Table of Contents

Class Part15Signer

Namespace
EncDotNet.S100.ExchangeSets.Protection
Assembly
EncDotNet.S100.ExchangeSets.dll

Produces Part 15 digital signatures with a data server's (or other signing authority's) ECDSA P-384 key.

public sealed class Part15Signer : IDisposable
Inheritance
Part15Signer
Implements
Inherited Members

Remarks

S-100 Edition 5.2.1 Part 15 §15-8.4 and §15-8.7: signatures are ECDSA over a SHA-384 hash using the NIST P-384 curve, encoded as an ASN.1 DER SEQUENCE { r, s }. This is the producer-side counterpart of ExchangeSetVerifier and PermitSignatureVerifier; the signatures it produces verify with them.

The signer does not own Certificate; dispose the signer to release the private key it extracted from the certificate. A key passed to Part15Signer(X509Certificate2, ECDsa, string, string) stays the caller's.

Constructors

Part15Signer(X509Certificate2, ECDsa, string, string)

Creates a signer that signs with signingKey, for a key held outside the certificate (a hardware module, or a deterministic test key).

public Part15Signer(X509Certificate2 certificate, ECDsa signingKey, string certificateId, string schemeAdministratorId)

Parameters

certificate X509Certificate2

The signing certificate; its public key must match signingKey.

signingKey ECDsa

The ECDSA P-384 private key. The signer doesn't dispose it.

certificateId string

The identifier signatures use to reference the certificate.

schemeAdministratorId string

The identity of the Scheme Administrator that issued the certificate.

Exceptions

ArgumentException

The key is not P-384, or the certificate's public key is not the key's.

Part15Signer(X509Certificate2, string, string)

Creates a signer from a certificate that carries an ECDSA P-384 private key.

public Part15Signer(X509Certificate2 certificate, string certificateId, string schemeAdministratorId)

Parameters

certificate X509Certificate2

The signing certificate, with its private key.

certificateId string

The identifier signatures use to reference the certificate (the certificateRef attribute), for example urn:mrn:iho:s62:xx:key1.

schemeAdministratorId string

The identity of the Scheme Administrator that issued the certificate, written as the schemeAdministrator id (§15-8.11.1), for example IHO.

Exceptions

ArgumentException

The certificate has no ECDSA private key, or its key is not P-384.

Properties

Certificate

The signing certificate.

public X509Certificate2 Certificate { get; }

Property Value

X509Certificate2

CertificateId

The identifier signatures use to reference Certificate.

public string CertificateId { get; }

Property Value

string

SchemeAdministratorId

The identity of the Scheme Administrator that issued Certificate.

public string SchemeAdministratorId { get; }

Property Value

string

Methods

CreateCertificateBlock()

Creates the certificate block that authenticates this signer's signatures: the Scheme Administrator identity and the signing certificate.

public CertificateBlock CreateCertificateBlock()

Returns

CertificateBlock

A new certificate block.

Remarks

The Scheme Administrator certificate itself is not included; a client verifies against its own configured copy (§15-8.11.1).

Dispose()

Performs application-defined tasks associated with freeing, releasing, or resetting unmanaged resources.

public void Dispose()

SignData(ReadOnlySpan<byte>, string, SignatureDataStatus)

Signs a resource's bytes, producing an S100_SE_SignatureOnData.

public DigitalSignatureValue SignData(ReadOnlySpan<byte> content, string signatureId, SignatureDataStatus dataStatus = SignatureDataStatus.Unencrypted)

Parameters

content ReadOnlySpan<byte>

The resource bytes in the representation dataStatus names.

signatureId string

The unique identifier of the signature.

dataStatus SignatureDataStatus

Which representation of the resource content is (§15-8.11.6). Protected datasets are normally signed Unencrypted.

Returns

DigitalSignatureValue

The signature.

Remarks

This method is synchronous and CPU-bound.

SignDataAsync(Stream, string, SignatureDataStatus, CancellationToken)

Signs a resource read from a stream, producing an S100_SE_SignatureOnData.

public Task<DigitalSignatureValue> SignDataAsync(Stream content, string signatureId, SignatureDataStatus dataStatus = SignatureDataStatus.Unencrypted, CancellationToken cancellationToken = default)

Parameters

content Stream

A stream of the resource bytes in the representation dataStatus names. It is read to its end and not disposed.

signatureId string

The unique identifier of the signature.

dataStatus SignatureDataStatus

Which representation of the resource content is.

cancellationToken CancellationToken

A token to cancel reading the stream.

Returns

Task<DigitalSignatureValue>

The signature.

SignSignature(DigitalSignatureValue, string)

Countersigns another signature, producing an S100_SE_SignatureOnSignature (§15-8.11.5), for example a distributor endorsing a producer's signature.

public DigitalSignatureValue SignSignature(DigitalSignatureValue signature, string signatureId)

Parameters

signature DigitalSignatureValue

The signature to countersign.

signatureId string

The unique identifier of the new signature.

Returns

DigitalSignatureValue

The signature, referencing signature by its identifier.

Remarks

This method is synchronous and CPU-bound.

SignStandalone(ReadOnlySpan<byte>, string, string)

Signs a file's bytes as a standalone signature document, the form of PERMIT.SIGN and CATALOG.SIGN (§15-8.11.2).

public StandaloneDigitalSignature SignStandalone(ReadOnlySpan<byte> content, string fileName, string signatureId = "signature")

Parameters

content ReadOnlySpan<byte>

The exact bytes of the signed file.

fileName string

The name of the signed file, for example PERMIT.XML.

signatureId string

The unique identifier of the signature.

Returns

StandaloneDigitalSignature

The standalone signature; write it with StandaloneDigitalSignatureWriter.

Remarks

This method is synchronous and CPU-bound.

Edit this page