Timestamp and signature problems

Question

Hello, everybody!
I have a problem when attaching a timestamp to a signature using the BouncyCastle provider.
I have read the [RFC 3161|http://www.ietf.org/rfc/rfc3161.txt] and in chapter 2.4.1 it states that the messageImprint contained in the request "SHOULD contain the hash of the datum to be time-stamped."
Also, in the appendix A of the same RFC, it's stated: "The value of messageImprint field within TimeStampToken shall be a hash of the value of signature field within SignerInfo for the signedData being time-stamped."
My problem is as follows:
I'm creating a request generator, using TimeStampRequestGenerator class in the org.bouncycastle.tsp package of the BouncyCastle provider. Then the request is created using the generate method of the TimeStampRequestGenerator object
TimeStampRequestGenerator reqGen = new TimeStampRequestGenerator();
reqGen.setCertReq (true);
TimeStampRequest request = reqGen.generate(TSPAlgorithms.SHA1, hash, BigInteger.valueOf(100));Please, be aware that the hash variable is generic. But what value must this variable have? The value of the a hash function for the unsigned data or the value of a hash function for the signature field in the SignerInfo? What is the right way to build the request?
The request should be build using the hash of the unsigned data? Then, after generating the pkcs7 file with the timestamped attached as an unsigned attribute, when a verification is performed, should I verify that the value in the messageImprint has the same value with the hash of the signature field in the SignerInfo? If so, it means I'm doingsomething wrong,because those values cannot be equal at all.
Or the request should be built using the hash of the signature. And when the verification is performed, the messageImprint will contain the correct value, as stated in the Appendix A of the RFC3161?
So my problem is what value must be passed for the hash when building the request?
Any help qould be appreciated.
Thank you!

Answer 1

problem solved
I had interpreting in the wrong way the RFC3161 that states that if adding the timestamp to a signature in a pkcs7 file the hash that needs to be sent to the TSA must be the hash of the signature field in the SignerInfo of the data.
Which is correct if I stay a little bit to think because the timestamp is for the signature, not for the unsigned data.
So, when creating the request for the TSA, the hash has to be the the hash for the signature.