redcar 0.3.2dev → 0.3.3

data/lib/openssl/src/java/org/jruby/ext/openssl/impl/Signed.java

@@ -0,0 +1,345 @@
+/***** BEGIN LICENSE BLOCK *****
+ * Version: CPL 1.0/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Common Public
+ * License Version 1.0 (the "License"); you may not use this file
+ * except in compliance with the License. You may obtain a copy of
+ * the License at http://www.eclipse.org/legal/cpl-v10.html
+ *
+ * Software distributed under the License is distributed on an "AS
+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
+ * implied. See the License for the specific language governing
+ * rights and limitations under the License.
+ *
+ * Copyright (C) 2008 Ola Bini <ola.bini@gmail.com>
+ * 
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the CPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the CPL, the GPL or the LGPL.
+ ***** END LICENSE BLOCK *****/
+package org.jruby.ext.openssl.impl;
+
+import java.io.ByteArrayInputStream;
+import java.security.cert.CertificateParsingException;
+import java.security.cert.X509CRL;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Enumeration;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import org.bouncycastle.asn1.ASN1Encodable;
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.ASN1InputStream;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.ASN1Set;
+import org.bouncycastle.asn1.DEREncodable;
+import org.bouncycastle.asn1.DERInteger;
+import org.bouncycastle.asn1.DERObjectIdentifier;
+import org.bouncycastle.asn1.DERSequence;
+import org.bouncycastle.asn1.DERSet;
+import org.bouncycastle.asn1.DERTaggedObject;
+import org.bouncycastle.asn1.pkcs.SignerInfo;
+import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
+import org.bouncycastle.asn1.x509.X509CertificateStructure;
+import org.bouncycastle.jce.provider.X509CertificateObject;
+import org.jruby.ext.openssl.x509store.X509AuxCertificate;
+
+/** PKCS7_SIGNED
+ *
+ * @author <a href="mailto:ola.bini@gmail.com">Ola Bini</a>
+ */
+public class Signed {
+    /**
+     * Describe version here.
+     */
+    private int version;
+
+    /**
+     * Describe crl here.
+     */
+    private Collection<X509CRL> crl = new ArrayList<X509CRL>();
+
+    /**
+     * Describe cert here.
+     */
+    private Collection<X509AuxCertificate> cert = new ArrayList<X509AuxCertificate>();
+
+    /**
+     * Describe mdAlgs here.
+     */
+    private Set<AlgorithmIdentifier> mdAlgs = new HashSet<AlgorithmIdentifier>();
+
+    /**
+     * Describe signerInfo here.
+     */
+    private Collection<SignerInfoWithPkey> signerInfo = new ArrayList<SignerInfoWithPkey>();
+
+    PKCS7 contents;
+
+    /**
+     * Get the <code>Version</code> value.
+     *
+     * @return an <code>int</code> value
+     */
+    public final int getVersion() {
+        return version;
+    }
+
+    /**
+     * Set the <code>Version</code> value.
+     *
+     * @param newVersion The new Version value.
+     */
+    public final void setVersion(final int newVersion) {
+        this.version = newVersion;
+    }
+
+    /**
+     * Get the <code>SignerInfo</code> value.
+     *
+     * @return a <code>Collection<SignerInfoWithPkey></code> value
+     */
+    public final Collection<SignerInfoWithPkey> getSignerInfo() {
+        return signerInfo;
+    }
+
+    /**
+     * Set the <code>SignerInfo</code> value.
+     *
+     * @param newSignerInfo The new SignerInfo value.
+     */
+    public final void setSignerInfo(final Collection<SignerInfoWithPkey> newSignerInfo) {
+        this.signerInfo = newSignerInfo;
+    }
+
+    /**
+     * Get the <code>MdAlgs</code> value.
+     *
+     * @return a <code>Set<AlgorithmIdentifier></code> value
+     */
+    public final Set<AlgorithmIdentifier> getMdAlgs() {
+        return mdAlgs;
+    }
+
+    /**
+     * Set the <code>MdAlgs</code> value.
+     *
+     * @param newMdAlgs The new MdAlgs value.
+     */
+    public final void setMdAlgs(final Set<AlgorithmIdentifier> newMdAlgs) {
+        this.mdAlgs = newMdAlgs;
+    }
+
+    /**
+     * Get the <code>Contents</code> value.
+     *
+     * @return a <code>PKCS7</code> value
+     */
+    public final PKCS7 getContents() {
+        return contents;
+    }
+
+    /**
+     * Set the <code>Contents</code> value.
+     *
+     * @param newContents The new Contents value.
+     */
+    public final void setContents(final PKCS7 newContents) {
+        this.contents = newContents;
+    }
+
+    /**
+     * Get the <code>Cert</code> value.
+     *
+     * @return a <code>Collection<X509AuxCertificate></code> value
+     */
+    public final Collection<X509AuxCertificate> getCert() {
+        return cert;
+    }
+
+    /**
+     * Set the <code>Cert</code> value.
+     *
+     * @param newCert The new Cert value.
+     */
+    public final void setCert(final Collection<X509AuxCertificate> newCert) {
+        this.cert = newCert;
+    }
+
+    /**
+     * Get the <code>Crl</code> value.
+     *
+     * @return a <code>Set<X509CRL></code> value
+     */
+    public final Collection<X509CRL> getCrl() {
+        return crl;
+    }
+
+    /**
+     * Set the <code>Crl</code> value.
+     *
+     * @param newCrl The new Crl value.
+     */
+    public final void setCrl(final Collection<X509CRL> newCrl) {
+        this.crl = newCrl;
+    }
+
+    @Override
+    public String toString() {
+        return "#<Signed version=" + version + " mdAlgs="+mdAlgs+" content="+contents+" cert="+cert+" crls="+crl+" signerInfos="+signerInfo+">";
+    }
+
+    public ASN1Encodable asASN1() {
+        ASN1EncodableVector vector = new ASN1EncodableVector();
+        vector.add(new DERInteger(version));
+        vector.add(digestAlgorithmsToASN1Set());
+        vector.add(contents.asASN1());
+        if(cert != null && cert.size() > 0) {
+            vector.add(new DERTaggedObject(0, certificatesToASN1Set()));
+        }
+        if(crl != null && crl.size() > 0) {
+            vector.add(new DERTaggedObject(1, crlsToASN1Set()));
+        }
+        vector.add(signerInfosToASN1Set());
+        return new DERSequence(vector);
+    }
+
+    private ASN1Set digestAlgorithmsToASN1Set() {
+        ASN1EncodableVector vector = new ASN1EncodableVector();
+        for(AlgorithmIdentifier ai : mdAlgs) {
+            vector.add(ai.toASN1Object());
+        }
+        return new DERSet(vector);
+    }
+
+    // This imlementation is stupid and wasteful. Ouch.
+    private ASN1Set certificatesToASN1Set() {
+        try {
+            ASN1EncodableVector vector = new ASN1EncodableVector();
+            for(X509AuxCertificate c : cert) {
+                vector.add(new ASN1InputStream(new ByteArrayInputStream(c.getEncoded())).readObject());
+            }
+            return new DERSet(vector);
+        } catch(Exception e) {
+            return null;
+        }
+    }
+
+    private ASN1Set crlsToASN1Set() {
+        throw new RuntimeException("TODO: implement CRL part");
+    }
+
+    private ASN1Set signerInfosToASN1Set() {
+        ASN1EncodableVector vector = new ASN1EncodableVector();
+        for(SignerInfoWithPkey si : signerInfo) {
+            vector.add(si.toASN1Object());
+        }
+        return new DERSet(vector);
+    }
+
+    /**
+     * SignedData ::= SEQUENCE {
+     *   version Version,
+     *   digestAlgorithms DigestAlgorithmIdentifiers,
+     *   contentInfo ContentInfo,
+     *   certificates [0] IMPLICIT ExtendedCertificatesAndCertificates OPTIONAL,
+     *   crls [1] IMPLICIT CertificateRevocationLists OPTIONAL,
+     *   signerInfos SignerInfos }
+     *
+     * Version ::= INTEGER
+     *
+     * DigestAlgorithmIdentifiers ::= SET OF DigestAlgorithmIdentifier
+     *
+     * SignerInfos ::= SET OF SignerInfo
+     */
+    public static Signed fromASN1(DEREncodable content) {
+        ASN1Sequence sequence = (ASN1Sequence)content;
+        DERInteger version = (DERInteger)sequence.getObjectAt(0);
+        ASN1Set digestAlgos = (ASN1Set)sequence.getObjectAt(1);
+        DEREncodable contentInfo = sequence.getObjectAt(2);
+
+        DEREncodable certificates = null;
+        DEREncodable crls = null;
+
+        int index = 3;
+        DEREncodable tmp = sequence.getObjectAt(index);
+        if((tmp instanceof DERTaggedObject) && ((DERTaggedObject)tmp).getTagNo() == 0) {
+            certificates = ((DERTaggedObject)tmp).getObject();
+            index++;
+        }
+
+        tmp = sequence.getObjectAt(index);
+        if((tmp instanceof DERTaggedObject) && ((DERTaggedObject)tmp).getTagNo() == 1) {
+            crls = ((DERTaggedObject)tmp).getObject();
+            index++;
+        }
+
+        ASN1Set signerInfos = (ASN1Set)sequence.getObjectAt(index);
+
+        Signed signed = new Signed();
+        signed.setVersion(version.getValue().intValue());
+        signed.setMdAlgs(algorithmIdentifiersFromASN1Set(digestAlgos));
+        signed.setContents(PKCS7.fromASN1(contentInfo));
+        if(certificates != null) {
+            signed.setCert(certificatesFromASN1Set(certificates));
+        }
+        if(crls != null) {
+            throw new RuntimeException("TODO: implement CRL part");
+        }
+        signed.setSignerInfo(signerInfosFromASN1Set(signerInfos));
+
+        return signed;
+    }
+
+    private static Collection<X509AuxCertificate> certificatesFromASN1Set(DEREncodable content) {
+        Collection<X509AuxCertificate> result = new ArrayList<X509AuxCertificate>();
+        if(content instanceof DERSet) {
+            for(Enumeration<?> enm = ((DERSet)content).getObjects(); enm.hasMoreElements(); ) {
+                DEREncodable current = (DEREncodable)enm.nextElement();
+                X509CertificateStructure struct = X509CertificateStructure.getInstance(current);
+                try {
+                    result.add(new X509AuxCertificate(new X509CertificateObject(struct)));
+                } catch(CertificateParsingException ex) {
+                    throw new PKCS7Exception(PKCS7.F_B64_READ_PKCS7, PKCS7.R_CERTIFICATE_VERIFY_ERROR, "exception: " + ex);
+                }
+            }
+        } else {
+            X509CertificateStructure struct = X509CertificateStructure.getInstance(content);
+            try {
+                result.add(new X509AuxCertificate(new X509CertificateObject(struct)));
+            } catch(CertificateParsingException ex) {
+                throw new PKCS7Exception(PKCS7.F_B64_READ_PKCS7, PKCS7.R_CERTIFICATE_VERIFY_ERROR, "exception: " + ex);
+            }
+        }
+
+
+        return result;
+    }
+
+    private static Set<AlgorithmIdentifier> algorithmIdentifiersFromASN1Set(DEREncodable content) {
+        ASN1Set set = (ASN1Set)content;
+        Set<AlgorithmIdentifier> result = new HashSet<AlgorithmIdentifier>();
+        for(Enumeration<?> e = set.getObjects(); e.hasMoreElements();) {
+            result.add(AlgorithmIdentifier.getInstance(e.nextElement()));
+        }
+        return result;
+    }
+
+    private static Collection<SignerInfoWithPkey> signerInfosFromASN1Set(DEREncodable content) {
+        ASN1Set set = (ASN1Set)content;
+        Collection<SignerInfoWithPkey> result = new ArrayList<SignerInfoWithPkey>();
+        for(Enumeration<?> e = set.getObjects(); e.hasMoreElements();) {
+            result.add(SignerInfoWithPkey.getInstance(e.nextElement()));
+        }
+        return result;
+    }
+}// Signed

data/lib/openssl/src/java/org/jruby/ext/openssl/impl/SignerInfoWithPkey.java

@@ -0,0 +1,365 @@
+/***** BEGIN LICENSE BLOCK *****
+ * Version: CPL 1.0/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Common Public
+ * License Version 1.0 (the "License"); you may not use this file
+ * except in compliance with the License. You may obtain a copy of
+ * the License at http://www.eclipse.org/legal/cpl-v10.html
+ *
+ * Software distributed under the License is distributed on an "AS
+ * IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or
+ * implied. See the License for the specific language governing
+ * rights and limitations under the License.
+ *
+ * Copyright (C) 2008 Ola Bini <ola.bini@gmail.com>
+ * 
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the CPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the CPL, the GPL or the LGPL.
+ ***** END LICENSE BLOCK *****/
+package org.jruby.ext.openssl.impl;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.math.BigInteger;
+import java.security.MessageDigest;
+import java.security.PrivateKey;
+import java.security.interfaces.DSAPrivateKey;
+import java.security.interfaces.ECPrivateKey;
+import java.security.interfaces.RSAPrivateKey;
+import java.util.Enumeration;
+import org.bouncycastle.asn1.ASN1Encodable;
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.ASN1InputStream;
+import org.bouncycastle.asn1.ASN1OctetString;
+import org.bouncycastle.asn1.ASN1Sequence;
+import org.bouncycastle.asn1.ASN1Set;
+import org.bouncycastle.asn1.ASN1TaggedObject;
+import org.bouncycastle.asn1.DEREncodable;
+import org.bouncycastle.asn1.DERInteger;
+import org.bouncycastle.asn1.DERObject;
+import org.bouncycastle.asn1.DERObjectIdentifier;
+import org.bouncycastle.asn1.DEROctetString;
+import org.bouncycastle.asn1.DERSequence;
+import org.bouncycastle.asn1.DERSet;
+import org.bouncycastle.asn1.DERTaggedObject;
+import org.bouncycastle.asn1.pkcs.Attribute;
+import org.bouncycastle.asn1.pkcs.IssuerAndSerialNumber;
+import org.bouncycastle.asn1.pkcs.SignerInfo;
+import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
+import org.bouncycastle.asn1.x509.X509Name;
+import org.jruby.ext.openssl.x509store.X509AuxCertificate;
+
+/**
+ *
+ * @author <a href="mailto:ola.bini@gmail.com">Ola Bini</a>
+ */
+public class SignerInfoWithPkey extends ASN1Encodable {
+    private DERInteger              version;
+    private IssuerAndSerialNumber   issuerAndSerialNumber;
+    private AlgorithmIdentifier     digAlgorithm;
+    private ASN1Set                 authenticatedAttributes;
+    private AlgorithmIdentifier     digEncryptionAlgorithm;
+    private ASN1OctetString         encryptedDigest;
+    private ASN1Set                 unauthenticatedAttributes;
+
+    public static SignerInfoWithPkey getInstance(Object o) {
+        if(o instanceof SignerInfo) {
+            return (SignerInfoWithPkey)o;
+        } else if (o instanceof ASN1Sequence) {
+            return new SignerInfoWithPkey((ASN1Sequence)o);
+        }
+
+        throw new IllegalArgumentException("unknown object in factory: " + o.getClass().getName());
+    }
+
+    public SignerInfoWithPkey dup() {
+        SignerInfoWithPkey copy = new SignerInfoWithPkey(version, 
+                                                         issuerAndSerialNumber,
+                                                         digAlgorithm,
+                                                         authenticatedAttributes,
+                                                         digEncryptionAlgorithm,
+                                                         encryptedDigest,
+                                                         unauthenticatedAttributes);
+        copy.pkey = pkey;
+        return copy;
+    }
+
+    SignerInfoWithPkey() {        
+    }
+
+    public SignerInfoWithPkey(DERInteger              version,
+        IssuerAndSerialNumber   issuerAndSerialNumber,
+        AlgorithmIdentifier     digAlgorithm,
+        ASN1Set                 authenticatedAttributes,
+        AlgorithmIdentifier     digEncryptionAlgorithm,
+        ASN1OctetString         encryptedDigest,
+        ASN1Set                 unauthenticatedAttributes) {
+        this.version = version;
+        this.issuerAndSerialNumber = issuerAndSerialNumber;
+        this.digAlgorithm = digAlgorithm;
+        this.authenticatedAttributes = authenticatedAttributes;
+        this.digEncryptionAlgorithm = digEncryptionAlgorithm;
+        this.encryptedDigest = encryptedDigest;
+        this.unauthenticatedAttributes = unauthenticatedAttributes;
+    }
+
+    public SignerInfoWithPkey(ASN1Sequence seq) {
+        Enumeration     e = seq.getObjects();
+
+        version = (DERInteger)e.nextElement();
+        issuerAndSerialNumber = IssuerAndSerialNumber.getInstance(e.nextElement());
+        digAlgorithm = AlgorithmIdentifier.getInstance(e.nextElement());
+
+        Object obj = e.nextElement();
+
+        if(obj instanceof ASN1TaggedObject) {
+            authenticatedAttributes = ASN1Set.getInstance((ASN1TaggedObject)obj, false);
+
+            digEncryptionAlgorithm = AlgorithmIdentifier.getInstance(e.nextElement());
+        }
+        else {
+            authenticatedAttributes = null;
+            digEncryptionAlgorithm = AlgorithmIdentifier.getInstance(obj);
+        }
+
+        encryptedDigest = DEROctetString.getInstance(e.nextElement());
+
+        if(e.hasMoreElements()) {
+            unauthenticatedAttributes = ASN1Set.getInstance((ASN1TaggedObject)e.nextElement(), false);
+        }
+        else {
+            unauthenticatedAttributes = null;
+        }
+    }
+
+    public DERInteger getVersion() {
+        return version;
+    }
+
+    public IssuerAndSerialNumber getIssuerAndSerialNumber() {
+        return issuerAndSerialNumber;
+    }
+
+    public ASN1Set getAuthenticatedAttributes() {
+        return authenticatedAttributes;
+    }
+
+    public AlgorithmIdentifier getDigestAlgorithm() {
+        return digAlgorithm;
+    }
+
+    public ASN1OctetString getEncryptedDigest() {
+        return encryptedDigest;
+    }
+
+    public AlgorithmIdentifier getDigestEncryptionAlgorithm() {
+        return digEncryptionAlgorithm;
+    }
+
+    public ASN1Set getUnauthenticatedAttributes() {
+        return unauthenticatedAttributes;
+    }
+
+    /* c: PKCS7_SIGNER_INFO_set
+     *
+     */
+    public void set(X509AuxCertificate x509, PrivateKey pkey, MessageDigest dgst) {
+        boolean dsa = 
+            (pkey instanceof DSAPrivateKey) || 
+            (pkey instanceof ECPrivateKey);
+
+        version = new DERInteger(1);
+
+        try {
+            X509Name issuer = X509Name.getInstance(new ASN1InputStream(new ByteArrayInputStream(x509.getIssuerX500Principal().getEncoded())).readObject());
+            BigInteger serial = x509.getSerialNumber();
+            issuerAndSerialNumber = new IssuerAndSerialNumber(issuer, serial);
+        } catch(IOException e) {
+            throw new PKCS7Exception(-1, -1);
+        }
+
+        this.pkey = pkey;
+        
+        if(dsa) {
+            digAlgorithm = new AlgorithmIdentifier(ASN1Registry.nid2obj(ASN1Registry.NID_sha1));
+        } else {
+            digAlgorithm = new AlgorithmIdentifier(ASN1Registry.nid2obj(EVP.type(dgst)));
+        }
+        
+        if(pkey instanceof RSAPrivateKey) {
+            digEncryptionAlgorithm = new AlgorithmIdentifier(ASN1Registry.nid2obj(ASN1Registry.NID_rsaEncryption));
+        } else if(pkey instanceof DSAPrivateKey) {
+            digEncryptionAlgorithm = new AlgorithmIdentifier(ASN1Registry.nid2obj(ASN1Registry.NID_dsa));
+        } else if(pkey instanceof ECPrivateKey) {
+            digEncryptionAlgorithm = new AlgorithmIdentifier(ASN1Registry.nid2obj(ASN1Registry.NID_ecdsa_with_SHA1));
+        }
+    }
+
+    /**
+     * Produce an object suitable for an ASN1OutputStream.
+     * <pre>
+     *  SignerInfo ::= SEQUENCE {
+     *      version Version,
+     *      issuerAndSerialNumber IssuerAndSerialNumber,
+     *      digestAlgorithm DigestAlgorithmIdentifier,
+     *      authenticatedAttributes [0] IMPLICIT Attributes OPTIONAL,
+     *      digestEncryptionAlgorithm DigestEncryptionAlgorithmIdentifier,
+     *      encryptedDigest EncryptedDigest,
+     *      unauthenticatedAttributes [1] IMPLICIT Attributes OPTIONAL
+     *  }
+     *
+     *  EncryptedDigest ::= OCTET STRING
+     *
+     *  DigestAlgorithmIdentifier ::= AlgorithmIdentifier
+     *
+     *  DigestEncryptionAlgorithmIdentifier ::= AlgorithmIdentifier
+     * </pre>
+     */
+    public DERObject toASN1Object() {
+        ASN1EncodableVector v = new ASN1EncodableVector();
+
+        v.add(version);
+        v.add(issuerAndSerialNumber);
+        v.add(digAlgorithm);
+
+        if (authenticatedAttributes != null) {
+            v.add(new DERTaggedObject(false, 0, authenticatedAttributes));
+        }
+
+        v.add(digEncryptionAlgorithm);
+        v.add(encryptedDigest);
+
+        if (unauthenticatedAttributes != null) {
+            v.add(new DERTaggedObject(false, 1, unauthenticatedAttributes));
+        }
+
+        return new DERSequence(v);
+    }
+
+    /**
+     * Describe pkey here.
+     */
+    private PrivateKey pkey;
+
+    /**
+     * Get the <code>Pkey</code> value.
+     *
+     * @return a <code>PrivateKey</code> value
+     */
+    public final PrivateKey getPkey() {
+        return pkey;
+    }
+
+    /**
+     * Set the <code>Pkey</code> value.
+     *
+     * @param newPkey The new Pkey value.
+     */
+    public final void setPkey(final PrivateKey newPkey) {
+        this.pkey = newPkey;
+    }
+
+    public void setAuthenticatedAttributes(ASN1Set authAttr) {
+        this.authenticatedAttributes = authAttr;
+    }
+
+    public void setUnauthenticatedAttributes(ASN1Set unauthAttr) {
+        this.unauthenticatedAttributes = unauthAttr;
+    }
+
+    public void setEncryptedDigest(ASN1OctetString encryptedDigest) {
+        this.encryptedDigest = encryptedDigest;
+    }
+
+    /** c: PKCS7_get_signed_attribute
+     *
+     */
+    public DEREncodable getSignedAttribute(int nid) {
+        return getAttribute(this.authenticatedAttributes, nid);
+    }
+
+    /** c: PKCS7_get_attribute
+     *
+     */
+    public DEREncodable getAttribute(int nid) {
+        return getAttribute(this.unauthenticatedAttributes, nid);
+    }
+
+    /** c: static get_attribute
+     *
+     */
+    public static DEREncodable getAttribute(ASN1Set sk, int nid) {
+        Attribute xa = null;
+        DERObjectIdentifier o = ASN1Registry.nid2obj(nid);
+
+        if(null == o || null == sk) {
+            return null;
+        }
+
+        for(Enumeration e = sk.getObjects(); e.hasMoreElements();) {
+            Object val = e.nextElement();
+            if(val instanceof Attribute) {
+                xa = (Attribute)val;
+            } else {
+                xa = Attribute.getInstance(val);
+            }
+
+            if(o.equals(xa.getAttrType())) {
+                if(xa.getAttrValues().size() > 0) {
+                    return xa.getAttrValues().getObjectAt(0);
+                } else {
+                    return null;
+                }
+            }
+        }
+        return null;
+    }
+
+    /** c: PKCS7_add_signed_attribute
+     *
+     */
+    public void addSignedAttribute(int atrType, DEREncodable value) {
+        this.authenticatedAttributes = addAttribute(this.authenticatedAttributes, atrType, value);
+    }
+
+    /** c: PKCS7_add_attribute
+     *
+     */
+    public void addAttribute(int atrType, DEREncodable value) {
+        this.unauthenticatedAttributes = addAttribute(this.unauthenticatedAttributes, atrType, value);
+    }
+
+    /** c: static add_attribute
+     *
+     */
+    private ASN1Set addAttribute(ASN1Set base, int atrType, DEREncodable value) {
+        ASN1EncodableVector vector = new ASN1EncodableVector();
+        if(base == null) {
+            base = new DERSet();
+        }
+        Attribute attr = null;
+        for(Enumeration e = base.getObjects(); e.hasMoreElements();) {
+            Object val = e.nextElement();
+            if(val instanceof Attribute) {
+                attr = (Attribute)val;
+            } else {
+                attr = Attribute.getInstance(val);
+            }
+            if(ASN1Registry.obj2nid(attr.getAttrType()) != atrType) {
+                vector.add(attr);
+            }
+        }
+        attr = new Attribute(ASN1Registry.nid2obj(atrType), new DERSet(value));
+        vector.add(attr);
+        return new DERSet(vector);
+    }
+}// SignerInfoWithPkey