SignedObject Class

Reference

Definition

Namespace:: Java.Security

Assembly:: Mono.Android.dll

Important

Some information relates to prerelease product that may be substantially modified before it’s released. Microsoft makes no warranties, express or implied, with respect to the information provided here.

SignedObject is a class for the purpose of creating authentic runtime objects whose integrity cannot be compromised without being detected.

[Android.Runtime.Register("java/security/SignedObject", DoNotGenerateAcw=true)]
public sealed class SignedObject : Java.Lang.Object, IDisposable, Java.Interop.IJavaPeerable, Java.IO.ISerializable

[<Android.Runtime.Register("java/security/SignedObject", DoNotGenerateAcw=true)>]
type SignedObject = class
    inherit Object
    interface ISerializable
    interface IJavaObject
    interface IDisposable
    interface IJavaPeerable

Inheritance: Object

Object
SignedObject

Attributes: RegisterAttribute

Implements: IJavaObject IJavaPeerable ISerializable IDisposable

Remarks

SignedObject is a class for the purpose of creating authentic runtime objects whose integrity cannot be compromised without being detected.

More specifically, a SignedObject contains another Serializable object, the (to-be-)signed object and its signature.

The signed object is a "deep copy" (in serialized form) of an original object. Once the copy is made, further manipulation of the original object has no side effect on the copy.

The underlying signing algorithm is designated by the Signature object passed to the constructor and the verify method. A typical usage for signing is the following:

{@code
            Signature signingEngine = Signature.getInstance(algorithm,
                                                            provider);
            SignedObject so = new SignedObject(myobject, signingKey,
                                               signingEngine);
            }

A typical usage for verification is the following (having received SignedObject so):

{@code
            Signature verificationEngine =
                Signature.getInstance(algorithm, provider);
            if (so.verify(publickey, verificationEngine))
                try {
                    Object myobj = so.getObject();
                } catch (java.lang.ClassNotFoundException e) {};
            }

Several points are worth noting. First, there is no need to initialize the signing or verification engine, as it will be re-initialized inside the constructor and the verify method. Secondly, for verification to succeed, the specified public key must be the public key corresponding to the private key used to generate the SignedObject.

More importantly, for flexibility reasons, the constructor and verify method allow for customized signature engines, which can implement signature algorithms that are not installed formally as part of a crypto provider. However, it is crucial that the programmer writing the verifier code be aware what Signature engine is being used, as its own implementation of the verify method is invoked to verify a signature. In other words, a malicious Signature may choose to always return true on verification in an attempt to bypass a security check.

The signature algorithm can be, among others, the NIST standard DSA, using DSA and SHA-256. The algorithm is specified using the same convention as that for signatures. The DSA algorithm using the SHA-256 message digest algorithm can be specified, for example, as "SHA256withDSA". In the case of RSA the signing algorithm could be specified as, for example, "SHA256withRSA". The algorithm name must be specified, as there is no default.

The name of the Cryptography Package Provider is designated also by the Signature parameter to the constructor and the verify method. If the provider is not specified, the default provider is used. Each installation can be configured to use a particular provider as default.

Potential applications of SignedObject include: <ul> <li> It can be used internally to any Java runtime as an unforgeable authorization token -- one that can be passed around without the fear that the token can be maliciously modified without being detected. <li> It can be used to sign and serialize data/object for storage outside the Java runtime (e.g., storing critical access control data on disk). <li> Nested SignedObjects can be used to construct a logical sequence of signatures, resembling a chain of authorization and delegation. </ul>

Added in 1.2.

Java documentation for java.security.SignedObject.

Portions of this page are modifications based on work created and shared by the Android Open Source Project and used according to terms described in the Creative Commons 2.5 Attribution License.

Constructors

SignedObject(ISerializable, IPrivateKey, Signature)

Constructs a SignedObject from any Serializable object.

Properties

Algorithm	Retrieves the name of the signature algorithm.
Class	Returns the runtime class of this `Object`. (Inherited from Object)
Handle	The handle to the underlying Android instance. (Inherited from Object)
JniIdentityHashCode	(Inherited from Object)
JniPeerMembers
Object	Retrieves the encapsulated object.
PeerReference	(Inherited from Object)
ThresholdClass	This API supports the Mono for Android infrastructure and is not intended to be used directly from your code. (Inherited from Object)
ThresholdType	This API supports the Mono for Android infrastructure and is not intended to be used directly from your code. (Inherited from Object)

Methods

Clone()	Creates and returns a copy of this object. (Inherited from Object)
Dispose()	(Inherited from Object)
Dispose(Boolean)	(Inherited from Object)
Equals(Object)	Indicates whether some other object is "equal to" this one. (Inherited from Object)
GetHashCode()	Returns a hash code value for the object. (Inherited from Object)
GetSignature()	Retrieves the signature on the signed object, in the form of a byte array.
JavaFinalize()	Called by the garbage collector on an object when garbage collection determines that there are no more references to the object. (Inherited from Object)
Notify()	Wakes up a single thread that is waiting on this object's monitor. (Inherited from Object)
NotifyAll()	Wakes up all threads that are waiting on this object's monitor. (Inherited from Object)
SetHandle(IntPtr, JniHandleOwnership)	Sets the Handle property. (Inherited from Object)
ToArray<T>()	(Inherited from Object)
ToString()	Returns a string representation of the object. (Inherited from Object)
UnregisterFromRuntime()	(Inherited from Object)
Verify(IPublicKey, Signature)	Verifies that the signature in this SignedObject is the valid signature for the object stored inside, with the given verification key, using the designated verification engine.
Wait()	Causes the current thread to wait until it is awakened, typically by being <em>notified</em> or <em>interrupted</em>. (Inherited from Object)
Wait(Int64, Int32)	Causes the current thread to wait until it is awakened, typically by being <em>notified</em> or <em>interrupted</em>, or until a certain amount of real time has elapsed. (Inherited from Object)
Wait(Int64)	Causes the current thread to wait until it is awakened, typically by being <em>notified</em> or <em>interrupted</em>, or until a certain amount of real time has elapsed. (Inherited from Object)

Explicit Interface Implementations

IJavaPeerable.Disposed()	(Inherited from Object)
IJavaPeerable.DisposeUnlessReferenced()	(Inherited from Object)
IJavaPeerable.Finalized()	(Inherited from Object)
IJavaPeerable.JniManagedPeerState	(Inherited from Object)
IJavaPeerable.SetJniIdentityHashCode(Int32)	(Inherited from Object)
IJavaPeerable.SetJniManagedPeerState(JniManagedPeerStates)	(Inherited from Object)
IJavaPeerable.SetPeerReference(JniObjectReference)	(Inherited from Object)

Extension Methods

JavaCast<TResult>(IJavaObject)	Performs an Android runtime-checked type conversion.
JavaCast<TResult>(IJavaObject)
GetJniTypeName(IJavaPeerable)

Applies to

Share via