import org.bouncycastle.tsp.TSPException; //导入依赖的package包/类
/**
 * We are extending CMS Signature
 *
 * @param signer
 *            information about signer
 * @return information about SignerInformation
 */
private SignerInformation signTimeStamp(SignerInformation signer) throws IOException, TSPException {
	AttributeTable unsignedAttributes = signer.getUnsignedAttributes();

	ASN1EncodableVector vector = new ASN1EncodableVector();
	if (unsignedAttributes != null) {
		vector = unsignedAttributes.toASN1EncodableVector();
	}

	byte[] token = tsaClient.getTimeStampToken(signer.getSignature());
	ASN1ObjectIdentifier oid = PKCSObjectIdentifiers.id_aa_signatureTimeStampToken;
	ASN1Encodable signatureTimeStamp = new Attribute(oid, new DERSet(ASN1Primitive.fromByteArray(token)));

	vector.add(signatureTimeStamp);
	Attributes signedAttributes = new Attributes(vector);

	SignerInformation newSigner = SignerInformation.replaceUnsignedAttributes(signer,
			new AttributeTable(signedAttributes));

	return newSigner;
}
 

import org.bouncycastle.tsp.TSPException; //导入依赖的package包/类
/**
 *  validade a timestampo on signature
 * @param attributeTimeStamp
 * @param varSignature
 * @return
 */
private Timestamp validateTimestamp(Attribute attributeTimeStamp, byte[] varSignature){
	try {
		TimeStampOperator timeStampOperator = new TimeStampOperator();
		byte [] varTimeStamp = attributeTimeStamp.getAttrValues().getObjectAt(0).toASN1Primitive().getEncoded();
		TimeStampToken timeStampToken = new TimeStampToken(new CMSSignedData(varTimeStamp));
		Timestamp timeStampSigner = new Timestamp(timeStampToken);
		timeStampOperator.validate(varSignature,varTimeStamp , null);
		return timeStampSigner;
	} catch (CertificateCoreException | IOException | TSPException | CMSException e) {
		throw new SignerException(e);
	}		
}
 

import org.bouncycastle.tsp.TSPException; //导入依赖的package包/类
/**
 * We just extend CMS signed Data
 *
 * @param signedData
 *            -Generated CMS signed data
 * @return CMSSignedData - Extended CMS signed data
 */
private CMSSignedData signTimeStamps(CMSSignedData signedData) throws IOException, TSPException {
	SignerInformationStore signerStore = signedData.getSignerInfos();
	List<SignerInformation> newSigners = new ArrayList<SignerInformation>();

	for (SignerInformation signer : (Collection<SignerInformation>) signerStore.getSigners()) {
		newSigners.add(signTimeStamp(signer));
	}

	// TODO do we have to return a new store?
	return CMSSignedData.replaceSigners(signedData, new SignerInformationStore(newSigners));
}
 

import org.bouncycastle.tsp.TSPException; //导入依赖的package包/类
public CMSTimestampValidator(DSSDocument timestamp, TimestampType type) {
	super(timestamp);
	try {
		this.bcToken = new TimeStampToken(cmsSignedData);
		this.type = type;
	} catch (IOException | TSPException e) {
		throw new DSSException("Unable to parse timestamp", e);
	}
}
 

import org.bouncycastle.tsp.TSPException; //导入依赖的package包/类
/**
 * Efetua a validacao de um carimbo de tempo
 *
 * @param response O carimbo de tempo a ser validado
 * @throws TimestampException
 */
public void validate(byte[] response) throws TimestampException {
    try {
        Security.addProvider(new BouncyCastleProvider());
        TimeStampResponse tsr = new TimeStampResponse(response);
        TimeStampToken timeStampToken = tsr.getTimeStampToken();
        CMSSignedData s = timeStampToken.toCMSSignedData();

        int verified = 0;

        Store certStore = s.getCertificates();
        SignerInformationStore signers = s.getSignerInfos();
        Collection c = signers.getSigners();
        Iterator it = c.iterator();

        while (it.hasNext()) {
            SignerInformation signer = (SignerInformation) it.next();
            Collection certCollection = certStore.getMatches(signer.getSID());
            Iterator certIt = certCollection.iterator();
            X509CertificateHolder cert = (X509CertificateHolder) certIt.next();
            if (signer.verify(new JcaSimpleSignerInfoVerifierBuilder().setProvider("BC").build(cert))) {
                verified++;
            }

            cert.getExtension(new ASN1ObjectIdentifier("2.5.29.31")).getExtnValue();
        }

        logger.info("Assinaturas Verificadas....: {}", verified);
        this.timestamp = new Timestamp(timeStampToken);
    } catch (TSPException | IOException | CMSException | OperatorCreationException | CertificateException ex) {
        throw new TimestampException(ex.getMessage());
    }
}
 

import org.bouncycastle.tsp.TSPException; //导入依赖的package包/类
TimeStampTokenInfo(TSTInfo tstInfo) throws TSPException,
        IOException {
    this.tstInfo = tstInfo;

    try {
        this.genTime = tstInfo.getGenTime().getDate();
    } catch (ParseException e) {
        throw new TSPException("unable to parse genTime field");
    }
}
 

import org.bouncycastle.tsp.TSPException; //导入依赖的package包/类
/**
    * Validate a time stamp
    *
    * @param content if it is assigned, the parameter hash must to be null
    * @param timeStamp timestamp to be validated
    * @param hash if it is assigned, the parameter content must to be null
    * @throws CertificateCoreException validate exception
    */
   @SuppressWarnings("unchecked")
public void validate(byte[] content, byte[] timeStamp, byte[] hash) throws CertificateCoreException {
       try {
           TimeStampToken timeStampToken = new TimeStampToken(new CMSSignedData(timeStamp));
           CMSSignedData s = timeStampToken.toCMSSignedData();

           int verified = 0;

           Store<?> certStore = s.getCertificates();
           SignerInformationStore signers = s.getSignerInfos();
           Collection<SignerInformation> c = signers.getSigners();
           Iterator<SignerInformation> it = c.iterator();

           while (it.hasNext()) {
               SignerInformation signer = it.next();
               Collection<?> certCollection = certStore.getMatches(signer.getSID());
               Iterator<?> certIt = certCollection.iterator();
               X509CertificateHolder cert = (X509CertificateHolder) certIt.next();
               if (signer.verify(new JcaSimpleSignerInfoVerifierBuilder().setProvider("BC").build(cert))) {
                   verified++;
               }
               cert.getExtension(new ASN1ObjectIdentifier("2.5.29.31")).getExtnValue();
           }

           logger.info(timeStampMessagesBundle.getString("info.signature.verified", verified));

           //Valida o hash  incluso no carimbo de tempo com hash do arquivo carimbado
           byte[] calculatedHash = null;
           if (content != null){
           	Digest digest = DigestFactory.getInstance().factoryDefault();
               digest.setAlgorithm(DigestAlgorithmEnum.SHA_256);
               calculatedHash = digest.digest(content);
           }else{
           	calculatedHash = hash;
           }
           

           if (Arrays.equals(calculatedHash, timeStampToken.getTimeStampInfo().getMessageImprintDigest())) {
               logger.info(timeStampMessagesBundle.getString("info.timestamp.hash.ok"));
           } else {
               throw new CertificateCoreException(timeStampMessagesBundle.getString("info.timestamp.hash.nok"));
           }

       } catch (TSPException | IOException | CMSException | OperatorCreationException | CertificateException ex) {
           throw new CertificateCoreException(ex.getMessage());
       }
   }
 

import org.bouncycastle.tsp.TSPException; //导入依赖的package包/类
public TimestampToken(final byte[] binaries, final TimestampType type, final CertificatePool certPool) throws TSPException, IOException, CMSException {
	this(new CMSSignedData(binaries), type, certPool);
}
 

import org.bouncycastle.tsp.TSPException; //导入依赖的package包/类
TimeStampToken(ContentInfo contentInfo) throws TSPException,
        IOException {
    this(new CMSSignedData(contentInfo));
}
 

import org.bouncycastle.tsp.TSPException; //导入依赖的package包/类
/**
 * <a href="http://stackoverflow.com/questions/34544380/pdf-signing-with-timestamp-certificate-details-does-not-appear-in-timestamp-pro">
 * PDF signing with timestamp: certificate details does not appear in timestamp properties
 * </a>
 * <br/>
 * <a href="https://drive.google.com/file/d/0B61KdyZ43x-9cEk5YVV6WVd4WUU/view?usp=sharing">
 * PDFSigned.pdf
 * </a>,
 * the signature being extracted as "PDFSigned.pdf.Signature1.raw".
 * 
 * <p>
 * The OP used the same certificate for signing the signature and the time stamp, it
 * in particular does not have the required extended key usage marking it as a time
 * stamping certificate.
 * </p>
 */
@Test
public void testAGDevSignatureWithTimeStamp() throws IOException, CMSException, TSPException, OperatorCreationException
{
    try (InputStream resource = getClass().getResourceAsStream("PDFSigned.pdf.Signature1.raw"))
    {
        byte[] signatureBytes = IOUtils.toByteArray(resource);
        
        SignatureAnalyzer analyzer = new SignatureAnalyzer(signatureBytes);
    }
}
 

import org.bouncycastle.tsp.TSPException; //导入依赖的package包/类
/**
 * <a href="http://stackoverflow.com/questions/35613203/pdf-signature-ltv-crl-alternative">
 * PDF Signature - LTV - CRL alternative?
 * </a>
 * <br/>
 * <a href="http://we.tl/dBFE114SAd">
 * test_signed.pdf
 * </a>,
 * the signature being extracted as "test_signed.pdf.Signature1.raw".
 * 
 * <p>
 * The signature does not conform to any LTV profile, merely to T-Level, i.e. it is timestamped.
 * </p>
 */
@Test
public void testTonnySignature() throws IOException, CMSException, TSPException, OperatorCreationException
{
    try (InputStream resource = getClass().getResourceAsStream("test_signed.pdf.Signature1.raw"))
    {
        byte[] signatureBytes = IOUtils.toByteArray(resource);
        
        SignatureAnalyzer analyzer = new SignatureAnalyzer(signatureBytes);
    }
}
 

import org.bouncycastle.tsp.TSPException; //导入依赖的package包/类
/**
 * <a href="http://stackoverflow.com/questions/40979157/how-to-detect-a-signed-pdf-is-valid-with-itext">
 * How to detect a signed pdf is valid with iText?
 * </a>
 * <br/>
 * <a href="https://drive.google.com/file/d/0B8fLGZLVFcLyeXF0TjluNzRjT3c/view?usp=sharing">
 * corrupted-sign-file.pdf
 * </a>,
 * the signature being extracted as "corrupted-sign-file.pdf.Signature2.raw".
 * 
 * <p>
 * It does not become clear here why Adobe Reader rejects the signature.
 * </p>
 */
@Test
public void testKe20Signature() throws IOException, CMSException, TSPException, OperatorCreationException
{
    try (InputStream resource = getClass().getResourceAsStream("corrupted-sign-file.pdf.Signature2.raw"))
    {
        byte[] signatureBytes = IOUtils.toByteArray(resource);
        
        SignatureAnalyzer analyzer = new SignatureAnalyzer(signatureBytes);
    }
}