Question

我使用SD-DSS开源解决方案对文档进行数字签名。我检查了dss-documentation页，但不确定如何获取示例请求中的signatureValue。据我解释，我必须将摘要的输出getDataToSign和摘要signatureValue一起使用，但是示例REST项目中的这些值之间是不匹配的。

getDataToSign的输出是：

{{

{ "bytes" : "MYIBETAYBgkqhkiG9w0BCQMxCwYJKoZIhvcNAQcBMBwGCSqGSIb3DQEJBTEPFw0xODAzMjYwODEyMDlaMC0GCSqGSIb3DQEJNDEgMB4wDQYJYIZIAWUDBAIBBQChDQYJKoZIhvcNAQELBQAwLwYJKoZIhvcNAQkEMSIEIBhfjbMicf4l9WGm/JOLLiZDBuwwTtpRgAfRdkgmOBlpMHcGCyqGSIb3DQEJEAIvMWgwZjBkMGIEIALz68oBYydCU7yAnSdJjdQbsDFtfmsGaWARXeFVWJ2cMD4wNKQyMDAxGzAZBgNVBAMMElJvb3RTZWxmU2lnbmVkRmFrZTERMA8GA1UECgwIRFNTLXRlc3QCBi7WFNe7Vw==" }
}}

signDocument请求中的值：

{{ "signatureValue" : { "algorithm" : "RSA_SHA256", "value" : "AQIDBA==" },}}

更新：

我使用以下请求：

<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<ns2:getDataToSign xmlns:ns2="http://signature.dss.esig.europa.eu/">
<dataToSignDTO>
<parameters>
<BLevelParams>
<trustAnchorBPPolicy>true</trustAnchorBPPolicy>
<signingDate>2019-01-01T01:01:01.464Z</signingDate>
</BLevelParams>
<digestAlgorithm>SHA256</digestAlgorithm>
<encryptionAlgorithm>RSA</encryptionAlgorithm>
<signatureLevel>PAdES_BASELINE_B</signatureLevel>
<signaturePackaging>ENVELOPED</signaturePackaging>
<signingCertificate>
<encodedCertificate>${#cert}</encodedCertificate>
</signingCertificate>
</parameters>
<toSignDocument>
<bytes><xop:Include xmlns:xop="http://www.w3.org/2004/08/xop/include" href="ref1"/></bytes>
</toSignDocument>
</dataToSignDTO>
</ns2:getDataToSign>
</soap:Body>
</soap:Envelope>


<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
<soap:Body>
<ns2:signDocument xmlns:ns2="http://signature.dss.esig.europa.eu/">
<signDocumentDTO>
<parameters>
<BLevelParams>
<trustAnchorBPPolicy>true</trustAnchorBPPolicy>
<signingDate>2019-01-01T01:01:01.464Z</signingDate>
</BLevelParams>
<digestAlgorithm>SHA256</digestAlgorithm>
<signatureLevel>PAdES_BASELINE_B</signatureLevel>
<signaturePackaging>ENVELOPED</signaturePackaging>
<signingCertificate>
<encodedCertificate>${#cert}</encodedCertificate>
</signingCertificate>
</parameters>
<signatureValue>
<algorithm>RSA_SHA256</algorithm>
<value>${#datatosign}</value>
</signatureValue>
<toSignDocument>
<bytes><xop:Include xmlns:xop="http://www.w3.org/2004/08/xop/include" href="ref1"/></bytes>
<name>dsstest</name>
</toSignDocument>
</signDocumentDTO>
</ns2:signDocument>
</soap:Body>
</soap:Envelope>

生成signatureValue的代码：

try (Pkcs12SignatureToken token = new Pkcs12SignatureToken("src/main/resources/user_a_rsa.p12", new PasswordProtection("password".toCharArray()))) {

        List<DSSPrivateKeyEntry> keys = token.getKeys();
        for (DSSPrivateKeyEntry entry : keys) {
                System.out.println(entry.getCertificate().getCertificate());
        }

        ToBeSigned toBeSigned = new ToBeSigned("Hello world".getBytes());
        SignatureValue signatureValue = token.sign(toBeSigned, DigestAlgorithm.SHA256, keys.get(0));

        System.out.println("Signature value : " + Utils.toBase64(signatureValue.getValue()));
}

Answer 1

DSS正在getDataToSign中为您提供要使用与您发送的证书相对应的私钥进行签名的摘要。

您必须使用指定的算法对该值进行数字签名，然后将结果发送到signDocument。对于您的情况，带有SHA256的RSA PKCS＃1

伪代码

var digestToSign = getDataToSign(document, params)
var signatureValue = PKCS#1_v1.5(privateKey, digestToSign, SHA256)
var finalDocument = signDocument(signatureValue)

此后，DSS将构建最终的签名文档。

从DSS中的getDataToSign方法获取signatureValue

1 个答案: