Bouncy Castle-如何使用Bouncy Castle实现SignedAndEnveloped数据

Question

我想创建一个signedandenvelopeddata(PKCS#7)数据，使用Bouncy Castle（1.59版）实现。

在Bouncy Castle中，CMSOBjectIdentifiers接口包括SignedAndEnvelopedData类型。

然而，当尝试多次时，却无法正确创建。你能给我一些建议吗？下面是我的核心实现

1. 首先签名数据

CMSTypedData msg = (CMSTypedData) new CMSProcessableByteArray(
        new ASN1ObjectIdentifier(CMSObjectIdentifiers.data.getId()),
        srcMsg.getBytes(charSet));

Store certs = new JcaCertStore(certList);

CMSSignedDataGenerator gen = new CMSSignedDataGenerator();
ContentSigner signer = new JcaContentSignerBuilder(
        signatureSchema).setProvider("BC").build(privateKey);

gen.addSignerInfoGenerator(new JcaSignerInfoGeneratorBuilder(
        new JcaDigestCalculatorProviderBuilder().setProvider("BC")
                .build()).build(signer, cerx509));

gen.addCertificates(certs);

CMSSignedData sigData = gen.generate(msg, true);
sigData = new CMSSignedData(msg,sigData.getEncoded())

return sigData.getEncoded()

在这里，我将cmstypedata的输入数据设置为cmsobjectedentifiers.data.getid()

CMSTypedData msg = (CMSTypedData) new CMSProcessableByteArray(
                new ASN1ObjectIdentifier(CMSObjectIdentifiers.data.getId()),
                srcMsg.getBytes(charSet)); 

CMSTypedData msg = new CMSProcessableByteArray(new ASN1ObjectIdentifier(CMSObjectIdentifiers.signedAndEnvelopedData.getId()),srcMsg.getBytes(charSet));

    CMSEnvelopedDataGenerator edGen = new CMSEnvelopedDataGenerator();

    JcaAlgorithmParametersConverter paramsConverter = new JcaAlgorithmParametersConverter();

    edGen.addRecipientInfoGenerator(
            new JceKeyTransRecipientInfoGenerator(cert,paramsConverter.getAlgorithmIdentifier(PKCSObjectIdentifiers.id_RSAES_OAEP,OAEPParameterSpec.DEFAULT))
                    .setProvider(new BouncyCastleProvider()));
    OutputEncryptor encryptor = new JceCMSContentEncryptorBuilder(CMSAlgorithm.AES256_CBC)
            .setProvider(new BouncyCastleProvider())
            .build()
    CMSEnvelopedData ed = edGen.generate(msg,encryptor)

    encryptedContent = ed.getEncoded()
    String result = new String(Base64.encode(ed.getEncoded()));

    return result;

在这里，我将cmStypedData的输入数据设置为cmsObjectEntifiers.SignedAndEnvelopedData.getID()

CMSTypedData msg = new CMSProcessableByteArray(new ASN1ObjectIdentifier(CMSObjectIdentifiers.signedAndEnvelopedData.getId()),srcMsg.getBytes(charSet));

问题：

1. 是否支持Bouncy Castle（1.59）的PKCS#7SignedAndeneVloped
2. 如果第一个问题是，那么创建signedandenevloped数据的步骤是否正确？
3. 如果第一个问题是“否”，是否有某种方法来实施它？

Answer 1

我刚刚在XMLSignatrure（SignedAndEnevloped）中编写了一个关于使用Bouncy CALTE提供程序执行RSA的演示，请参阅本文https：//honwhy.wang/2018/09/07/use-bc-provider-xmlSignature/

演示代码,

1,https://github.com/honwhy/xml-sec/blob/master/src/main/Java/com/honey/xmlsec/bcsignaturealgorithm.Java#L37

2,https://github.com/honwhy/xml-sec/blob/master/src/main/Java/com/honey/xmlsec/myutil.Java#L107

也许你需要一些线路来满足你的要求。