatureContainer external = new PreSignatureContainer(PdfName.Adobe_PPKLite,
                        PdfName.ETSI_CAdES_DETACHED);
                
                signer.signExternalContainer(external, 8192);
                String hash = Base64.encodeBase64String(external.getHash());
                return hash;
               // byte[] preSignedBytes = os.toByteArray();
              //  outputStream.close();
                
            
            //return outputStream;
        }
        static class PreSignatureContainer  implements IExternalSignatureContainer 
        {
            private PdfDictionary sigDic;
            private byte hash[];
    
            public PreSignatureContainer(PdfName filter, PdfName subFilter) {
                sigDic = new PdfDictionary();
                sigDic.put(PdfName.Filter, filter);
                sigDic.put(PdfName.SubFilter, subFilter);
            }
    
            @Override
            public byte[] sign(InputStream data) throws GeneralSecurityException {
                String hashAlgorithm = "SHA256";
                BouncyCastleDigest digest = new BouncyCastleDigest();
    
                try {
                    this.hash = DigestAlgorithms.digest(data, digest.getMessageDigest(hashAlgorithm));
                } catch (IOException e) {
                    throw new GeneralSecurityException("PreSignatureContainer signing exception", e);
                }
    
                return new byte[0];
            }
    
            @Override
            public void modifySigningDictionary(PdfDictionary signDic) {
                signDic.putAll(sigDic);
            }
    
            public byte[] getHash() {
                return hash;
            }
        }
    
    public static void createSignature(InputStream in, String signatures) throws Exception {
             byte[] decodeSignature = Base64.decodeBase64(signatures);
             PdfReader reader =  null;
                reader = new PdfReader(in);
                FileOutputStream outputStream = new FileOutputStream(new File("D:\\zealid\\test\\newZeal.pdf"));
                 PdfSigner signer = new PdfSigner(reader, outputStream,  new StampingProperties().useAppendMode());
                 signer.signDeferred(signer.getDocument(), "testing", outputStream, new ExternalPrecalculatedSignatureContainer(decodeSignature));
                
                
                    outputStream.close();
        }
    
    class ExternalPrecalculatedSignatureContainer extends ExternalBlankSignatureContainer
        {
            byte[] cmsSignatureContents;
            public ExternalPrecalculatedSignatureContainer(byte[] cmsSignatureContents) 
            {
                super(new PdfDictionary());
                this.cmsSignatureContents = cmsSignatureContents;
            }
            
            
            @Override
            public  byte[] sign(InputStream data) throws CertificateException, InvalidKeyException, NoSuchProviderException, NoSuchAlgorithmException
            {
              BouncyCastleDigest digest = new BouncyCastleDigest();
             PdfPKCS7 sgn = new PdfPKCS7(null, chain, DigestAlgorithms.SHA256, null, digest, false);
             sgn.setExternalDigest(cmsSignatureContents, null,"RSA");
             cmsSignatureContents = sgn.getEncodedPKCS7();
             
                return cmsSignatureContents;
            }
    
          
    
        
        }