74.4. 서명된 데이터
crypto-cms:sign 엔드포인트는 일반적으로 하나의 경로에 정의되고 다른 경로에는 무료 crypto-cms:verify 가 정의되어 있지만 예제의 단순성을 위해 서로의 단순성을 제공합니다.
다음 예에서는 Signed Data 메시지를 생성하는 방법과 Signed Data 메시지를 확인하는 방법을 보여줍니다.
Java DSL의 기본 예
import org.apache.camel.util.jsse.KeyStoreParameters;
import org.apache.camel.component.crypto.cms.sig.DefaultSignerInfo;
...
KeyStoreParameters keystore = new KeyStoreParameters();
keystore.setType("JCEKS");
keystore.setResource("keystore/keystore.jceks);
keystore.setPassword("some_password"); // this password will also be used for accessing the private key if not specified in the signerInfo1 bean
//Signer Information, by default the following signed attributes are included: contentType, signingTime, messageDigest, and cmsAlgorithmProtect; by default no unsigned attribute is included.
// If you want to add your own signed attributes or unsigned attributes, see methods DefaultSignerInfo.setSignedAttributeGenerator and DefaultSignerInfo.setUnsignedAttributeGenerator.
DefaultSignerInfo signerInfo1 = new DefaultSignerInfo();
signerInfo1.setIncludeCertificates(true); // if set to true then the certificate chain of the private key will be added to the Signed Data object
signerInfo1.setSignatureAlgorithm("SHA256withRSA"); // signature algorithm; attention, the signature algorithm must fit to the signer private key.
signerInfo1.setPrivateKeyAlias("rsa"); // alias of the private key used for the signing
signerInfo1.setPassword("private_key_pw".toCharArray()); // optional parameter, if not set then the password of the KeyStoreParameters will be used for accessing the private key
signerInfo1.setKeyStoreParameters(keystore);
simpleReg.put("keyStoreParameters", keystore); //register keystore in the registry
simpleReg.put("signer1", signerInfo1); //register signer info in the registry
from("direct:start")
.to("crypto-cms:sign://testsign?signer=#signer1&includeContent=true&toBase64=true")
.to("crypto-cms:verify://testverify?keyStoreParameters=#keyStoreParameters&fromBase64=true"")
.to("mock:result");Spring XML의 기본 예
<keyStoreParameters xmlns="http://camel.apache.org/schema/spring"
id="keyStoreParameters1" resource="./keystore/keystore.jceks"
password="some_password" type="JCEKS" />
<bean id="signer1"
class="org.apache.camel.component.crypto.cms.sig.DefaultSignerInfo">
<property name="keyStoreParameters" ref="keyStoreParameters1" />
<property name="privateKeyAlias" value="rsa" />
<property name="signatureAlgorithm" value="SHA256withRSA" />
<property name="includeCertificates" value="true" />
<!-- optional parameter 'password', if not set then the password of the KeyStoreParameters will be used for accessing the private key -->
<property name="password" value="private_key_pw" />
</bean>
...
<route>
<from uri="direct:start" />
<to uri="crypto-cms:sign://testsign?signer=#signer1&includeContent=true&toBase64=true" />
<to uri="crypto-cms:verify://testverify?keyStoreParameters=#keyStoreParameters1&fromBase64=true" />
<to uri="mock:result" />
</route>Java DSL에서 두 개의 서명자가 있는 예
import org.apache.camel.util.jsse.KeyStoreParameters;
import org.apache.camel.component.crypto.cms.sig.DefaultSignerInfo;
...
KeyStoreParameters keystore = new KeyStoreParameters();
keystore.setType("JCEKS");
keystore.setResource("keystore/keystore.jceks);
keystore.setPassword("some_password"); // this password will also be used for accessing the private key if not specified in the signerInfo1 bean
//Signer Information, by default the following signed attributes are included: contentType, signingTime, messageDigest, and cmsAlgorithmProtect; by default no unsigned attribute is included.
// If you want to add your own signed attributes or unsigned attributes, see methods DefaultSignerInfo.setSignedAttributeGenerator and DefaultSignerInfo.setUnsignedAttributeGenerator.
DefaultSignerInfo signerInfo1 = new DefaultSignerInfo();
signerInfo1.setIncludeCertificates(true); // if set to true then the certificate chain of the private key will be added to the Signed Data object
signerInfo1.setSignatureAlgorithm("SHA256withRSA"); // signature algorithm; attention, the signature algorithm must fit to the signer private key.
signerInfo1.setPrivateKeyAlias("rsa"); // alias of the private key used for the signing
signerInfo1.setPassword("private_key_pw".toCharArray()); // optional parameter, if not set then the password of the KeyStoreParameters will be used for accessing the private key
signerInfo1.setKeyStoreParameters(keystore);
DefaultSignerInfo signerInfo2 = new DefaultSignerInfo();
signerInfo2.setIncludeCertificates(true);
signerInfo2.setSignatureAlgorithm("SHA256withDSA");
signerInfo2.setPrivateKeyAlias("dsa");
signerInfo2.setKeyStoreParameters(keystore);
simpleReg.put("keyStoreParameters", keystore); //register keystore in the registry
simpleReg.put("signer1", signerInfo1); //register signer info in the registry
simpleReg.put("signer2", signerInfo2); //register signer info in the registry
from("direct:start")
.to("crypto-cms:sign://testsign?signer=#signer1&signer=#signer2&includeContent=true")
.to("crypto-cms:verify://testverify?keyStoreParameters=#keyStoreParameters")
.to("mock:result");Spring XML에서 두 개의 서명자가 있는 예
<keyStoreParameters xmlns="http://camel.apache.org/schema/spring"
id="keyStoreParameters1" resource="./keystore/keystore.jceks"
password="some_password" type="JCEKS" />
<bean id="signer1"
class="org.apache.camel.component.crypto.cms.sig.DefaultSignerInfo">
<property name="keyStoreParameters" ref="keyStoreParameters1" />
<property name="privateKeyAlias" value="rsa" />
<property name="signatureAlgorithm" value="SHA256withRSA" />
<property name="includeCertificates" value="true" />
<!-- optional parameter 'password', if not set then the password of the KeyStoreParameters will be used for accessing the private key -->
<property name="password" value="private_key_pw" />
</bean>
<bean id="signer2"
class="org.apache.camel.component.crypto.cms.sig.DefaultSignerInfo">
<property name="keyStoreParameters" ref="keyStoreParameters1" />
<property name="privateKeyAlias" value="dsa" />
<property name="signatureAlgorithm" value="SHA256withDSA" />
<!-- optional parameter 'password', if not set then the password of the KeyStoreParameters will be used for accessing the private key -->
<property name="password" value="private_key_pw2" />
</bean>
...
<route>
<from uri="direct:start" />
<to uri="crypto-cms:sign://testsign?signer=#signer1&signer=#signer2&includeContent=true" />
<to uri="crypto-cms:verify://testverify?keyStoreParameters=#keyStoreParameters1" />
<to uri="mock:result" />
</route>Java DSL의 분리된 서명 예
import org.apache.camel.util.jsse.KeyStoreParameters;
import org.apache.camel.component.crypto.cms.sig.DefaultSignerInfo;
...
KeyStoreParameters keystore = new KeyStoreParameters();
keystore.setType("JCEKS");
keystore.setResource("keystore/keystore.jceks);
keystore.setPassword("some_password"); // this password will also be used for accessing the private key if not specified in the signerInfo1 bean
//Signer Information, by default the following signed attributes are included: contentType, signingTime, messageDigest, and cmsAlgorithmProtect; by default no unsigned attribute is included.
// If you want to add your own signed attributes or unsigned attributes, see methods DefaultSignerInfo.setSignedAttributeGenerator and DefaultSignerInfo.setUnsignedAttributeGenerator.
DefaultSignerInfo signerInfo1 = new DefaultSignerInfo();
signerInfo1.setIncludeCertificates(true); // if set to true then the certificate chain of the private key will be added to the Signed Data object
signerInfo1.setSignatureAlgorithm("SHA256withRSA"); // signature algorithm; attention, the signature algorithm must fit to the signer private key.
signerInfo1.setPrivateKeyAlias("rsa"); // alias of the private key used for the signing
signerInfo1.setPassword("private_key_pw".toCharArray()); // optional parameter, if not set then the password of the KeyStoreParameters will be used for accessing the private key
signerInfo1.setKeyStoreParameters(keystore);
simpleReg.put("keyStoreParameters", keystore); //register keystore in the registry
simpleReg.put("signer1", signerInfo1); //register signer info in the registry
from("direct:start")
//with the option includeContent=false the SignedData object without the signed text will be written into the header "CamelCryptoCmsSignedData"
.to("crypto-cms:sign://testsign?signer=#signer1&includeContent=false&toBase64=true")
//the verifier reads the Signed Data object form the header CamelCryptoCmsSignedData and assumes that the signed content is in the message body
.to("crypto-cms:verify://testverify?keyStoreParameters=#keyStoreParameters&signedDataHeaderBase64=true")
.to("mock:result");Spring XML의 분리된 서명 예
<keyStoreParameters xmlns="http://camel.apache.org/schema/spring"
id="keyStoreParameters1" resource="./keystore/keystore.jceks"
password="some_password" type="JCEKS" />
<bean id="signer1"
class="org.apache.camel.component.crypto.cms.sig.DefaultSignerInfo">
<property name="keyStoreParameters" ref="keyStoreParameters1" />
<property name="privateKeyAlias" value="rsa" />
<property name="signatureAlgorithm" value="SHA256withRSA" />
<property name="includeCertificates" value="true" />
<!-- optional parameter 'password', if not set then the password of the KeyStoreParameters will be used for accessing the private key -->
<property name="password" value="private_key_pw" />
</bean>
...
<route>
<from uri="direct:start" />
<!-- with the option includeContent=false the SignedData object without the signed text will be written into the header "CamelCryptoCmsSignedData" -->
<to uri="crypto-cms:sign://testsign?signer=#signer1&includeContent=false&toBase64=true" />
<!-- the verifier reads the Signed Data object form the header CamelCryptoCmsSignedData and assumes that the signed content is in the message body -->
<to uri="crypto-cms:verify://testverify?keyStoreParameters=#keyStoreParameters1&signedDataHeaderBase64=true" />
<to uri="mock:result" />
</route>