MessageVerifier Class

Properties   Methods   Events   Config Settings   Errors  

The MessageVerifier class verifies digital signatures of data stored in the PKCS#7 format.

Syntax

secureblackbox.MessageVerifier

Remarks

PKCS#7 (Public Key Cryptography Standard #7) is a common format used to store encrypted and signed data. It is used by a variety of protocols, including S/MIME and CMS.

MessageVerifier can process signed data in PKCS#7 SignedData and AuthenticatedData subformats. RSA, ECDSA, and EdDSA algorithms are supported.

Setting up and using MessageVerifier is easy:

• Set up your source and destination via InputFile (InputBytes) and OutputFile (OutputBytes) properties. For detached signatures, provide the signed data separately via DataFile (DataBytes).
• For the SignedData-type signatures (most commonly used), add the public part of the signing certificate to the Certificates collection. This step may be unnecessary, as it is typical for signers to include their certificates in the signature.
• For the AuthenticatedData-type signature, add the recipient's (i.e. your) certificate, with its private key, to Certificates collection.
• Call Verify or VerifyDetached, as appropriate, to execute the validation operation.
• Post-validation, you can get access to signature properties, such as ClaimedSigningTime, SignedAttributes, and UnsignedAttributes.

Note that MessageVerifier can only work with binary PKCS#7-compliant and PKCS#1-compliant signatures. To process S/MIME-signed emails, see MailReader. To process PGP signatures, see PGPReader.

MessageVerifier is a simplified form of CAdESVerifier. Both classes work with PKCS#7 signed messages. CAdESVerifier, however, provides support for advanced (CAdES) signatures, including long-term validity, archival, and full chain validation capabilities. These advanced capabilities are absent from MessageVerifier, which is only capable of processing basic PKCS#7 signatures without any chain of trust validation. MessageVerifier verifier = new MessageVerifier(); // Select the file which contains the signed message verifier.setInputFile("signedMessage.bin"); if (verifier.checkSignatureType() == Constants.stPKCS7Detached) { // To verify a detached signature, we need // to provide both the signature and the original data verifier.setDataFile("message.txt"); verifier.verifyDetached(); } else { // To verify an enveloping signature, we need // to provide the location to extract the data verifier.setOutputFile("output.txt"); verifier.verify(); } System.out.println("Validation result: " + verifier.getSignatureValidationResult() + "\n" + "Signing time: " + verifier.getValidatedSigningTime() + "\n" + "TSA certificate: " + verifier.getSigningCertificate().getSubjectRDN()); // Output: // // Validation result: 0 // 0 == svtValid // Signing time: 2024-05-16 15:18:35 // TSA certificate: /CN=Test Certificate

Property List

---

The following is the full list of the properties of the class with short descriptions. Click on the links for further details.

Method List

---

The following is the full list of the methods of the class with short descriptions. Click on the links for further details.

Event List

---

The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.

Config Settings

---

The following is a list of config settings for the class with short descriptions. Click on the links for further details.

Certificates Property (MessageVerifier Class)

A collection of certificates included in the electronic signature.

Syntax

public CertificateList getCertificates();

Remarks

This property includes a collection of certificates of the currently selected info.

This collection is indexed from 0 to size -1.

This property is read-only and not available at design time.

Please refer to the Certificate type for a complete list of fields.

ClaimedSigningTime Property (MessageVerifier Class)

Returns a signature's claimed signing time.

Syntax

public String getClaimedSigningTime();

Default Value

""

Remarks

Use this property to get the signature creation time from the signer's computer. Note that the claimed time is not covered by the signature and may be forfeited or wrong. Use ValidatedSigningTime to obtain the signing time figure verified by a trusted timestamping authority. The time is in UTC.

This property is read-only and not available at design time.

ContentType Property (MessageVerifier Class)

A content type property of the signed message.

Syntax

public String getContentType();

Default Value

""

Remarks

Use this property to check the content type property of the processed signed message.

This property is read-only and not available at design time.

DataBytes Property (MessageVerifier Class)

Use this property to pass the original signed data to class in the byte array form.

Syntax

public byte[] getDataBytes();
public void setDataBytes(byte[] dataBytes);

Remarks

When validating detached signatures, assign a byte array containing the signed data to this property.

This property is not available at design time.

DataFile Property (MessageVerifier Class)

The name of the file containing the original signed data.

Syntax

public String getDataFile();
public void setDataFile(String dataFile);

Default Value

""

Remarks

Use this property to provide the original data when validating detached signatures with VerifyDetached.

DataStream Property (MessageVerifier Class)

A stream containing the originally signed data.

Syntax

public java.io.InputStream getDataStream();
public void setDataStream(java.io.InputStream dataStream);

Default Value

null

Remarks

Use this property to provide the original data when validating detached signatures with VerifyDetached.

This property is not available at design time.

FIPSMode Property (MessageVerifier Class)

Reserved.

Syntax

public boolean isFIPSMode();
public void setFIPSMode(boolean FIPSMode);

Default Value

False

Remarks

This property is reserved for future use.

HashAlgorithm Property (MessageVerifier Class)

Hash algorithm which was used to calculate the signature.

Syntax

public String getHashAlgorithm();
public void setHashAlgorithm(String hashAlgorithm);

Default Value

""

Remarks

Check this property after calling Verify or VerifyDetached to get the hash algorithm that was used to calculate the signature message digest.

InputBytes Property (MessageVerifier Class)

Use this property to pass the input to class in byte array form.

Syntax

public byte[] getInputBytes();
public void setInputBytes(byte[] inputBytes);

Remarks

Assign a byte array containing the data to be processed to this property.

This property is not available at design time.

InputFile Property (MessageVerifier Class)

Path to the file containing the signed message.

Syntax

public String getInputFile();
public void setInputFile(String inputFile);

Default Value

""

Remarks

Use this property to provide a file containing the signed data, either enveloping or detached.

InputIsHash Property (MessageVerifier Class)

Specifies whether the input source contains the hash of the data or the actual data.

Syntax

public boolean isInputIsHash();
public void setInputIsHash(boolean inputIsHash);

Default Value

False

Remarks

Use this property to tell the component whether the input source contains the actual data or its hash.

This property is not available at design time.

InputStream Property (MessageVerifier Class)

The stream containing the signed message.

Syntax

public java.io.InputStream getInputStream();
public void setInputStream(java.io.InputStream inputStream);

Default Value

null

Remarks

Use this property to provide a stream containing the signed message.

This property is not available at design time.

KnownCertificates Property (MessageVerifier Class)

Additional certificates for chain validation.

Syntax

public CertificateList getKnownCertificates();
public void setKnownCertificates(CertificateList knownCertificates);

Remarks

Use this property to supply a list of additional certificates that might be needed for chain validation. An example of a scenario where you might want to do that is when intermediary CA certificates are absent from the standard system locations (or when there are no standard system locations), and therefore should be supplied to the class manually.

The purpose of the certificates to be added to this collection is roughly equivalent to that of the Intermediate Certification Authorities system store in Windows.

Do not add trust anchors or root certificates to this collection: add them to TrustedCertificates instead.

This property is not available at design time.

Please refer to the Certificate type for a complete list of fields.

MACAlgorithm Property (MessageVerifier Class)

Specifies the hash algorithm to be used.

Syntax

public String getMACAlgorithm();

Default Value

"SHA256"

Remarks

This property specifies the MAC algorithm that was used to calculate an authenticated signature.

This property is read-only.

OutputBytes Property (MessageVerifier Class)

Use this property to read the output the class object has produced.

Syntax

public byte[] getOutputBytes();

Remarks

Read the contents of this property after the operation has completed to read the produced output. This property will only be set if the OutputFile and OutputStream properties had not been assigned.

This property is read-only and not available at design time.

OutputFile Property (MessageVerifier Class)

Path to the file to save the extracted data to.

Syntax

public String getOutputFile();
public void setOutputFile(String outputFile);

Default Value

""

Remarks

Use this property when validating enveloping signatures to specify the output file where the extracted message should be saved.

OutputStream Property (MessageVerifier Class)

The stream to save the extracted data to.

Syntax

public java.io.OutputStream getOutputStream();
public void setOutputStream(java.io.OutputStream outputStream);

Default Value

null

Remarks

Use this property when verifying enveloping signatures to provide the stream to save the extracted data to.

This property is not available at design time.

SignatureType Property (MessageVerifier Class)

The type of the processed signature.

Syntax

public int getSignatureType();

Enumerated values:
  public final static int stUnknown = 0;
  public final static int stPKCS1Detached = 1;
  public final static int stPKCS7Detached = 2;
  public final static int stPKCS7Enveloping = 3;
  public final static int stPKCS7MACDetached = 4;
  public final static int stPKCS7MACEnveloping = 5;

Default Value

0

Remarks

Use this property to check the result of the most recent signature validation.

This property is read-only and not available at design time.

SignatureValidationResult Property (MessageVerifier Class)

The signature validation result.

Syntax

public int getSignatureValidationResult();

Enumerated values:
  public final static int svtValid = 0;
  public final static int svtUnknown = 1;
  public final static int svtCorrupted = 2;
  public final static int svtSignerNotFound = 3;
  public final static int svtFailure = 4;
  public final static int svtReferenceCorrupted = 5;

Default Value

0

Remarks

Use this property to check the result of the most recent signature validation.

This property is read-only and not available at design time.

SignedAttributes Property (MessageVerifier Class)

Custom signature attributes that are covered by the electronic signature.

Syntax

public SignatureAttributeList getSignedAttributes();

Remarks

Signature attributes are used to store auxiliary information in the signature. Values included as signed attributes are covered by the signature.

This property is read-only and not available at design time.

Please refer to the SignatureAttribute type for a complete list of fields.

SigningCertificate Property (MessageVerifier Class)

The certificate that was used to create the signature.

Syntax

public Certificate getSigningCertificate();

Remarks

Use this property to access the certificate that was used to create the signature. This property might not be available if the signer chose not to include the certificate into the signature.

This property is read-only and not available at design time.

Please refer to the Certificate type for a complete list of fields.

Timestamp Property (MessageVerifier Class)

Contains the timestamp which is being validated.

Syntax

public TimestampInfo getTimestamp();

Remarks

Use this property to access the timestamp which is currently being validated.

This property is read-only and not available at design time.

Please refer to the TimestampInfo type for a complete list of fields.

Timestamped Property (MessageVerifier Class)

Indicates whether or not the signature is timestamped.

Syntax

public boolean isTimestamped();

Default Value

False

Remarks

This property returns True if the signature is timestamped, and False otherwise.

This property is read-only and not available at design time.

TSACertificate Property (MessageVerifier Class)

The certificate of the Time Stamping Authority.

Syntax

public Certificate getTSACertificate();

Remarks

Use this property to access the certificate of the TSA that produced the timestamp.

Note that in some instances the TSA certificate might be unavailable, even for timestamped documents and signatures.

This property is read-only and not available at design time.

Please refer to the Certificate type for a complete list of fields.

UnsignedAttributes Property (MessageVerifier Class)

Custom unsigned attributes included in the electronic signature.

Syntax

public SignatureAttributeList getUnsignedAttributes();

Remarks

Signature attributes are used to store auxiliary information in the signature. Values included as unsigned attributes are not covered by the signature and can be changed or removed without affecting the signature.

This property is read-only and not available at design time.

Please refer to the SignatureAttribute type for a complete list of fields.

ValidatedSigningTime Property (MessageVerifier Class)

Contains the certified signing time.

Syntax

public String getValidatedSigningTime();

Default Value

""

Remarks

Use this property to obtain the signing time as certified by an external timestamp. The time is in UTC.

This property is read-only and not available at design time.

CheckSignatureType Method (MessageVerifier Class)

Determines the signature kind.

Syntax

public int checkSignatureType();

Remarks

Use this method to determine the kind of the signature stored in InputFile (InputStream).

Config Method (MessageVerifier Class)

Sets or retrieves a configuration setting.

Syntax

public String config(String configurationString);

Remarks

Config is a generic method available in every class. It is used to set and retrieve configuration settings for the class.

These settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the Config method.

To set a configuration setting named PROPERTY, you must call Config("PROPERTY=VALUE"), where VALUE is the value of the setting expressed as a string. For boolean values, use the strings "True", "False", "0", "1", "Yes", or "No" (case does not matter).

To read (query) the value of a configuration setting, you must call Config("PROPERTY"). The value will be returned as a string.

DoAction Method (MessageVerifier Class)

Performs an additional action.

Syntax

public String doAction(String actionID, String actionParams);

Remarks

DoAction is a generic method available in every class. It is used to perform an additional action introduced after the product major release. The list of actions is not fixed, and may be flexibly extended over time.

The unique identifier (case insensitive) of the action is provided in the ActionID parameter.

ActionParams contains the value of a single parameter, or a list of multiple parameters for the action in the form of PARAM1=VALUE1;PARAM2=VALUE2;....

Common ActionIDs:

Reset Method (MessageVerifier Class)

Resets the class settings.

Syntax

public void reset();

Remarks

Reset is a generic method available in every class.

Verify Method (MessageVerifier Class)

Verifies digitally signed data.

Syntax

public void verify();

Remarks

PKCS#7 and its successor, CMS, support two types of signatures: (1) enveloping signatures, where the signed data and its signature are combined in the same message, and (2) detached signatures, where the signature is stored as a separate entity. This method verifies enveloped signatures and extracts data contained in them. Use VerifyDetached to verify detached signatures.

This method expects the enveloping signature to be provided via InputFile or InputStream properties.

Note that this method only checks the integrity of the signature, i.e., that it is signed with the claimed certificate and has not been altered. It does not validate the signing certificate chain. To validate the certificate chain, either use CertificateValidator component together with MessageVerifier, or consider using CAdESVerifier component instead.

VerifyDetached Method (MessageVerifier Class)

Verifies a detached signature.

Syntax

public void verifyDetached();

Remarks

Use this method to verify detached signatures. Pass the signature via InputFile (or InputStream) property, and the original data via DataFile (DataStream).

Error Event (MessageVerifier Class)

Information about errors during PKCS#7 message verification.

Syntax

public class DefaultMessageVerifierEventListener implements MessageVerifierEventListener {
  ...
  public void error(MessageVerifierErrorEvent e) {}
  ...
}

public class MessageVerifierErrorEvent {
  public int errorCode;
  public String description;
}

Remarks

The event is fired in case of exceptional conditions during message processing.

ErrorCode contains an error code and Description contains a textual description of the error. For a list of valid error codes and their descriptions, please refer to the Messages section.

Notification Event (MessageVerifier Class)

This event notifies the application about an underlying control flow event.

Syntax

public class DefaultMessageVerifierEventListener implements MessageVerifierEventListener {
  ...
  public void notification(MessageVerifierNotificationEvent e) {}
  ...
}

public class MessageVerifierNotificationEvent {
  public String eventID;
  public String eventParam;
}

Remarks

The class fires this event to let the application know about some event, occurrence, or milestone in the class. For example, it may fire to report completion of the document processing. The list of events being reported is not fixed, and may be flexibly extended over time.

The unique identifier of the event is provided in the EventID parameter. EventParam contains any parameters accompanying the occurrence. Depending on the type of the class, the exact action it is performing, or the document being processed, one or both may be omitted.

RecipientFound Event (MessageVerifier Class)

Fires to report a message addressee parameters.

Syntax

public class DefaultMessageVerifierEventListener implements MessageVerifierEventListener {
  ...
  public void recipientFound(MessageVerifierRecipientFoundEvent e) {}
  ...
}

public class MessageVerifierRecipientFoundEvent {
  public String issuerRDN;
  public byte[] serialNumber;
  public byte[] subjectKeyID;
  public boolean certFound;
}

Remarks

This event is fired for each addressee the message is encrypted for. It may fire several times in a row if the message is encrypted for more than one recipient.

The IssuerRDN, SerialNumber, and SubjectKeyID parameters to identify the recipient's certificate. CertFound indicates if the specified certificate has been located in Certificates collection. If it wasn't, you might want to look up the certificate manually, and add it to the collection inside the event handler.

SignatureFound Event (MessageVerifier Class)

Signifies the start of signature validation.

Syntax

public class DefaultMessageVerifierEventListener implements MessageVerifierEventListener {
  ...
  public void signatureFound(MessageVerifierSignatureFoundEvent e) {}
  ...
}

public class MessageVerifierSignatureFoundEvent {
  public String issuerRDN;
  public byte[] serialNumber;
  public byte[] subjectKeyID;
  public boolean certFound;
  public boolean validateSignature; //read-write
  public boolean validateChain; //read-write
}

Remarks

This event tells the application that signature validation is about to start, and provides the details about the signer's certificate via its IssuerRDN, SerialNumber, and SubjectKeyID parameters. It fires for every signature located in the verified document or message.

The CertFound parameter is set to True if the class has found the needed certificate in one of the known locations, and to False otherwise, in which case you must provide it manually via the KnownCertificates property.

Signature validation consists of two independent stages: cryptographic signature validation and chain validation. Separate validation results are reported for each, with the SignatureValidationResult and ChainValidationResult properties respectively.

Use the ValidateSignature and ValidateChain parameters to tell the verifier which stages to include in the validation.

SignatureValidated Event (MessageVerifier Class)

Marks the completion of the signature validation routine.

Syntax

public class DefaultMessageVerifierEventListener implements MessageVerifierEventListener {
  ...
  public void signatureValidated(MessageVerifierSignatureValidatedEvent e) {}
  ...
}

public class MessageVerifierSignatureValidatedEvent {
  public String issuerRDN;
  public byte[] serialNumber;
  public byte[] subjectKeyID;
  public int validationResult;
}

Remarks

This event is fired upon the completion of the signature validation routine, and reports the respective validation result.

Use the IssuerRDN, SerialNumber, and/or SubjectKeyID parameters to identify the signing certificate.

ValidationResult is set to 0 if the validation has been successful, or to a non-zero value in case of a validation failure.

TimestampFound Event (MessageVerifier Class)

Signifies the start of a timestamp validation routine.

Syntax

public class DefaultMessageVerifierEventListener implements MessageVerifierEventListener {
  ...
  public void timestampFound(MessageVerifierTimestampFoundEvent e) {}
  ...
}

public class MessageVerifierTimestampFoundEvent {
  public String issuerRDN;
  public byte[] serialNumber;
  public byte[] subjectKeyID;
  public boolean certFound;
  public boolean validateTimestamp; //read-write
  public boolean validateChain; //read-write
}

Remarks

This event fires for every timestamp identified during signature processing, and reports the details about the signer's certificate via its IssuerRDN, SerialNumber, and SubjectKeyID parameters.

The CertFound parameter is set to True if the class has found the needed certificate in one of the known locations, and to False otherwise, in which case you must provide it manually via the KnownCertificates property.

Just like with signature validation, timestamp validation consists of two independent stages: cryptographic signature validation and chain validation. Separate validation results are reported for each, with the ValidationResult and ChainValidationResult properties respectively.

Use the ValidateSignature and ValidateChain parameters to tell the verifier which stages to include in the validation.

TimestampValidated Event (MessageVerifier Class)

Reports the completion of the timestamp validation routine.

Syntax

public class DefaultMessageVerifierEventListener implements MessageVerifierEventListener {
  ...
  public void timestampValidated(MessageVerifierTimestampValidatedEvent e) {}
  ...
}

public class MessageVerifierTimestampValidatedEvent {
  public String issuerRDN;
  public byte[] serialNumber;
  public byte[] subjectKeyID;
  public String time;
  public int validationResult;
  public int chainValidationResult;
  public int chainValidationDetails;
}

Remarks

This event is fired upon the completion of the timestamp validation routine, and reports the respective validation result.

ValidationResult is set to 0 if the validation has been successful, or to a non-zero value in case of a failure.

Certificate Type

Encapsulates an individual X.509 certificate.

Remarks

This type keeps and provides access to X.509 certificate details.

Fields

Constructors

public Certificate( bytes,  startIndex,  count,  password);

public Certificate( certBytes,  certStartIndex,  certCount,  keyBytes,  keyStartIndex,  keyCount,  password);

public Certificate( bytes,  startIndex,  count);

public Certificate( path,  password);

public Certificate( certPath,  keyPath,  password);

public Certificate( path);

public Certificate( stream);

public Certificate( stream,  password);

public Certificate( certStream,  keyStream,  password);

public Certificate();

SignatureAttribute Type

Represents an attribute of a digital PKCS#7/CMS signature.

Remarks

Attributes store auxiliary information about the signed message, the signature, or the owner. Each attribute is a OID=Value pair.

Common attributes are signing time, a content type, a policy identifier, and a signature timestamp.

Fields

Constructors

public SignatureAttribute();

TimestampInfo Type

A container for timestamp information.

Remarks

The TimestampInfo object contains details of a third-party timestamp and the outcome of its validation.

Fields

Constructors

public TimestampInfo();

Config Settings (MessageVerifier Class)

The class accepts one or more of the following configuration settings. Configuration settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the Config method.

MessageVerifier Config Settings

Base Config Settings

Trappable Errors (MessageVerifier Class)

MessageVerifier Errors