在 Java 中管理 XAdES 签名的库

Library to manage XAdES signatures in Java

提问by Jhack

I'm looking for a Java library that allows the creation and verification of XAdES signatures (the more formats, the better: XAdES-BES, XAdES-C, XAdES-X-L, etc.).

我正在寻找一个允许创建和验证 XAdES 签名的 Java 库（格式越多越好：XAdES-BES、XAdES-C、XAdES-XL 等）。

The most interesting implementations I found are:

我发现的最有趣的实现是：

• Java XML Digital Signature API (JSR 105) (= the one included in Java SE 6), which is based on the following one;
• Apache Santuario (http://santuario.apache.org/), which provides an useful support only for basic features;
• XAdES4j (http://code.google.com/p/xades4j/, nice presentation: http://prezi.com/06vyxbgohncv/xades4j-en/), which seems to be interesting, because it "enables producing, verifying and extending signatures in the main XAdES forms: XAdES-BES, XAdES-EPES, XAdES-T and XAdES-C. Also, extended forms are supported through the enrichment of an existing signature". However it's the result of a thesys and it's followed only by a developer;
• eID Digital Signature Service (http://code.google.com/p/eid-dss/), which is developed by the Belgium Federal ICT Department and supports the XAdES-X-L format.

• Java XML Digital Signature API (JSR 105)（= Java SE 6 中包含的那个），它基于以下一个；
• Apache Santuario ( http://santuario.apache.org/)，它只为基本功能提供有用的支持；
• XAdES4j（http://code.google.com/p/xades4j/，不错的演示文稿：http: //prezi.com/06vyxbgohncv/xades4j-en/ ），这似乎很有趣，因为它“使生产、验证和在主要 XAdES 形式中扩展签名：XAdES-BES、XAdES-EPES、XAdES-T 和 XAdES-C。此外，通过丰富现有签名支持扩展形式”。然而，这是一个thesys的结果，只有开发人员遵循；
• eID 数字签名服务 ( http://code.google.com/p/eid-dss/)，由比利时联邦 ICT 部门开发，支持 XAdES-XL 格式。

Which one would you suggest to use or to build on?

您建议使用哪一个？

回答by spikeheap

We have recently completed a project using XAdES-BES signatures in both enveloped and enveloping forms. We chose the XAdES4j project because it seemed the most complete, and XAdES was a core requirement.

我们最近完成了一个使用 XAdES-BES 签名的封装和封装形式的项目。我们选择 XAdES4j 项目是因为它看起来最完整，而且 XAdES 是核心需求。

The support on the Q&A section is sometimes slow, and and only the most obvious use case is well documented. That said the library is well tested, excellently designed, and very useful.

Q&A 部分的支持有时很慢，并且只有最明显的用例才有详细记录。也就是说，该库经过了良好的测试、出色的设计并且非常有用。

We spent a couple of weeks getting our heads around it and I would now recommend it as a platform.

我们花了几个星期的时间来了解它，现在我将它推荐为一个平台。

The only caveat is that (as you say) it is the production of an academic project, so how much support it will receive in the future is anyone's guess. If you pick it up and buy into it then consider contributing, and it might pick up a bit of speed.

唯一需要注意的是（如你所说）它是一个学术项目的生产，所以它在未来会得到多少支持是任何人的猜测。如果你拿起它并购买它，然后考虑贡献，它可能会加快一点速度。

回答by user2277870

You can look at the "Componentes de firma", a LGPL suite of components created and mantained by the Spanish government. It's a full cryptographic suite that supports creation and validation of the following XAdES formats:

您可以查看“Componentes de Firma”，这是西班牙政府创建和维护的 LGPL 组件套件。它是一个完整的加密套件，支持创建和验证以下 XAdES 格式：

• XAdES-BES
• XAdES-T
• XAdES-C
• XAdES-X
• XAdES-XL
• XAdES-EPES

• XAdES-BES
• XAdES-T
• XAdES-C
• XAdES-X
• XAdES-XL
• XAdES-EPES

With detached, enveloped, enveloping and mixed signatures.

带有分离式、封闭式、封闭式和混合式签名。

Detailed description of the XAdES signatures can be found at http://oficinavirtual.mityc.es/componentes/MITyCLibXADES/index.html, and the download site is http://oficinavirtual.mityc.es/componentes/downloads.html

XAdES 签名的详细描述可以在http://oficinavirtual.mityc.es/componentes/MITyCLibXADES/index.html找到，下载地址是http://oficinavirtual.mityc.es/componentes/downloads.html

回答by Eugene Mayevski 'Callback

Just to complete the list, XMLBlackboxpackage of our SecureBlackbox (Java edition) offers full support for all XAdES versions and is actively maintained and supported.

为了完成列表，我们 SecureBlackbox（Java 版）的XMLBlackbox包提供对所有 XAdES 版本的全面支持，并得到积极维护和支持。