MessageVerifier Class

Properties   Methods   Events   Config Settings   Errors  

The MessageVerifier class verifies digital signatures of data stored in the PKCS#7 format.

Syntax

secureblackbox.Messageverifier

Remarks

PKCS#7 (Public Key Cryptography Standard #7) is a common format used to store encrypted and signed data. It is used by a variety of protocols, including S/MIME and CMS.

Property List

---

The following is the full list of the properties of the class with short descriptions. Click on the links for further details.

Method List

---

The following is the full list of the methods of the class with short descriptions. Click on the links for further details.

Event List

---

The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.

Config Settings

---

The following is a list of config settings for the class with short descriptions. Click on the links for further details.

Certificates Property (MessageVerifier Class)

A collection of certificates included in the electronic signature.

Syntax

public CertificateList getCertificates();

Remarks

Use this property to access all certificates included into the signature(s) by its creator.

This property is read-only and not available at design time.

Please refer to the Certificate type for a complete list of fields.

ClaimedSigningTime Property (MessageVerifier Class)

Returns a signature's claimed signing time.

Syntax

public String getClaimedSigningTime();

Default Value

""

Remarks

Use this property to get the signature creation time from the signer's computer. Note that the claimed time is not covered by the signature and may be forfeited or wrong. Use ValidatedSigningTime to obtain the signing time figure verified by a trusted timestamping authority. The time is in UTC.

This property is read-only and not available at design time.

ContentType Property (MessageVerifier Class)

A content type property of the signed message.

Syntax

public String getContentType();

Default Value

""

Remarks

Use this property to check the content type property of the processed signed message.

This property is read-only and not available at design time.

DataBytes Property (MessageVerifier Class)

Use this property to pass the original signed data to class in the byte array form.

Syntax

public byte[] getDataBytes();


public void setDataBytes(byte[] dataBytes);

Remarks

When validating detached signatures, assign a byte array containing the signed data to this property.

This property is not available at design time.

DataFile Property (MessageVerifier Class)

The name of the file containing the original signed data.

Syntax

public String getDataFile();


public void setDataFile(String dataFile);

Default Value

""

Remarks

Use this property to provide the original data when validating detached signatures with VerifyDetached.

DataStream Property (MessageVerifier Class)

A stream containing the originally signed data.

Syntax

public java.io.InputStream getDataStream();


public void setDataStream(java.io.InputStream dataStream);

Default Value

null

Remarks

Use this property to provide the original data when validating detached signatures with VerifyDetached.

This property is not available at design time.

FIPSMode Property (MessageVerifier Class)

Reserved.

Syntax

public boolean isFIPSMode();


public void setFIPSMode(boolean FIPSMode);

Default Value

False

Remarks

This property is reserved for future use.

HashAlgorithm Property (MessageVerifier Class)

Hash algorithm which was used to calculate the signature.

Syntax

public String getHashAlgorithm();


public void setHashAlgorithm(String hashAlgorithm);

Default Value

""

Remarks

Check this property after calling Verify or VerifyDetached to get the hash algorithm that was used to calculate the signature message digest.

InputBytes Property (MessageVerifier Class)

Use this property to pass the input to class in byte array form.

Syntax

public byte[] getInputBytes();


public void setInputBytes(byte[] inputBytes);

Remarks

Assign a byte array containing the data to be processed to this property.

This property is not available at design time.

InputFile Property (MessageVerifier Class)

Path to the file containing the signed message.

Syntax

public String getInputFile();


public void setInputFile(String inputFile);

Default Value

""

Remarks

Use this property to provide a file containing the signed data, either enveloping or detached.

InputIsHash Property (MessageVerifier Class)

Specifies whether the input source contains the hash of the data or the actual data.

Syntax

public boolean isInputIsHash();


public void setInputIsHash(boolean inputIsHash);

Default Value

False

Remarks

Use this property to tell the component whether the input source contains the actual data or its hash.

This property is not available at design time.

InputStream Property (MessageVerifier Class)

The stream containing the signed message.

Syntax

public java.io.InputStream getInputStream();


public void setInputStream(java.io.InputStream inputStream);

Default Value

null

Remarks

Use this property to provide a stream containing the signed message.

This property is not available at design time.

KnownCertificates Property (MessageVerifier Class)

Additional certificates for chain validation.

Syntax

public CertificateList getKnownCertificates();


public void setKnownCertificates(CertificateList knownCertificates);

Remarks

Use this property to supply a list of additional certificates that might be needed for chain validation. An example of a scenario where you might want to do that is when intermediary CA certificates are absent from the standard system locations (or when there are no standard system locations), and therefore should be supplied to the class manually.

The purpose of the certificates to be added to this collection is roughly equivalent to that of the Intermediate Certification Authorities system store in Windows.

Do not add trust anchors or root certificates to this collection: add them to TrustedCertificates instead.

This property is not available at design time.

Please refer to the Certificate type for a complete list of fields.

MACAlgorithm Property (MessageVerifier Class)

Specifies the hash algorithm to be used.

Syntax

public String getMACAlgorithm();

Default Value

"SHA256"

Remarks

This property specifies the MAC algorithm that was used to calculate an authenticated signature.

This property is read-only.

OutputBytes Property (MessageVerifier Class)

Use this property to read the output the class object has produced.

Syntax

public byte[] getOutputBytes();

Remarks

Read the contents of this property after the operation has completed to read the produced output. This property will only be set if the OutputFile and OutputStream properties had not been assigned.

This property is read-only and not available at design time.

OutputFile Property (MessageVerifier Class)

Path to the file to save the extracted data to.

Syntax

public String getOutputFile();


public void setOutputFile(String outputFile);

Default Value

""

Remarks

Use this property when validating enveloping signatures to specify the output file where the extracted message should be saved.

OutputStream Property (MessageVerifier Class)

The stream to save the extracted data to.

Syntax

public java.io.OutputStream getOutputStream();


public void setOutputStream(java.io.OutputStream outputStream);

Default Value

null

Remarks

Use this property when verifying enveloping signatures to provide the stream to save the extracted data to.

This property is not available at design time.

SignatureType Property (MessageVerifier Class)

The type of the processed signature.

Syntax

public int getSignatureType();



Enumerated values:
  public final static int stUnknown = 0;
  public final static int stPKCS1Detached = 1;
  public final static int stPKCS7Detached = 2;
  public final static int stPKCS7Enveloping = 3;
  public final static int stPKCS7MACDetached = 4;
  public final static int stPKCS7MACEnveloping = 5;

Default Value

0

Remarks

Use this property to check the result of the most recent signature validation.

This property is read-only and not available at design time.

SignatureValidationResult Property (MessageVerifier Class)

The signature validation result.

Syntax

public int getSignatureValidationResult();



Enumerated values:
  public final static int svtValid = 0;
  public final static int svtUnknown = 1;
  public final static int svtCorrupted = 2;
  public final static int svtSignerNotFound = 3;
  public final static int svtFailure = 4;

Default Value

0

Remarks

Use this property to check the result of the most recent signature validation.

This property is read-only and not available at design time.

SignedAttributes Property (MessageVerifier Class)

Custom signature attributes that are covered by the electronic signature.

Syntax

public SignatureAttributeList getSignedAttributes();

Remarks

Signature attributes are used to store auxiliary information in the signature. Values included as signed attributes are covered by the signature.

This property is read-only and not available at design time.

Please refer to the SignatureAttribute type for a complete list of fields.

SigningCertificate Property (MessageVerifier Class)

The certificate that was used to create the signature.

Syntax

public Certificate getSigningCertificate();

Remarks

Use this property to access the certificate that was used to create the signature. This property might not be available if the signer chose not to include the certificate into the signature.

This property is read-only and not available at design time.

Please refer to the Certificate type for a complete list of fields.

Timestamp Property (MessageVerifier Class)

Contains the timestamp which is being validated.

Syntax

public TimestampInfo getTimestamp();

Remarks

Use this property to access the timestamp which is currently being validated.

This property is read-only and not available at design time.

Please refer to the TimestampInfo type for a complete list of fields.

Timestamped Property (MessageVerifier Class)

Indicates whether or not the signature is timestamped.

Syntax

public boolean isTimestamped();

Default Value

False

Remarks

This property returns True if the signature is timestamped, and False otherwise.

This property is read-only and not available at design time.

TSACertificate Property (MessageVerifier Class)

The certificate of the Time Stamping Authority.

Syntax

public Certificate getTSACertificate();

Remarks

Use this property to access the certificate of the TSA that produced the timestamp.

Note that in some instances the TSA certificate might be unavailable, even for timestamped documents and signatures.

This property is read-only and not available at design time.

Please refer to the Certificate type for a complete list of fields.

UnsignedAttributes Property (MessageVerifier Class)

Custom unsigned attributes included in the electronic signature.

Syntax

public SignatureAttributeList getUnsignedAttributes();

Remarks

Signature attributes are used to store auxiliary information in the signature. Values included as unsigned attributes are not covered by the signature and can be changed or removed without affecting the signature.

This property is read-only and not available at design time.

Please refer to the SignatureAttribute type for a complete list of fields.

ValidatedSigningTime Property (MessageVerifier Class)

Contains the certified signing time.

Syntax

public String getValidatedSigningTime();

Default Value

""

Remarks

Use this property to obtain the signing time as certified by an external timestamp. The time is in UTC.

This property is read-only and not available at design time.

CheckSignatureType Method (Messageverifier Class)

Determines the signature kind.

Syntax

public int checkSignatureType();

Remarks

Use this method to determine the kind of the signature stored in InputFile (InputStream).

Config Method (Messageverifier Class)

Sets or retrieves a configuration setting.

Syntax

public String config(String configurationString);

Remarks

Config is a generic method available in every class. It is used to set and retrieve configuration settings for the class.

These settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the Config method.

To set a configuration setting named PROPERTY, you must call Config("PROPERTY=VALUE"), where VALUE is the value of the setting expressed as a string. For boolean values, use the strings "True", "False", "0", "1", "Yes", or "No" (case does not matter).

To read (query) the value of a configuration setting, you must call Config("PROPERTY"). The value will be returned as a string.

DoAction Method (Messageverifier Class)

Performs an additional action.

Syntax

public String doAction(String actionID, String actionParams);

Remarks

DoAction is a generic method available in every class. It is used to perform an additional action introduced after the product major release. The list of actions is not fixed, and may be flexibly extended over time.

The unique identifier (case insensitive) of the action is provided in the ActionID parameter.

ActionParams contains the value of a single parameter, or a list of multiple parameters for the action in the form of PARAM1=VALUE1;PARAM2=VALUE2;....

Verify Method (Messageverifier Class)

Verifies digitally signed data.

Syntax

public void verify();

Remarks

PKCS#7 and its successor, CMS, support two types of signatures: (1) enveloping signatures, where the signed data and its signature are combined in the same message, and (2) detached signatures, where the signature is stored as a separate entity. This method verifies enveloped signatures and extracts data contained in them. Use VerifyDetached to verify detached signatures.

This method expects the enveloping signature to be provided via InputFile or InputStream properties.

Note that this method only checks the integrity of the signature, i.e., that it is signed with the claimed certificate and has not been altered. It does not validate the signing certificate chain. To validate the certificate chain, either use CertificateValidator component together with MessageVerifier, or consider using CAdESVerifier component instead.

VerifyDetached Method (Messageverifier Class)

Verifies a detached signature.

Syntax

public void verifyDetached();

Remarks

Use this method to verify detached signatures. Pass the signature via InputFile (or InputStream) property, and the original data via DataFile (DataStream).

Error Event (Messageverifier Class)

Information about errors during PKCS#7 message verification.

Syntax

public class DefaultMessageverifierEventListener implements MessageverifierEventListener {
  ...
  public void error(MessageverifierErrorEvent e) {}
  ...
}

public class MessageverifierErrorEvent {
  public int errorCode;
  public String description;
}

Remarks

The event is fired in case of exceptional conditions during message processing.

ErrorCode contains an error code and Description contains a textual description of the error. For a list of valid error codes and their descriptions, please refer to the Messages section.

Notification Event (Messageverifier Class)

This event notifies the application about an underlying control flow event.

Syntax

public class DefaultMessageverifierEventListener implements MessageverifierEventListener {
  ...
  public void notification(MessageverifierNotificationEvent e) {}
  ...
}

public class MessageverifierNotificationEvent {
  public String eventID;
  public String eventParam;
}

Remarks

The class fires this event to let the application know about some event, occurrence, or milestone in the class. For example, it may fire to report completion of the document processing. The list of events being reported is not fixed, and may be flexibly extended over time.

The unique identifier of the event is provided in the EventID parameter. EventParam contains any parameters accompanying the occurrence. Depending on the type of the class, the exact action it is performing, or the document being processed, one or both may be omitted.

RecipientFound Event (Messageverifier Class)

Fires to report a message addressee parameters.

Syntax

public class DefaultMessageverifierEventListener implements MessageverifierEventListener {
  ...
  public void recipientFound(MessageverifierRecipientFoundEvent e) {}
  ...
}

public class MessageverifierRecipientFoundEvent {
  public String issuerRDN;
  public byte[] serialNumber;
  public byte[] subjectKeyID;
  public boolean certFound;
}

Remarks

This event is fired for each addressee the message is encrypted for. It may fire several times in a row if the message is encrypted for more than one recipient.

The IssuerRDN, SerialNumber, and SubjectKeyID parameters to identify the recipient's certificate. CertFound indicates if the specified certificate has been located in Certificates collection. If it wasn't, you might want to look up the certificate manually, and add it to the collection inside the event handler.

SignatureFound Event (Messageverifier Class)

Signifies the start of signature validation.

Syntax

public class DefaultMessageverifierEventListener implements MessageverifierEventListener {
  ...
  public void signatureFound(MessageverifierSignatureFoundEvent e) {}
  ...
}

public class MessageverifierSignatureFoundEvent {
  public String issuerRDN;
  public byte[] serialNumber;
  public byte[] subjectKeyID;
  public boolean certFound;
  public boolean validateSignature;
  public boolean validateChain;
}

Remarks

This event tells the application that signature validation is about to start, and provides the details about the signer's certificate via its IssuerRDN, SerialNumber, and SubjectKeyID parameters. It fires for every signature located in the verified document or message.

The CertFound parameter is set to True if the class has found the needed certificate in one of the known locations, and to False otherwise, in which case you must provide it manually via the KnownCertificates property.

Signature validation consists of two independent stages: cryptographic signature validation and chain validation. Separate validation results are reported for each, with the SignatureValidationResult and ChainValidationResult properties respectively.

Use the ValidateSignature and ValidateChain parameters to tell the verifier which stages to include in the validation.

SignatureValidated Event (Messageverifier Class)

Marks the completion of the signature validation routine.

Syntax

public class DefaultMessageverifierEventListener implements MessageverifierEventListener {
  ...
  public void signatureValidated(MessageverifierSignatureValidatedEvent e) {}
  ...
}

public class MessageverifierSignatureValidatedEvent {
  public String issuerRDN;
  public byte[] serialNumber;
  public byte[] subjectKeyID;
  public int validationResult;
}

Remarks

This event is fired upon the completion of the signature validation routine, and reports the respective validation result.

Use the IssuerRDN, SerialNumber, and/or SubjectKeyID parameters to identify the signing certificate.

ValidationResult is set to 0 if the validation has been successful, or to a non-zero value in case of a validation failure.

TimestampFound Event (Messageverifier Class)

Signifies the start of a timestamp validation routine.

Syntax

public class DefaultMessageverifierEventListener implements MessageverifierEventListener {
  ...
  public void timestampFound(MessageverifierTimestampFoundEvent e) {}
  ...
}

public class MessageverifierTimestampFoundEvent {
  public String issuerRDN;
  public byte[] serialNumber;
  public byte[] subjectKeyID;
  public boolean certFound;
  public boolean validateTimestamp;
  public boolean validateChain;
}

Remarks

This event fires for every timestamp identified during signature processing, and reports the details about the signer's certificate via its IssuerRDN, SerialNumber, and SubjectKeyID parameters.

The CertFound parameter is set to True if the class has found the needed certificate in one of the known locations, and to False otherwise, in which case you must provide it manually via the KnownCertificates property.

Just like with signature validation, timestamp validation consists of two independent stages: cryptographic signature validation and chain validation. Separate validation results are reported for each, with the ValidationResult and ChainValidationResult properties respectively.

Use the ValidateSignature and ValidateChain parameters to tell the verifier which stages to include in the validation.

TimestampValidated Event (Messageverifier Class)

Reports the completion of the timestamp validation routine.

Syntax

public class DefaultMessageverifierEventListener implements MessageverifierEventListener {
  ...
  public void timestampValidated(MessageverifierTimestampValidatedEvent e) {}
  ...
}

public class MessageverifierTimestampValidatedEvent {
  public String issuerRDN;
  public byte[] serialNumber;
  public byte[] subjectKeyID;
  public String time;
  public int validationResult;
  public int chainValidationResult;
  public int chainValidationDetails;
}

Remarks

This event is fired upon the completion of the timestamp validation routine, and reports the respective validation result.

ValidationResult is set to 0 if the validation has been successful, or to a non-zero value in case of a failure.

Certificate Type

Provides details of an individual X.509 certificate.

Remarks

This type provides access to X.509 certificate details.

Fields

Constructors

public Certificate( bytes,  startIndex,  count,  password);

Loads the X.509 certificate from a memory buffer. Bytes is a buffer containing the raw certificate data. StartIndex and Count specify the starting position and number of bytes to be read from the buffer, respectively. Password is a password encrypting the certificate.

public Certificate( certBytes,  certStartIndex,  certCount,  keyBytes,  keyStartIndex,  keyCount,  password);

Loads the X.509 certificate from a memory buffer. CertBytes is a buffer containing the raw certificate data. CertStartIndex and CertCount specify the number of bytes to be read from the buffer, respectively. KeyBytes is a buffer containing the private key data. KeyStartIndex and KeyCount specify the starting position and number of bytes to be read from the buffer, respectively. Password is a password encrypting the certificate.

public Certificate( bytes,  startIndex,  count);

Loads the X.509 certificate from a memory buffer. Bytes is a buffer containing the raw certificate data. StartIndex and Count specify the starting position and number of bytes to be read from the buffer, respectively.

public Certificate( path,  password);

Loads the X.509 certificate from a file. Path specifies the full path to the file containing the certificate data. Password is a password encrypting the certificate.

public Certificate( certPath,  keyPath,  password);

Loads the X.509 certificate from a file. CertPath specifies the full path to the file containing the certificate data. KeyPath specifies the full path to the file containing the private key. Password is a password encrypting the certificate.

public Certificate( path);

Loads the X.509 certificate from a file. Path specifies the full path to the file containing the certificate data.

public Certificate( stream);

Loads the X.509 certificate from a stream. Stream is a stream containing the certificate data.

public Certificate( stream,  password);

Loads the X.509 certificate from a stream. Stream is a stream containing the certificate data. Password is a password encrypting the certificate.

public Certificate( certStream,  keyStream,  password);

Loads the X.509 certificate from a stream. CertStream is a stream containing the certificate data. KeyStream is a stream containing the private key. Password is a password encrypting the certificate.

public Certificate();

Creates a new object with default field values.

SignatureAttribute Type

Represents an attribute of a digital PKCS#7/CMS signature.

Remarks

Attributes store auxiliary information about the signed message, the signature, or the owner. Each attribute is a OID=Value pair.

Common attributes are signing time, a content type, a policy identifier, and a signature timestamp.

Fields

Constructors

public SignatureAttribute();

Creates a new, empty, signature attribute.

TimestampInfo Type

A container for timestamp information.

Remarks

The TimestampInfo object contains details of a third-party timestamp and the outcome of its validation.

Fields

Constructors

public TimestampInfo();

Creates a new TimestampInfo object with default field values.

Config Settings (Messageverifier Class)

The class accepts one or more of the following configuration settings. Configuration settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the Config method.

MessageVerifier Config Settings

Base Config Settings

Trappable Errors (Messageverifier Class)

MessageVerifier Errors

	1048577   Invalid parameter value (SB_ERROR_INVALID_PARAMETER)
	1048578   Class is configured incorrectly (SB_ERROR_INVALID_SETUP)
	1048579   Operation cannot be executed in the current state (SB_ERROR_INVALID_STATE)
	1048580   Attempt to set an invalid value to a property (SB_ERROR_INVALID_VALUE)
	1048581   Certificate does not have its private key loaded (SB_ERROR_NO_PRIVATE_KEY)
	1048581   Cancelled by the user (SB_ERROR_CANCELLED_BY_USER)