Class XAdESSignature
- java.lang.Object
-
- eu.europa.esig.dss.validation.DefaultAdvancedSignature
-
- eu.europa.esig.dss.xades.validation.XAdESSignature
-
- All Implemented Interfaces:
AdvancedSignature,Serializable
public class XAdESSignature extends DefaultAdvancedSignature
Parse an XAdES signature structure. Note that for each signature to be validated a new instance of this object must be created.- See Also:
- Serialized Form
-
-
Nested Class Summary
-
Nested classes/interfaces inherited from class eu.europa.esig.dss.validation.DefaultAdvancedSignature
DefaultAdvancedSignature.RevocationDataForInclusion
-
-
Field Summary
Fields Modifier and Type Field Description protected static StringDEFAULT_CANONICALIZATION_METHODThe default canonicalization method used inSignatureDigestReferencecomputationprotected XPathQueryHolderxPathQueryHolderThis variable contains the XPathQueryHolder adapted to the signature schema.-
Fields inherited from class eu.europa.esig.dss.validation.DefaultAdvancedSignature
candidatesForSigningCertificate, certPool, detachedContents, manifestFiles, offlineCertificateSource, providedSigningCertificateToken, referenceValidations, signatureCRLSource, signatureCryptographicVerification, signatureIdentifier, signatureOCSPSource, signaturePolicy, signatureTimestampSource, structureValidation
-
-
Constructor Summary
Constructors Constructor Description XAdESSignature(Element signatureElement)This constructor is used when creating the signature.XAdESSignature(Element signatureElement, List<XPathQueryHolder> xPathQueryHolders, CertificatePool certPool)The default constructor for XAdESSignature.
-
Method Summary
Modifier and Type Method Description protected SignatureIdentifierbuildSignatureIdentifier()Build and definessignatureIdentifiervaluevoidcheckSignatureIntegrity()Verifies the signature integrity; checks if the signed content has not been tampered with.voidcheckSignaturePolicy(SignaturePolicyProvider signaturePolicyProvider)voidcheckSigningCertificate()This method checks the protection of the certificates included within the signature (XAdES: KeyInfo) against the substitution attack.CandidatesForSigningCertificategetCandidatesForSigningCertificate()Gets an object containing the signing certificate or information indicating why it is impossible to extract it from the signature.List<CertificateRef>getCertificateRefs()Retrieve list of certificate refSignatureCertificateSourcegetCertificateSource()Gets a certificate source which contains ALL certificates embedded in the signature.ElementgetCertificateValues()List<SignerRole>getCertifiedSignerRoles()Returns the certified roles of the signer.List<SignerRole>getClaimedSignerRoles()Returns the claimed roles of the signer.CommitmentTypegetCommitmentTypeIndication()This method obtains the information concerning commitment type indication linked to the signatureElementgetCompleteCertificateRefs()ElementgetCompleteRevocationRefs()StringgetContentHints()StringgetContentIdentifier()StringgetContentType()Returns the value of the signed attribute content-typeList<AdvancedSignature>getCounterSignatures()This method retrieves the potential countersignatures embedded in the XAdES signature document.SignatureCRLSourcegetCRLSource()Gets a CRL source which contains ALL CRLs embedded in the signature.StringgetDAIdentifier()This method returns an identifier provided by the Driving Application (DA) Note: used only for XAdESDigestAlgorithmgetDigestAlgorithm()Retrieves the digest algorithm used for generating the signature.EncryptionAlgorithmgetEncryptionAlgorithm()Retrieves the encryption algorithm used for generating the signature.ElementgetLastTimestampValidationData()This method returns the last timestamp validation data for an archive timestamp.NodegetManifestById(String uri)List<ReferenceValidation>getManifestReferences(Node manifestNode)Returns a list of all references contained in the given manifestMaskGenerationFunctiongetMaskGenerationFunction()Retrieves the mask generation function used for generating the signature.StringgetMimeType()Returns the value of the signed attribute mime-typeNodegetObjectById(String uri)NodeListgetObjects()This method returns the list of ds:Object elements for the current signature element.SignatureOCSPSourcegetOCSPSource()Gets an OCSP source which contains ALL OCSP responses embedded in the signature.List<org.apache.xml.security.signature.Reference>getReferences()List<ReferenceValidation>getReferenceValidations()Returns individual validation foreach reference (XAdES) or for the message-imprint (CAdES)ElementgetRevocationValues()NodeListgetSigAndRefsTimeStamp()SignatureAlgorithmgetSignatureAlgorithm()Retrieves the signature algorithm (or cipher) used for generating the signature.SignatureDigestReferencegetSignatureDigestReference(DigestAlgorithm digestAlgorithm)TS 119 442 - V1.1.1 - Electronic Signatures and Infrastructures (ESI), ch.ElementgetSignatureElement()Returns the w3c.dom encapsulated signature element.SignatureFormgetSignatureForm()Specifies the format of the signatureSignatureLevel[]getSignatureLevels()List<Element>getSignatureObjects()SignatureProductionPlacegetSignatureProductionPlace()Returns information about the place where the signature was generatedbyte[]getSignatureValue()Returns the digital signature valueList<String>getSignedDataObjectProperties()List<String>getSignedProperties()List<String>getSignedSignatureProperties()protected List<CertificateValidity>getSigningCertificateValidityList(PublicKey extractedPublicKey)This method returns aListofSigningCertificateValiditybase on the providedprovidedSigningCertificateToken.DategetSigningTime()Returns the signing time included within the signature.XAdESTimestampSourcegetTimestampSource()Gets a Signature Timestamp source which contains ALL timestamps embedded in the signature.List<String>getUnsignedProperties()List<String>getUnsignedSignatureProperties()Retrieves the name of each node found under the unsignedSignatureProperties elementXPathQueryHoldergetXPathQueryHolder()This getter returns theXPathQueryHolderbooleanhasBProfile()Checks the presence of ...booleanhasCProfile()Checks the presence of CompleteCertificateRefs and CompleteRevocationRefs segments in the signature, what is the proof -C profile existencebooleanhasXProfile()Checks the presence of SigAndRefsTimeStamp segment in the signature, what is the proof -X profile existencebooleanisDataForSignatureLevelPresent(SignatureLevel signatureLevel)voidrecursiveNamespaceBrowser(Element element)This method sets the namespace which will determinate theXPathQueryHolderto use.voidregisterXPathQueryHolder(XPathQueryHolder xPathQueryHolder)This method allows to register a newXPathQueryHolder.voidresetCertificateSource()This method resets the source of certificates.voidresetRevocationSources()This method resets the sources of the revocation data.voidresetTimestampSource()This method resets the timestamp source.voidvalidateStructure()This method allows the structure validation of the signature.-
Methods inherited from class eu.europa.esig.dss.validation.DefaultAdvancedSignature
addEncapsulatedCertificatesFromTimestamp, addExternalTimestamp, addReference, addReferences, addReferencesForCertificates, addReferencesForPreviousTimestamps, addReferencesFromRevocationData, equals, findRefsForRevocationIdentifier, findRefsForRevocationToken, findSignatureScope, getAllFoundRevocationIdentifiers, getAllFoundRevocationRefs, getAllRevocationTokens, getAllTimestamps, getArchiveTimestamps, getAttributeRevocationCRLReferences, getAttributeRevocationOCSPReferences, getAttributeRevocationTokens, getAttributeRevocationValuesTokens, getCertificateListWithinSignatureAndTimestamps, getCertificateMapWithinSignatureAndTimestamps, getCertificates, getCertificatesForInclusion, getCompleteCRLSource, getCompleteOCSPSource, getCompleteRevocationCRLReferences, getCompleteRevocationOCSPReferences, getCompleteRevocationTokens, getContactInfo, getContainerContents, getContentTimestampReferences, getContentTimestamps, getDataFoundUpToLevel, getDetachedContents, getDocumentTimestamps, getDSSDictionaryRevocationTokens, getDSSId, getFilter, getId, getManifestedDocuments, getMasterSignature, getMessageDigestValue, getOrphanCertificateRefs, getOrphanRevocationRefs, getPolicyId, getProvidedSigningCertificateToken, getReason, getRevocationDataForInclusion, getRevocationValuesTokens, getSignatureByteRange, getSignatureCryptographicVerification, getSignatureFieldName, getSignatureFilename, getSignatureScopes, getSignatureTimestampReferences, getSignatureTimestamps, getSignatureValidationContext, getSignerName, getSignerRoles, getSigningCertificateTimestampReferences, getSigningCertificateToken, getStructureValidationResult, getSubFilter, getTimestampedReferencesFromCertificates, getTimestampRevocationCRLReferences, getTimestampRevocationOCSPReferences, getTimestampSourceCertificates, getTimestampsX1, getTimestampsX2, getTimestampValidationDataTokens, getVRIDictionaryRevocationTokens, hashCode, hasLTAProfile, hasLTProfile, hasTProfile, isDocHashOnlyValidation, isHashOnlyValidation, populateCRLTokenLists, populateOCSPTokenLists, prepareTimestamps, setContainerContents, setDetachedContents, setManifestFiles, setMasterSignature, setProvidedSigningCertificateToken, setSignatureFilename
-
-
-
-
Field Detail
-
DEFAULT_CANONICALIZATION_METHOD
protected static final String DEFAULT_CANONICALIZATION_METHOD
The default canonicalization method used inSignatureDigestReferencecomputation- See Also:
- Constant Field Values
-
xPathQueryHolder
protected XPathQueryHolder xPathQueryHolder
This variable contains the XPathQueryHolder adapted to the signature schema.
-
-
Constructor Detail
-
XAdESSignature
public XAdESSignature(Element signatureElement)
This constructor is used when creating the signature. The defaultXPathQueryHolderis set.- Parameters:
signatureElement- the signature DOM element
-
XAdESSignature
public XAdESSignature(Element signatureElement, List<XPathQueryHolder> xPathQueryHolders, CertificatePool certPool)
The default constructor for XAdESSignature.- Parameters:
signatureElement- the signature DOM elementxPathQueryHolders- List ofXPathQueryHolderto use when handling signaturecertPool- the certificate pool (can be null)
-
-
Method Detail
-
recursiveNamespaceBrowser
public void recursiveNamespaceBrowser(Element element)
This method sets the namespace which will determinate theXPathQueryHolderto use. The content of the Transform element is ignored.- Parameters:
element-
-
getXPathQueryHolder
public XPathQueryHolder getXPathQueryHolder()
This getter returns theXPathQueryHolder- Returns:
-
getSignatureElement
public Element getSignatureElement()
Returns the w3c.dom encapsulated signature element.- Returns:
- the signatureElement
-
getSignatureForm
public SignatureForm getSignatureForm()
Description copied from interface:AdvancedSignatureSpecifies the format of the signature
-
getEncryptionAlgorithm
public EncryptionAlgorithm getEncryptionAlgorithm()
Description copied from interface:AdvancedSignatureRetrieves the encryption algorithm used for generating the signature.- Returns:
EncryptionAlgorithm
-
getDigestAlgorithm
public DigestAlgorithm getDigestAlgorithm()
Description copied from interface:AdvancedSignatureRetrieves the digest algorithm used for generating the signature.- Returns:
DigestAlgorithm
-
getMaskGenerationFunction
public MaskGenerationFunction getMaskGenerationFunction()
Description copied from interface:AdvancedSignatureRetrieves the mask generation function used for generating the signature.- Returns:
MaskGenerationFunction
-
getSignatureAlgorithm
public SignatureAlgorithm getSignatureAlgorithm()
Description copied from interface:AdvancedSignatureRetrieves the signature algorithm (or cipher) used for generating the signature.- Returns:
SignatureAlgorithm
-
getCertificateSource
public SignatureCertificateSource getCertificateSource()
Description copied from interface:AdvancedSignatureGets a certificate source which contains ALL certificates embedded in the signature.- Returns:
-
resetCertificateSource
public void resetCertificateSource()
This method resets the source of certificates. It must be called when any certificate is added to the KeyInfo or CertificateValues.
-
getCRLSource
public SignatureCRLSource getCRLSource()
Description copied from interface:AdvancedSignatureGets a CRL source which contains ALL CRLs embedded in the signature.- Returns:
SignatureCRLSource
-
getOCSPSource
public SignatureOCSPSource getOCSPSource()
Description copied from interface:AdvancedSignatureGets an OCSP source which contains ALL OCSP responses embedded in the signature.- Returns:
SignatureOCSPSource
-
resetRevocationSources
public void resetRevocationSources()
This method resets the sources of the revocation data. It must be called when -LT level is created.
-
getTimestampSource
public XAdESTimestampSource getTimestampSource()
Description copied from interface:AdvancedSignatureGets a Signature Timestamp source which contains ALL timestamps embedded in the signature.- Returns:
SignatureTimestampSource
-
resetTimestampSource
public void resetTimestampSource()
This method resets the timestamp source. It must be called when -LT level is created.
-
getCandidatesForSigningCertificate
public CandidatesForSigningCertificate getCandidatesForSigningCertificate()
Description copied from interface:AdvancedSignatureGets an object containing the signing certificate or information indicating why it is impossible to extract it from the signature. If the signing certificate is identified then it is cached and the subsequent calls to this method will return this cached value. This method never returns null.- Returns:
-
checkSigningCertificate
public void checkSigningCertificate()
Description copied from interface:AdvancedSignatureThis method checks the protection of the certificates included within the signature (XAdES: KeyInfo) against the substitution attack.
-
getSigningTime
public Date getSigningTime()
Description copied from interface:AdvancedSignatureReturns the signing time included within the signature.- Returns:
Daterepresenting the signing time or null
-
checkSignaturePolicy
public void checkSignaturePolicy(SignaturePolicyProvider signaturePolicyProvider)
-
getSignatureProductionPlace
public SignatureProductionPlace getSignatureProductionPlace()
Description copied from interface:AdvancedSignatureReturns information about the place where the signature was generated- Returns:
SignatureProductionPlace
-
getClaimedSignerRoles
public List<SignerRole> getClaimedSignerRoles()
Description copied from interface:AdvancedSignatureReturns the claimed roles of the signer.- Returns:
- list of the
SignerRoles
-
getCertifiedSignerRoles
public List<SignerRole> getCertifiedSignerRoles()
Description copied from interface:AdvancedSignatureReturns the certified roles of the signer.- Returns:
- list of the
SignerRoles
-
getContentType
public String getContentType()
Description copied from interface:AdvancedSignatureReturns the value of the signed attribute content-type- Returns:
- content type as
String
-
getMimeType
public String getMimeType()
Description copied from interface:AdvancedSignatureReturns the value of the signed attribute mime-type- Returns:
- mime type as
String
-
getContentIdentifier
public String getContentIdentifier()
- Returns:
- content identifier as
String
-
getContentHints
public String getContentHints()
- Returns:
- content hints as
String
-
getSignatureValue
public byte[] getSignatureValue()
Description copied from interface:AdvancedSignatureReturns the digital signature value- Returns:
- digital signature value byte array
-
getObjects
public NodeList getObjects()
This method returns the list of ds:Object elements for the current signature element.- Returns:
-
getCompleteCertificateRefs
public Element getCompleteCertificateRefs()
-
getCompleteRevocationRefs
public Element getCompleteRevocationRefs()
-
getSigAndRefsTimeStamp
public NodeList getSigAndRefsTimeStamp()
-
getCertificateValues
public Element getCertificateValues()
-
getRevocationValues
public Element getRevocationValues()
-
hasBProfile
public boolean hasBProfile()
Checks the presence of ... segment in the signature, what is the proof -B profile existence- Returns:
- true if B Profile is detected
-
hasCProfile
public boolean hasCProfile()
Checks the presence of CompleteCertificateRefs and CompleteRevocationRefs segments in the signature, what is the proof -C profile existence- Returns:
- true if C Profile is detected
-
hasXProfile
public boolean hasXProfile()
Checks the presence of SigAndRefsTimeStamp segment in the signature, what is the proof -X profile existence- Returns:
- true if the -X extension is present
-
checkSignatureIntegrity
public void checkSignatureIntegrity()
Description copied from interface:AdvancedSignatureVerifies the signature integrity; checks if the signed content has not been tampered with. In the case of a non-AdES signature no including the signing certificate then the latter must be provided by callingsetProvidedSigningCertificateTokenIn the case of a detached signature the signed content must be provided by callingsetProvidedSigningCertificateToken
-
getReferenceValidations
public List<ReferenceValidation> getReferenceValidations()
Description copied from interface:AdvancedSignatureReturns individual validation foreach reference (XAdES) or for the message-imprint (CAdES)- Returns:
- a list with one or more
ReferenceValidation
-
getSignatureDigestReference
public SignatureDigestReference getSignatureDigestReference(DigestAlgorithm digestAlgorithm)
TS 119 442 - V1.1.1 - Electronic Signatures and Infrastructures (ESI), ch. 5.1.4.2.1.3 XML component: In case of XAdES signatures, the input of the digest value computation shall be the result of applying the canonicalization algorithm identified within the CanonicalizationMethod child element's value to the corresponding ds:Signature element and its contents. The canonicalization shall be computed keeping this ds:Signature element as a descendant of the XML root element, without detaching it.- Parameters:
digestAlgorithm-DigestAlgorithmto use- Returns:
SignatureDigestReference
-
getManifestReferences
public List<ReferenceValidation> getManifestReferences(Node manifestNode)
Returns a list of all references contained in the given manifest- Parameters:
manifestNode-Nodeto get references from- Returns:
- list of
ReferenceValidationobjects
-
getSigningCertificateValidityList
protected List<CertificateValidity> getSigningCertificateValidityList(PublicKey extractedPublicKey)
This method returns aListofSigningCertificateValiditybase on the providedprovidedSigningCertificateToken. The fieldcandidatesForSigningCertificateis instantiated.- Parameters:
extractedPublicKey- provided public key:PublicKey- Returns:
-
getCounterSignatures
public List<AdvancedSignature> getCounterSignatures()
This method retrieves the potential countersignatures embedded in the XAdES signature document. From ETSI TS 101 903 v1.4.2: 7.2.4.1 Countersignature identifier in Type attribute of ds:Reference A XAdES signature containing a ds:Reference element whose Type attribute has value "http://uri.etsi.org/01903#CountersignedSignature" will indicate that is is, in fact, a countersignature of the signature referenced by this element. 7.2.4.2 Enveloped countersignatures: the CounterSignature element The CounterSignature is an unsigned property that qualifies the signature. A XAdES signature MAY have more than one CounterSignature properties. As indicated by its name, it contains one countersignature of the qualified signature.- Returns:
- a list containing the countersignatures embedded in the XAdES signature document
-
getCertificateRefs
public List<CertificateRef> getCertificateRefs()
Description copied from interface:AdvancedSignatureRetrieve list of certificate ref- Returns:
ListofCertificateRef
-
buildSignatureIdentifier
protected SignatureIdentifier buildSignatureIdentifier()
Description copied from class:DefaultAdvancedSignatureBuild and definessignatureIdentifiervalue- Specified by:
buildSignatureIdentifierin classDefaultAdvancedSignature
-
getDAIdentifier
public String getDAIdentifier()
Description copied from interface:AdvancedSignatureThis method returns an identifier provided by the Driving Application (DA) Note: used only for XAdES- Returns:
- The signature identifier
-
getUnsignedSignatureProperties
public List<String> getUnsignedSignatureProperties()
Retrieves the name of each node found under the unsignedSignatureProperties element- Returns:
- an ArrayList containing the retrieved node names
-
isDataForSignatureLevelPresent
public boolean isDataForSignatureLevelPresent(SignatureLevel signatureLevel)
- Parameters:
signatureLevel-SignatureLevelto be checked- Returns:
- true if the signature contains the data needed for this
SignatureLevel. Doesn't mean any validity of the data found.
-
getSignatureLevels
public SignatureLevel[] getSignatureLevels()
- Returns:
- the list of signature levels for this type of signature, in the simple to complete order. Example: B,T,LT,LTA
-
validateStructure
public void validateStructure()
Description copied from interface:AdvancedSignatureThis method allows the structure validation of the signature.- Specified by:
validateStructurein interfaceAdvancedSignature- Overrides:
validateStructurein classDefaultAdvancedSignature
-
getLastTimestampValidationData
public Element getLastTimestampValidationData()
This method returns the last timestamp validation data for an archive timestamp.- Returns:
-
getCommitmentTypeIndication
public CommitmentType getCommitmentTypeIndication()
Description copied from interface:AdvancedSignatureThis method obtains the information concerning commitment type indication linked to the signature- Returns:
CommitmentType
-
getReferences
public List<org.apache.xml.security.signature.Reference> getReferences()
-
registerXPathQueryHolder
public void registerXPathQueryHolder(XPathQueryHolder xPathQueryHolder)
This method allows to register a newXPathQueryHolder.- Parameters:
xPathQueryHolder-XPathQueryHolderto register
-
-