Download - Svetlin Nakov

import java.io.*;
import java.util.List;
import java.util.HashSet;
/**
* Utility class for digital signatures and certificates verification.
*
* Verification of digital signature aims to confirm or deny that given signature is
* created by signing given document with the private key corresponding to given
* certificate. Verification of signatures is done with the standard digital
* signature verification algorithm, provided by Java Cryptography API:
* 1. The message digest is calculated from given document.
* 2. The original message digest is obtained by decrypting the signature with
* the public key of the signer (this public key is taken from the signer's
* certificate).
* 3. Values calculated in step 1. and step 2. are compared.
*
* Verification of a certificate aims to check if the certificate is valid wihtout
* inspecting its certification chain (sometimes it is unavailable). The certificate
* verification is done in two steps:
* 1. The certificate validity period is checked against current date.
* 2. The certificate is checked if it is directly signed by some of the trusted
* certificates that we have. A list of trusted certificates is supported for this
* direct certificate verification process. If we want to successfully validate the
* certificates issued by some certification authority (CA), we need to add the
* certificate of this CA in our trusted list. Note that some CA have several
* certificates and we should add only that of them, which the CA directly uses for
* issuing certificates to its clients.
*
* Verification of a certification chains aims to check if given certificate is
* valid by analysing its certification chain. A certification chain always starts
* with the user certificate that should be verified, then several intermediate CA
* certificates follow and at the end of the chain stays some root CA certificate.
* The verification process includes following steps (according to PKIX algorithm):
* 1. Check the certificate validity period against current date.
* 2. Check if each certificate in the chain is signed by the previous.
* 3. Check if all the certificates in the chain, except the first, belong to
* some CA, i.e. if they are authorized to be used for signing other certificates.
* 4. Check if the root CA certificate in the end of the chain is trusted, i.e.
* if is it in the list of trusted root CA certificates.
* The verification process uses PKIX algorithm, defined in RFC-3280, but don't use
* CRL lists.
*
* This file is part of NakovDocumentSigner digital document
* signing framework for Java-based Web applications:
* http://www.nakov.com/documents-signing/
*
* Copyright (c) 2003 by Svetlin Nakov - http://www.nakov.com
* National Academy for Software Development - http://academy.devbg.org
* All rights reserved. This code is freeware. It can be used
* for any purpose as long as this copyright statement is not
* removed or modified.
*/
public class DigitalSignatureUtils {
private static final String X509_CERTIFICATE_TYPE = "X.509";
private static final String CERT_CHAIN_ENCODING = "PkiPath";
private static final String DIGITAL_SIGNATURE_ALGORITHM_NAME = "SHA1withRSA";
private static final String CERT_CHAIN_VALIDATION_ALGORITHM = "PKIX";
/**
* Loads X.509 certificate from DER-encoded binary stream.
*/
public static X509Certificate loadX509CertificateFromStream(
127