Class SignedAspect is a wrapper for an Aspect contained in a
SignedObject. Thus it is possible to verify the signer of the
extension before it is used. For security reason, this class
is (and has to be) declared final
At construction, the public and private keys passed as
KeyPair are not checked for being a valid pair
and the private key is not stored for later use. Only
an explicit call to verifyExtension does
check the public key stored. The signing algorithm
to use is deduced by the algorithm type of the public
key: if the public key is of type "DSA" then the algorithm
"SHA1withDSA" is used, in case of an "RSA" key it is "MD5withRSA".
Keys generated with the keytool for the standard
Java 2 keystore are of type "DSA" if not specified otherwise.
The creation of certificates has to be performed by a third party
tool, such as the ones provided with OpenSSL.
The JCE signing engine that is used can not be specified for the
moment, this class simply uses the first available one.
To repeat: It is up to the user of this class to assign trust to such
an extension, this class can only be used to transfer an extension
secured from unnoticed changes.
Remark: to simplify the security auditing of this class, the
necessary and constant parameters are passed to the constructor
and no additional setter-methods are available.
version:
$Revision: 1.1.1.1 $
author:
Marcel Muller | 