Mailing-List: contact users-help@pdfbox.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@pdfbox.apache.org
From: Michael Lindsay <michael.lindsay@hellosign.com.INVALID>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Mime-Version: 1.0 (Mac OS X Mail 10.3 \(3273\))
Subject: Re: HSM Signing
Date: Mon, 2 Oct 2017 17:11:22 -0700
References: <F80ECF78-F448-46EB-B681-688C0EC288A2@hellosign.com>
 <CAKtZ4qMULAMsp0-0F7UZ_TsDQaF_Y8Pu4VWzq9Jy29pyXKxa4Q@mail.gmail.com>
 <CAKtZ4qNwvgfxW0ZSbO7VMJZ-fv7_Ebq8sKyJr141UzJvr830Rg@mail.gmail.com>
 <B78E3BBD-079C-454F-8694-7C76444D3195@hellosign.com>
 <CAKtZ4qMpyY98mp3AB1-H2rF1J20hDXU1B4N5QkJ4b+4jTunuWg@mail.gmail.com>
 <5f81ded7-8797-50bc-d1ca-06db81ac7d32@t-online.de>
To: users@pdfbox.apache.org
In-Reply-To: <5f81ded7-8797-50bc-d1ca-06db81ac7d32@t-online.de>
Message-Id: <1DDA009D-5194-463C-A926-8F6B98233585@hellosign.com>
archived-at: Tue, 03 Oct 2017 00:11:32 -0000

I=E2=80=99m happy to post the code, but I have yet to get it working.  =
The biggest change from the example code appears to be in =
CreateSignatureBase.sign


    public byte[] sign(InputStream content) throws IOException
    {
        //TODO this method should be private
        try
        {
            List<Certificate> certList =3D new ArrayList<>();
            certList.addAll(Arrays.asList(certificateChain));
            Store certs =3D new JcaCertStore(certList);
            CMSSignedDataGenerator gen =3D new CMSSignedDataGenerator();

		// This is my hash generation code, I=E2=80=99m =
presuming that content is the part of the pdf to be signed
		// create hex encoded sha256 message digest
            byte[] sh =3D =
MessageDigest.getInstance("SHA-256").digest(IOUtils.toByteArray(content));=

            String hexencodedDigest =3D new BigInteger(1, =
sh).toString(16);
            hexencodedDigest =3D hexencodedDigest.toUpperCase();
            final String signedHash =3D =
certProvider.signPdfDigest(hexencodedDigest);

		// This is the new code from Paresh
            ContentSigner nonSigner =3D new ContentSigner() {

                @Override
                public byte[] getSignature() {
                    try {
                        return Hex.decodeHex(signedHash.toCharArray());
                    } catch (DecoderException e) {
                        e.printStackTrace();
                    }
                    //we can also base64 decode and return (used to be =
the case, now it isn't)
//                    return Base64.decodeBase64(signedHash);
                    return null;
                }

                @Override
                public OutputStream getOutputStream() {
                    return new ByteArrayOutputStream();
                }

                @Override
                public AlgorithmIdentifier getAlgorithmIdentifier() {
                    return new =
DefaultSignatureAlgorithmIdentifierFinder().find("SHA256WithRSAEncryption"=
);
                }
            };

            org.bouncycastle.asn1.x509.Certificate cert =3D =
org.bouncycastle.asn1.x509.Certificate.getInstance(certificateChain[0].get=
Encoded());
            JcaSignerInfoGeneratorBuilder sigb =3D new =
JcaSignerInfoGeneratorBuilder(new =
JcaDigestCalculatorProviderBuilder().build());

            //ContentSigner sha1Signer =3D new =
JcaContentSignerBuilder("SHA256WithRSA").build(privateKey);
            gen.addSignerInfoGenerator(sigb.build(nonSigner, new =
X509CertificateHolder(cert)));
            gen.addCertificates(certs);
            CMSTypedDataInputStream msg =3D new =
CMSTypedDataInputStream(new =
ByteArrayInputStream("useless_data".getBytes())); // this is never used.

            //CMSProcessableInputStream msg =3D new =
CMSProcessableInputStream(content);
            CMSSignedData signedData =3D gen.generate(msg, false);
            if (tsaClient !=3D null)
            {
                signedData =3D signTimeStamps(signedData);
            }
            return signedData.getEncoded();
        }
        catch (GeneralSecurityException | CMSException | TSPException | =
OperatorCreationException e)
        {
            throw new IOException(e);
        } catch (SessionExpiredException | TokenExpiredException | =
CertProviderException e) {
            throw new IOException(e);
        }
    }

When I view the pdf, it says my document has bee altered or corrupted.  =
Not sure where I=E2=80=99m going wrong.

Any help greatly appreciated!


> On Oct 2, 2017, at 2:34 AM, Tilman Hausherr <THausherr@t-online.de> =
wrote:
>=20
> Hi,
>=20
> The 0bin content has expired... if you have something useful to share =
(and it seems so) please post the entire code here so it will be =
archived.
>=20
> Tilman
>=20
> Am 29.09.2017 um 18:58 schrieb Paresh Chouhan:
>> that returns the signed value which was signed by external signer =
@Michael
>> 1. prepareToSign() - to prepare pdf for signing - this generates Hash =
and
>> pass it to the client (HSM) for signing (I access HSM using JS, =
hashtosign
>> is sent to JS script)
>> -- ANY AMOUNT OF DELAY BETWEEN THESE STEPS--
>> 2. finishSign() - takes the signed hash value and resumes to sign =
PDF. (PDF
>> is saved in memory while this is happening)
>>=20
>>=20
>> On Fri, Sep 29, 2017 at 3:12 AM Michael Lindsay
>> <michael.lindsay@hellosign.com.invalid> wrote:
>>=20
>>> Hi Paresh,
>>>=20
>>> Thanks so much for the quick reply and the code snippets.  Very =
helpful
>>> indeed.
>>>=20
>>> Couple quick questions=E2=80=A6. There=E2=80=99s a reference here to
>>>=20
>>> final String signedHash =3D pdfFile.getPdfSignedHash();
>>>=20
>>> But I can=E2=80=99t find where pdfFile is created or what it=E2=80=99s=
 type is.
>>>=20
>>> Also, can you share your generateHash method and your PDFSigner =
class?
>>>=20
>>> Thanks again,
>>>  - Michael
>>>=20
>>>=20
>>>=20
>>>> On Sep 28, 2017, at 5:09 AM, Paresh Chouhan =
<pareshchouhan2013@gmail.com>
>>> wrote:
>>>> here's the setup for signing
>>>>=20
>>> =
https://0bin.net/paste/1hDByAx4i9dBAoGh#0CCZBX5Il0FHxsuYQUvoe7otY3-tHxtM0Z=
s9IYqLozG
>>>> On Thu, Sep 28, 2017 at 5:35 PM Paresh Chouhan <
>>> pareshchouhan2013@gmail.com>
>>>> wrote:
>>>>=20
>>>>> Yes, Michael I wrote that post, It is working well with an HSM,
>>>>>=20
>>>>>=20
>>> =
https://0bin.net/paste/iEhbQJm8y-waiV+O#2deRPmaGUdvWwg0iD+htfR4gWm3wmKUe3u=
pyt0+3jRS
>>>>>=20
>>>>> On Wed, Sep 27, 2017 at 10:19 PM Michael Lindsay
>>>>> <michael.lindsay@hellosign.com.invalid> wrote:
>>>>>=20
>>>>>> Hello List!
>>>>>>=20
>>>>>> I=E2=80=99ve got an implementation of pdfbox digital signing =
working fabulously
>>>>>> with a self signed cert based on the examples provided.  We are =
trying
>>> to
>>>>>> switch over to using an HSM and I can=E2=80=99t seem to crack it. =
 I believe
>>> from
>>>>>> the post here that such a thing is possible:
>>>>>>=20
>>> =
https://stackoverflow.com/questions/44196316/pdf-signing-generated-pdf-doc=
ument-certification-is-invalid-using-external-si
>>>>>> <
>>>>>>=20
>>> =
https://stackoverflow.com/questions/44196316/pdf-signing-generated-pdf-doc=
ument-certification-is-invalid-using-external-si
>>>>>> The signing service provides a signing certificate and ocsp which =
I
>>> need
>>>>>> to use to calculate the digest then pass that along to them for =
signing
>>>>>> with the private key.  All of the examples in the documentation =
assume
>>> I
>>>>>> have the private key.
>>>>>>=20
>>>>>> Does anyone here have any example code for calculating and =
sending pdf
>>>>>> digest to external service to sign pdfs?  Any help would be =
greatly
>>>>>> appreciated.
>>>>>>=20
>>>>>> Thanks,
>>>>>> - Michael
>>>>> --
>>>>> Regards
>>>>> Paresh Chouhan
>>>>> https://github.com/pareshchouhan
>>>>>=20
>>>> --
>>>> Regards
>>>> Paresh Chouhan
>>>> https://github.com/pareshchouhan
>>>=20
>>> =
---------------------------------------------------------------------
>>> To unsubscribe, e-mail: users-unsubscribe@pdfbox.apache.org
>>> For additional commands, e-mail: users-help@pdfbox.apache.org
>>>=20
>>> --
>> Regards
>> Paresh Chouhan
>> https://github.com/pareshchouhan
>>=20
>=20
>=20
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@pdfbox.apache.org
> For additional commands, e-mail: users-help@pdfbox.apache.org
>=20


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@pdfbox.apache.org
For additional commands, e-mail: users-help@pdfbox.apache.org