Class SecomEnvelopeSigner

Namespace

EncDotNet.S100.Collections.Secom

Assembly

EncDotNet.S100.Collections.dll

Signs SECOM 2.0 request envelopes (issue #838) with this client's MCP identity: the POST …/v2/object/search/summary (GetSummary) and POST …/v2/object/search (Get) filters that services such as KHRA and KRISO list and serve objects through.

public sealed class SecomEnvelopeSigner

Inheritance

object

SecomEnvelopeSigner

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

An envelope carries its filter fields, then the signer's certificate chain (base64 DER, the signer first, then any intermediates up to but not including the root), a SHA-384 thumbprint of its root and the signing time. SECOMLib validates exactly the certificates sent against its trust store, which may hold only the root: AMSA refused the signer alone and accepted it with the MCP Identity Registry intermediate (#882). The signature is over the envelope's canonical string: its fields in declared order joined with ., where a missing value is empty, a time is its Unix epoch seconds, a list is joined with , and a container type is its number. The signature is hex-encoded DER ECDSA, as GLA's SECOMLib produces and checks it.

A search envelope names no algorithm, so a service checks it with the one it is configured for. The default follows the key: SHA-384 for P-384 (the MCP curve), SHA-256 otherwise. Live on 2026-10-13, AMSA and KHRA verified SHA-384 envelopes and rejected SHA3-384 ones (#882).

Constructors

SecomEnvelopeSigner(SecomClientIdentity, SecomTrustAnchors?, string?)

Creates a signer for identity.

public SecomEnvelopeSigner(SecomClientIdentity identity, SecomTrustAnchors? anchors = null, string? signatureReference = null)

Parameters

identity SecomClientIdentity

The identity whose key signs.

anchors SecomTrustAnchors

The anchors its root is found among; by default BuiltIn.

signatureReference string

A SECOM digitalSignatureReference (ecdsa-384-sha3, ecdsa-384-sha2, ecdsa-256-sha2-256, ecdsa-256-sha3-256), or null to follow the key.

Exceptions

InvalidDataException

The identity has no ECDSA key, or the reference is not an ECDSA one.

Properties

Identity

The identity that signs.

public SecomClientIdentity Identity { get; }

Property Value

SecomClientIdentity

SignatureReference

The signature reference used, e.g. ecdsa-384-sha2.

public string SignatureReference { get; }

Property Value

string

Methods

CanonicalString(IEnumerable<object?>)

The canonical string of an envelope's values, in declared order: what the signature covers.

public static string CanonicalString(IEnumerable<object?> values)

Parameters

values IEnumerable<object>

Returns

string

GetRequest(string, DateTimeOffset)

The body of a SECOM 2.0 POST Get for one object.

public JsonObject GetRequest(string dataReference, DateTimeOffset now)

Parameters

dataReference string

now DateTimeOffset

Returns

JsonObject

SummaryRequest(SecomQuery, int, DateTimeOffset)

The body of a SECOM 2.0 POST GetSummary for one page: { "envelope": {…}, "envelopeSignature": "…" }.

public JsonObject SummaryRequest(SecomQuery query, int page, DateTimeOffset now)

Parameters

query SecomQuery

page int

now DateTimeOffset

Returns

JsonObject