Java Code Examples for sun.security.util.DerInputStream#getDerValue()

/**
 * Parse (unmarshal) a kerberostime from a DER input stream.  This form
 * parsing might be used when expanding a value which is part of
 * a constructed sequence and uses explicitly tagged type.
 *
 * @exception Asn1Exception on error.
 * @param data the Der input stream value, which contains
 *             one or more marshaled value.
 * @param explicitTag tag number.
 * @param optional indicates if this data field is optional
 * @return an instance of KerberosTime.
 *
 */
public static KerberosTime parse(
        DerInputStream data, byte explicitTag, boolean optional)
        throws Asn1Exception, IOException {
    if ((optional) && (((byte)data.peekByte() & (byte)0x1F)!= explicitTag))
        return null;
    DerValue der = data.getDerValue();
    if (explicitTag != (der.getTag() & (byte)0x1F))  {
        throw new Asn1Exception(Krb5.ASN1_BAD_ID);
    }
    else {
        DerValue subDer = der.getData().getDerValue();
        Date temp = subDer.getGeneralizedTime();
        return new KerberosTime(temp.getTime(), 0);
    }
}
 

@SuppressWarnings("fallthrough")
private static void checkPKCS8Encoding(byte[] encodedKey)
    throws IOException {
    DerInputStream in = new DerInputStream(encodedKey);
    DerValue[] values = in.getSequence(3);

    switch (values.length) {
    case 4:
        checkTag(values[3], DerValue.TAG_CONTEXT, "attributes");
        /* fall through */
    case 3:
        checkTag(values[0], DerValue.tag_Integer, "version");
        DerInputStream algid = values[1].toDerInputStream();
        algid.getOID();
        if (algid.available() != 0) {
            algid.getDerValue();
        }
        checkTag(values[2], DerValue.tag_OctetString, "privateKey");
        break;
    default:
        throw new IOException("invalid key encoding");
    }
}
 

@SuppressWarnings("fallthrough")
private static void checkPKCS8Encoding(byte[] encodedKey)
    throws IOException {
    DerInputStream in = new DerInputStream(encodedKey);
    DerValue[] values = in.getSequence(3);

    switch (values.length) {
    case 4:
        checkTag(values[3], DerValue.TAG_CONTEXT, "attributes");
        /* fall through */
    case 3:
        checkTag(values[0], DerValue.tag_Integer, "version");
        DerInputStream algid = values[1].toDerInputStream();
        algid.getOID();
        if (algid.available() != 0) {
            algid.getDerValue();
        }
        checkTag(values[2], DerValue.tag_OctetString, "privateKey");
        break;
    default:
        throw new IOException("invalid key encoding");
    }
}
 

/**
 * Parse (unmarshal) a kerberostime from a DER input stream.  This form
 * parsing might be used when expanding a value which is part of
 * a constructed sequence and uses explicitly tagged type.
 *
 * @exception Asn1Exception on error.
 * @param data the Der input stream value, which contains
 *             one or more marshaled value.
 * @param explicitTag tag number.
 * @param optional indicates if this data field is optional
 * @return an instance of KerberosTime.
 *
 */
public static KerberosTime parse(
        DerInputStream data, byte explicitTag, boolean optional)
        throws Asn1Exception, IOException {
    if ((optional) && (((byte)data.peekByte() & (byte)0x1F)!= explicitTag))
        return null;
    DerValue der = data.getDerValue();
    if (explicitTag != (der.getTag() & (byte)0x1F))  {
        throw new Asn1Exception(Krb5.ASN1_BAD_ID);
    }
    else {
        DerValue subDer = der.getData().getDerValue();
        Date temp = subDer.getGeneralizedTime();
        return new KerberosTime(temp.getTime(), 0);
    }
}
 

/**
 * Parse (unmarshal) a kerberostime from a DER input stream.  This form
 * parsing might be used when expanding a value which is part of
 * a constructed sequence and uses explicitly tagged type.
 *
 * @exception Asn1Exception on error.
 * @param data the Der input stream value, which contains
 *             one or more marshaled value.
 * @param explicitTag tag number.
 * @param optional indicates if this data field is optional
 * @return an instance of KerberosTime.
 *
 */
public static KerberosTime parse(
        DerInputStream data, byte explicitTag, boolean optional)
        throws Asn1Exception, IOException {
    if ((optional) && (((byte)data.peekByte() & (byte)0x1F)!= explicitTag))
        return null;
    DerValue der = data.getDerValue();
    if (explicitTag != (der.getTag() & (byte)0x1F))  {
        throw new Asn1Exception(Krb5.ASN1_BAD_ID);
    }
    else {
        DerValue subDer = der.getData().getDerValue();
        Date temp = subDer.getGeneralizedTime();
        return new KerberosTime(temp.getTime(), 0);
    }
}
 

/**
 * Parse (unmarshal) a kerberostime from a DER input stream.  This form
 * parsing might be used when expanding a value which is part of
 * a constructed sequence and uses explicitly tagged type.
 *
 * @exception Asn1Exception on error.
 * @param data the Der input stream value, which contains
 *             one or more marshaled value.
 * @param explicitTag tag number.
 * @param optional indicates if this data field is optional
 * @return an instance of KerberosTime.
 *
 */
public static KerberosTime parse(
        DerInputStream data, byte explicitTag, boolean optional)
        throws Asn1Exception, IOException {
    if ((optional) && (((byte)data.peekByte() & (byte)0x1F)!= explicitTag))
        return null;
    DerValue der = data.getDerValue();
    if (explicitTag != (der.getTag() & (byte)0x1F))  {
        throw new Asn1Exception(Krb5.ASN1_BAD_ID);
    }
    else {
        DerValue subDer = der.getData().getDerValue();
        Date temp = subDer.getGeneralizedTime();
        return new KerberosTime(temp.getTime(), 0);
    }
}
 

@SuppressWarnings("fallthrough")
private static void checkPKCS8Encoding(byte[] encodedKey)
    throws IOException {
    DerInputStream in = new DerInputStream(encodedKey);
    DerValue[] values = in.getSequence(3);

    switch (values.length) {
    case 4:
        checkTag(values[3], DerValue.TAG_CONTEXT, "attributes");
        /* fall through */
    case 3:
        checkTag(values[0], DerValue.tag_Integer, "version");
        DerInputStream algid = values[1].toDerInputStream();
        algid.getOID();
        if (algid.available() != 0) {
            algid.getDerValue();
        }
        checkTag(values[2], DerValue.tag_OctetString, "privateKey");
        break;
    default:
        throw new IOException("invalid key encoding");
    }
}
 

/**
 * Parse (unmarshal) a kerberostime from a DER input stream.  This form
 * parsing might be used when expanding a value which is part of
 * a constructed sequence and uses explicitly tagged type.
 *
 * @exception Asn1Exception on error.
 * @param data the Der input stream value, which contains
 *             one or more marshaled value.
 * @param explicitTag tag number.
 * @param optional indicates if this data field is optional
 * @return an instance of KerberosTime.
 *
 */
public static KerberosTime parse(
        DerInputStream data, byte explicitTag, boolean optional)
        throws Asn1Exception, IOException {
    if ((optional) && (((byte)data.peekByte() & (byte)0x1F)!= explicitTag))
        return null;
    DerValue der = data.getDerValue();
    if (explicitTag != (der.getTag() & (byte)0x1F))  {
        throw new Asn1Exception(Krb5.ASN1_BAD_ID);
    }
    else {
        DerValue subDer = der.getData().getDerValue();
        Date temp = subDer.getGeneralizedTime();
        return new KerberosTime(temp.getTime(), 0);
    }
}
 

private AlgorithmParameters parseAlgParameters(ObjectIdentifier algorithm,
    DerInputStream in) throws IOException
{
    AlgorithmParameters algParams = null;
    try {
        DerValue params;
        if (in.available() == 0) {
            params = null;
        } else {
            params = in.getDerValue();
            if (params.tag == DerValue.tag_Null) {
               params = null;
            }
        }
        if (params != null) {
            if (algorithm.equals((Object)pbes2_OID)) {
                algParams = AlgorithmParameters.getInstance("PBES2");
            } else {
                algParams = AlgorithmParameters.getInstance("PBE");
            }
            algParams.init(params.toByteArray());
        }
    } catch (Exception e) {
       throw new IOException("parseAlgParameters failed: " +
                             e.getMessage(), e);
    }
    return algParams;
}
 

private AlgorithmParameters parseAlgParameters(ObjectIdentifier algorithm,
    DerInputStream in) throws IOException
{
    AlgorithmParameters algParams = null;
    try {
        DerValue params;
        if (in.available() == 0) {
            params = null;
        } else {
            params = in.getDerValue();
            if (params.tag == DerValue.tag_Null) {
               params = null;
            }
        }
        if (params != null) {
            if (algorithm.equals((Object)pbes2_OID)) {
                algParams = AlgorithmParameters.getInstance("PBES2");
            } else {
                algParams = AlgorithmParameters.getInstance("PBE");
            }
            algParams.init(params.toByteArray());
        }
    } catch (Exception e) {
       throw new IOException("parseAlgParameters failed: " +
                             e.getMessage(), e);
    }
    return algParams;
}
 

private AlgorithmParameters parseAlgParameters(ObjectIdentifier algorithm,
    DerInputStream in) throws IOException
{
    AlgorithmParameters algParams = null;
    try {
        DerValue params;
        if (in.available() == 0) {
            params = null;
        } else {
            params = in.getDerValue();
            if (params.tag == DerValue.tag_Null) {
               params = null;
            }
        }
        if (params != null) {
            if (algorithm.equals((Object)pbes2_OID)) {
                algParams = AlgorithmParameters.getInstance("PBES2");
            } else {
                algParams = AlgorithmParameters.getInstance("PBE");
            }
            algParams.init(params.toByteArray());
        }
    } catch (Exception e) {
       throw new IOException("parseAlgParameters failed: " +
                             e.getMessage(), e);
    }
    return algParams;
}
 

private AlgorithmParameters parseAlgParameters(ObjectIdentifier algorithm,
    DerInputStream in) throws IOException
{
    AlgorithmParameters algParams = null;
    try {
        DerValue params;
        if (in.available() == 0) {
            params = null;
        } else {
            params = in.getDerValue();
            if (params.tag == DerValue.tag_Null) {
               params = null;
            }
        }
        if (params != null) {
            if (algorithm.equals((Object)pbes2_OID)) {
                algParams = AlgorithmParameters.getInstance("PBES2");
            } else {
                algParams = AlgorithmParameters.getInstance("PBE");
            }
            algParams.init(params.toByteArray());
        }
    } catch (Exception e) {
       throw new IOException("parseAlgParameters failed: " +
                             e.getMessage(), e);
    }
    return algParams;
}
 

private AlgorithmParameters parseAlgParameters(ObjectIdentifier algorithm,
    DerInputStream in) throws IOException
{
    AlgorithmParameters algParams = null;
    try {
        DerValue params;
        if (in.available() == 0) {
            params = null;
        } else {
            params = in.getDerValue();
            if (params.tag == DerValue.tag_Null) {
               params = null;
            }
        }
        if (params != null) {
            if (algorithm.equals((Object)pbes2_OID)) {
                algParams = AlgorithmParameters.getInstance("PBES2");
            } else {
                algParams = AlgorithmParameters.getInstance("PBE");
            }
            algParams.init(params.toByteArray());
        }
    } catch (Exception e) {
       throw new IOException("parseAlgParameters failed: " +
                             e.getMessage(), e);
    }
    return algParams;
}
 

private AlgorithmParameters parseAlgParameters(ObjectIdentifier algorithm,
    DerInputStream in) throws IOException
{
    AlgorithmParameters algParams = null;
    try {
        DerValue params;
        if (in.available() == 0) {
            params = null;
        } else {
            params = in.getDerValue();
            if (params.tag == DerValue.tag_Null) {
               params = null;
            }
        }
        if (params != null) {
            if (algorithm.equals((Object)pbes2_OID)) {
                algParams = AlgorithmParameters.getInstance("PBES2");
            } else {
                algParams = AlgorithmParameters.getInstance("PBE");
            }
            algParams.init(params.toByteArray());
        }
    } catch (Exception e) {
       throw new IOException("parseAlgParameters failed: " +
                             e.getMessage(), e);
    }
    return algParams;
}
 

/**
 * Parses a PKCS#7 signer info.
 *
 * <p>This constructor is used only for backwards compatibility with
 * PKCS#7 blocks that were generated using JDK1.1.x.
 *
 * @param derin the ASN.1 encoding of the signer info.
 * @param oldStyle flag indicating whether or not the given signer info
 * is encoded according to JDK1.1.x.
 */
public SignerInfo(DerInputStream derin, boolean oldStyle)
    throws IOException, ParsingException
{
    // version
    version = derin.getBigInteger();

    // issuerAndSerialNumber
    DerValue[] issuerAndSerialNumber = derin.getSequence(2);
    byte[] issuerBytes = issuerAndSerialNumber[0].toByteArray();
    issuerName = new X500Name(new DerValue(DerValue.tag_Sequence,
                                           issuerBytes));
    certificateSerialNumber = issuerAndSerialNumber[1].getBigInteger();

    // digestAlgorithmId
    DerValue tmp = derin.getDerValue();

    digestAlgorithmId = AlgorithmId.parse(tmp);

    // authenticatedAttributes
    if (oldStyle) {
        // In JDK1.1.x, the authenticatedAttributes are always present,
        // encoded as an empty Set (Set of length zero)
        derin.getSet(0);
    } else {
        // check if set of auth attributes (implicit tag) is provided
        // (auth attributes are OPTIONAL)
        if ((byte)(derin.peekByte()) == (byte)0xA0) {
            authenticatedAttributes = new PKCS9Attributes(derin);
        }
    }

    // digestEncryptionAlgorithmId - little RSA naming scheme -
    // signature == encryption...
    tmp = derin.getDerValue();

    digestEncryptionAlgorithmId = AlgorithmId.parse(tmp);

    // encryptedDigest
    encryptedDigest = derin.getOctetString();

    // unauthenticatedAttributes
    if (oldStyle) {
        // In JDK1.1.x, the unauthenticatedAttributes are always present,
        // encoded as an empty Set (Set of length zero)
        derin.getSet(0);
    } else {
        // check if set of unauth attributes (implicit tag) is provided
        // (unauth attributes are OPTIONAL)
        if (derin.available() != 0
            && (byte)(derin.peekByte()) == (byte)0xA1) {
            unauthenticatedAttributes =
                new PKCS9Attributes(derin, true);// ignore unsupported attrs
        }
    }

    // all done
    if (derin.available() != 0) {
        throw new ParsingException("extra data at the end");
    }
}
 

/**
 * Creates a critical IssuingDistributionPointExtension from its
 * DER-encoding.
 *
 * @param critical true if the extension is to be treated as critical.
 * @param value the DER-encoded value. It must be a <code>byte[]</code>.
 * @exception IOException on decoding error.
 */
public IssuingDistributionPointExtension(Boolean critical, Object value)
        throws IOException {
    this.extensionId = PKIXExtensions.IssuingDistributionPoint_Id;
    this.critical = critical.booleanValue();

    if (!(value instanceof byte[])) {
        throw new IOException("Illegal argument type");
    }

    extensionValue = (byte[])value;
    DerValue val = new DerValue(extensionValue);
    if (val.tag != DerValue.tag_Sequence) {
        throw new IOException("Invalid encoding for " +
                              "IssuingDistributionPointExtension.");
    }

    // All the elements in issuingDistributionPoint are optional
    if ((val.data == null) || (val.data.available() == 0)) {
        return;
    }

    DerInputStream in = val.data;
    while (in != null && in.available() != 0) {
        DerValue opt = in.getDerValue();

        if (opt.isContextSpecific(TAG_DISTRIBUTION_POINT) &&
            opt.isConstructed()) {
            distributionPoint =
                new DistributionPointName(opt.data.getDerValue());
        } else if (opt.isContextSpecific(TAG_ONLY_USER_CERTS) &&
                   !opt.isConstructed()) {
            opt.resetTag(DerValue.tag_Boolean);
            hasOnlyUserCerts = opt.getBoolean();
        } else if (opt.isContextSpecific(TAG_ONLY_CA_CERTS) &&
              !opt.isConstructed()) {
            opt.resetTag(DerValue.tag_Boolean);
            hasOnlyCACerts = opt.getBoolean();
        } else if (opt.isContextSpecific(TAG_ONLY_SOME_REASONS) &&
                   !opt.isConstructed()) {
            revocationReasons = new ReasonFlags(opt); // expects tag implicit
        } else if (opt.isContextSpecific(TAG_INDIRECT_CRL) &&
                   !opt.isConstructed()) {
            opt.resetTag(DerValue.tag_Boolean);
            isIndirectCRL = opt.getBoolean();
        } else if (opt.isContextSpecific(TAG_ONLY_ATTRIBUTE_CERTS) &&
                   !opt.isConstructed()) {
            opt.resetTag(DerValue.tag_Boolean);
            hasOnlyAttributeCerts = opt.getBoolean();
        } else {
            throw new IOException
                ("Invalid encoding of IssuingDistributionPoint");
        }
    }
}
 

/**
 * Creates a critical IssuingDistributionPointExtension from its
 * DER-encoding.
 *
 * @param critical true if the extension is to be treated as critical.
 * @param value the DER-encoded value. It must be a <code>byte[]</code>.
 * @exception IOException on decoding error.
 */
public IssuingDistributionPointExtension(Boolean critical, Object value)
        throws IOException {
    this.extensionId = PKIXExtensions.IssuingDistributionPoint_Id;
    this.critical = critical.booleanValue();

    if (!(value instanceof byte[])) {
        throw new IOException("Illegal argument type");
    }

    extensionValue = (byte[])value;
    DerValue val = new DerValue(extensionValue);
    if (val.tag != DerValue.tag_Sequence) {
        throw new IOException("Invalid encoding for " +
                              "IssuingDistributionPointExtension.");
    }

    // All the elements in issuingDistributionPoint are optional
    if ((val.data == null) || (val.data.available() == 0)) {
        return;
    }

    DerInputStream in = val.data;
    while (in != null && in.available() != 0) {
        DerValue opt = in.getDerValue();

        if (opt.isContextSpecific(TAG_DISTRIBUTION_POINT) &&
            opt.isConstructed()) {
            distributionPoint =
                new DistributionPointName(opt.data.getDerValue());
        } else if (opt.isContextSpecific(TAG_ONLY_USER_CERTS) &&
                   !opt.isConstructed()) {
            opt.resetTag(DerValue.tag_Boolean);
            hasOnlyUserCerts = opt.getBoolean();
        } else if (opt.isContextSpecific(TAG_ONLY_CA_CERTS) &&
              !opt.isConstructed()) {
            opt.resetTag(DerValue.tag_Boolean);
            hasOnlyCACerts = opt.getBoolean();
        } else if (opt.isContextSpecific(TAG_ONLY_SOME_REASONS) &&
                   !opt.isConstructed()) {
            revocationReasons = new ReasonFlags(opt); // expects tag implicit
        } else if (opt.isContextSpecific(TAG_INDIRECT_CRL) &&
                   !opt.isConstructed()) {
            opt.resetTag(DerValue.tag_Boolean);
            isIndirectCRL = opt.getBoolean();
        } else if (opt.isContextSpecific(TAG_ONLY_ATTRIBUTE_CERTS) &&
                   !opt.isConstructed()) {
            opt.resetTag(DerValue.tag_Boolean);
            hasOnlyAttributeCerts = opt.getBoolean();
        } else {
            throw new IOException
                ("Invalid encoding of IssuingDistributionPoint");
        }
    }
}
 

/**
 * Parses a PKCS#7 signer info.
 *
 * <p>This constructor is used only for backwards compatibility with
 * PKCS#7 blocks that were generated using JDK1.1.x.
 *
 * @param derin the ASN.1 encoding of the signer info.
 * @param oldStyle flag indicating whether or not the given signer info
 * is encoded according to JDK1.1.x.
 */
public SignerInfo(DerInputStream derin, boolean oldStyle)
    throws IOException, ParsingException
{
    // version
    version = derin.getBigInteger();

    // issuerAndSerialNumber
    DerValue[] issuerAndSerialNumber = derin.getSequence(2);
    byte[] issuerBytes = issuerAndSerialNumber[0].toByteArray();
    issuerName = new X500Name(new DerValue(DerValue.tag_Sequence,
                                           issuerBytes));
    certificateSerialNumber = issuerAndSerialNumber[1].getBigInteger();

    // digestAlgorithmId
    DerValue tmp = derin.getDerValue();

    digestAlgorithmId = AlgorithmId.parse(tmp);

    // authenticatedAttributes
    if (oldStyle) {
        // In JDK1.1.x, the authenticatedAttributes are always present,
        // encoded as an empty Set (Set of length zero)
        derin.getSet(0);
    } else {
        // check if set of auth attributes (implicit tag) is provided
        // (auth attributes are OPTIONAL)
        if ((byte)(derin.peekByte()) == (byte)0xA0) {
            authenticatedAttributes = new PKCS9Attributes(derin);
        }
    }

    // digestEncryptionAlgorithmId - little RSA naming scheme -
    // signature == encryption...
    tmp = derin.getDerValue();

    digestEncryptionAlgorithmId = AlgorithmId.parse(tmp);

    // encryptedDigest
    encryptedDigest = derin.getOctetString();

    // unauthenticatedAttributes
    if (oldStyle) {
        // In JDK1.1.x, the unauthenticatedAttributes are always present,
        // encoded as an empty Set (Set of length zero)
        derin.getSet(0);
    } else {
        // check if set of unauth attributes (implicit tag) is provided
        // (unauth attributes are OPTIONAL)
        if (derin.available() != 0
            && (byte)(derin.peekByte()) == (byte)0xA1) {
            unauthenticatedAttributes =
                new PKCS9Attributes(derin, true);// ignore unsupported attrs
        }
    }

    // all done
    if (derin.available() != 0) {
        throw new ParsingException("extra data at the end");
    }
}
 

/**
 * Creates a critical IssuingDistributionPointExtension from its
 * DER-encoding.
 *
 * @param critical true if the extension is to be treated as critical.
 * @param value the DER-encoded value. It must be a <code>byte[]</code>.
 * @exception IOException on decoding error.
 */
public IssuingDistributionPointExtension(Boolean critical, Object value)
        throws IOException {
    this.extensionId = PKIXExtensions.IssuingDistributionPoint_Id;
    this.critical = critical.booleanValue();

    if (!(value instanceof byte[])) {
        throw new IOException("Illegal argument type");
    }

    extensionValue = (byte[])value;
    DerValue val = new DerValue(extensionValue);
    if (val.tag != DerValue.tag_Sequence) {
        throw new IOException("Invalid encoding for " +
                              "IssuingDistributionPointExtension.");
    }

    // All the elements in issuingDistributionPoint are optional
    if ((val.data == null) || (val.data.available() == 0)) {
        return;
    }

    DerInputStream in = val.data;
    while (in != null && in.available() != 0) {
        DerValue opt = in.getDerValue();

        if (opt.isContextSpecific(TAG_DISTRIBUTION_POINT) &&
            opt.isConstructed()) {
            distributionPoint =
                new DistributionPointName(opt.data.getDerValue());
        } else if (opt.isContextSpecific(TAG_ONLY_USER_CERTS) &&
                   !opt.isConstructed()) {
            opt.resetTag(DerValue.tag_Boolean);
            hasOnlyUserCerts = opt.getBoolean();
        } else if (opt.isContextSpecific(TAG_ONLY_CA_CERTS) &&
              !opt.isConstructed()) {
            opt.resetTag(DerValue.tag_Boolean);
            hasOnlyCACerts = opt.getBoolean();
        } else if (opt.isContextSpecific(TAG_ONLY_SOME_REASONS) &&
                   !opt.isConstructed()) {
            revocationReasons = new ReasonFlags(opt); // expects tag implicit
        } else if (opt.isContextSpecific(TAG_INDIRECT_CRL) &&
                   !opt.isConstructed()) {
            opt.resetTag(DerValue.tag_Boolean);
            isIndirectCRL = opt.getBoolean();
        } else if (opt.isContextSpecific(TAG_ONLY_ATTRIBUTE_CERTS) &&
                   !opt.isConstructed()) {
            opt.resetTag(DerValue.tag_Boolean);
            hasOnlyAttributeCerts = opt.getBoolean();
        } else {
            throw new IOException
                ("Invalid encoding of IssuingDistributionPoint");
        }
    }
}
 

/**
 * Decode this set of PKCS9 attributes from the contents of its
 * DER encoding. Ignores unsupported attributes when directed.
 *
 * @param in
 * the contents of the DER encoding of the attribute set.
 *
 * @exception IOException
 * on i/o error, encoding syntax error, unacceptable or
 * unsupported attribute, or duplicate attribute.
 */
private byte[] decode(DerInputStream in) throws IOException {

    DerValue val = in.getDerValue();

    // save the DER encoding with its proper tag byte.
    byte[] derEncoding = val.toByteArray();
    derEncoding[0] = DerValue.tag_SetOf;

    DerInputStream derIn = new DerInputStream(derEncoding);
    DerValue[] derVals = derIn.getSet(3,true);

    PKCS9Attribute attrib;
    ObjectIdentifier oid;
    boolean reuseEncoding = true;

    for (int i=0; i < derVals.length; i++) {

        try {
            attrib = new PKCS9Attribute(derVals[i]);

        } catch (ParsingException e) {
            if (ignoreUnsupportedAttributes) {
                reuseEncoding = false; // cannot reuse supplied DER encoding
                continue; // skip
            } else {
                throw e;
            }
        }
        oid = attrib.getOID();

        if (attributes.get(oid) != null)
            throw new IOException("Duplicate PKCS9 attribute: " + oid);

        if (permittedAttributes != null &&
            !permittedAttributes.containsKey(oid))
            throw new IOException("Attribute " + oid +
                                  " not permitted in this attribute set");

        attributes.put(oid, attrib);
    }
    return reuseEncoding ? derEncoding : generateDerEncoding();
}