Package org.bouncycastle.cades

package org.bouncycastle.cades
High-level CAdES (CMS Advanced Electronic Signatures) builders.

This package wraps the existing cms / tsp primitives with profile-aware builders for the four CAdES baseline levels of ETSI EN 319 122-1 (and the older RFC 5126 profile names):

  • B-B (BES) — CAdESSignerInfoGeneratorBuilder + CAdESSignedDataGenerator: a CMS SignedData carrying the mandatory ESS signing-certificate(-v2) reference plus optional commitment-type, signature-policy, signer-location and content-hints signed attributes.
  • B-T (T) — CAdESSignatureTimestampUtil: attaches an id-aa-signatureTimeStampToken unsigned attribute over the SignerInfo signature value.
  • B-LT (C-X-L) — CAdESLongTermValuesUtil: attaches the four long-term validation-data unsigned attributes (id-aa-ets-certificateRefs / certValues / revocationRefs / revocationValues) for offline validation.
  • B-LTA (A) — CAdESArchiveTimestampUtil: attaches an id-aa-ets-archiveTimestampV2 (ETSI TS 101 733 v1.7.4) unsigned attribute over a canonical concatenation of the SignedData, with existing archive-timestamps stripped so chains are renewable.

CAdESLevelDetector inspects a SignerInformation and reports the attained baseline level. None of these classes embed an HTTP / OCSP transport — callers fetch timestamps, CRLs and OCSP responses out-of-band and pass them in. The low-level ASN.1 types for all CAdES attributes live in org.bouncycastle.asn1.esf and org.bouncycastle.asn1.ess; callers needing fine-grained control over a signature's shape can build those directly and feed them to a standard CMSSignedDataGenerator.

  • Class
    Description
    CAdESArchiveTimestampUtil
    Helpers for upgrading a CAdES B-LT signature to B-LTA by attaching an archive-time-stamp covering the entire SignedData.
    CAdESException
    Exception thrown when a CAdES builder cannot assemble a profile (e.g.
    CAdESLevel
    CAdES baseline profile levels per ETSI EN 319 122-1, with the older RFC 5126 names alongside for callers that still target the legacy specification.
    CAdESLevelDetector
    Inspect a SignerInformation and report the highest CAdES baseline level (per ETSI EN 319 122-1) whose mandatory attributes are present.
    CAdESLongTermValuesUtil
    Helpers for upgrading a CAdES B-T signature to B-LT (RFC 5126 X-L / ETSI EN 319 122-1 B-LT) by attaching the four long-term validation-data attributes: id-aa-ets-certificateRefs (RFC 5126 sec.
    CAdESSignatureTimestampUtil
    Helpers for upgrading a CAdES B-B signature to B-T by attaching an id-aa-signatureTimeStampToken unsigned attribute carrying a caller-fetched RFC 3161 TSA token.
    CAdESSignedDataGenerator
    Marker subclass of CMSSignedDataGenerator for assembling CAdES SignedData objects, giving CAdES-aware code a discoverable named entry point.
    CAdESSignerInfoGeneratorBuilder
    Builds a SignerInfoGenerator for a CAdES B-B signature (ETSI EN 319 122-1 / RFC 5126 BES).