Questions on "MakeSignature.signDetached" CRL processing algorithm

--===============7032306594131419336==
Content-Type: multipart/alternative; boundary="94eb2c07457e09e0290569eacaad"

--94eb2c07457e09e0290569eacaad
Content-Type: text/plain; charset="UTF-8"

In Java iText around version 5.5.14-SNAPSHOT, I can see the following:

public static void signDetached(PdfSignatureAppearance sap, ExternalDigest
externalDigest, ExternalSignature externalSignature, Certificate[]
chain, *Collection<CrlClient>
crlList*, ... {
    Collection<byte[]> crlBytes = null;
    int i = 0;
    while (*crlBytes == null* && i < chain.length)
    *crlBytes = processCrl*(chain[i++], crlList);
    ...

And I have some questions around that algorithm:

   1. What is the motivation to receive a collection of CrlClients as shown
   in the red highlighted text?. Wouldn't it make the intent clearer to
   receive only one CrlClient?. Furthermore, note that in the
   itext-signaturesdemo there isn't any example where that collection holds
   more than only one element.
   2. Why are you keeping only the first processCrl response not being null?.
   With the current CrlClientOnline implementation (instantiated with its
   default constructor) it could result in no CRLs being downloaded for
   certificates higher than the EE certificate in the certification path, i.e.
   if we have a chain with an EE and an ICA both with cRLDistributionPoints,
   the only CRL being downloaded would be the one that verifies the EE
   certificate, but the CRL that verifies the ICA certificate wouldn't be
   download.

So, what do you think about implementing that part of the code something
quite simpler like this:

public static void signDetached(PdfSignatureAppearance sap, ExternalDigest
externalDigest, ExternalSignature externalSignature, Certificate[]
chain, *CrlClient
crlClient*, ... {
    Collection<byte[]> crlBytes = new ArrayList<byte[]>();
    for (Certificate certificate : chain) {
        // Trying to get a CRL for each certificate in the certification
chain.
        byte[] crl = crlClient.getEncoded(certificate);
        if (crl != null) {
            crlBytes.add(crl);
        }
    }

Of course the previous code is just an idea (it doesn't even currently
compiles) as I'm seeing that changing the approach like this would require
changes in many other places, e.g. CrlClient, CrlClientOnline, etc.

-- 
Jaime Hablutzel -  RPC 994690880

--94eb2c07457e09e0290569eacaad
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">In Java iText around version=C2=A0<font face=3D"monospace,=
 monospace">5.5.14-SNAPSHOT</font>, I can see the following:<div><div><br><=
/div><div><div><font face=3D"monospace, monospace">public static void signD=
etached(PdfSignatureAppearance sap, ExternalDigest externalDigest, External=
Signature externalSignature, Certificate[] chain, <b><font color=3D"#ff0000=
">Collection&lt;CrlClient&gt; crlList</font></b>, ...</font><span style=3D"=
font-family:monospace,monospace">=C2=A0{</span></div><div><font face=3D"mon=
ospace, monospace">=C2=A0 =C2=A0 Collection&lt;byte[]&gt; crlBytes =3D null=
;</font></div><div><font face=3D"monospace, monospace">=C2=A0 =C2=A0 int i =
=3D 0;</font></div><div><font face=3D"monospace, monospace">=C2=A0 =C2=A0 w=
hile (<b><font color=3D"#0000ff">crlBytes =3D=3D null</font></b> &amp;&amp;=
 i &lt; chain.length)</font></div><div><font face=3D"monospace, monospace">=
=C2=A0 =C2=A0 <span style=3D"white-space:pre">	</span><b><font color=3D"#00=
00ff">crlBytes =3D processCrl</font></b>(chain[i++], crlList);</font></div>=
<div><font face=3D"monospace, monospace">=C2=A0 =C2=A0 ...</font></div><div=
><br></div><div>And I have some questions around that algorithm:</div><div>=
<ol><li>What is the motivation to receive a collection of <font face=3D"mon=
ospace, monospace">CrlClient</font>s as shown in the red highlighted text?.=
 Wouldn&#39;t it make the intent clearer to receive only one <font face=3D"=
monospace, monospace">CrlClient</font>?. Furthermore, note that in the <fon=
t face=3D"monospace, monospace">itext-signaturesdemo</font> there isn&#39;t=
 any example where that collection holds more than only one element.</li><l=
i>Why are you keeping only the first <font face=3D"monospace, monospace">pr=
ocessCrl</font> response=C2=A0not being <font face=3D"monospace, monospace"=
>null</font>?. With the current=C2=A0<font face=3D"monospace, monospace">Cr=
lClientOnline</font> implementation (instantiated with its default construc=
tor) it could result in no CRLs being downloaded for certificates higher th=
an the EE certificate in the certification path, i.e. if we have a chain wi=
th an EE and an ICA both with=C2=A0<font face=3D"monospace, monospace">cRLD=
istributionPoints</font>, the only CRL being downloaded would be the one th=
at verifies the EE certificate, but the CRL that verifies the ICA certifica=
te wouldn&#39;t be download.</li></ol><div>So, what do you think about impl=
ementing that part of the code something quite simpler like this:</div></di=
v><div><br></div><div><div><font face=3D"monospace, monospace">public stati=
c void signDetached(PdfSignatureAppearance sap, ExternalDigest externalDige=
st, ExternalSignature externalSignature, Certificate[] chain, <b>CrlClient =
crlClient</b>, ...</font><span style=3D"font-family:monospace,monospace">=
=C2=A0{</span></div><div><font face=3D"monospace, monospace">=C2=A0 =C2=A0 =
Collection&lt;byte[]&gt; crlBytes =3D new ArrayList&lt;byte[]&gt;();</font>=
</div><div><font face=3D"monospace, monospace">=C2=A0 =C2=A0 for (Certifica=
te certificate : chain) {</font></div><div><font face=3D"monospace, monospa=
ce">=C2=A0 =C2=A0 =C2=A0 =C2=A0 // Trying to get a CRL for each certificate=
 in the certification chain.</font></div><div><font face=3D"monospace, mono=
space">=C2=A0 =C2=A0 =C2=A0 =C2=A0 byte[] crl =3D crlClient.getEncoded(cert=
ificate);</font></div><div><font face=3D"monospace, monospace">=C2=A0 =C2=
=A0 =C2=A0 =C2=A0 if (crl !=3D null) {</font></div><div><font face=3D"monos=
pace, monospace">=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 crlBytes.add(crl=
);</font></div><div><font face=3D"monospace, monospace">=C2=A0 =C2=A0 =C2=
=A0 =C2=A0 }</font></div><div><font face=3D"monospace, monospace">=C2=A0 =
=C2=A0 }</font></div></div><div><br></div><div>Of course the previous code =
is just an idea (it doesn&#39;t even currently compiles) as I&#39;m seeing =
that changing the approach like this would require changes in many other pl=
aces, e.g.=C2=A0<font face=3D"monospace, monospace">CrlClient</font><font f=
ace=3D"arial, helvetica, sans-serif">,=C2=A0</font><font face=3D"monospace,=
 monospace">CrlClientOnline</font><font face=3D"arial, helvetica, sans-seri=
f">, etc.=C2=A0</font></div><div><br></div>-- <br><div class=3D"gmail_signa=
ture"><div dir=3D"ltr"><div><div dir=3D"ltr">Jaime Hablutzel - <font color=
=3D"#259bda" face=3D"Verdana, Geneva, Arial, sans-serif">=C2=A0RPC 99469088=
0</font><br></div></div></div></div>
</div></div></div>

--94eb2c07457e09e0290569eacaad--


--===============7032306594131419336==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
--===============7032306594131419336==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
iText-questions mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/itext-questions

iText(R) is a registered trademark of 1T3XT BVBA.
Many questions posted to this list can (and will) be answered with a reference to the iText book: http://www.itextpdf.com/book/
Please check the keywords list before you ask for examples: http://itextpdf.com/themes/keywords.php
--===============7032306594131419336==--