Class CmsUtil

Namespace

MiPdf.Signatures

Assembly

MiPdf.dll

Low-level helpers for CMS signature containers produced elsewhere (signing services, smart cards, remote signing APIs): adding a signature time-stamp without re-encoding the signed parts, and assembling a CMS from a raw signature value (deferred hash signing, e.g. when the signature value arrives in a later HTTP round trip).

public static class CmsUtil

Inheritance

object

CmsUtil

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Methods

AddSignatureTimestamp(byte[], ITimestampClient, HashAlgorithmName?)

Adds an RFC 3161 signature time-stamp (unsigned attribute) to the first SignerInfo of cms (PAdES B-T). The signed parts are copied byte by byte.

public static byte[] AddSignatureTimestamp(byte[] cms, ITimestampClient tsa, HashAlgorithmName? hashAlgorithm = null)

Parameters

cms byte[]

tsa ITimestampClient

hashAlgorithm HashAlgorithmName?

Returns

byte[]

AddUnsignedAttribute(byte[], string, byte[])

Adds an unsigned attribute (DER encoded value) to the first SignerInfo.

public static byte[] AddUnsignedAttribute(byte[] cms, string oid, byte[] valueDer)

Parameters

cms byte[]

oid string

valueDer byte[]

Returns

byte[]

AssembleSignedData(byte[], byte[], X509Certificate2, IEnumerable<X509Certificate2>?, HashAlgorithmName?, RSASignaturePadding?)

Assembles a detached CMS SignedData from signed attributes (as returned by CreateSignedAttributes(byte[], X509Certificate2, PdfSignatureFormat, DateTimeOffset?, IEnumerable<AsnEncodedData>?)) and the signature value over them.

public static byte[] AssembleSignedData(byte[] signedAttributes, byte[] signatureValue, X509Certificate2 signerCertificate, IEnumerable<X509Certificate2>? chain = null, HashAlgorithmName? digestAlgorithm = null, RSASignaturePadding? rsaPadding = null)

Parameters

signedAttributes byte[]

DER SET OF Attribute that was hashed and signed.

signatureValue byte[]

RSA: PKCS#1 v1.5 or PSS signature. ECDSA: IEEE P1363 (r || s) or DER-encoded.

signerCertificate X509Certificate2

Signer certificate.

chain IEnumerable<X509Certificate2>

Further certificates to embed (intermediates).

digestAlgorithm HashAlgorithmName?

Digest algorithm used for the document digest and the attributes.

rsaPadding RSASignaturePadding

RSA only: Pkcs1 (default) or Pss when the signature value is RSASSA-PSS (MGF1 with digestAlgorithm, salt as long as the digest).

Returns

byte[]

CreateSignedAttributes(byte[], X509Certificate2, PdfSignatureFormat, DateTimeOffset?, IEnumerable<AsnEncodedData>?)

Builds the DER-encoded signed attributes (SET OF Attribute) for a PAdES/CAdES signature over a document digest. Hash these bytes and have the hash signed (e.g. by a remote service); then call AssembleSignedData(byte[], byte[], X509Certificate2, IEnumerable<X509Certificate2>?, HashAlgorithmName?, RSASignaturePadding?) with the same attributes and the signature value. Store the returned bytes between the two steps.

public static byte[] CreateSignedAttributes(byte[] documentDigest, X509Certificate2 signerCertificate, PdfSignatureFormat format = PdfSignatureFormat.PAdES, DateTimeOffset? signingTime = null, IEnumerable<AsnEncodedData>? additionalAttributes = null)

Parameters

documentDigest byte[]

Digest of the signed byte ranges (GetDocumentDigest()).

signerCertificate X509Certificate2

Signer certificate (for the signing-certificate-v2 attribute).

format PdfSignatureFormat

PAdES (signing-certificate-v2) or PKCS#7 (signing-certificate-v2 and signing-time).

signingTime DateTimeOffset?

Signing time for PKCS#7 signatures.

additionalAttributes IEnumerable<AsnEncodedData>

Further signed attributes (e.g. biometric data).

Returns

byte[]

GetSignatureValue(byte[])

Returns the signature value (the encrypted digest) of the first SignerInfo.

public static byte[] GetSignatureValue(byte[] cms)

Parameters

cms byte[]

Returns

byte[]

GetSignedAttribute(byte[], string)

Returns the value of a signed attribute of the first SignerInfo (DER of the first value), or null.

public static byte[]? GetSignedAttribute(byte[] cms, string oid)

Parameters

cms byte[]

oid string

Returns

byte[]

GetUnsignedAttribute(byte[], string)

Returns the value of an unsigned attribute of the first SignerInfo (DER of the first value), or null.

public static byte[]? GetUnsignedAttribute(byte[] cms, string oid)

Parameters

cms byte[]

oid string

Returns

byte[]

P1363ToDer(byte[])

Converts an IEEE P1363 ECDSA signature (r || s) to the DER SEQUENCE { r, s } used in CMS.

public static byte[] P1363ToDer(byte[] signature)

Parameters

signature byte[]

Returns

byte[]