Class CAdESLongTermValuesUtil

java.lang.Object

org.bouncycastle.cades.CAdESLongTermValuesUtil

public final class CAdESLongTermValuesUtil
extends Object

Helpers for upgrading a CAdES B-T signature to B-LT (RFC 5126 X-L / ETSI EN 319 122-1 B-LT) by attaching the four long-term validation-data attributes:

• id-aa-ets-certificateRefs (RFC 5126 sec. 6.2.1) — digest + IssuerSerial references for each non-signer cert.
• id-aa-ets-revocationRefs (RFC 5126 sec. 6.2.2) — digest references for each CRL (and/or OCSP response).
• id-aa-ets-certValues (RFC 5126 sec. 6.3.3) — the cert bytes themselves.
• id-aa-ets-revocationValues (RFC 5126 sec. 6.3.4) — the CRL / OCSP response bytes themselves.

Both CRL (X509CRLHolder) and OCSP (BasicOCSPResp) revocation material are supported. An OCSP response contributes:

• An OcspResponsesID entry under the revocationRefs attribute's ocspids branch, holding the responder identifier, producedAt timestamp and a digest of the BasicOCSPResponse bytes (RFC 5126 sec. 6.2.2).
• A BasicOCSPResponse entry under the revocationValues attribute's ocspVals branch (RFC 5126 sec. 6.3.4).

The caller is responsible for fetching the long-term material out-of-band (BC stays out of HTTP / OCSP transport); this helper only assembles the attributes and attaches them.

Level detector ordering: CAdESLevelDetector.attainedLevel(SignerInformation) only reports CAdESLevel.B_LT when a signature time-stamp (CAdESLevel.B_T) is also present on the signer; without it the detector keeps reporting CAdESLevel.B_B regardless of the four LT attributes being attached. Apply the signature time-stamp via CAdESSignatureTimestampUtil.applySignatureTimestamp(CMSSignedData, SignerId, TimeStampToken) first if you want the detector to advance.

Reading LT material back: getCertificateValues(SignerInformation), getCertificateRevocationLists(SignerInformation) and getOcspResponses(SignerInformation) expose the embedded trust material as the corresponding holder / response types so a relying party can plug them into JCA CertPathValidator / OCSP verification directly. validateLongTermValues(SignerInformation, DigestCalculatorProvider) checks the LT bundle is internally self-consistent (every reference's hash matches the corresponding value bytes); a full chain / revocation validation at the timestamp's genTime is the caller's responsibility and is built on top of those holders.

Method Summary

Modifier and Type	Method	Description
static CMSSignedData	applyLongTermValues(CMSSignedData signed, SignerId signerId, List<X509CertificateHolder> additionalCerts, List<X509CRLHolder> crls, List<BasicOCSPResp> ocspResponses, org.bouncycastle.asn1.x509.AlgorithmIdentifier refDigestAlg, DigestCalculatorProvider digCalcProv)	Attach the four CAdES B-LT unsigned attributes to the signer matched by signerId.
static CMSSignedData	applyLongTermValues(CMSSignedData signed, SignerId signerId, List<X509CertificateHolder> additionalCerts, List<X509CRLHolder> crls, org.bouncycastle.asn1.x509.AlgorithmIdentifier refDigestAlg, DigestCalculatorProvider digCalcProv)	Convenience overload that takes no OCSP responses — equivalent to applyLongTermValues(CMSSignedData, SignerId, List, List, List, AlgorithmIdentifier, DigestCalculatorProvider) with an empty OCSP list.
static List<X509CRLHolder>	getCertificateRevocationLists(SignerInformation signer)	Extract the CRLs bundled into the signer's id-aa-ets-revocationValues attribute.
static List<X509CertificateHolder>	getCertificateValues(SignerInformation signer)	Extract the cert chain bundled into the signer's id-aa-ets-certValues attribute.
static List<BasicOCSPResp>	getOcspResponses(SignerInformation signer)	Extract the OCSP responses bundled into the signer's id-aa-ets-revocationValues attribute.
static void	validateLongTermValues(SignerInformation signer, DigestCalculatorProvider digCalcProv)	Self-consistency check across the four B-LT attributes on the signer: All four attributes (id-aa-ets-certificateRefs, id-aa-ets-certValues, id-aa-ets-revocationRefs, id-aa-ets-revocationValues) must be present. For each cert in certValues, an OtherCertID entry under certificateRefs must reference the same (issuer, serialNumber) and its hash must match the digest of the cert under the ref's hash algorithm. For each CRL / OCSP response under revocationValues, a reference must exist under revocationRefs with a matching hash (CRLs are matched positionally; OCSP responses are matched by OcspIdentifier).

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

applyLongTermValues

public static CMSSignedData applyLongTermValues(CMSSignedData signed,
 SignerId signerId,
 List<X509CertificateHolder> additionalCerts,
 List<X509CRLHolder> crls,
 org.bouncycastle.asn1.x509.AlgorithmIdentifier refDigestAlg,
 DigestCalculatorProvider digCalcProv)
                                         throws CAdESException,
OperatorCreationException,
IOException

Convenience overload that takes no OCSP responses — equivalent to applyLongTermValues(CMSSignedData, SignerId, List, List, List, AlgorithmIdentifier, DigestCalculatorProvider) with an empty OCSP list.

Throws:

CAdESException

OperatorCreationException

IOException

applyLongTermValues

public static CMSSignedData applyLongTermValues(CMSSignedData signed,
 SignerId signerId,
 List<X509CertificateHolder> additionalCerts,
 List<X509CRLHolder> crls,
 List<BasicOCSPResp> ocspResponses,
 org.bouncycastle.asn1.x509.AlgorithmIdentifier refDigestAlg,
 DigestCalculatorProvider digCalcProv)
                                         throws CAdESException,
OperatorCreationException,
IOException

Attach the four CAdES B-LT unsigned attributes to the signer matched by signerId. Long-term references use refDigestAlg (typically SHA-256); the corresponding values attributes hold the raw cert / CRL / OCSP-response bytes.

Parameters:

signed - the source CMSSignedData (unchanged).

signerId - selector identifying which signer to upgrade.

additionalCerts - certs to include in certValues (typically any intermediate / root not already in the SignedData.certificates field). Cannot be null; pass an empty list for none.

crls - CRLs to include in revocationValues / revocationRefs. Cannot be null; pass an empty list for none.

ocspResponses - OCSP responses to include in revocationValues / revocationRefs. Cannot be null; pass an empty list for none.

refDigestAlg - digest algorithm for the cert / CRL / OCSP refs; null defaults to SHA-256.

digCalcProv - source of digest calculators for the reference digests.

Returns:

a new CMSSignedData with the B-LT attributes attached.

Throws:

CAdESException - if signerId matches no signer, or a structure cannot be encoded.

OperatorCreationException

IOException

getCertificateValues

public static List<X509CertificateHolder> getCertificateValues(SignerInformation signer)

Extract the cert chain bundled into the signer's id-aa-ets-certValues attribute. Returns an empty list when the attribute is absent — the signer is not (yet) B-LT.

getCertificateRevocationLists

public static List<X509CRLHolder> getCertificateRevocationLists(SignerInformation signer)

Extract the CRLs bundled into the signer's id-aa-ets-revocationValues attribute. Returns an empty list when the attribute is absent or carries only OCSP responses.

getOcspResponses

public static List<BasicOCSPResp> getOcspResponses(SignerInformation signer)

Extract the OCSP responses bundled into the signer's id-aa-ets-revocationValues attribute. Returns an empty list when the attribute is absent or carries only CRLs.

validateLongTermValues

public static void validateLongTermValues(SignerInformation signer,
 DigestCalculatorProvider digCalcProv)
                                   throws CAdESException,
OperatorCreationException,
IOException

Self-consistency check across the four B-LT attributes on the signer:

• All four attributes (id-aa-ets-certificateRefs, id-aa-ets-certValues, id-aa-ets-revocationRefs, id-aa-ets-revocationValues) must be present.
• For each cert in certValues, an OtherCertID entry under certificateRefs must reference the same (issuer, serialNumber) and its hash must match the digest of the cert under the ref's hash algorithm.
• For each CRL / OCSP response under revocationValues, a reference must exist under revocationRefs with a matching hash (CRLs are matched positionally; OCSP responses are matched by OcspIdentifier).

What this method does not do: walk the cert chain to a trust anchor, check signing-time validity windows, verify the embedded CRL / OCSP signatures, or look up revocation status. Those steps are the caller's responsibility, built on getCertificateValues(SignerInformation), getCertificateRevocationLists(SignerInformation) and getOcspResponses(SignerInformation) plus a standard JCA CertPathValidator.

Throws:

CAdESException - if the LT attributes are inconsistent, or any required attribute is missing.

OperatorCreationException

IOException