java - PDFBox 2.0.15 的外部签名
问题描述
我正在实现一个应用程序来签署服务器中的 PDF 文件,具有以下场景(为了使历史悠久,简短):
- 客户端开始向服务器发送签名、日期/时间和水印
- 服务器将签名字典添加到文件中并发送要签名的数据
- 客户签到内容
- 服务器完成签名
我正在使用 PDFBox 2.0.15,并使用saveIncrementalForExternalSigning
如下代码所示的新功能:
try {
String name = document.getID();
File signedFile = new File(workingDir.getAbsolutePath() + sep + name + "_Signed.pdf");
this.log("[SIGNATURE] Creating signed version of the document");
if (signedFile.exists()) {
signedFile.delete();
}
FileOutputStream tbsFos = new FileOutputStream(signedFile);
ExternalSigningSupport externalSigning = pdfdoc.saveIncrementalForExternalSigning(tbsFos);
byte[] content = readExternalSignatureContent(externalSigning);
if (postparams.get("action").equalsIgnoreCase("calc_hash")) {
this.log("[SIGNATURE] Calculating hash of the document");
String strBase64 = ParametersHandle.compressParamBase64(content);
// this saves the file with a 0 signature
externalSigning.setSignature(new byte[0]);
// remember the offset (add 1 because of "<")
int offset = signature.getByteRange()[1] + 1;
this.log("[SIGNATURE] Sending calculated hash to APP");
return new String[] { strBase64, processID, String.valueOf(offset) };
} else {
this.log("[SIGNATURE] Signature received from APP");
String signature64 = postparams.get("sign_disgest");
byte[] cmsSignature = ParametersHandle.decompressParamFromBase64(signature64);
this.log("[SIGNATURE] Setting signature to document");
externalSigning.setSignature(cmsSignature);
pdfdoc.close();
IOUtils.closeQuietly(signatureOptions);
this.log("[DOXIS] Creating new version of document on Doxis");
createNewVersionOfDocument(doxisServer, documentServer, doxisSession, document, signedFile);
return new String[] { "SIGNOK" };
}
} catch (IOException ex) {
this.log("[SAVE FOR SIGN] " + ex);
return null;
}
在“IF”语句中,我正在生成要签名的数据。在“ELSE”语句中,将通过发布请求(就是这样ParametersHandle.decompressParamFromBase64
做的)来的签名添加到文档中。所以我在这次尝试中有两个关于这个方法的帖子请求。
第二种方法是在一个方法中执行每个发布请求,所以我有第二个代码块:
// remember the offset (add 1 because of "<")
int offset = Integer.valueOf(postparams.get("offset"));
this.log("[PDF BOX] Retrieving offset of bytes range for this signature. The value is: "
+ String.valueOf(offset));
File signedPDF = new File(workingDir.getAbsolutePath() + sep + name + "_Signed.pdf");
this.log("[SIGNATURE] Reloading document for apply signature: " + signedPDF.getAbsolutePath());
// invoke external signature service
String signature64 = postparams.get("sign_disgest");
byte[] cmsSignature = ParametersHandle.decompressParamFromBase64(signature64);
this.log("[SIGNATURE] Got signature byte array from APP.");
// set signature bytes received from the service
// now write the signature at the correct offset without any PDFBox methods
this.log("[SIGNATURE] Writing signed document...");
RandomAccessFile raf = new RandomAccessFile(signedPDF, "rw");
raf.seek(offset);
raf.write(Hex.getBytes(cmsSignature));
raf.close();
this.log("[SIGNATURE] New signed document has been saved!");
问题是:在 Adobe Reader 上验证文档时,我收到错误消息“自应用签名以来文档已被更改或损坏”。据我了解,它不应该发生,因为签名字节范围的偏移量在第二次调用后被记住。
任何帮助或想法表示赞赏,
先感谢您。
[编辑]
有关已使用文件的完整列表:https ://drive.google.com/drive/folders/1S9a88lCGaQYujlEyCrhyzqvmWB-68LR3
[编辑 2]
根据@mkl 评论,这里是签名的方法:
public byte[] sign(byte[] hash)
throws IOException, NoSuchAlgorithmException, InvalidKeyException, SignatureException {
PrivateKey privKey = (PrivateKey) windowsCertRep.getPrivateKey(this.selected_alias, "");
X509Certificate[] certificateChain = windowsCertRep.getCertificateChain(this.selected_alias);
try
{
CMSSignedDataGenerator gen = new CMSSignedDataGenerator();
X509Certificate cert = (X509Certificate) certificateChain[0];
ContentSigner sha1Signer = new JcaContentSignerBuilder("SHA256WithRSA").build(privKey);
gen.addSignerInfoGenerator(new JcaSignerInfoGeneratorBuilder(new JcaDigestCalculatorProviderBuilder().build()).build(sha1Signer, cert));
gen.addCertificates(new JcaCertStore(Arrays.asList(certificateChain)));
CMSProcessableInputStream msg = new CMSProcessableInputStream(new ByteArrayInputStream(hash));
CMSSignedData signedData = gen.generate(msg, false);
return signedData.getEncoded();
}
catch (GeneralSecurityException e)
{
throw new IOException(e);
}
catch (CMSException e)
{
throw new IOException(e);
}
catch (OperatorCreationException e)
{
throw new IOException(e);
}
}
我已经测试了这个CreateVisibleSignature2
例子,替换了sign
调用这个服务的方法,它返回了我的签名,它可以工作。
解决方案
感谢Tilman Hausherr,我可以弄清楚发生了什么:
1 - 我有一个与SmatCards等通信的桌面APP,它是签名者。为了与服务器通信(通过网页),我们使用 WebSocket。我编写了自己的 websocket 服务器类,这就是为什么它只准备使用 65k 字节。比我尝试在这里发送数据时:
ExternalSigningSupport externalSigning = doc.saveIncrementalForExternalSigning(fos);
byte[] cmsSignature = sign(externalSigning.getContent());
我在APP中遇到错误。
2 - Tilman,建议我看看这个@mkl 答案,他在哪里做同样的事情:创建一个 SHA256 哈希externalSigning.getContent()
并发送到另一个地方签名。我不知道为什么,但唯一对我不起作用的是:
gen.addSignerInfoGenerator(builder.build(
new BcRSAContentSignerBuilder(sha256withRSA,
new DefaultDigestAlgorithmIdentifierFinder().find(sha256withRSA))
.build(PrivateKeyFactory.createKey(pk.getEncoded())),
new JcaX509CertificateHolder(cert)));
因此,我已将此块替换为:
ContentSigner sha256Signer = new JcaContentSignerBuilder("SHA256WithRSA").build(privKey);
比,我完整的签名方法是这样的:
PrivateKey privKey = (PrivateKey) windowsCertRep.getPrivateKey(this.selected_alias, "changeit");
X509Certificate[] certificateChain = windowsCertRep.getCertificateChain(this.selected_alias);
List<X509Certificate> certList = Arrays.asList(certificateChain);
JcaCertStore certs = new JcaCertStore(certList);
CMSSignedDataGenerator gen = new CMSSignedDataGenerator();
Attribute attr = new Attribute(CMSAttributes.messageDigest,
new DERSet(new DEROctetString(hash)));
ASN1EncodableVector v = new ASN1EncodableVector();
v.add(attr);
SignerInfoGeneratorBuilder builder = new SignerInfoGeneratorBuilder(new BcDigestCalculatorProvider())
.setSignedAttributeGenerator(new DefaultSignedAttributeTableGenerator(new AttributeTable(v)));
AlgorithmIdentifier sha256withRSA = new DefaultSignatureAlgorithmIdentifierFinder().find("SHA256withRSA");
CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
InputStream in = new ByteArrayInputStream(certificateChain[0].getEncoded());
X509Certificate cert = (X509Certificate) certFactory.generateCertificate(in);
ContentSigner sha256Signer = new JcaContentSignerBuilder("SHA256WithRSA").build(privKey);
gen.addSignerInfoGenerator(builder.build(sha256Signer, new JcaX509CertificateHolder(cert)));
gen.addCertificates(certs);
CMSSignedData s = gen.generate(new CMSAbsentContent(), false);
return s.getEncoded();
所以,再次感谢社区!
推荐阅读
- c# - MEF 不再看到我的课程之一
- visual-studio-code - VS 代码中是否有用于在单独选择与 ctrl+d 匹配的单词时跳过匹配项的命令?
- python - 具有排除项的随机数生成器
- c - 在 pset3 中 CS50 的潮人出现问题(当一些配对并列时,没有打印出选举的获胜者)
- testing - 如何在 AzureDevOps 的 TestPlans 中确定单个测试用例属于哪些计划和套件
- excel - 计算 Excel Pivot 中排除负数的最小值和平均值
- python - 使用 lambda 表达式连接插槽时的 memory_profiler
- python - TypeError:列表索引必须是整数或切片,而不是 re.Pattern
- javascript - 打字稿无法读取未定义 onDocumentClick 的属性目标
- jquery - 未捕获的类型错误:$(...).kumaGauge 不是函数