Package com.bfo.box

Class C2PASignature

java.lang.Object

com.bfo.box.Box

com.bfo.box.JUMBox

com.bfo.box.CborContainerBox

com.bfo.box.C2PASignature

public class C2PASignature
extends CborContainerBox

The C2PA signature is applied to each manifest to sign it. There is one signature per manifest.

Since:

5

See Also:

• COSE

Method Summary

Modifier and Type	Method	Description
COSE	cose()	Return the COSE object which actually contains the signature.
long	getTimestamp()	Return the timestamp the signature was applied at, or 0 if not known.
boolean	hasSigner()	Return true if an identity has been set for signing with setSigner(java.security.PrivateKey, java.util.List<java.security.cert.X509Certificate>)
void	setSigner(PrivateKey key, List<X509Certificate> certs)	Set the identity that will be used in a subsequent call to sign().
void	setTimestamp(long timestamp)	If the signature does not contain a timestamp, set the time that the signature was applied.
List<C2PAStatus>	sign()	Sign the claim.
String	toString()	Return a String representation of this Box, which will be parseable as JSON
List<C2PAStatus>	verify(KeyStore keystore)	Verify the cryptographic aspects of the claim.

Methods inherited from class com.bfo.box.CborContainerBox

cbor, getBox

Methods inherited from class com.bfo.box.JUMBox

find, find, label, subtype

Methods inherited from class com.bfo.box.Box

add, dump, duplicate, first, fullType, getEncoded, insertBefore, isSparse, length, next, parent, remove, type

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, wait, wait, wait

Method Details

toString

public String toString()

Description copied from class: Box

Return a String representation of this Box, which will be parseable as JSON

Overrides:

toString in class Box

cose

public COSE cose()

Return the COSE object which actually contains the signature. While useful for retrieving cryptographic details from the signature, don't call sign/verify on the returned object; call them on this class instead.

Returns:

the COSE object

setSigner

public void setSigner(PrivateKey key,
 List<X509Certificate> certs)

Set the identity that will be used in a subsequent call to sign(). These values are not preserved in any way; they're only used by sign().

Parameters:

key - the PrivateKey

certs - a list of X.509 certificates to include in the COSE object.

hasSigner

public boolean hasSigner()

Return true if an identity has been set for signing with setSigner(java.security.PrivateKey, java.util.List<java.security.cert.X509Certificate>)

Returns:

whether the identity is set

sign

public List<C2PAStatus> sign()
                      throws IOException

Sign the claim. Before signing

• the setSigner() method must have been called with a key and non-empty certificates
• If the claim's assertions are empty, it will be initialized to all the manifest's assertions
• The assertions must be non-empty and include a "hash" type assertion
• The claim format must be set
• The claim instance id must be set
• If the hash algorithm is not set, it will be initialized to a default value
• If the generator is not set, it will be initialized to a default value
• The claim object is finalized and signed

Returns:

a list of status codes - if any of them are invalid, signing failed

Throws:

RuntimeException - wrapping a GeneralSecurityException if signing fails

IOException - if signing fails due to an IOException

setTimestamp

public void setTimestamp(long timestamp)

If the signature does not contain a timestamp, set the time that the signature was applied. Without this information and a timestamp, the signature will be verified against the current time

Parameters:

timestamp - the timestamp of the signature, or 0 to use the default (the current time)

getTimestamp

public long getTimestamp()

Return the timestamp the signature was applied at, or 0 if not known.

Returns:

the timestamp

verify

public List<C2PAStatus> verify(KeyStore keystore)
                        throws IOException

Verify the cryptographic aspects of the claim. Note for full verification, each asseration in the claim's list must also be verified, see C2PA_Assertion.verify()

Parameters:

keystore - if not null, the final certificate in the chain will be verified against the trusted roots in this KeyStore

Returns:

a list of validation status codes

Throws:

IllegalArgumentException - if no key is available to verify

IllegalStateException - if the signature is not signed or has been incorrectly set up

IOException - if such an exception was thrown while computing the object digest