com.lowagie.text.pdf

## Class PdfPKCS7

- java.lang.Object
- - com.lowagie.text.pdf.PdfPKCS7

-     public class PdfPKCS7
      extends java.lang.Object

  This class does all the processing related to signing and verifying a PKCS#7 signature.

  It's based in code found at org.bouncycastle.

- - ### Nested Class Summary

    Nested Classes
    Modifier and Type | Class and Description
    --- | ---
    `static class` | `PdfPKCS7.X509Name` a class that holds an X509 name
    `static class` | `PdfPKCS7.X509NameTokenizer` class for breaking up an X500 Name into it's component tokens, ala java.util.StringTokenizer.

  - ### Field Summary

    Fields
    Modifier and Type | Field and Description
    --- | ---
    `private static java.util.HashMap` | `algorithmNames`
    `private static java.util.HashMap` | `allowedDigests`
    `private BasicOCSPResp` | `basicResp`
    `private java.util.Collection` | `certs`
    `private java.util.Collection` | `crls`
    `private byte[]` | `digest`
    `private java.lang.String` | `digestAlgorithm`
    `private java.util.Set` | `digestalgos`
    `private byte[]` | `digestAttr`
    `private java.lang.String` | `digestEncryptionAlgorithm`
    `private static java.util.HashMap` | `digestNames`
    `private byte[]` | `externalDigest`
    `private byte[]` | `externalRSAdata`
    `private static java.lang.String` | `ID_ADBE_REVOCATION`
    `private static java.lang.String` | `ID_CONTENT_TYPE`
    `private static java.lang.String` | `ID_DSA`
    `private static java.lang.String` | `ID_MESSAGE_DIGEST`
    `private static java.lang.String` | `ID_PKCS7_DATA`
    `private static java.lang.String` | `ID_PKCS7_SIGNED_DATA`
    `private static java.lang.String` | `ID_RSA`
    `private static java.lang.String` | `ID_SIGNING_TIME`
    `private java.lang.String` | `location` Holds value of property location.
    `private java.security.MessageDigest` | `messageDigest`
    `private java.security.PrivateKey` | `privKey`
    `private java.lang.String` | `provider`
    `private java.lang.String` | `reason` Holds value of property reason.
    `private byte[]` | `RSAdata`
    `private java.security.Signature` | `sig`
    `private byte[]` | `sigAttr`
    `private java.security.cert.X509Certificate` | `signCert`
    `private java.util.Collection` | `signCerts`
    `private java.util.Calendar` | `signDate` Holds value of property signDate.
    `private int` | `signerversion`
    `private java.lang.String` | `signName` Holds value of property signName.
    `private TimeStampToken` | `timeStampToken`
    `private boolean` | `verified`
    `private boolean` | `verifyResult`
    `private int` | `version`

  - ### Constructor Summary

    Constructors
    Constructor and Description
    `PdfPKCS7(byte[] contentsKey, byte[] certsKey, java.lang.String provider)` Verifies a signature using the sub-filter adbe.x509.rsa_sha1.
    `PdfPKCS7(byte[] contentsKey, java.lang.String provider)` Verifies a signature using the sub-filter adbe.pkcs7.detached or adbe.pkcs7.sha1.
    `PdfPKCS7(java.security.PrivateKey privKey, java.security.cert.Certificate[] certChain, java.security.cert.CRL[] crlList, java.lang.String hashAlgorithm, java.lang.String provider, boolean hasRSAdata)` Generates a signature.

  - ### Method Summary

    Methods
    Modifier and Type | Method and Description
    --- | ---
    `private ASN1EncodableVector` | `buildUnauthenticatedAttributes(byte[] timeStampToken)` Added by Aiken Sam, 2006-11-15, modifed by Martin Brunecky 07/12/2007 to start with the timeStampToken (signedData 1.2.840.113549.1.7.2).
    `private void` | `findOcsp(ASN1Sequence seq)`
    `static java.lang.String` | `getAlgorithm(java.lang.String oid)` Gets the algorithm name for a certain id.
    `byte[]` | `getAuthenticatedAttributeBytes(byte[] secondDigest, java.util.Calendar signingTime, byte[] ocsp)` When using authenticatedAttributes the authentication process is different.
    `private DERSet` | `getAuthenticatedAttributeSet(byte[] secondDigest, java.util.Calendar signingTime, byte[] ocsp)`
    `java.security.cert.Certificate[]` | `getCertificates()` Get all the X.509 certificates associated with this PKCS#7 object in no particular order.
    `java.util.Collection` | `getCRLs()` Get the X.509 certificate revocation lists associated with this PKCS#7 object
    `static java.lang.String` | `getDigest(java.lang.String oid)` Gets the digest name for a certain id
    `java.lang.String` | `getDigestAlgorithm()` Get the algorithm used to calculate the message digest
    `byte[]` | `getEncodedPKCS1()` Gets the bytes for the PKCS#1 object.
    `byte[]` | `getEncodedPKCS7()` Gets the bytes for the PKCS7SignedData object.
    `byte[]` | `getEncodedPKCS7(byte[] secondDigest, java.util.Calendar signingTime)` Gets the bytes for the PKCS7SignedData object.
    `byte[]` | `getEncodedPKCS7(byte[] secondDigest, java.util.Calendar signingTime, TSAClient tsaClient, byte[] ocsp)` Gets the bytes for the PKCS7SignedData object.
    `private static DERObject` | `getExtensionValue(java.security.cert.X509Certificate cert, java.lang.String oid)`
    `java.lang.String` | `getHashAlgorithm()` Returns the algorithm.
    `private static DERObject` | `getIssuer(byte[] enc)` Get the "issuer" from the TBSCertificate bytes that are passed in
    `static PdfPKCS7.X509Name` | `getIssuerFields(java.security.cert.X509Certificate cert)` Get the issuer fields from an X509 Certificate
    `java.lang.String` | `getLocation()` Getter for property location.
    `BasicOCSPResp` | `getOcsp()` Gets the OCSP basic response if there is one.
    `static java.lang.String` | `getOCSPURL(java.security.cert.X509Certificate certificate)` Retrieves the OCSP URL from the given certificate.
    `java.lang.String` | `getReason()` Getter for property reason.
    `java.security.cert.Certificate[]` | `getSignCertificateChain()` Get the X.509 sign certificate chain associated with this PKCS#7 object.
    `java.util.Calendar` | `getSignDate()` Getter for property signDate.
    `java.security.cert.X509Certificate` | `getSigningCertificate()` Get the X.509 certificate actually used to sign the digest.
    `int` | `getSigningInfoVersion()` Get the version of the PKCS#7 "SignerInfo" object.
    `java.lang.String` | `getSignName()` Getter for property sigName.
    `private static java.lang.String` | `getStringFromGeneralName(DERObject names)`
    `private static DERObject` | `getSubject(byte[] enc)` Get the "subject" from the TBSCertificate bytes that are passed in
    `static PdfPKCS7.X509Name` | `getSubjectFields(java.security.cert.X509Certificate cert)` Get the subject fields from an X509 Certificate
    `java.util.Calendar` | `getTimeStampDate()` Gets the timestamp date
    `TimeStampToken` | `getTimeStampToken()` Gets the timestamp token if there is one.
    `int` | `getVersion()` Get the version of the PKCS#7 object.
    `boolean` | `isRevocationValid()` Checks if OCSP revocation refers to the document signing certificate.
    `static java.security.KeyStore` | `loadCacertsKeyStore()` Loads the default root certificates at <java.home>/lib/security/cacerts with the default provider.
    `static java.security.KeyStore` | `loadCacertsKeyStore(java.lang.String provider)` Loads the default root certificates at <java.home>/lib/security/cacerts.
    `void` | `setExternalDigest(byte[] digest, byte[] RSAdata, java.lang.String digestEncryptionAlgorithm)` Sets the digest/signature to an external calculated value.
    `void` | `setLocation(java.lang.String location)` Setter for property location.
    `void` | `setReason(java.lang.String reason)` Setter for property reason.
    `void` | `setSignDate(java.util.Calendar signDate)` Setter for property signDate.
    `void` | `setSignName(java.lang.String signName)` Setter for property sigName.
    `private void` | `signCertificateChain()`
    `void` | `update(byte[] buf, int off, int len)` Update the digest with the specified bytes.
    `boolean` | `verify()` Verify the digest.
    `static java.lang.String` | `verifyCertificate(java.security.cert.X509Certificate cert, java.util.Collection crls, java.util.Calendar calendar)` Verifies a single certificate.
    `static java.lang.Object[]` | `verifyCertificates(java.security.cert.Certificate[] certs, java.security.KeyStore keystore, java.util.Collection crls, java.util.Calendar calendar)` Verifies a certificate chain against a KeyStore.
    `static boolean` | `verifyOcspCertificates(BasicOCSPResp ocsp, java.security.KeyStore keystore, java.lang.String provider)` Verifies an OCSP response against a KeyStore.
    `static boolean` | `verifyTimestampCertificates(TimeStampToken ts, java.security.KeyStore keystore, java.lang.String provider)` Verifies a timestamp against a KeyStore.
    `boolean` | `verifyTimestampImprint()` Checks if the timestamp refers to this document.

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Field Detail

    - #### sigAttr

          private byte[] sigAttr

    - #### digestAttr

          private byte[] digestAttr

    - #### version

          private int version

    - #### signerversion

          private int signerversion

    - #### digestalgos

          private java.util.Set digestalgos

    - #### certs

          private java.util.Collection certs

    - #### crls

          private java.util.Collection crls

    - #### signCerts

          private java.util.Collection signCerts

    - #### signCert

          private java.security.cert.X509Certificate signCert

    - #### digest

          private byte[] digest

    - #### messageDigest

          private java.security.MessageDigest messageDigest

    - #### digestAlgorithm

          private java.lang.String digestAlgorithm

    - #### digestEncryptionAlgorithm

          private java.lang.String digestEncryptionAlgorithm

    - #### sig

          private java.security.Signature sig

    - #### privKey

          private transient java.security.PrivateKey privKey

    - #### RSAdata

          private byte[] RSAdata

    - #### verified

          private boolean verified

    - #### verifyResult

          private boolean verifyResult

    - #### externalDigest

          private byte[] externalDigest

    - #### externalRSAdata

          private byte[] externalRSAdata

    - #### provider

          private java.lang.String provider

    - #### ID_PKCS7_DATA

          private static final java.lang.String ID_PKCS7_DATA

      See Also:
        Constant Field Values

    - #### ID_PKCS7_SIGNED_DATA

          private static final java.lang.String ID_PKCS7_SIGNED_DATA

      See Also:
        Constant Field Values

    - #### ID_RSA

          private static final java.lang.String ID_RSA

      See Also:
        Constant Field Values

    - #### ID_DSA

          private static final java.lang.String ID_DSA

      See Also:
        Constant Field Values

    - #### ID_CONTENT_TYPE

          private static final java.lang.String ID_CONTENT_TYPE

      See Also:
        Constant Field Values

    - #### ID_MESSAGE_DIGEST

          private static final java.lang.String ID_MESSAGE_DIGEST

      See Also:
        Constant Field Values

    - #### ID_SIGNING_TIME

          private static final java.lang.String ID_SIGNING_TIME

      See Also:
        Constant Field Values

    - #### ID_ADBE_REVOCATION

          private static final java.lang.String ID_ADBE_REVOCATION

      See Also:
        Constant Field Values

    - #### reason

          private java.lang.String reason

      Holds value of property reason.

    - #### location

          private java.lang.String location

      Holds value of property location.

    - #### signDate

          private java.util.Calendar signDate

      Holds value of property signDate.

    - #### signName

          private java.lang.String signName

      Holds value of property signName.

    - #### timeStampToken

          private TimeStampToken timeStampToken

    - #### digestNames

          private static final java.util.HashMap digestNames

    - #### algorithmNames

          private static final java.util.HashMap algorithmNames

    - #### allowedDigests

          private static final java.util.HashMap allowedDigests

    - #### basicResp

          private BasicOCSPResp basicResp

  - ### Constructor Detail

    - #### PdfPKCS7

          public PdfPKCS7(byte[] contentsKey,
                  byte[] certsKey,
                  java.lang.String provider)

      Verifies a signature using the sub-filter adbe.x509.rsa_sha1.
      Parameters:
        `contentsKey` - the /Contents key
        `certsKey` - the /Cert key
        `provider` - the provider or `null` for the default provider

    - #### PdfPKCS7

          public PdfPKCS7(byte[] contentsKey,
                  java.lang.String provider)

      Verifies a signature using the sub-filter adbe.pkcs7.detached or adbe.pkcs7.sha1.
      Parameters:
        `contentsKey` - the /Contents key
        `provider` - the provider or `null` for the default provider

    - #### PdfPKCS7

          public PdfPKCS7(java.security.PrivateKey privKey,
                  java.security.cert.Certificate[] certChain,
                  java.security.cert.CRL[] crlList,
                  java.lang.String hashAlgorithm,
                  java.lang.String provider,
                  boolean hasRSAdata)
                   throws java.security.InvalidKeyException,
                          java.security.NoSuchProviderException,
                          java.security.NoSuchAlgorithmException

      Generates a signature.
      Parameters:
        `privKey` - the private key
        `certChain` - the certificate chain
        `crlList` - the certificate revocation list
        `hashAlgorithm` - the hash algorithm
        `provider` - the provider or `null` for the default provider
        `hasRSAdata` - `true` if the sub-filter is adbe.pkcs7.sha1
      Throws:
        `java.security.InvalidKeyException` - on error
        `java.security.NoSuchProviderException` - on error
        `java.security.NoSuchAlgorithmException` - on error

  - ### Method Detail

    - #### getDigest

          public static java.lang.String getDigest(java.lang.String oid)

      Gets the digest name for a certain id
      Parameters:
        `oid` - an id (for instance "1.2.840.113549.2.5")
      Returns:
        a digest name (for instance "MD5")
      Since:
        2.1.6

    - #### getAlgorithm

          public static java.lang.String getAlgorithm(java.lang.String oid)

      Gets the algorithm name for a certain id.
      Parameters:
        `oid` - an id (for instance "1.2.840.113549.1.1.1")
      Returns:
        an algorithm name (for instance "RSA")
      Since:
        2.1.6

    - #### getTimeStampToken

          public TimeStampToken getTimeStampToken()

      Gets the timestamp token if there is one.
      Returns:
        the timestamp token or null
      Since:
        2.1.6

    - #### getTimeStampDate

          public java.util.Calendar getTimeStampDate()

      Gets the timestamp date
      Returns:
        a date
      Since:
        2.1.6

    - #### getOcsp

          public BasicOCSPResp getOcsp()

      Gets the OCSP basic response if there is one.
      Returns:
        the OCSP basic response or null
      Since:
        2.1.6

    - #### findOcsp

          private void findOcsp(ASN1Sequence seq)
                         throws java.io.IOException

      Throws:
        `java.io.IOException`

    - #### update

          public void update(byte[] buf,
                    int off,
                    int len)
                      throws java.security.SignatureException

      Update the digest with the specified bytes. This method is used both for signing and verifying
      Parameters:
        `buf` - the data buffer
        `off` - the offset in the data buffer
        `len` - the data length
      Throws:
        `java.security.SignatureException` - on error

    - #### verify

          public boolean verify()
                         throws java.security.SignatureException

      Verify the digest.
      Returns:
        `true` if the signature checks out, `false` otherwise
      Throws:
        `java.security.SignatureException` - on error

    - #### verifyTimestampImprint

          public boolean verifyTimestampImprint()
                                         throws java.security.NoSuchAlgorithmException

      Checks if the timestamp refers to this document.
      Returns:
        true if it checks false otherwise
      Throws:
        `java.security.NoSuchAlgorithmException` - on error
      Since:
        2.1.6

    - #### getCertificates

          public java.security.cert.Certificate[] getCertificates()

      Get all the X.509 certificates associated with this PKCS#7 object in no particular order. Other certificates, from OCSP for example, will also be included.
      Returns:
        the X.509 certificates associated with this PKCS#7 object

    - #### getSignCertificateChain

          public java.security.cert.Certificate[] getSignCertificateChain()

      Get the X.509 sign certificate chain associated with this PKCS#7 object. Only the certificates used for the main signature will be returned, with the signing certificate first.
      Returns:
        the X.509 certificates associated with this PKCS#7 object
      Since:
        2.1.6

    - #### signCertificateChain

          private void signCertificateChain()

    - #### getCRLs

          public java.util.Collection getCRLs()

      Get the X.509 certificate revocation lists associated with this PKCS#7 object
      Returns:
        the X.509 certificate revocation lists associated with this PKCS#7 object

    - #### getSigningCertificate

          public java.security.cert.X509Certificate getSigningCertificate()

      Get the X.509 certificate actually used to sign the digest.
      Returns:
        the X.509 certificate actually used to sign the digest

    - #### getVersion

          public int getVersion()

      Get the version of the PKCS#7 object. Always 1
      Returns:
        the version of the PKCS#7 object. Always 1

    - #### getSigningInfoVersion

          public int getSigningInfoVersion()

      Get the version of the PKCS#7 "SignerInfo" object. Always 1
      Returns:
        the version of the PKCS#7 "SignerInfo" object. Always 1

    - #### getDigestAlgorithm

          public java.lang.String getDigestAlgorithm()

      Get the algorithm used to calculate the message digest
      Returns:
        the algorithm used to calculate the message digest

    - #### getHashAlgorithm

          public java.lang.String getHashAlgorithm()

      Returns the algorithm.
      Returns:
        the digest algorithm

    - #### loadCacertsKeyStore

          public static java.security.KeyStore loadCacertsKeyStore()

      Loads the default root certificates at <java.home>/lib/security/cacerts with the default provider.
      Returns:
        a `KeyStore`

    - #### loadCacertsKeyStore

          public static java.security.KeyStore loadCacertsKeyStore(java.lang.String provider)

      Loads the default root certificates at <java.home>/lib/security/cacerts.
      Parameters:
        `provider` - the provider or `null` for the default provider
      Returns:
        a `KeyStore`

    - #### verifyCertificate

          public static java.lang.String verifyCertificate(java.security.cert.X509Certificate cert,
                                           java.util.Collection crls,
                                           java.util.Calendar calendar)

      Verifies a single certificate.
      Parameters:
        `cert` - the certificate to verify
        `crls` - the certificate revocation list or `null`
        `calendar` - the date or `null` for the current date
      Returns:
        a `String` with the error description or `null` if no error

    - #### verifyCertificates

          public static java.lang.Object[] verifyCertificates(java.security.cert.Certificate[] certs,
                                              java.security.KeyStore keystore,
                                              java.util.Collection crls,
                                              java.util.Calendar calendar)

      Verifies a certificate chain against a KeyStore.
      Parameters:
        `certs` - the certificate chain
        `keystore` - the `KeyStore`
        `crls` - the certificate revocation list or `null`
        `calendar` - the date or `null` for the current date
      Returns:
        `null` if the certificate chain could be validated or a `Object[]{cert,error}` where `cert` is the failed certificate and `error` is the error message

    - #### verifyOcspCertificates

          public static boolean verifyOcspCertificates(BasicOCSPResp ocsp,
                                       java.security.KeyStore keystore,
                                       java.lang.String provider)

      Verifies an OCSP response against a KeyStore.
      Parameters:
        `ocsp` - the OCSP response
        `keystore` - the `KeyStore`
        `provider` - the provider or `null` to use the BouncyCastle provider
      Returns:
        `true` is a certificate was found
      Since:
        2.1.6

    - #### verifyTimestampCertificates

          public static boolean verifyTimestampCertificates(TimeStampToken ts,
                                            java.security.KeyStore keystore,
                                            java.lang.String provider)

      Verifies a timestamp against a KeyStore.
      Parameters:
        `ts` - the timestamp
        `keystore` - the `KeyStore`
        `provider` - the provider or `null` to use the BouncyCastle provider
      Returns:
        `true` is a certificate was found
      Since:
        2.1.6

    - #### getOCSPURL

          public static java.lang.String getOCSPURL(java.security.cert.X509Certificate certificate)
                                             throws java.security.cert.CertificateParsingException

      Retrieves the OCSP URL from the given certificate.
      Parameters:
        `certificate` - the certificate
      Returns:
        the URL or null
      Throws:
        `java.security.cert.CertificateParsingException` - on error
      Since:
        2.1.6

    - #### isRevocationValid

          public boolean isRevocationValid()

      Checks if OCSP revocation refers to the document signing certificate.
      Returns:
        true if it checks false otherwise
      Since:
        2.1.6

    - #### getExtensionValue

          private static DERObject getExtensionValue(java.security.cert.X509Certificate cert,
                                    java.lang.String oid)
                                              throws java.io.IOException

      Throws:
        `java.io.IOException`

    - #### getStringFromGeneralName

          private static java.lang.String getStringFromGeneralName(DERObject names)
                                                            throws java.io.IOException

      Throws:
        `java.io.IOException`

    - #### getIssuer

          private static DERObject getIssuer(byte[] enc)

      Get the "issuer" from the TBSCertificate bytes that are passed in
      Parameters:
        `enc` - a TBSCertificate in a byte array
      Returns:
        a DERObject

    - #### getSubject

          private static DERObject getSubject(byte[] enc)

      Get the "subject" from the TBSCertificate bytes that are passed in
      Parameters:
        `enc` - A TBSCertificate in a byte array
      Returns:
        a DERObject

    - #### getIssuerFields

          public static PdfPKCS7.X509Name getIssuerFields(java.security.cert.X509Certificate cert)

      Get the issuer fields from an X509 Certificate
      Parameters:
        `cert` - an X509Certificate
      Returns:
        an X509Name

    - #### getSubjectFields

          public static PdfPKCS7.X509Name getSubjectFields(java.security.cert.X509Certificate cert)

      Get the subject fields from an X509 Certificate
      Parameters:
        `cert` - an X509Certificate
      Returns:
        an X509Name

    - #### getEncodedPKCS1

          public byte[] getEncodedPKCS1()

      Gets the bytes for the PKCS#1 object.
      Returns:
        a byte array

    - #### setExternalDigest

          public void setExternalDigest(byte[] digest,
                               byte[] RSAdata,
                               java.lang.String digestEncryptionAlgorithm)

      Sets the digest/signature to an external calculated value.
      Parameters:
        `digest` - the digest. This is the actual signature
        `RSAdata` - the extra data that goes into the data tag in PKCS#7
        `digestEncryptionAlgorithm` - the encryption algorithm. It may must be `null` if the `digest` is also `null`. If the `digest` is not `null` then it may be "RSA" or "DSA"

    - #### getEncodedPKCS7

          public byte[] getEncodedPKCS7()

      Gets the bytes for the PKCS7SignedData object.
      Returns:
        the bytes for the PKCS7SignedData object

    - #### getEncodedPKCS7

          public byte[] getEncodedPKCS7(byte[] secondDigest,
                               java.util.Calendar signingTime)

      Gets the bytes for the PKCS7SignedData object. Optionally the authenticatedAttributes in the signerInfo can also be set. If either of the parameters is `null`, none will be used.
      Parameters:
        `secondDigest` - the digest in the authenticatedAttributes
        `signingTime` - the signing time in the authenticatedAttributes
      Returns:
        the bytes for the PKCS7SignedData object

    - #### getEncodedPKCS7

          public byte[] getEncodedPKCS7(byte[] secondDigest,
                               java.util.Calendar signingTime,
                               TSAClient tsaClient,
                               byte[] ocsp)

      Gets the bytes for the PKCS7SignedData object. Optionally the authenticatedAttributes in the signerInfo can also be set, OR a time-stamp-authority client may be provided.
      Parameters:
        `secondDigest` - the digest in the authenticatedAttributes
        `signingTime` - the signing time in the authenticatedAttributes
        `tsaClient` - TSAClient - null or an optional time stamp authority client
      Returns:
        byte[] the bytes for the PKCS7SignedData object
      Since:
        2.1.6

    - #### buildUnauthenticatedAttributes

          private ASN1EncodableVector buildUnauthenticatedAttributes(byte[] timeStampToken)
                                                              throws java.io.IOException

      Added by Aiken Sam, 2006-11-15, modifed by Martin Brunecky 07/12/2007 to start with the timeStampToken (signedData 1.2.840.113549.1.7.2). Token is the TSA response without response status, which is usually handled by the (vendor supplied) TSA request/response interface).
      Parameters:
        `timeStampToken` - byte[] - time stamp token, DER encoded signedData
      Returns:
        ASN1EncodableVector
      Throws:
        `java.io.IOException`

    - #### getAuthenticatedAttributeBytes

          public byte[] getAuthenticatedAttributeBytes(byte[] secondDigest,
                                              java.util.Calendar signingTime,
                                              byte[] ocsp)

      When using authenticatedAttributes the authentication process is different. The document digest is generated and put inside the attribute. The signing is done over the DER encoded authenticatedAttributes. This method provides that encoding and the parameters must be exactly the same as in `getEncodedPKCS7(byte[],Calendar)`.

      A simple example:

           Calendar cal = Calendar.getInstance();
           PdfPKCS7 pk7 = new PdfPKCS7(key, chain, null, "SHA1", null, false);
           MessageDigest messageDigest = MessageDigest.getInstance("SHA1");
           byte buf[] = new byte[8192];
           int n;
           InputStream inp = sap.getRangeStream();
           while ((n = inp.read(buf)) > 0) {
              messageDigest.update(buf, 0, n);
           }
           byte hash[] = messageDigest.digest();
           byte sh[] = pk7.getAuthenticatedAttributeBytes(hash, cal);
           pk7.update(sh, 0, sh.length);
           byte sg[] = pk7.getEncodedPKCS7(hash, cal);

      Parameters:
        `secondDigest` - the content digest
        `signingTime` - the signing time
      Returns:
        the byte array representation of the authenticatedAttributes ready to be signed

    - #### getAuthenticatedAttributeSet

          private DERSet getAuthenticatedAttributeSet(byte[] secondDigest,
                                            java.util.Calendar signingTime,
                                            byte[] ocsp)

    - #### getReason

          public java.lang.String getReason()

      Getter for property reason.
      Returns:
        Value of property reason.

    - #### setReason

          public void setReason(java.lang.String reason)

      Setter for property reason.
      Parameters:
        `reason` - New value of property reason.

    - #### getLocation

          public java.lang.String getLocation()

      Getter for property location.
      Returns:
        Value of property location.

    - #### setLocation

          public void setLocation(java.lang.String location)

      Setter for property location.
      Parameters:
        `location` - New value of property location.

    - #### getSignDate

          public java.util.Calendar getSignDate()

      Getter for property signDate.
      Returns:
        Value of property signDate.

    - #### setSignDate

          public void setSignDate(java.util.Calendar signDate)

      Setter for property signDate.
      Parameters:
        `signDate` - New value of property signDate.

    - #### getSignName

          public java.lang.String getSignName()

      Getter for property sigName.
      Returns:
        Value of property sigName.

    - #### setSignName

          public void setSignName(java.lang.String signName)

      Setter for property sigName.
      Parameters:
        `signName` - New value of property sigName.