Package se.digg.dgc.signatures.impl

Class DefaultDGCSigner

java.lang.Object

se.digg.dgc.signatures.impl.DefaultDGCSigner

All Implemented Interfaces:

DGCSigner

public class DefaultDGCSigner
extends Object
implements DGCSigner

A bean implementing the DGCSigner interface.

Author:

Martin Lindström (martin@idsec.se), Henrik Bengtsson (extern.henrik.bengtsson@digg.se), Henric Norlander (extern.henric.norlander@digg.se)

Constructor Summary

Constructors

Constructor	Description
DefaultDGCSigner(PrivateKey signerKey, X509Certificate signerCertificate)	Constructor.
DefaultDGCSigner(PkiCredential signerCredential)	Constructor.

Method Summary

Modifier and Type	Method	Description
String	getSignerCountry()	Gets the ISO-3166 country code of the signer (issuer).
Instant	getSignerExpiration()	Gets the point in time when this signer's certificate expires.
void	setAlgorithmIdentifier(SignatureAlgorithm algorithmIdentifier)	Assigns the algorithm to use.
void	setIncludeCoseTag(boolean includeCoseTag)	Whether to include the Cose_Sign1 message tag in the resulting encoding.
void	setIncludeCwtTag(boolean includeCwtTag)	Sets whether to include the CWT message tag.
void	setSecurityProvider(Provider securityProvider)	Assigns a specific Java Security Provider that should be used when signing.
byte[]	sign(byte[] dccPayload, Instant expiration)	Creates a CWT including the CBOR encoded DCC payload and signs it.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

DefaultDGCSigner

public DefaultDGCSigner(PrivateKey signerKey,
                        X509Certificate signerCertificate)
                 throws CertificateException

Constructor.

Parameters:

signerKey - the signer key

signerCertificate - the certificate holding the public key corresponding to the signer key

Throws:

CertificateException - for certificate decoding errors

DefaultDGCSigner

public DefaultDGCSigner(PkiCredential signerCredential)
                 throws CertificateException

Constructor.

Parameters:

signerCredential - the signer credential

Throws:

CertificateException - for certificate decoding errors

Method Detail

sign

public byte[] sign(byte[] dccPayload,
                   Instant expiration)
            throws SignatureException

Creates a CWT including the CBOR encoded DCC payload and signs it.

Note: It is the caller's responsibility to ensure that the validity of the issued DCC does not exceed the validity of the signer's certificate (see DGCSigner.getSignerExpiration()).

Specified by:

sign in interface DGCSigner

Parameters:

dccPayload - the CBOR encoding of the DCC payload

expiration - the expiration time for the DCC

Returns:

the CBOR encoding of the signed CWT holding the DCC payload

Throws:

SignatureException - for signature errors

getSignerExpiration

public Instant getSignerExpiration()

Gets the point in time when this signer's certificate expires. For maximum interoperability, the validity of a DCC should not stretch beyond this time.

Specified by:

getSignerExpiration in interface DGCSigner

Returns:

the signer certificate expiration time

getSignerCountry

public String getSignerCountry()

Gets the ISO-3166 country code of the signer (issuer).

Specified by:

getSignerCountry in interface DGCSigner

Returns:

the country code of the signer

setAlgorithmIdentifier

public void setAlgorithmIdentifier(SignatureAlgorithm algorithmIdentifier)

Assigns the algorithm to use.

SignatureAlgorithm.ES256 is the default for EC keys and SignatureAlgorithm.PS256 is the default for RSA keys.

Parameters:

algorithmIdentifier - the algorithm to use

setSecurityProvider

public void setSecurityProvider(Provider securityProvider)

Assigns a specific Java Security Provider that should be used when signing. If not assigned, a default provider will be used.

Parameters:

securityProvider - the security provider

setIncludeCoseTag

public void setIncludeCoseTag(boolean includeCoseTag)

Whether to include the Cose_Sign1 message tag in the resulting encoding. The default is true.

See RFC8152.

Parameters:

includeCoseTag - whether to include the Cose_Sign1 message tag

setIncludeCwtTag

public void setIncludeCwtTag(boolean includeCwtTag)

Sets whether to include the CWT message tag. The default is false.

See section 6, or RFC8392.

Parameters:

includeCwtTag - whether to include the CWT message tag