PDF Digital Signature

Question

Hi,
Does any body know how to write a PKCS#7 (Public Key Cryptography Standard) object in java. This object has to be written to PDF file in order to generate signed pdf's.
plz let me now any code samples or URLs to write PKCS#7 format. I dont want to use third party libraries.
Thanks in advance.
Subhani.

Answer 1

Here i'm attaching a sample file how to generate signature for PDF document. If i remove the BouncyCastle clasess the rest of the program perfectly compiled and generated valid signature bytes and i used BC clasess to convert this signature bytes in to PKCS#7 Format. one error is "gen.addCertificatesAndCRLs" of BC accept CertStore where as i got CertChain from keystore. (plz see the code)
import java.security.*;
import java.security.cert.*;
import java.security.spec.*;
import java.io.*;
import java.util.*;
import org.bouncycastle.cms.*;
public class TestDigSig {
// Generate a RSA signature
public TestDigSig() {
try {
KeyStore keyStore = KeyStore.getInstance("PKCS12");
// aa.pfx - Trial Digitlal Id got from Verisign site.
keyStore.load(new FileInputStream("aa.pfx"), storepswd);
Provider provider = keyStore.getProvider();
for(Enumeration e = keyStore.aliases() ; e.hasMoreElements() ;) {
alias = e.nextElement().toString();
// Retrieving private key
PrivateKey privKey = (PrivateKey)keyStore.getKey(alias, storepswd);
java.security.cert.X509Certificate cert = (java.security.cert.X509Certificate)keyStore.getCertificate(alias);
java.security.cert.Certificate[] certChain =
keyStore.getCertificateChain(alias);
// Length of certChain is 3
//System.out.println("certificte chain "+certChain.length);
// Retrieving public key
PublicKey pubKey = cert.getPublicKey();
// Have to support RSA - MD5 only
Signature rsa = Signature.getInstance("MD5withRSA");
rsa.initSign(privKey);
/* Update and sign the data */
// dumpPart1.dat and dumpPart2.dat are bytes of PDF document.
// Two dat files are compulsory in order to embed signature(PKCS#7 Format) in PDF doc
FileInputStream fis = new FileInputStream("dumpPart1.dat");
BufferedInputStream bufin = new BufferedInputStream(fis);
byte[] buffer = new byte[1024];
int len;
while (bufin.available() != 0) {
len = bufin.read(buffer);
rsa.update(buffer, 0, len);
bufin.close();
FileInputStream fis1 = new FileInputStream("dumpPart2.dat");
BufferedInputStream bufin1 = new BufferedInputStream(fis1);
byte[] buffer1 = new byte[1024];
int len1;
while (bufin1.available() != 0) {
len1 = bufin1.read(buffer1);
rsa.update(buffer1, 0, len1);
bufin1.close();
/* Now that all the data to be signed has been read in,
generate a signature for it */
// The array contains signature bytes.
byte[] rsaSign = rsa.sign();
// using BouncyCastl clasess for PKCS#7 Format
CMSSignedDataGenerator gen = new CMSSignedDataGenerator();
gen.addSigner(privKey, cert, CMSSignedDataGenerator.DIGEST_MD5);
gen.addCertificatesAndCRLs(certChain);
CMSProcessableByteArray process = new CMSProcessableByteArray(rsaSign);
CMSSignedData data = gen.generate(process, "BC");
FileOutputStream contentStream = new FileOutputStream("chkContent");
contentStream.write(data.getEncoded());
contentStream.close();
} catch(Exception e) {
e.printStackTrace();
public static void main(String[] args) {
new TestDigSig();
private char[] storepswd = {'1', '2', '3'};
private String alias;
If you have any piece of code that how to create a PKCS#7 object using BC clasess, please let me know.
Thanks.