Skip to content

Latest commit

 

History

History
64 lines (55 loc) · 2.68 KB

README.md

File metadata and controls

64 lines (55 loc) · 2.68 KB
Raw

Crypto Lib for testing

Library for crypto operations testing mostly for GOST standarts. It is based on BouncyCastle library Library supports reading private key from CryptoPro pfx with PBE 1.2.840.113549.1.12.1.80, but now only for GOST R 34.10-2012 256 bit key.

Important

It is only for testing, not production ready.

Usage/Examples

Build self signed certificate and crl

  • Signature is:
    • 1.2.643.7.1.1.3.2
    • id-tc26-signwithdigest-gost3410-12-256
    • алгоритм подписи ГОСТ Р 34.10-2012 с ключом 256 с хэшированием ГОСТ Р 34.11-2012
  • GOST EC Key curve is:
    • 1.2.643.7.1.2.1.1.1
    • id-tc26-gost-3410-12-256-paramSetA
    • рабочие параметры А алгоритма подписи ГОСТ Р 34.10-2012 с ключом 256
CertificatePrivateKeyPair ca = CertificateService.generateDefaultGOSTSelfSignedCertificate("CN=TEST", 365);
X509Certificate certificate  = ca.getCertificate();
PrivateKey privateKey = ca.getPrivateKey();
X509CRL crl = CertificateService.generateCertificateRevocationList(ca.getCertificate(),ca.getPrivateKey(),null,14);

Build user certificate

  • Signature is:
    • 1.2.643.7.1.1.3.2
    • id-tc26-signwithdigest-gost3410-12-256
    • алгоритм подписи ГОСТ Р 34.10-2012 с ключом 256 с хэшированием ГОСТ Р 34.11-2012
  • GOST EC Key curve is:
    • 1.2.643.7.1.2.1.1.1
    • id-tc26-gost-3410-12-256-paramSetA
    • рабочие параметры А алгоритма подписи ГОСТ Р 34.10-2012 с ключом 256
CertificatePrivateKeyPair user = CertificateService.generateGOSTCertificate(
                "1.2.643.3.131.1.1=075305894589,CN=ФизЛицо, surname=Ivanov",
                ca.getCertificate(),
                ca.getPrivateKey(),
                null, //CryptoTools.DEFAULT_GOST_SIGNATURE
                "http://localhost:8080/cert.cer",
                "http://localhost:8080/cert/ocsp",
                "http://localhost:8080/cert.crl",
                15,
                List.of(KeyPurposeId.id_kp_clientAuth),
                365
        );

Open CryptoPro pfx container, sign document and save to file

byte[] pfx = Files.readAllBytes(Path.of("file.pfx"));
Map<String,CertificatePrivateKeyPair> pairs = ContainerService.readPfxContainer(pfx, "SomePassword");
CertificatePrivateKeyPair pair = pairs.values().iterator().next();

byte[] document = Files.readAllBytes(Path.of("doc.pdf"));
byte[] sig = SignService.signData(pair.getCertificate(),pair.getPrivateKey(),null,document,true);
Files.write(Path.of("document.sig"),sig, StandardOpenOption.CREATE)