java - Bouncycastle and S/MIME signing-time attribute -

i kind of new signing / certificate after checking google + so, can't find answer. have base code generating signature file pkcs #7 detached signature, , far good... client verify signature happy signature generated. have new requirement include date/time original file signed using s/mime signing-time attribute.

my code far dealing is:

    final attribute signingattribute = new attribute(cmsattributes.signingtime, new derset(new derutctime(new date())));      signedattributes.add(new attribute(cmsattributes.contenttype, new derset(new asn1objectidentifier("1.2.840.113549.1.7.1"))));     signedattributes.add(new attribute(cmsattributes.messagedigest, new derset(new deroctetstring(hash))));     signedattributes.add(signingattribute);     final attributetable signedattributestable = new attributetable(signedattributes);     final defaultsignedattributetablegenerator signedattributegenerator = new defaultsignedattributetablegenerator(signedattributestable);     // proceed signing process bouncycastle     final jcasimplesignerinfogeneratorbuilder builder = new jcasimplesignerinfogeneratorbuilder().setprovider("bc").setdirectsignature(true);     builder.setsignedattributegenerator(signedattributegenerator);     final signerinfogenerator signergenerator = builder.build("sha1withrsa", key, cert);      final cmssigneddatagenerator gen = new cmssigneddatagenerator();     ... 

then code afterward same used have generating signature... doesn't work.

one thing not hash messagedigest:

    signedattributes.add(new attribute(cmsattributes.messagedigest, new derset(new deroctetstring(hash)))); 

i got hash generated as:

    messagedigest md = messagedigest.getinstance("sha1", "bc");     md.update(filetosign.getbytes("utf-8"));     hash = md.digest();         

but absolutely not sure it's right way hash? , overall way s/mime signing-time attribute generated...

any hints or overall explanation on missed welcome.

ok after digging more code solution easy... first code can simplify , issue not @ related hash.

for getting signing time, can have 1 attribute:

final asn1encodablevector signedattributes = new asn1encodablevector(); final attribute signingattribute = new attribute(cmsattributes.signingtime, new derset(new derutctime(new date())));  signedattributes.add(signingattribute); // create signing table final attributetable signedattributestable = new attributetable(signedattributes); // create table table generator added signer builder final defaultsignedattributetablegenerator signedattributegenerator = new defaultsignedattributetablegenerator(signedattributestable);   final jcasimplesignerinfogeneratorbuilder builder = new jcasimplesignerinfogeneratorbuilder().setprovider(bouncycastleprovider.provider_name); builder.setsignedattributegenerator(signedattributegenerator);  // ****** not call: setdirectsignature(true); ***** final signerinfogenerator signergenerator = builder.build("sha1withrsa", key, cert); 

the critical piece here in commented part:

// ****** not call: setdirectsignature(true); ***** 

if calling setdirectsignature(true), undo work done prior. according documentation:

if passed in flag true, signer signature based on data, not collection of signed attributes, , no signed attributes included.

so that's it... on signature generated have signing time...

i verified new client, , previous error/log getting gone