将消息和签名转换为BouncyCastle CMSSignedData对象

Question

我有一个 X509CertificateObject，一个匹配的 RSAPublicKey，并设法创建一个字节数组，其中包含某个消息对象的有效数字证书，也作为字节数组。

不幸的是，我正在构建的系统只接受CMSSignedData对象作为输入。如何将我的基本构建块转换为这样一个有效的 CMSSignedData 对象？

背景：根据这个示例（摘要是SHA512），我正在试用Java Bouncy Castle RSA盲签名，需要将结果输入到标准签名处理中。

Answer 1

首先，您可能希望用私钥签署您的数据。这个想法是，签名应该是只有你能创造的东西。剩下的应该如下:

X509Certificate signingCertificate = getSigningCertificate();
//The chain of certificates that issued your signing certificate and so on
Collection&ltX509Certificate> certificateChain = getCertificateChain();
PrivateKey pk = getPrivateKey();
byte[] message = "SomeMessage".getBytes();

CMSSignedDataGenerator generator = new CMSSignedDataGenerator();
certificateChain.add(signingCertificate);
generator.addCertificates(new CollectionStore(certificateChain));

JcaDigestCalculatorProviderBuilder jcaDigestProvider = new JcaDigestCalculatorProviderBuilder();
jcaDigestProvider.setProvider(new BouncyCastleProvider());
JcaSignerInfoGeneratorBuilder singerInfoGenerator = new JcaSignerInfoGeneratorBuilder(jcaDigestProvider.build());

AlgorithmIdentifier sigAlgId = new DefaultSignatureAlgorithmIdentifierFinder().find("SHA1withRSA");
AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder().find(sigAlgId);
AsymmetricKeyParameter privateKeyParam = PrivateKeyFactory.createKey(pk.getEncoded());
ContentSigner cs = new BcRSAContentSignerBuilder(sigAlgId, digAlgId).build(privateKeyParam);

SignerInfoGenerator sig = singerInfoGenerator.build(cs, signingCertificate);
generator.addSignerInfoGenerator(sig);

CMSSignedData data = generator.generate(new CMSProcessableByteArray(message), true);