Package eu.europa.esig.dss.spi.signature

Interface AdvancedSignature

All Superinterfaces:

IdentifierBasedObject, Serializable

All Known Implementing Classes:

CAdESSignature, DefaultAdvancedSignature, JAdESSignature, PAdESSignature, XAdESSignature

public interface AdvancedSignature
extends IdentifierBasedObject, Serializable

Provides an abstraction for an Advanced Electronic Signature. This ease the validation process. Every signature format : XAdES, CAdES and PAdES are treated the same.

Method Summary

Modifier and Type	Method	Description
void	addExternalEvidenceRecord(EvidenceRecord evidenceRecord)	Adds an evidence record covering the signature file
void	addExternalTimestamp(TimestampToken timestamp)	This method allows to add an external timestamp.
boolean	areAllSelfSignedCertificates()	Checks if all certificate chains present in the signature are self-signed
void	checkSignatureIntegrity()	Verifies the signature integrity; checks if the signed content has not been tampered with.
List<EvidenceRecord>	getAllEvidenceRecords()	Returns a list of all evidence records
List<TimestampToken>	getAllTimestamps()	Returns a list of all timestamps found in the signature
List<TimestampToken>	getArchiveTimestamps()	Returns the archive Timestamps
CandidatesForSigningCertificate	getCandidatesForSigningCertificate()	Gets an object containing the signing certificate or information indicating why it is impossible to extract it from the signature.
List<CertificateToken>	getCertificates()	Get certificates embedded in the signature
SignatureCertificateSource	getCertificateSource()	Gets a certificate source which contains ALL certificates embedded in the signature.
List<SignerRole>	getCertifiedSignerRoles()	Returns the certified roles of the signer.
List<SignerRole>	getClaimedSignerRoles()	Returns the claimed roles of the signer.
List<CommitmentTypeIndication>	getCommitmentTypeIndications()	This method obtains the information concerning commitment type indication linked to the signature
ListCertificateSource	getCompleteCertificateSource()	Gets a ListCertificateSource representing a merged source from signatureCertificateSource and all included to the signature timestamp objects
ListRevocationSource<CRL>	getCompleteCRLSource()	Gets a ListRevocationSource representing a merged source from signatureCRLSourse and all included to the signature timestamp objects
ListRevocationSource<OCSP>	getCompleteOCSPSource()	Gets a ListRevocationSource representing a merged source from signatureOCSPSourse and all included to the signature timestamp objects
List<DSSDocument>	getContainerContents()	Returns container's content
List<TimestampToken>	getContentTimestamps()	Returns the content timestamps
String	getContentType()	Returns the value of the signed attribute content-type
List<AdvancedSignature>	getCounterSignatures()	Returns a list of counter signatures applied to this signature
OfflineRevocationSource<CRL>	getCRLSource()	Gets a CRL source which contains ALL CRLs embedded in the signature.
String	getDAIdentifier()	This method returns an identifier provided by the Driving Application (DA) Note: used only for XAdES
SignatureLevel	getDataFoundUpToLevel()	This method returns the signature level
Digest	getDataToBeSignedRepresentation()	TS 119 102-1 (4.2.8 Data to be signed representation (DTBSR)) : The DTBS preparation component shall take the DTBSF and hash it according to the hash algorithm specified in the cryptographic suite.
List<DSSDocument>	getDetachedContents()	Returns detached contents
List<EvidenceRecord>	getDetachedEvidenceRecords()	Returns a list of detached evidence records
List<TimestampToken>	getDetachedTimestamps()	Returns a list of detached timestamps NOTE: used for ASiC with CAdES only
DigestAlgorithm	getDigestAlgorithm()	Retrieves the digest algorithm used for generating the signature.
List<TimestampToken>	getDocumentTimestamps()	Returns a list of timestamps defined with the 'DocTimeStamp' type NOTE: applicable only for PAdES
SignatureIdentifier	getDSSId()	This method returns the SignatureIdentifier.
List<EvidenceRecord>	getEmbeddedEvidenceRecords()	Returns a list of embedded evidence records
EncryptionAlgorithm	getEncryptionAlgorithm()	Retrieves the encryption algorithm used for generating the signature.
String	getId()	This method returns the DSS unique signature id.
ManifestFile	getManifestFile()	This method returns a related ManifestFile in the case of ASiC-E signature.
MaskGenerationFunction	getMaskGenerationFunction()	Deprecated. since DSS 6.1.
AdvancedSignature	getMasterSignature()	Gets master signature
String	getMimeType()	Returns the value of the signed attribute mime-type
OfflineRevocationSource<OCSP>	getOCSPSource()	Gets an OCSP source which contains ALL OCSP responses embedded in the signature.
List<ReferenceValidation>	getReferenceValidations()	Returns individual validation foreach reference (XAdES, JAdES) or for the message-imprint (CAdES)
SignatureAlgorithm	getSignatureAlgorithm()	Retrieves the signature algorithm (or cipher) used for generating the signature.
SignatureCryptographicVerification	getSignatureCryptographicVerification()	Gets signature's cryptographic validation result
SignatureDigestReference	getSignatureDigestReference(DigestAlgorithm digestAlgorithm)	Returns a signature reference element as defined in TS 119 442 - V1.1.1 - Electronic Signatures and Infrastructures (ESI), ch. 5.1.4.2.1.3 XML component
String	getSignatureFilename()	This method returns the signature filename (useful for ASiC and multiple signature files)
SignatureForm	getSignatureForm()	Specifies the format of the signature
SignaturePolicy	getSignaturePolicy()	Returns the Signature Policy OID from the signature.
SignaturePolicyStore	getSignaturePolicyStore()	Returns the Signature Policy Store from the signature
SignatureProductionPlace	getSignatureProductionPlace()	Returns information about the place where the signature was generated
List<SignatureScope>	getSignatureScopes()	Returns a list of found SignatureScopes
List<TimestampToken>	getSignatureTimestamps()	Returns the signature timestamps
byte[]	getSignatureValue()	Returns the digital signature value
List<SignerRole>	getSignedAssertions()	Returns the list of embedded signed assertions.
List<SignerRole>	getSignerRoles()	Returns the list of roles of the signer.
CertificateToken	getSigningCertificateToken()	This method returns the signing certificate token or null if there is no valid signing certificate.
Date	getSigningTime()	Returns the signing time included within the signature.
List<String>	getStructureValidationResult()	Returns a message if the structure validation fails
TimestampSource	getTimestampSource()	Gets a Signature Timestamp source which contains ALL timestamps embedded in the signature.
List<TimestampToken>	getTimestampsX1()	Returns the time-stamp which is placed on the digital signature (XAdES example: ds:SignatureValue element), the signature time-stamp(s) present in the AdES-T form, the certification path references and the revocation status references.
List<TimestampToken>	getTimestampsX2()	Returns the time-stamp which is computed over the concatenation of CompleteCertificateRefs and CompleteRevocationRefs elements (XAdES example).
boolean	hasAProfile()	Checks the presence of ArchiveTimeStamp element in the signature, what is the proof -A profile existence
boolean	hasBESProfile()	Checks the presence of signing certificate covered by the signature, what is the proof -BES profile existence
boolean	hasBProfile()	Checks if the signature is conformant to AdES-BASELINE-B level
boolean	hasCProfile()	Checks the presence of CompleteCertificateRefs and CompleteRevocationRefs segments in the signature, what is the proof -C profile existence
boolean	hasEPESProfile()	Checks the presence of SignaturePolicyIdentifier element in the signature, what is the proof -EPES profile existence
boolean	hasExtendedTProfile()	Checks the presence of SignatureTimeStamp element in the signature, what is the proof -T profile existence
boolean	hasLTAProfile()	Checks if the LTA-level is present in the signature
boolean	hasLTProfile()	Checks if the LT-level is present in the signature
boolean	hasTProfile()	Checks if the T-level is present in the signature
boolean	hasXLProfile()	Checks the presence of CertificateValues/RevocationValues segment in the signature, what is the proof -XL profile existence
boolean	hasXProfile()	Checks the presence of SigAndRefsTimeStamp segment in the signature, what is the proof -X profile existence
void	initBaselineRequirementsChecker(CertificateVerifier certificateVerifier)	This method creates an offline copy of certificateVerifier and instantiates a BaselineRequirementsChecker
boolean	isCounterSignature()	Checks if the current signature is a counter signature (i.e. has a Master signature)
boolean	isDocHashOnlyValidation()	Returns true if the validation of the signature has been performed only on Signer's Document Representation (SDR).
boolean	isHashOnlyValidation()	Returns true if the validation of the signature has been performed only on Data To Be Signed Representation (DTBSR).
void	setContainerContents(List<DSSDocument> containerContents)	This method allows to set the archive container contents in the case of ASiC-S signature.
void	setDetachedContents(List<DSSDocument> detachedContents)	This method allows to set the signed contents in the case of the detached signature.
void	setManifestFile(ManifestFile manifestFile)	This method allows to set a manifest file in the case of ASiC-E signature.
void	setMasterSignature(AdvancedSignature masterSignature)	This setter allows to indicate the master signature.
void	setSignatureFilename(String signatureFilename)	This method allows to set the signature filename (useful in case of ASiC)
void	setSigningCertificateSource(CertificateSource signingCertificateSource)	Set a certificate source which allows to find the signing certificate by kid or certificate's digest

Method Details

getSignatureFilename

String getSignatureFilename()

This method returns the signature filename (useful for ASiC and multiple signature files)

Returns:

the signature filename

setSignatureFilename

void setSignatureFilename(String signatureFilename)

This method allows to set the signature filename (useful in case of ASiC)

Parameters:

signatureFilename - String

getDetachedContents

List<DSSDocument> getDetachedContents()

Returns detached contents

Returns:

in the case of the detached signature this is the List of signed contents.

setDetachedContents

void setDetachedContents(List<DSSDocument> detachedContents)

This method allows to set the signed contents in the case of the detached signature.

Parameters:

detachedContents - List of DSSDocument representing the signed detached contents.

getContainerContents

List<DSSDocument> getContainerContents()

Returns container's content

Returns:

in case of ASiC-S signature returns a list of an archive container documents

setContainerContents

void setContainerContents(List<DSSDocument> containerContents)

This method allows to set the archive container contents in the case of ASiC-S signature.

Parameters:

containerContents - List of DSSDocument representing the archive container contents.

getManifestFile

ManifestFile getManifestFile()

This method returns a related ManifestFile in the case of ASiC-E signature.

Returns:

manifestFile ManifestFile

setManifestFile

void setManifestFile(ManifestFile manifestFile)

This method allows to set a manifest file in the case of ASiC-E signature.

Parameters:

manifestFile - ManifestFile

setSigningCertificateSource

void setSigningCertificateSource(CertificateSource signingCertificateSource)

Set a certificate source which allows to find the signing certificate by kid or certificate's digest

Parameters:

signingCertificateSource - the certificate source to resolve missing signing certificate

getSignatureForm

SignatureForm getSignatureForm()

Specifies the format of the signature

Returns:

SignatureForm

getSignatureAlgorithm

SignatureAlgorithm getSignatureAlgorithm()

Retrieves the signature algorithm (or cipher) used for generating the signature.

Returns:

SignatureAlgorithm

getEncryptionAlgorithm

EncryptionAlgorithm getEncryptionAlgorithm()

Retrieves the encryption algorithm used for generating the signature.

Returns:

EncryptionAlgorithm

getDigestAlgorithm

DigestAlgorithm getDigestAlgorithm()

Retrieves the digest algorithm used for generating the signature.

Returns:

DigestAlgorithm

getMaskGenerationFunction

@Deprecated
MaskGenerationFunction getMaskGenerationFunction()

Deprecated.

since DSS 6.1. Please use #getEncryptionAlgorithm method instead in order to determine mask generation function (i.e. EncryptionAlgorithm.RSA for none MGF, EncryptionAlgorithm.RSASSA_PSS for MGF1)

Retrieves the mask generation function used for generating the signature.

Returns:

MaskGenerationFunction

getSigningTime

Date getSigningTime()

Returns the signing time included within the signature.

Returns:

Date representing the signing time or null

getCertificateSource

SignatureCertificateSource getCertificateSource()

Gets a certificate source which contains ALL certificates embedded in the signature.

Returns:

SignatureCertificateSource

getCompleteCertificateSource

ListCertificateSource getCompleteCertificateSource()

Gets a ListCertificateSource representing a merged source from signatureCertificateSource and all included to the signature timestamp objects

Returns:

ListCertificateSource

getCRLSource

OfflineRevocationSource<CRL> getCRLSource()

Gets a CRL source which contains ALL CRLs embedded in the signature.

Returns:

OfflineRevocationSource

getOCSPSource

OfflineRevocationSource<OCSP> getOCSPSource()

Gets an OCSP source which contains ALL OCSP responses embedded in the signature.

Returns:

OfflineRevocationSource

getCompleteCRLSource

ListRevocationSource<CRL> getCompleteCRLSource()

Gets a ListRevocationSource representing a merged source from signatureCRLSourse and all included to the signature timestamp objects

Returns:

ListRevocationSource

getCompleteOCSPSource

ListRevocationSource<OCSP> getCompleteOCSPSource()

Gets a ListRevocationSource representing a merged source from signatureOCSPSourse and all included to the signature timestamp objects

Returns:

ListRevocationSource

getTimestampSource

TimestampSource getTimestampSource()

Gets a Signature Timestamp source which contains ALL timestamps embedded in the signature.

Returns:

SignatureTimestampSource

getCandidatesForSigningCertificate

CandidatesForSigningCertificate getCandidatesForSigningCertificate()

Gets an object containing the signing certificate or information indicating why it is impossible to extract it from the signature. If the signing certificate is identified then it is cached and the subsequent calls to this method will return this cached value. This method never returns null.

Returns:

CandidatesForSigningCertificate

initBaselineRequirementsChecker

void initBaselineRequirementsChecker(CertificateVerifier certificateVerifier)

This method creates an offline copy of certificateVerifier and instantiates a BaselineRequirementsChecker

Parameters:

certificateVerifier - CertificateVerifier

setMasterSignature

void setMasterSignature(AdvancedSignature masterSignature)

This setter allows to indicate the master signature. It means that this is a countersignature.

Parameters:

masterSignature - AdvancedSignature

getMasterSignature

AdvancedSignature getMasterSignature()

Gets master signature

Returns:

AdvancedSignature

isCounterSignature

boolean isCounterSignature()

Checks if the current signature is a counter signature (i.e. has a Master signature)

Returns:

TRUE if it is a counter signature, FALSE otherwise

getSigningCertificateToken

CertificateToken getSigningCertificateToken()

This method returns the signing certificate token or null if there is no valid signing certificate. Note that to determinate the signing certificate the signature must be validated: the method checkSignatureIntegrity must be called.

Returns:

CertificateToken

checkSignatureIntegrity

void checkSignatureIntegrity()

Verifies the signature integrity; checks if the signed content has not been tampered with. In the case of a non-AdES signature no including the signing certificate then the latter must be provided by calling setProvidedSigningCertificateToken In the case of a detached signature the signed content must be provided by calling setProvidedSigningCertificateToken

getSignatureCryptographicVerification

SignatureCryptographicVerification getSignatureCryptographicVerification()

Gets signature's cryptographic validation result

Returns:

SignatureCryptographicVerification with all the information collected during the validation process.

getSignaturePolicy

SignaturePolicy getSignaturePolicy()

Returns the Signature Policy OID from the signature.

Returns:

SignaturePolicy

getSignaturePolicyStore

SignaturePolicyStore getSignaturePolicyStore()

Returns the Signature Policy Store from the signature

Returns:

SignaturePolicyStore

getSignatureProductionPlace

SignatureProductionPlace getSignatureProductionPlace()

Returns information about the place where the signature was generated

Returns:

SignatureProductionPlace

getCommitmentTypeIndications

List<CommitmentTypeIndication> getCommitmentTypeIndications()

This method obtains the information concerning commitment type indication linked to the signature

Returns:

a list of CommitmentTypeIndications

getContentType

String getContentType()

Returns the value of the signed attribute content-type

Returns:

content type as String

getMimeType

String getMimeType()

Returns the value of the signed attribute mime-type

Returns:

mime type as String

getSignerRoles

List<SignerRole> getSignerRoles()

Returns the list of roles of the signer.

Returns:

list of the SignerRoles

getSignedAssertions

List<SignerRole> getSignedAssertions()

Returns the list of embedded signed assertions.

Returns:

list of the assertions s

getClaimedSignerRoles

List<SignerRole> getClaimedSignerRoles()

Returns the claimed roles of the signer.

Returns:

list of the SignerRoles

getCertifiedSignerRoles

List<SignerRole> getCertifiedSignerRoles()

Returns the certified roles of the signer.

Returns:

list of the SignerRoles

getCertificates

List<CertificateToken> getCertificates()

Get certificates embedded in the signature

Returns:

a list of certificate contained within the signature

getContentTimestamps

List<TimestampToken> getContentTimestamps()

Returns the content timestamps

Returns:

List of TimestampToken

getSignatureTimestamps

List<TimestampToken> getSignatureTimestamps()

Returns the signature timestamps

Returns:

List of TimestampToken

getTimestampsX1

List<TimestampToken> getTimestampsX1()

Returns the time-stamp which is placed on the digital signature (XAdES example: ds:SignatureValue element), the signature time-stamp(s) present in the AdES-T form, the certification path references and the revocation status references.

Returns:

List of TimestampToken

getTimestampsX2

List<TimestampToken> getTimestampsX2()

Returns the time-stamp which is computed over the concatenation of CompleteCertificateRefs and CompleteRevocationRefs elements (XAdES example).

Returns:

List of TimestampToken

getArchiveTimestamps

List<TimestampToken> getArchiveTimestamps()

Returns the archive Timestamps

Returns:

List of TimestampTokens

getDocumentTimestamps

List<TimestampToken> getDocumentTimestamps()

Returns a list of timestamps defined with the 'DocTimeStamp' type NOTE: applicable only for PAdES

Returns:

List of TimestampTokens

getDetachedTimestamps

List<TimestampToken> getDetachedTimestamps()

Returns a list of detached timestamps NOTE: used for ASiC with CAdES only

Returns:

a list of TimestampTokens

getAllTimestamps

List<TimestampToken> getAllTimestamps()

Returns a list of all timestamps found in the signature

Returns:

List of TimestampTokens

addExternalTimestamp

void addExternalTimestamp(TimestampToken timestamp)

This method allows to add an external timestamp. The given timestamp must be processed before. NOTE: The method is supported only for CAdES signatures

Parameters:

timestamp - the timestamp token

getCounterSignatures

List<AdvancedSignature> getCounterSignatures()

Returns a list of counter signatures applied to this signature

Returns:

a List of AdvancedSignatures representing the counter signatures

getEmbeddedEvidenceRecords

List<EvidenceRecord> getEmbeddedEvidenceRecords()

Returns a list of embedded evidence records

Returns:

a list of EvidenceRecords

addExternalEvidenceRecord

void addExternalEvidenceRecord(EvidenceRecord evidenceRecord)

Adds an evidence record covering the signature file

Parameters:

evidenceRecord - EvidenceRecord

getDetachedEvidenceRecords

List<EvidenceRecord> getDetachedEvidenceRecords()

Returns a list of detached evidence records

Returns:

a list of EvidenceRecords

getAllEvidenceRecords

List<EvidenceRecord> getAllEvidenceRecords()

Returns a list of all evidence records

Returns:

a list of EvidenceRecords

getDSSId

SignatureIdentifier getDSSId()

This method returns the SignatureIdentifier.

Specified by:

getDSSId in interface IdentifierBasedObject

Returns:

unique SignatureIdentifier

getId

String getId()

This method returns the DSS unique signature id. It allows to unambiguously identify each signature.

Returns:

The signature unique Id

getDAIdentifier

String getDAIdentifier()

This method returns an identifier provided by the Driving Application (DA) Note: used only for XAdES

Returns:

The signature identifier

getDataFoundUpToLevel

SignatureLevel getDataFoundUpToLevel()

This method returns the signature level

Returns:

a value of SignatureLevel

hasBProfile

boolean hasBProfile()

Checks if the signature is conformant to AdES-BASELINE-B level

Returns:

TRUE if the B-level is present, FALSE otherwise

hasTProfile

boolean hasTProfile()

Checks if the T-level is present in the signature

Returns:

TRUE if the T-level is present, FALSE otherwise

hasLTProfile

boolean hasLTProfile()

Checks if the LT-level is present in the signature

Returns:

TRUE if the LT-level is present, FALSE otherwise

hasLTAProfile

boolean hasLTAProfile()

Checks if the LTA-level is present in the signature

Returns:

TRUE if the LTA-level is present, FALSE otherwise

hasBESProfile

boolean hasBESProfile()

Checks the presence of signing certificate covered by the signature, what is the proof -BES profile existence

Returns:

true if BES Profile is detected

hasEPESProfile

boolean hasEPESProfile()

Checks the presence of SignaturePolicyIdentifier element in the signature, what is the proof -EPES profile existence

Returns:

true if EPES Profile is detected

hasExtendedTProfile

boolean hasExtendedTProfile()

Checks the presence of SignatureTimeStamp element in the signature, what is the proof -T profile existence

Returns:

true if T Profile is detected

hasCProfile

boolean hasCProfile()

Checks the presence of CompleteCertificateRefs and CompleteRevocationRefs segments in the signature, what is the proof -C profile existence

Returns:

true if C Profile is detected

hasXProfile

boolean hasXProfile()

Checks the presence of SigAndRefsTimeStamp segment in the signature, what is the proof -X profile existence

Returns:

true if the -X extension is present

hasXLProfile

boolean hasXLProfile()

Checks the presence of CertificateValues/RevocationValues segment in the signature, what is the proof -XL profile existence

Returns:

true if the -XL extension is present

hasAProfile

boolean hasAProfile()

Checks the presence of ArchiveTimeStamp element in the signature, what is the proof -A profile existence

Returns:

true if the -A extension is present

areAllSelfSignedCertificates

boolean areAllSelfSignedCertificates()

Checks if all certificate chains present in the signature are self-signed

Returns:

TRUE if all certificates are self-signed, false otherwise

getStructureValidationResult

List<String> getStructureValidationResult()

Returns a message if the structure validation fails

Returns:

a list of String error messages if validation fails, an empty list if structural validation succeeds

getSignatureScopes

List<SignatureScope> getSignatureScopes()

Returns a list of found SignatureScopes

Returns:

a list of SignatureScopes

isDocHashOnlyValidation

boolean isDocHashOnlyValidation()

Returns true if the validation of the signature has been performed only on Signer's Document Representation (SDR). (An SDR typically is built on a cryptographic hash of the Signer's Document)

Returns:

true of it is DocHashOnly validation, false otherwise

isHashOnlyValidation

boolean isHashOnlyValidation()

Returns true if the validation of the signature has been performed only on Data To Be Signed Representation (DTBSR). EN 319 102-1 v1.1.1 (4.2.8 Data to be signed representation (DTBSR)): The DTBS preparation component shall take the DTBSF and hash it according to the hash algorithm specified in the cryptographic suite. The result of this process is the DTBSR, which is then used to create the signature. NOTE: In order for the produced hash to be representative of the DTBSF, the hashing function has the property that it is computationally infeasible to find collisions for the expected signature lifetime. Should the hash function become weak in the future, additional security measures, such as applying time-stamp tokens, can be taken.

Returns:

true of it is HashOnly validation, false otherwise

getSignatureValue

byte[] getSignatureValue()

Returns the digital signature value

Returns:

digital signature value byte array

getReferenceValidations

List<ReferenceValidation> getReferenceValidations()

Returns individual validation foreach reference (XAdES, JAdES) or for the message-imprint (CAdES)

Returns:

a list with one or more ReferenceValidation

getSignatureDigestReference

SignatureDigestReference getSignatureDigestReference(DigestAlgorithm digestAlgorithm)

Returns a signature reference element as defined in TS 119 442 - V1.1.1 - Electronic Signatures and Infrastructures (ESI), ch. 5.1.4.2.1.3 XML component

Parameters:

digestAlgorithm - DigestAlgorithm to use

Returns:

SignatureDigestReference

getDataToBeSignedRepresentation

Digest getDataToBeSignedRepresentation()

TS 119 102-1 (4.2.8 Data to be signed representation (DTBSR)) : The DTBS preparation component shall take the DTBSF and hash it according to the hash algorithm specified in the cryptographic suite.

Returns:

Digest DTBSR, which is then used to create the signature.