pkcs7

sign

Creates a PKCS7 signed Data object.

Input parameters for sign

  • signerInfo: Document List Information about a single signer of the signed data object. Each signerInfo requires either a certificate chain and a private key or a key alias that references them.
    • keyStoreAlias: String Name of the keystore alias. - keyAlias: String Alias of the private key.
    • hashAlgorithm: String The algorithm to use when computing the digest of the provided data. Specify: - MD5 (the default) - SHA-1 - SHA-256 - SHA-384 - SHA-512.
  • data: byte[] Optional. Data in the form of a byte array to be digitally signed.
  • dataAsStream: java.io.InputStream Optional. Data in the form of an input stream to be digitally signed.
  • detachedSignature: String Flag specifying whether to generate a detached signature. A detached signature does not include the data that was signed. Set to: - true to generate a detached signature. - false to generate an implicit signature (one that includes the signed data). This is the default.
Note: If both data and dataAsStream are provided, dataAsStream takes precedence.

Output parameters for sign

  • signature: byte[] Conditional. Signature generated in the form of a byte array from the supplied data. This is a DER-encoded representation of the SignedData object as specified in PKCS#7. signature is returned when the input parameter data is provided.
  • signatureAsStream: java.io.OutputStream Conditional. Signature generated in the form of an output stream from the supplied data. signatureAsStream is returned when the input parameter dataAsStream is provided.

verify

Verifies signed data.

Input parameters for verify

  • data: Document. Signed data that you want to verify. The data must be in one of the following formats. If multiple input parameters are supplied for data, the service throws an exception stating that only one parameter must be passed.
    • string: String. Optional. The signed string that you want to verify.
    • stream: java.io.InputStream. Optional. The signed stream data that you want to verify.
    • bytes: byte[]. Optional. The signed byte array that you want to verify.
  • loadAs: String. Optional. The format in which the service returns the output. Set to: - bytes to return the output as a byte array. This is the default. - stream to return the output as a stream object. - string to return the output as a string.
  • publicKey: Document. The signer's public key required to verify the signed data. Provide publicKeyBytes, publicKeyString. 
    - publicKeyBytes: Object List. Optional. One or more public key files as byte arrays.
        - publicKeyString: String List. Optional. One or more public keys as strings.
    Note: Public key files have a .asc extension.

Output parameters for verify

  • stream: java.io.OutputStream. Conditional. Verified data as an output stream. Returned when the loadAs input parameter is set to stream.
  • bytes: byte[]. Conditional. Verified data in bytes. Returned when the loadAs input parameter is set to bytes.
  • string: String. Conditional. Verified data as a string. Returned when the loadAs input parameter is set to string.
  • verified: Boolean. Indicates whether the signature associated with the data is valid or not. A value of: - true indicates that the signed data is verified. - false indicates that the signed data is not verified.
  • status: String. Indicates whether the data is successfully verified or not. If successful, status is success. Otherwise, status contains failure along with an error message.

Usage notes for verify

  • To verify signed data, server must have access to the signer's public key.
  • To verify the data for multiple users, provide the users' public keys to the service as a list of byte arrays, strings, or a keyring file.
  • If you provide a keyring file, you must also provide the public key aliases. The verify service cannot verify a detached signature.
  • Authentication keys used in this service must be in the PGP format and generated using the RSA encryption algorithm.
  • Authentication keys in the .ecc format are not supported.