You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pdfbox.apache.org by ti...@apache.org on 2020/07/16 03:54:39 UTC
svn commit: r1879916 -
/pdfbox/branches/issue45/examples/src/test/java/org/apache/pdfbox/examples/pdmodel/TestCreateSignature.java
Author: tilman
Date: Thu Jul 16 03:54:38 2020
New Revision: 1879916
URL: http://svn.apache.org/viewvc?rev=1879916&view=rev
Log:
PDFBOX-3017: verify signature hash in timestamp (inspired by stackoverflow question 62872844 comment by mkl)
Modified:
pdfbox/branches/issue45/examples/src/test/java/org/apache/pdfbox/examples/pdmodel/TestCreateSignature.java
Modified: pdfbox/branches/issue45/examples/src/test/java/org/apache/pdfbox/examples/pdmodel/TestCreateSignature.java
URL: http://svn.apache.org/viewvc/pdfbox/branches/issue45/examples/src/test/java/org/apache/pdfbox/examples/pdmodel/TestCreateSignature.java?rev=1879916&r1=1879915&r2=1879916&view=diff
==============================================================================
--- pdfbox/branches/issue45/examples/src/test/java/org/apache/pdfbox/examples/pdmodel/TestCreateSignature.java (original)
+++ pdfbox/branches/issue45/examples/src/test/java/org/apache/pdfbox/examples/pdmodel/TestCreateSignature.java Thu Jul 16 03:54:38 2020
@@ -400,6 +400,12 @@ public class TestCreateSignature
{
Assert.assertNotNull(timeStampToken);
validateTimestampToken(timeStampToken);
+
+ // compare the hash of the signed content with the hash in the timestamp
+ byte[] tsMessageImprintDigest = timeStampToken.getTimeStampInfo().getMessageImprintDigest();
+ String hashAlgorithm = timeStampToken.getTimeStampInfo().getMessageImprintAlgOID().getId();
+ byte[] sigMessageImprintDigest = MessageDigest.getInstance(hashAlgorithm).digest(signerInformation.getSignature());
+ Assert.assertArrayEquals("timestamp signature verification failed", sigMessageImprintDigest, tsMessageImprintDigest);
}
else
{