Re: Questions on "MakeSignature.signDetached" CRL processing algorithm

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============0202092546714971081==
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="1s43IydoeduDkg9R9RyGaz7JM16vjOfiQ"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--1s43IydoeduDkg9R9RyGaz7JM16vjOfiQ
Content-Type: multipart/mixed; boundary="bPEAdfIuwuSvOPq5G9SFIj3nuZ3WXUMXS";
 protected-headers="v1"
From: Amedee Van Gasse <[email protected]>
To: [email protected]
Message-ID: <[email protected]>
Subject: Re: [iText-questions] Questions on "MakeSignature.signDetached" CRL
 processing algorithm
References: <CAFxNpv8CXZF3GtR6JfAtHTR21iKgzyVV4ads1-TZj+oVaKBdmw@mail.gmail.com>
In-Reply-To: <CAFxNpv8CXZF3GtR6JfAtHTR21iKgzyVV4ads1-TZj+oVaKBdmw@mail.gmail.com>

--bPEAdfIuwuSvOPq5G9SFIj3nuZ3WXUMXS
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable

Hi Jaime,

This mailing list is no longer in use, and will be removed soon - at the
latest when the GDPR comes into effect (25 May 2018).

For support questions about iText, please see:
https://itextpdf.com/support

For this particular question of yours, which contains a proposed code
change, I suggest that you submit a pull request on Github:
https://github.com/itext/itextpdf/pulls

Best regards,

Amedee Van Gasse
QA Engineer
iText Software


On 16-04-18 00:39, Jaime Hablutzel wrote:
> In Java iText around version 5.5.14-SNAPSHOT, I can see the following:
>=20
> public static void signDetached(PdfSignatureAppearance sap, ExternalDig=
est
> externalDigest, ExternalSignature externalSignature, Certificate[]
> chain, *Collection<CrlClient>
> crlList*, ... {
>     Collection<byte[]> crlBytes =3D null;
>     int i =3D 0;
>     while (*crlBytes =3D=3D null* && i < chain.length)
>     *crlBytes =3D processCrl*(chain[i++], crlList);
>     ...
>=20
> And I have some questions around that algorithm:
>=20
>    1. What is the motivation to receive a collection of CrlClients as s=
hown
>    in the red highlighted text?. Wouldn't it make the intent clearer to=

>    receive only one CrlClient?. Furthermore, note that in the
>    itext-signaturesdemo there isn't any example where that collection h=
olds
>    more than only one element.
>    2. Why are you keeping only the first processCrl response not being =
null?.
>    With the current CrlClientOnline implementation (instantiated with i=
ts
>    default constructor) it could result in no CRLs being downloaded for=

>    certificates higher than the EE certificate in the certification pat=
h, i.e.
>    if we have a chain with an EE and an ICA both with cRLDistributionPo=
ints,
>    the only CRL being downloaded would be the one that verifies the EE
>    certificate, but the CRL that verifies the ICA certificate wouldn't =
be
>    download.
>=20
> So, what do you think about implementing that part of the code somethin=
g
> quite simpler like this:
>=20
> public static void signDetached(PdfSignatureAppearance sap, ExternalDig=
est
> externalDigest, ExternalSignature externalSignature, Certificate[]
> chain, *CrlClient
> crlClient*, ... {
>     Collection<byte[]> crlBytes =3D new ArrayList<byte[]>();
>     for (Certificate certificate : chain) {
>         // Trying to get a CRL for each certificate in the certificatio=
n
> chain.
>         byte[] crl =3D crlClient.getEncoded(certificate);
>         if (crl !=3D null) {
>             crlBytes.add(crl);
>         }
>     }
>=20
> Of course the previous code is just an idea (it doesn't even currently
> compiles) as I'm seeing that changing the approach like this would requ=
ire
> changes in many other places, e.g. CrlClient, CrlClientOnline, etc.
>=20
>=20
>=20
> -----------------------------------------------------------------------=
-------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
>=20
>=20
>=20
> _______________________________________________
> iText-questions mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/itext-questions
>=20
> iText(R) is a registered trademark of 1T3XT BVBA.
> Many questions posted to this list can (and will) be answered with a re=
ference to the iText book: http://www.itextpdf.com/book/
> Please check the keywords list before you ask for examples: http://itex=
tpdf.com/themes/keywords.php
>=20


--bPEAdfIuwuSvOPq5G9SFIj3nuZ3WXUMXS--

--1s43IydoeduDkg9R9RyGaz7JM16vjOfiQ
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEcBAEBCAAGBQJa1FRYAAoJEBMpVlfmBCW6JFoH/1zxe01hDyq094R1giDf5RFr
nQ3SUHhmdcI6M2HJdLi8KHmKRAuxT+Ry7Sw2kbDl9PJUsMpbKwi1tRUmkp0qJ11I
5vpoUbWLgoKlr9QPBXVEN8NQBYGTCm1OpSbkrdj2yQUK3Ox/1ddoGX6dkykFaD/Y
y/VJOb+g2C/XtLXBWyI0nj9p5WRbgq9CbnUvsOY24RE9M7PXzCcl1XQhNnM4eGuH
NgjqDqhd6l3ras/Qbp2+oV8x02mkQYWmgofN8e/ZRrA6IZ/JQ1OEg/ALa2CiP7S6
bB8i6ZWuWMXmLVpPxftVR82cqEywTZs879GLBJF/bSi9zPUuvKtTGBl3OQjywdU=
=AXlF
-----END PGP SIGNATURE-----

--1s43IydoeduDkg9R9RyGaz7JM16vjOfiQ--


--===============0202092546714971081==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
--===============0202092546714971081==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
iText-questions mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/itext-questions

iText(R) is a registered trademark of 1T3XT BVBA.
Many questions posted to this list can (and will) be answered with a reference to the iText book: http://www.itextpdf.com/book/
Please check the keywords list before you ask for examples: http://itextpdf.com/themes/keywords.php
--===============0202092546714971081==--