Reading a pfx file from usb token with java

java digital-signature pfx pkcs#12 e-token
user3914864 picture user3914864 · Aug 12, 2014 · Viewed 11.4k times · Source

I am trying to sign a pdf document in java using a USB e-token.I want to read the signature from USB token safenet (alladin etoken pro 72 k(Java)) and attach to pdf using java code.I have done digital signature signing using a key stored in my local machine.But i want to know how the same can be done using a USB e-token.

Answer

eckes picture eckes · Nov 5, 2015

The whole point of a USB token for signing is, that nobody can read the secret key from that device. So you sent the hash to the token and the token will send you the signature back.

For this to work you need a JCE provider which can talk to the token. This is typically done either by PKCS#11 (the token delivers a library for this) or the token delivers a MSCAPI driver (under windows).

Both can be used under Java, the PKCS#11 way might be a bit more complicated to setup, but in my experience it is better for automated signing because in the MSCAPI case you often need to enter the token PIN manually.

If your token is recognized by windows the following command should see and list its key:

keytool -list -storetype Windows-MY

The Windows Keystore can then be used to get a handle of the key for signing, but you can also use it to export a copy of the public key.

Related questions

HMAC-SHA256 Algorithm for signature calculation

I am trying to create a signature using the HMAC-SHA256 algorithm and this is my code. I am using US ASCII encoding. final Charset asciiCs = Charset.forName("US-ASCII"); final Mac sha256_HMAC = Mac.getInstance("HmacSHA256"); final SecretKeySpec secret_key = new …

Read More
Using SHA1 and RSA with java.security.Signature vs. MessageDigest and Cipher

I'm trying to understand what the Java java.security.Signature class does. If I compute an SHA1 message digest, and then encrypt that digest using RSA, I get a different result to asking the Signature class to sign the same …

Read More
Correct way to sign and verify signature using bouncycastle

I am using bcmail-jdk16-1.46.jar and bcprov-jdk16-1.46.jar (Bouncycastle libraries) to sign a string and then verify the signature. This is my code to sign a string: package my.package; import java.io.FileInputStream; import java.security.Key; …

Read More