java - 将消息和签名转换为 BouncyCastle CMSSignedData 对象

Question

我有一个 X509CertificateObject，一个匹配的 RSAPublicKey 并设法创建一个字节数组，其中包含一些消息对象的有效数字证书，也作为一个字节数组。

不幸的是，我正在构建的系统只接受CMSSignedData对象作为输入。如何将我的基本构建块转换为这样一个有效的CMSSignedData对象？

背景：我正在根据此示例（摘要为 SHA512）试验 Java Bouncy Castle RSA 盲签名，并且需要将结果输入标准签名处理。

Answer 1

首先，您可能希望使用私钥对数据进行签名。这个想法是签名应该是只有你可以创建的东西。你得到一个，其余的应该如下：

X509Certificate signingCertificate = getSigningCertificate();
//The chain of certificates that issued your signing certificate and so on
Collection<X509Certificate> certificateChain = getCertificateChain();
PrivateKey pk = getPrivateKey();
byte[] message = "SomeMessage".getBytes();

CMSSignedDataGenerator generator = new CMSSignedDataGenerator();
certificateChain.add(signingCertificate);
generator.addCertificates(new CollectionStore(certificateChain));

JcaDigestCalculatorProviderBuilder jcaDigestProvider = new JcaDigestCalculatorProviderBuilder();
jcaDigestProvider.setProvider(new BouncyCastleProvider());
JcaSignerInfoGeneratorBuilder singerInfoGenerator = new JcaSignerInfoGeneratorBuilder(jcaDigestProvider.build());

AlgorithmIdentifier sigAlgId = new DefaultSignatureAlgorithmIdentifierFinder().find("SHA1withRSA");
AlgorithmIdentifier digAlgId = new DefaultDigestAlgorithmIdentifierFinder().find(sigAlgId);
AsymmetricKeyParameter privateKeyParam = PrivateKeyFactory.createKey(pk.getEncoded());
ContentSigner cs = new BcRSAContentSignerBuilder(sigAlgId, digAlgId).build(privateKeyParam);

SignerInfoGenerator sig = singerInfoGenerator.build(cs, signingCertificate);
generator.addSignerInfoGenerator(sig);

CMSSignedData data = generator.generate(new CMSProcessableByteArray(message), true);