initial TSP classes

9 files changed, 2053 insertions, 0 deletions

diff --git a/crypto/j2me/org/bouncycastle/tsp/TSPUtil.java b/crypto/j2me/org/bouncycastle/tsp/TSPUtil.java
new file mode 100644
index 000000000..daa51cdbb
--- /dev/null
+++ b/crypto/j2me/org/bouncycastle/tsp/TSPUtil.java
@@ -0,0 +1,233 @@
+package org.bouncycastle.tsp;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.OutputStream;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import org.bouncycastle.asn1.ASN1Encodable;
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.ASN1InputStream;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.ASN1OctetString;
+import org.bouncycastle.asn1.ASN1Set;
+import org.bouncycastle.asn1.cms.Attribute;
+import org.bouncycastle.asn1.cms.AttributeTable;
+import org.bouncycastle.asn1.cms.ContentInfo;
+import org.bouncycastle.asn1.cryptopro.CryptoProObjectIdentifiers;
+import org.bouncycastle.asn1.nist.NISTObjectIdentifiers;
+import org.bouncycastle.asn1.oiw.OIWObjectIdentifiers;
+import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
+import org.bouncycastle.asn1.teletrust.TeleTrusTObjectIdentifiers;
+import org.bouncycastle.asn1.x509.ExtendedKeyUsage;
+import org.bouncycastle.asn1.x509.Extension;
+import org.bouncycastle.asn1.x509.Extensions;
+import org.bouncycastle.asn1.x509.ExtensionsGenerator;
+import org.bouncycastle.asn1.x509.KeyPurposeId;
+import org.bouncycastle.asn1.x509.X509Extensions;
+import org.bouncycastle.cert.X509CertificateHolder;
+import org.bouncycastle.cms.SignerInformation;
+import org.bouncycastle.operator.DigestCalculator;
+import org.bouncycastle.operator.DigestCalculatorProvider;
+import org.bouncycastle.operator.OperatorCreationException;
+import org.bouncycastle.util.Arrays;
+
+public class TSPUtil
+{
+    private static Set EMPTY_SET = Collections.unmodifiableSet(new HashSet());
+    private static List EMPTY_LIST = Collections.unmodifiableList(new ArrayList());
+
+    private static final Map digestLengths = new HashMap();
+    private static final Map digestNames = new HashMap();
+
+    static
+    {
+        digestLengths.put(PKCSObjectIdentifiers.md5.getId(), new Integer(16));
+        digestLengths.put(OIWObjectIdentifiers.idSHA1.getId(), new Integer(20));
+        digestLengths.put(NISTObjectIdentifiers.id_sha224.getId(), new Integer(28));
+        digestLengths.put(NISTObjectIdentifiers.id_sha256.getId(), new Integer(32));
+        digestLengths.put(NISTObjectIdentifiers.id_sha384.getId(), new Integer(48));
+        digestLengths.put(NISTObjectIdentifiers.id_sha512.getId(), new Integer(64));
+        digestLengths.put(TeleTrusTObjectIdentifiers.ripemd128.getId(), new Integer(16));
+        digestLengths.put(TeleTrusTObjectIdentifiers.ripemd160.getId(), new Integer(20));
+        digestLengths.put(TeleTrusTObjectIdentifiers.ripemd256.getId(), new Integer(32));
+        digestLengths.put(CryptoProObjectIdentifiers.gostR3411.getId(), new Integer(32));
+
+        digestNames.put(PKCSObjectIdentifiers.md5.getId(), "MD5");
+        digestNames.put(OIWObjectIdentifiers.idSHA1.getId(), "SHA1");
+        digestNames.put(NISTObjectIdentifiers.id_sha224.getId(), "SHA224");
+        digestNames.put(NISTObjectIdentifiers.id_sha256.getId(), "SHA256");
+        digestNames.put(NISTObjectIdentifiers.id_sha384.getId(), "SHA384");
+        digestNames.put(NISTObjectIdentifiers.id_sha512.getId(), "SHA512");
+        digestNames.put(PKCSObjectIdentifiers.sha1WithRSAEncryption.getId(), "SHA1");
+        digestNames.put(PKCSObjectIdentifiers.sha224WithRSAEncryption.getId(), "SHA224");
+        digestNames.put(PKCSObjectIdentifiers.sha256WithRSAEncryption.getId(), "SHA256");
+        digestNames.put(PKCSObjectIdentifiers.sha384WithRSAEncryption.getId(), "SHA384");
+        digestNames.put(PKCSObjectIdentifiers.sha512WithRSAEncryption.getId(), "SHA512");
+        digestNames.put(TeleTrusTObjectIdentifiers.ripemd128.getId(), "RIPEMD128");
+        digestNames.put(TeleTrusTObjectIdentifiers.ripemd160.getId(), "RIPEMD160");
+        digestNames.put(TeleTrusTObjectIdentifiers.ripemd256.getId(), "RIPEMD256");
+        digestNames.put(CryptoProObjectIdentifiers.gostR3411.getId(), "GOST3411");
+    }
+
+     /**
+     * Fetches the signature time-stamp attributes from a SignerInformation object.
+     * Checks that the MessageImprint for each time-stamp matches the signature field.
+     * (see RFC 3161 Appendix A).
+     *
+     * @param signerInfo a SignerInformation to search for time-stamps
+     * @param digCalcProvider provider for digest calculators
+     * @return a collection of TimeStampToken objects
+     * @throws TSPValidationException
+     */
+    public static Collection getSignatureTimestamps(SignerInformation signerInfo, DigestCalculatorProvider digCalcProvider)
+        throws TSPValidationException
+    {
+        List timestamps = new ArrayList();
+
+        AttributeTable unsignedAttrs = signerInfo.getUnsignedAttributes();
+        if (unsignedAttrs != null)
+        {
+            ASN1EncodableVector allTSAttrs = unsignedAttrs.getAll(
+                PKCSObjectIdentifiers.id_aa_signatureTimeStampToken);
+            for (int i = 0; i < allTSAttrs.size(); ++i)
+            {
+                Attribute tsAttr = (Attribute)allTSAttrs.get(i);
+                ASN1Set tsAttrValues = tsAttr.getAttrValues();
+                for (int j = 0; j < tsAttrValues.size(); ++j)
+                {
+                    try
+                    {
+                        ContentInfo contentInfo = ContentInfo.getInstance(tsAttrValues.getObjectAt(j));
+                        TimeStampToken timeStampToken = new TimeStampToken(contentInfo);
+                        TimeStampTokenInfo tstInfo = timeStampToken.getTimeStampInfo();
+
+                        DigestCalculator digCalc = digCalcProvider.get(tstInfo.getHashAlgorithm());
+
+                        OutputStream dOut = digCalc.getOutputStream();
+
+                        dOut.write(signerInfo.getSignature());
+                        dOut.close();
+
+                        byte[] expectedDigest = digCalc.getDigest();
+
+                        if (!Arrays.constantTimeAreEqual(expectedDigest, tstInfo.getMessageImprintDigest()))
+                        {
+                            throw new TSPValidationException("Incorrect digest in message imprint");
+                        }
+
+                        timestamps.add(timeStampToken);
+                    }
+                    catch (OperatorCreationException e)
+                    {
+                        throw new TSPValidationException("Unknown hash algorithm specified in timestamp");
+                    }
+                    catch (Exception e)
+                    {
+                        throw new TSPValidationException("Timestamp could not be parsed");
+                    }
+                }
+            }
+        }
+
+        return timestamps;
+    }
+
+    /**
+     * Validate the passed in certificate as being of the correct type to be used
+     * for time stamping. To be valid it must have an ExtendedKeyUsage extension
+     * which has a key purpose identifier of id-kp-timeStamping.
+     *
+     * @param cert the certificate of interest.
+     * @throws TSPValidationException if the certicate fails on one of the check points.
+     */
+    public static void validateCertificate(
+        X509CertificateHolder cert)
+        throws TSPValidationException
+    {
+        if (cert.toASN1Structure().getVersionNumber() != 3)
+        {
+            throw new IllegalArgumentException("Certificate must have an ExtendedKeyUsage extension.");
+        }
+
+        Extension ext = cert.getExtension(Extension.extendedKeyUsage);
+        if (ext == null)
+        {
+            throw new TSPValidationException("Certificate must have an ExtendedKeyUsage extension.");
+        }
+
+        if (!ext.isCritical())
+        {
+            throw new TSPValidationException("Certificate must have an ExtendedKeyUsage extension marked as critical.");
+        }
+
+        ExtendedKeyUsage    extKey = ExtendedKeyUsage.getInstance(ext.getParsedValue());
+
+        if (!extKey.hasKeyPurposeId(KeyPurposeId.id_kp_timeStamping) || extKey.size() != 1)
+        {
+            throw new TSPValidationException("ExtendedKeyUsage not solely time stamping.");
+        }
+    }
+
+    /*
+     * Return the digest algorithm using one of the standard JCA string
+     * representations rather than the algorithm identifier (if possible).
+     */
+    static String getDigestAlgName(
+        String digestAlgOID)
+    {
+        String digestName = (String)digestNames.get(digestAlgOID);
+
+        if (digestName != null)
+        {
+            return digestName;
+        }
+
+        return digestAlgOID;
+    }
+
+    static int getDigestLength(
+        String digestAlgOID)
+        throws TSPException
+    {
+        Integer length = (Integer)digestLengths.get(digestAlgOID);
+
+        if (length != null)
+        {
+            return length.intValue();
+        }
+
+        throw new TSPException("digest algorithm cannot be found.");
+    }
+
+    static List getExtensionOIDs(Extensions extensions)
+    {
+        if (extensions == null)
+        {
+            return EMPTY_LIST;
+        }
+
+        return Collections.unmodifiableList(java.util.Arrays.asList(extensions.getExtensionOIDs()));
+    }
+
+    static void addExtension(ExtensionsGenerator extGenerator, ASN1ObjectIdentifier oid, boolean isCritical, ASN1Encodable value)
+        throws TSPIOException
+    {
+        try
+        {
+            extGenerator.addExtension(oid, isCritical, value);
+        }
+        catch (IOException e)
+        {
+            throw new TSPIOException("cannot encode extension: " + e.getMessage(), e);
+        }
+    }
+}
diff --git a/crypto/j2me/org/bouncycastle/tsp/TimeStampRequest.java b/crypto/j2me/org/bouncycastle/tsp/TimeStampRequest.java
new file mode 100644
index 000000000..60c95faf7
--- /dev/null
+++ b/crypto/j2me/org/bouncycastle/tsp/TimeStampRequest.java
@@ -0,0 +1,290 @@
+package org.bouncycastle.tsp;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.math.BigInteger;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.Enumeration;
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Set;
+
+import org.bouncycastle.asn1.ASN1InputStream;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.DERObjectIdentifier;
+import org.bouncycastle.asn1.cmp.PKIFailureInfo;
+import org.bouncycastle.asn1.tsp.TimeStampReq;
+import org.bouncycastle.asn1.x509.Extension;
+import org.bouncycastle.asn1.x509.Extensions;
+
+/**
+ * Base class for an RFC 3161 Time Stamp Request.
+ */
+public class TimeStampRequest
+{
+    private static Set EMPTY_SET = Collections.unmodifiableSet(new HashSet());
+
+    private TimeStampReq req;
+    private Extensions extensions;
+
+    public TimeStampRequest(TimeStampReq req)
+    {
+        this.req = req;
+        this.extensions = req.getExtensions();
+    }
+
+    /**
+     * Create a TimeStampRequest from the past in byte array.
+     * 
+     * @param req byte array containing the request.
+     * @throws IOException if the request is malformed.
+     */
+    public TimeStampRequest(byte[] req) 
+        throws IOException
+    {
+        this(new ByteArrayInputStream(req));
+    }
+
+    /**
+     * Create a TimeStampRequest from the past in input stream.
+     * 
+     * @param in input stream containing the request.
+     * @throws IOException if the request is malformed.
+     */
+    public TimeStampRequest(InputStream in) 
+        throws IOException
+    {
+        try
+        {
+            this.req = TimeStampReq.getInstance(new ASN1InputStream(in).readObject());
+        }
+        catch (ClassCastException e)
+        {
+            throw new IOException("malformed request: " + e);
+        }
+        catch (IllegalArgumentException e)
+        {
+            throw new IOException("malformed request: " + e);
+        }
+    }
+
+    public int getVersion()
+    {
+        return req.getVersion().getValue().intValue();
+    }
+
+    public ASN1ObjectIdentifier getMessageImprintAlgOID()
+    {
+        return req.getMessageImprint().getHashAlgorithm().getAlgorithm();
+    }
+
+    public byte[] getMessageImprintDigest()
+    {
+        return req.getMessageImprint().getHashedMessage();
+    }
+
+    public ASN1ObjectIdentifier getReqPolicy()
+    {
+        if (req.getReqPolicy() != null)
+        {
+            return req.getReqPolicy();
+        }
+        else
+        {
+            return null;
+        }
+    }
+
+    public BigInteger getNonce()
+    {
+        if (req.getNonce() != null)
+        {
+            return req.getNonce().getValue();
+        }
+        else
+        {
+            return null;
+        }
+    }
+
+    public boolean getCertReq()
+    {
+        if (req.getCertReq() != null)
+        {
+            return req.getCertReq().isTrue();
+        }
+        else
+        {
+            return false;
+        }
+    }
+
+    /**
+     * Validate the timestamp request, checking the digest to see if it is of an
+     * accepted type and whether it is of the correct length for the algorithm specified.
+     *
+     * @param algorithms a set of OIDs giving accepted algorithms.
+     * @param policies if non-null a set of policies OIDs we are willing to sign under.
+     * @param extensions if non-null a set of extensions OIDs we are willing to accept.
+     * @throws TSPException if the request is invalid, or processing fails.
+     */
+    public void validate(
+        Set    algorithms,
+        Set    policies,
+        Set    extensions)
+        throws TSPException
+    {
+        algorithms = convert(algorithms);
+        policies = convert(policies);
+        extensions = convert(extensions);
+
+        if (!algorithms.contains(this.getMessageImprintAlgOID()))
+        {
+            throw new TSPValidationException("request contains unknown algorithm.", PKIFailureInfo.badAlg);
+        }
+
+        if (policies != null && this.getReqPolicy() != null && !policies.contains(this.getReqPolicy()))
+        {
+            throw new TSPValidationException("request contains unknown policy.", PKIFailureInfo.unacceptedPolicy);
+        }
+
+        if (this.getExtensions() != null && extensions != null)
+        {
+            Enumeration en = this.getExtensions().oids();
+            while(en.hasMoreElements())
+            {
+                String  oid = ((DERObjectIdentifier)en.nextElement()).getId();
+                if (!extensions.contains(oid))
+                {
+                    throw new TSPValidationException("request contains unknown extension.", PKIFailureInfo.unacceptedExtension);
+                }
+            }
+        }
+
+        int digestLength = TSPUtil.getDigestLength(this.getMessageImprintAlgOID().getId());
+
+        if (digestLength != this.getMessageImprintDigest().length)
+        {
+            throw new TSPValidationException("imprint digest the wrong length.", PKIFailureInfo.badDataFormat);
+        }
+    }
+
+   /**
+    * return the ASN.1 encoded representation of this object.
+    * @return the default ASN,1 byte encoding for the object.
+    */
+    public byte[] getEncoded() throws IOException
+    {
+        return req.getEncoded();
+    }
+
+    Extensions getExtensions()
+    {
+        return extensions;
+    }
+
+    public boolean hasExtensions()
+    {
+        return extensions != null;
+    }
+
+    public Extension getExtension(ASN1ObjectIdentifier oid)
+    {
+        if (extensions != null)
+        {
+            return extensions.getExtension(oid);
+        }
+
+        return null;
+    }
+
+    public List getExtensionOIDs()
+    {
+        return TSPUtil.getExtensionOIDs(extensions);
+    }
+
+    /* (non-Javadoc)
+     * @see java.security.cert.X509Extension#getExtensionValue(java.lang.String)
+     * @deprecated use getExtension(ASN1ObjectIdentifier)
+     */
+    public byte[] getExtensionValue(String oid)
+    {
+        Extensions exts = req.getExtensions();
+
+        if (exts != null)
+        {
+            Extension   ext = exts.getExtension(new ASN1ObjectIdentifier(oid));
+
+            if (ext != null)
+            {
+                try
+                {
+                    return ext.getExtnValue().getEncoded();
+                }
+                catch (Exception e)
+                {
+                    throw new RuntimeException("error encoding " + e.toString());
+                }
+            }
+        }
+
+        return null;
+    }
+
+    /**
+     * Returns a set of ASN1ObjectIdentifiers giving the non-critical extensions.
+     * @return a set of ASN1ObjectIdentifiers.
+     */
+    public Set getNonCriticalExtensionOIDs()
+    {
+        if (extensions == null)
+        {
+            return EMPTY_SET;
+        }
+
+        return Collections.unmodifiableSet(new HashSet(Arrays.asList(extensions.getNonCriticalExtensionOIDs())));
+    }
+
+    /**
+     * Returns a set of ASN1ObjectIdentifiers giving the critical extensions.
+     * @return a set of ASN1ObjectIdentifiers.
+     */
+    public Set getCriticalExtensionOIDs()
+    {
+        if (extensions == null)
+        {
+            return EMPTY_SET;
+        }
+
+        return Collections.unmodifiableSet(new HashSet(Arrays.asList(extensions.getCriticalExtensionOIDs())));
+    }
+
+    private Set convert(Set orig)
+    {
+        if (orig == null)
+        {
+            return orig;
+        }
+
+        Set con = new HashSet(orig.size());
+
+        for (Iterator it = orig.iterator(); it.hasNext();)
+        {
+            Object o = it.next();
+
+            if (o instanceof String)
+            {
+                con.add(new ASN1ObjectIdentifier((String)o));
+            }
+            else
+            {
+                con.add(o);
+            }
+        }
+
+        return con;
+    }
+}
diff --git a/crypto/j2me/org/bouncycastle/tsp/TimeStampResponseGenerator.java b/crypto/j2me/org/bouncycastle/tsp/TimeStampResponseGenerator.java
new file mode 100644
index 000000000..38e5d2eeb
--- /dev/null
+++ b/crypto/j2me/org/bouncycastle/tsp/TimeStampResponseGenerator.java
@@ -0,0 +1,256 @@
+package org.bouncycastle.tsp;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.math.BigInteger;
+import java.util.Date;
+import java.util.HashSet;
+import java.util.Iterator;
+import java.util.Set;
+
+import org.bouncycastle.asn1.ASN1EncodableVector;
+import org.bouncycastle.asn1.ASN1InputStream;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.DERBitString;
+import org.bouncycastle.asn1.DERInteger;
+import org.bouncycastle.asn1.DERSequence;
+import org.bouncycastle.asn1.DERUTF8String;
+import org.bouncycastle.asn1.cmp.PKIFailureInfo;
+import org.bouncycastle.asn1.cmp.PKIFreeText;
+import org.bouncycastle.asn1.cmp.PKIStatus;
+import org.bouncycastle.asn1.cmp.PKIStatusInfo;
+import org.bouncycastle.asn1.cms.ContentInfo;
+import org.bouncycastle.asn1.tsp.TimeStampResp;
+
+/**
+ * Generator for RFC 3161 Time Stamp Responses.
+ */
+public class TimeStampResponseGenerator
+{
+    int status;
+
+    ASN1EncodableVector statusStrings;
+
+    int failInfo;
+    private TimeStampTokenGenerator tokenGenerator;
+    private Set                     acceptedAlgorithms;
+    private Set                     acceptedPolicies;
+    private Set                     acceptedExtensions;
+
+    /**
+     *
+     * @param tokenGenerator
+     * @param acceptedAlgorithms a set of OIDs giving accepted algorithms.
+     */
+    public TimeStampResponseGenerator(
+        TimeStampTokenGenerator tokenGenerator,
+        Set                     acceptedAlgorithms)
+    {
+        this(tokenGenerator, acceptedAlgorithms, null, null);
+    }
+
+    /**
+     *
+     * @param tokenGenerator
+     * @param acceptedAlgorithms a set of OIDs giving accepted algorithms.
+     * @param acceptedPolicies if non-null a set of policies OIDs we are willing to sign under.
+     */
+    public TimeStampResponseGenerator(
+        TimeStampTokenGenerator tokenGenerator,
+        Set                     acceptedAlgorithms,
+        Set                     acceptedPolicies)
+    {
+        this(tokenGenerator, acceptedAlgorithms, acceptedPolicies, null);
+    }
+
+    /**
+     *
+     * @param tokenGenerator
+     * @param acceptedAlgorithms a set of OIDs giving accepted algorithms.
+     * @param acceptedPolicies if non-null a set of policies OIDs we are willing to sign under.
+     * @param acceptedExtensions if non-null a set of extensions OIDs we are willing to accept.
+     */
+    public TimeStampResponseGenerator(
+        TimeStampTokenGenerator tokenGenerator,
+        Set                     acceptedAlgorithms,
+        Set                     acceptedPolicies,
+        Set                     acceptedExtensions)
+    {
+        this.tokenGenerator = tokenGenerator;
+        this.acceptedAlgorithms = convert(acceptedAlgorithms);
+        this.acceptedPolicies = convert(acceptedPolicies);
+        this.acceptedExtensions = convert(acceptedExtensions);
+
+        statusStrings = new ASN1EncodableVector();
+    }
+
+    private void addStatusString(String statusString)
+    {
+        statusStrings.add(new DERUTF8String(statusString));
+    }
+
+    private void setFailInfoField(int field)
+    {
+        failInfo = failInfo | field;
+    }
+
+    private PKIStatusInfo getPKIStatusInfo()
+    {
+        ASN1EncodableVector v = new ASN1EncodableVector();
+        
+        v.add(new DERInteger(status));
+        
+        if (statusStrings.size() > 0)
+        {
+            v.add(PKIFreeText.getInstance(new DERSequence(statusStrings)));
+        }
+
+        if (failInfo != 0)
+        {
+            DERBitString failInfoBitString = new FailInfo(failInfo);
+            v.add(failInfoBitString);
+        }
+
+        return PKIStatusInfo.getInstance(new DERSequence(v));
+    }
+
+    /**
+     * Return an appropriate TimeStampResponse.
+     * <p>
+     * If genTime is null a timeNotAvailable error response will be returned.
+     *
+     * @param request the request this response is for.
+     * @param serialNumber serial number for the response token.
+     * @param genTime generation time for the response token.
+     * @return
+     * @throws TSPException
+     */
+    public TimeStampResponse generate(
+        TimeStampRequest    request,
+        BigInteger          serialNumber,
+        Date                genTime)
+        throws TSPException
+    {
+        TimeStampResp resp;
+
+        try
+        {
+            if (genTime == null)
+            {
+                throw new TSPValidationException("The time source is not available.", PKIFailureInfo.timeNotAvailable);
+            }
+
+            request.validate(acceptedAlgorithms, acceptedPolicies, acceptedExtensions);
+
+            status = PKIStatus.GRANTED;
+            this.addStatusString("Operation Okay");
+
+            PKIStatusInfo pkiStatusInfo = getPKIStatusInfo();
+
+            ContentInfo tstTokenContentInfo = null;
+            try
+            {
+                ByteArrayInputStream    bIn = new ByteArrayInputStream(tokenGenerator.generate(request, serialNumber, genTime).toCMSSignedData().getEncoded());
+                ASN1InputStream         aIn = new ASN1InputStream(bIn);
+
+                tstTokenContentInfo = ContentInfo.getInstance(aIn.readObject());
+            }
+            catch (java.io.IOException ioEx)
+            {
+                throw new TSPException(
+                        "Timestamp token received cannot be converted to ContentInfo", ioEx);
+            }
+
+            resp = new TimeStampResp(pkiStatusInfo, tstTokenContentInfo);
+        }
+        catch (TSPValidationException e)
+        {
+            status = PKIStatus.REJECTION;
+
+            this.setFailInfoField(e.getFailureCode());
+            this.addStatusString(e.getMessage());
+
+            PKIStatusInfo pkiStatusInfo = getPKIStatusInfo();
+
+            resp = new TimeStampResp(pkiStatusInfo, null);
+        }
+
+        try
+        {
+            return new TimeStampResponse(resp);
+        }
+        catch (IOException e)
+        {
+            throw new TSPException("created badly formatted response!");
+        }
+    }
+
+    class FailInfo extends DERBitString
+    {
+        FailInfo(int failInfoValue)
+        {
+            super(getBytes(failInfoValue), getPadBits(failInfoValue));
+        }
+    }
+
+    /**
+     * Generate a TimeStampResponse with chosen status and FailInfoField.
+     * 
+     * @param status the PKIStatus to set.
+     * @param failInfoField the FailInfoField to set.
+     * @param statusString an optional string describing the failure.
+     * @return a TimeStampResponse with a failInfoField and optional statusString
+     * @throws TSPException in case the response could not be created
+     */
+    public TimeStampResponse generateFailResponse(int status, int failInfoField, String statusString)
+        throws TSPException
+    {
+        this.status = status;
+
+        this.setFailInfoField(failInfoField);
+
+        if (statusString != null)
+        {
+            this.addStatusString(statusString);
+        }
+
+        PKIStatusInfo pkiStatusInfo = getPKIStatusInfo();
+
+        TimeStampResp resp = new TimeStampResp(pkiStatusInfo, null);
+
+        try
+        {
+            return new TimeStampResponse(resp);
+        }
+        catch (IOException e)
+        {
+            throw new TSPException("created badly formatted response!");
+        }
+    }
+
+    private Set convert(Set orig)
+    {
+        if (orig == null)
+        {
+            return orig;
+        }
+
+        Set con = new HashSet(orig.size());
+
+        for (Iterator it = orig.iterator(); it.hasNext();)
+        {
+            Object o = it.next();
+
+            if (o instanceof String)
+            {
+                con.add(new ASN1ObjectIdentifier((String)o));
+            }
+            else
+            {
+                con.add(o);
+            }
+        }
+
+        return con;
+    }
+}
diff --git a/crypto/j2me/org/bouncycastle/tsp/TimeStampToken.java b/crypto/j2me/org/bouncycastle/tsp/TimeStampToken.java
new file mode 100644
index 000000000..3cd7f0a9e
--- /dev/null
+++ b/crypto/j2me/org/bouncycastle/tsp/TimeStampToken.java
@@ -0,0 +1,391 @@
+package org.bouncycastle.tsp;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.OutputStream;
+import java.util.Collection;
+import java.util.Date;
+
+import org.bouncycastle.asn1.ASN1InputStream;
+import org.bouncycastle.asn1.cms.Attribute;
+import org.bouncycastle.asn1.cms.AttributeTable;
+import org.bouncycastle.asn1.cms.ContentInfo;
+import org.bouncycastle.asn1.cms.IssuerAndSerialNumber;
+import org.bouncycastle.asn1.ess.ESSCertID;
+import org.bouncycastle.asn1.ess.ESSCertIDv2;
+import org.bouncycastle.asn1.ess.SigningCertificate;
+import org.bouncycastle.asn1.ess.SigningCertificateV2;
+import org.bouncycastle.asn1.nist.NISTObjectIdentifiers;
+import org.bouncycastle.asn1.oiw.OIWObjectIdentifiers;
+import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
+import org.bouncycastle.asn1.tsp.TSTInfo;
+import org.bouncycastle.asn1.x500.X500Name;
+import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
+import org.bouncycastle.asn1.x509.GeneralName;
+import org.bouncycastle.asn1.x509.IssuerSerial;
+import org.bouncycastle.asn1.x509.X509Name;
+import org.bouncycastle.cert.X509CertificateHolder;
+import org.bouncycastle.cms.CMSException;
+import org.bouncycastle.cms.CMSProcessable;
+import org.bouncycastle.cms.CMSSignedData;
+import org.bouncycastle.cms.SignerId;
+import org.bouncycastle.cms.SignerInformation;
+import org.bouncycastle.cms.SignerInformationVerifier;
+import org.bouncycastle.operator.DigestCalculator;
+import org.bouncycastle.operator.OperatorCreationException;
+import org.bouncycastle.util.Arrays;
+import org.bouncycastle.util.Store;
+
+public class TimeStampToken
+{
+    CMSSignedData tsToken;
+
+    SignerInformation tsaSignerInfo;
+
+    Date genTime;
+
+    TimeStampTokenInfo tstInfo;
+    
+    CertID   certID;
+
+    public TimeStampToken(ContentInfo contentInfo)
+        throws TSPException, IOException
+    {
+        this(getSignedData(contentInfo));
+    }
+
+    private static CMSSignedData getSignedData(ContentInfo contentInfo)
+        throws TSPException
+    {
+        try
+        {
+            return new CMSSignedData(contentInfo);
+        }
+        catch (CMSException e)
+        {
+            throw new TSPException("TSP parsing error: " + e.getMessage(), e.getCause());
+        }
+    }
+
+    public TimeStampToken(CMSSignedData signedData)
+        throws TSPException, IOException
+    {
+        this.tsToken = signedData;
+
+        if (!this.tsToken.getSignedContentTypeOID().equals(PKCSObjectIdentifiers.id_ct_TSTInfo.getId()))
+        {
+            throw new TSPValidationException("ContentInfo object not for a time stamp.");
+        }
+        
+        Collection signers = tsToken.getSignerInfos().getSigners();
+
+        if (signers.size() != 1)
+        {
+            throw new IllegalArgumentException("Time-stamp token signed by "
+                    + signers.size()
+                    + " signers, but it must contain just the TSA signature.");
+        }
+
+        tsaSignerInfo = (SignerInformation)signers.iterator().next();
+
+        try
+        {
+            CMSProcessable content = tsToken.getSignedContent();
+            ByteArrayOutputStream bOut = new ByteArrayOutputStream();
+
+            content.write(bOut);
+
+            ASN1InputStream aIn = new ASN1InputStream(new ByteArrayInputStream(bOut.toByteArray()));
+
+            this.tstInfo = new TimeStampTokenInfo(TSTInfo.getInstance(aIn.readObject()));
+            
+            Attribute   attr = tsaSignerInfo.getSignedAttributes().get(PKCSObjectIdentifiers.id_aa_signingCertificate);
+
+            if (attr != null)
+            {
+                SigningCertificate    signCert = SigningCertificate.getInstance(attr.getAttrValues().getObjectAt(0));
+
+                this.certID = new CertID(ESSCertID.getInstance(signCert.getCerts()[0]));
+            }
+            else
+            {
+                attr = tsaSignerInfo.getSignedAttributes().get(PKCSObjectIdentifiers.id_aa_signingCertificateV2);
+
+                if (attr == null)
+                {
+                    throw new TSPValidationException("no signing certificate attribute found, time stamp invalid.");
+                }
+
+                SigningCertificateV2 signCertV2 = SigningCertificateV2.getInstance(attr.getAttrValues().getObjectAt(0));
+
+                this.certID = new CertID(ESSCertIDv2.getInstance(signCertV2.getCerts()[0]));
+            }
+        }
+        catch (CMSException e)
+        {
+            throw new TSPException(e.getMessage(), e.getUnderlyingException());
+        }
+    }
+
+    public TimeStampTokenInfo getTimeStampInfo()
+    {
+        return tstInfo;
+    }
+
+    public SignerId getSID()
+    {
+        return tsaSignerInfo.getSID();
+    }
+    
+    public AttributeTable getSignedAttributes()
+    {
+        return tsaSignerInfo.getSignedAttributes();
+    }
+
+    public AttributeTable getUnsignedAttributes()
+    {
+        return tsaSignerInfo.getUnsignedAttributes();
+    }
+
+    public Store getCertificates()
+    {
+        return tsToken.getCertificates();
+    }
+
+    public Store getCRLs()
+    {
+        return tsToken.getCRLs();
+    }
+
+    public Store getAttributeCertificates()
+    {
+        return tsToken.getAttributeCertificates();
+    }
+
+    /**
+     * Validate the time stamp token.
+     * <p>
+     * To be valid the token must be signed by the passed in certificate and
+     * the certificate must be the one referred to by the SigningCertificate
+     * attribute included in the hashed attributes of the token. The
+     * certificate must also have the ExtendedKeyUsageExtension with only
+     * KeyPurposeId.id_kp_timeStamping and have been valid at the time the
+     * timestamp was created.
+     * </p>
+     * <p>
+     * A successful call to validate means all the above are true.
+     * </p>
+     *
+     * @param sigVerifier the content verifier create the objects required to verify the CMS object in the timestamp.
+     * @throws TSPException if an exception occurs in processing the token.
+     * @throws TSPValidationException if the certificate or signature fail to be valid.
+     * @throws IllegalArgumentException if the sigVerifierProvider has no associated certificate.
+     */
+    public void validate(
+        SignerInformationVerifier sigVerifier)
+        throws TSPException, TSPValidationException
+    {
+        if (!sigVerifier.hasAssociatedCertificate())
+        {
+            throw new IllegalArgumentException("verifier provider needs an associated certificate");
+        }
+
+        try
+        {
+            X509CertificateHolder certHolder = sigVerifier.getAssociatedCertificate();
+            DigestCalculator calc = sigVerifier.getDigestCalculator(certID.getHashAlgorithm());
+
+            OutputStream cOut = calc.getOutputStream();
+
+            cOut.write(certHolder.getEncoded());
+            cOut.close();
+
+            if (!Arrays.constantTimeAreEqual(certID.getCertHash(), calc.getDigest()))
+            {
+                throw new TSPValidationException("certificate hash does not match certID hash.");
+            }
+
+            if (certID.getIssuerSerial() != null)
+            {
+                IssuerAndSerialNumber issuerSerial = new IssuerAndSerialNumber(certHolder.toASN1Structure());
+
+                if (!certID.getIssuerSerial().getSerial().equals(issuerSerial.getSerialNumber()))
+                {
+                    throw new TSPValidationException("certificate serial number does not match certID for signature.");
+                }
+
+                GeneralName[]   names = certID.getIssuerSerial().getIssuer().getNames();
+                boolean         found = false;
+
+                for (int i = 0; i != names.length; i++)
+                {
+                    if (names[i].getTagNo() == 4 && X500Name.getInstance(names[i].getName()).equals(X500Name.getInstance(issuerSerial.getName())))
+                    {
+                        found = true;
+                        break;
+                    }
+                }
+
+                if (!found)
+                {
+                    throw new TSPValidationException("certificate name does not match certID for signature. ");
+                }
+            }
+
+            TSPUtil.validateCertificate(certHolder);
+
+            if (!certHolder.isValidOn(tstInfo.getGenTime()))
+            {
+                throw new TSPValidationException("certificate not valid when time stamp created.");
+            }
+
+            if (!tsaSignerInfo.verify(sigVerifier))
+            {
+                throw new TSPValidationException("signature not created by certificate.");
+            }
+        }
+        catch (CMSException e)
+        {
+            if (e.getUnderlyingException() != null)
+            {
+                throw new TSPException(e.getMessage(), e.getUnderlyingException());
+            }
+            else
+            {
+                throw new TSPException("CMS exception: " + e, e);
+            }
+        }
+        catch (IOException e)
+        {
+            throw new TSPException("problem processing certificate: " + e, e);
+        }
+        catch (OperatorCreationException e)
+        {
+            throw new TSPException("unable to create digest: " + e.getMessage(), e);
+        }
+    }
+
+    /**
+     * Return true if the signature on time stamp token is valid.
+     * <p>
+     * Note: this is a much weaker proof of correctness than calling validate().
+     * </p>
+     *
+     * @param sigVerifier the content verifier create the objects required to verify the CMS object in the timestamp.
+     * @return true if the signature matches, false otherwise.
+     * @throws TSPException if the signature cannot be processed or the provider cannot match the algorithm.
+     */
+    public boolean isSignatureValid(
+        SignerInformationVerifier sigVerifier)
+        throws TSPException
+    {
+        try
+        {
+            return tsaSignerInfo.verify(sigVerifier);
+        }
+        catch (CMSException e)
+        {
+            if (e.getUnderlyingException() != null)
+            {
+                throw new TSPException(e.getMessage(), e.getUnderlyingException());
+            }
+            else
+            {
+                throw new TSPException("CMS exception: " + e, e);
+            }
+        }
+    }
+
+    /**
+     * Return the underlying CMSSignedData object.
+     * 
+     * @return the underlying CMS structure.
+     */
+    public CMSSignedData toCMSSignedData()
+    {
+        return tsToken;
+    }
+    
+    /**
+     * Return a ASN.1 encoded byte stream representing the encoded object.
+     * 
+     * @throws IOException if encoding fails.
+     */
+    public byte[] getEncoded() 
+        throws IOException
+    {
+        return tsToken.getEncoded();
+    }
+
+    // perhaps this should be done using an interface on the ASN.1 classes...
+    private class CertID
+    {
+        private ESSCertID certID;
+        private ESSCertIDv2 certIDv2;
+
+        CertID(ESSCertID certID)
+        {
+            this.certID = certID;
+            this.certIDv2 = null;
+        }
+
+        CertID(ESSCertIDv2 certID)
+        {
+            this.certIDv2 = certID;
+            this.certID = null;
+        }
+
+        public String getHashAlgorithmName()
+        {
+            if (certID != null)
+            {
+                return "SHA-1";
+            }
+            else
+            {
+                if (NISTObjectIdentifiers.id_sha256.equals(certIDv2.getHashAlgorithm().getAlgorithm()))
+                {
+                    return "SHA-256";
+                }
+                return certIDv2.getHashAlgorithm().getAlgorithm().getId();
+            }
+        }
+
+        public AlgorithmIdentifier getHashAlgorithm()
+        {
+            if (certID != null)
+            {
+                return new AlgorithmIdentifier(OIWObjectIdentifiers.idSHA1);
+            }
+            else
+            {
+                return certIDv2.getHashAlgorithm();
+            }
+        }
+
+        public byte[] getCertHash()
+        {
+            if (certID != null)
+            {
+                return certID.getCertHash();
+            }
+            else
+            {
+                return certIDv2.getCertHash();
+            }
+        }
+
+        public IssuerSerial getIssuerSerial()
+        {
+            if (certID != null)
+            {
+                return certID.getIssuerSerial();
+            }
+            else
+            {
+                return certIDv2.getIssuerSerial();
+            }
+        }
+    }
+}
diff --git a/crypto/j2me/org/bouncycastle/tsp/TimeStampTokenGenerator.java b/crypto/j2me/org/bouncycastle/tsp/TimeStampTokenGenerator.java
new file mode 100644
index 000000000..bc7b8d581
--- /dev/null
+++ b/crypto/j2me/org/bouncycastle/tsp/TimeStampTokenGenerator.java
@@ -0,0 +1,280 @@
+package org.bouncycastle.tsp;
+
+import java.io.IOException;
+import java.io.OutputStream;
+import java.math.BigInteger;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Date;
+import java.util.Hashtable;
+import java.util.Iterator;
+import java.util.List;
+import java.util.Map;
+
+import org.bouncycastle.asn1.ASN1Boolean;
+import org.bouncycastle.asn1.ASN1Encoding;
+import org.bouncycastle.asn1.ASN1GeneralizedTime;
+import org.bouncycastle.asn1.ASN1Integer;
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.DERNull;
+import org.bouncycastle.asn1.DERSet;
+import org.bouncycastle.asn1.cms.Attribute;
+import org.bouncycastle.asn1.cms.AttributeTable;
+import org.bouncycastle.asn1.ess.ESSCertID;
+import org.bouncycastle.asn1.ess.SigningCertificate;
+import org.bouncycastle.asn1.oiw.OIWObjectIdentifiers;
+import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
+import org.bouncycastle.asn1.tsp.Accuracy;
+import org.bouncycastle.asn1.tsp.MessageImprint;
+import org.bouncycastle.asn1.tsp.TSTInfo;
+import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
+import org.bouncycastle.asn1.x509.GeneralName;
+
+import org.bouncycastle.cms.CMSAttributeTableGenerationException;
+import org.bouncycastle.cms.CMSAttributeTableGenerator;
+import org.bouncycastle.cms.CMSException;
+import org.bouncycastle.cms.CMSProcessableByteArray;
+import org.bouncycastle.cms.CMSSignedData;
+import org.bouncycastle.cms.CMSSignedDataGenerator;
+import org.bouncycastle.cms.CMSSignedGenerator;
+import org.bouncycastle.cms.DefaultSignedAttributeTableGenerator;
+import org.bouncycastle.cms.SignerInfoGenerator;
+import org.bouncycastle.cms.SimpleAttributeTableGenerator;
+
+import org.bouncycastle.operator.DigestCalculator;
+import org.bouncycastle.operator.OperatorCreationException;
+
+import org.bouncycastle.util.CollectionStore;
+import org.bouncycastle.util.Store;
+
+public class TimeStampTokenGenerator
+{
+    int accuracySeconds = -1;
+
+    int accuracyMillis = -1;
+
+    int accuracyMicros = -1;
+
+    boolean ordering = false;
+
+    GeneralName tsa = null;
+    
+    private ASN1ObjectIdentifier  tsaPolicyOID;
+
+    String          digestOID;
+    AttributeTable  signedAttr;
+    AttributeTable  unsignedAttr;
+
+    private List certs = new ArrayList();
+    private List crls = new ArrayList();
+    private List attrCerts = new ArrayList();
+    private SignerInfoGenerator signerInfoGen;
+
+    /**
+     *
+     */
+    public TimeStampTokenGenerator(
+        DigestCalculator                  sha1DigestCalculator,
+        final SignerInfoGenerator         signerInfoGen,
+        ASN1ObjectIdentifier              tsaPolicy)
+        throws IllegalArgumentException, TSPException
+    {
+        this.signerInfoGen = signerInfoGen;
+        this.tsaPolicyOID = tsaPolicy;
+
+        if (!sha1DigestCalculator.getAlgorithmIdentifier().getAlgorithm().equals(OIWObjectIdentifiers.idSHA1))
+        {
+            throw new IllegalArgumentException("Digest calculator must be for SHA-1");
+        }
+
+        if (!signerInfoGen.hasAssociatedCertificate())
+        {
+            throw new IllegalArgumentException("SignerInfoGenerator must have an associated certificate");
+        }
+        
+        TSPUtil.validateCertificate(signerInfoGen.getAssociatedCertificate());
+
+        try
+        {
+            OutputStream dOut = sha1DigestCalculator.getOutputStream();
+
+            dOut.write(signerInfoGen.getAssociatedCertificate().getEncoded());
+
+            dOut.close();
+
+            final ESSCertID essCertid = new ESSCertID(sha1DigestCalculator.getDigest());
+
+            this.signerInfoGen = new SignerInfoGenerator(signerInfoGen, new CMSAttributeTableGenerator()
+            {
+                public AttributeTable getAttributes(Map parameters)
+                    throws CMSAttributeTableGenerationException
+                {
+                    AttributeTable table = signerInfoGen.getSignedAttributeTableGenerator().getAttributes(parameters);
+
+                    return table.add(PKCSObjectIdentifiers.id_aa_signingCertificate, new SigningCertificate(essCertid));
+                }
+            }, signerInfoGen.getUnsignedAttributeTableGenerator());
+
+        }
+        catch (IOException e)
+        {
+            throw new TSPException("Exception processing certificate.", e);
+        }
+    }
+
+    /**
+     * Add the store of X509 Certificates to the generator.
+     *
+     * @param certStore  a Store containing X509CertificateHolder objects
+     */
+    public void addCertificates(
+        Store certStore)
+    {
+        certs.addAll(certStore.getMatches(null));
+    }
+
+    /**
+     *
+     * @param crlStore a Store containing X509CRLHolder objects.
+     */
+    public void addCRLs(
+        Store crlStore)
+    {
+        crls.addAll(crlStore.getMatches(null));
+    }
+
+    /**
+     *
+     * @param attrStore a Store containing X509AttributeCertificate objects.
+     */
+    public void addAttributeCertificates(
+        Store attrStore)
+    {
+        attrCerts.addAll(attrStore.getMatches(null));
+    }
+
+    public void setAccuracySeconds(int accuracySeconds)
+    {
+        this.accuracySeconds = accuracySeconds;
+    }
+
+    public void setAccuracyMillis(int accuracyMillis)
+    {
+        this.accuracyMillis = accuracyMillis;
+    }
+
+    public void setAccuracyMicros(int accuracyMicros)
+    {
+        this.accuracyMicros = accuracyMicros;
+    }
+
+    public void setOrdering(boolean ordering)
+    {
+        this.ordering = ordering;
+    }
+
+    public void setTSA(GeneralName tsa)
+    {
+        this.tsa = tsa;
+    }
+    
+    //------------------------------------------------------------------------------
+
+    public TimeStampToken generate(
+        TimeStampRequest    request,
+        BigInteger          serialNumber,
+        Date                genTime)
+        throws TSPException
+    {
+        if (signerInfoGen == null)
+        {
+            throw new IllegalStateException("can only use this method with SignerInfoGenerator constructor");
+        }
+
+        ASN1ObjectIdentifier digestAlgOID = request.getMessageImprintAlgOID();
+
+        AlgorithmIdentifier algID = new AlgorithmIdentifier(digestAlgOID, new DERNull());
+        MessageImprint      messageImprint = new MessageImprint(algID, request.getMessageImprintDigest());
+
+        Accuracy accuracy = null;
+        if (accuracySeconds > 0 || accuracyMillis > 0 || accuracyMicros > 0)
+        {
+            ASN1Integer seconds = null;
+            if (accuracySeconds > 0)
+            {
+                seconds = new ASN1Integer(accuracySeconds);
+            }
+
+            ASN1Integer millis = null;
+            if (accuracyMillis > 0)
+            {
+                millis = new ASN1Integer(accuracyMillis);
+            }
+
+            ASN1Integer micros = null;
+            if (accuracyMicros > 0)
+            {
+                micros = new ASN1Integer(accuracyMicros);
+            }
+
+            accuracy = new Accuracy(seconds, millis, micros);
+        }
+
+        ASN1Boolean derOrdering = null;
+        if (ordering)
+        {
+            derOrdering = new ASN1Boolean(ordering);
+        }
+
+        ASN1Integer  nonce = null;
+        if (request.getNonce() != null)
+        {
+            nonce = new ASN1Integer(request.getNonce());
+        }
+
+        ASN1ObjectIdentifier tsaPolicy = tsaPolicyOID;
+        if (request.getReqPolicy() != null)
+        {
+            tsaPolicy = request.getReqPolicy();
+        }
+
+        TSTInfo tstInfo = new TSTInfo(tsaPolicy,
+                messageImprint, new ASN1Integer(serialNumber),
+                new ASN1GeneralizedTime(genTime), accuracy, derOrdering,
+                nonce, tsa, request.getExtensions());
+
+        try
+        {
+            CMSSignedDataGenerator  signedDataGenerator = new CMSSignedDataGenerator();
+
+            if (request.getCertReq())
+            {
+                // TODO: do we need to check certs non-empty?
+                signedDataGenerator.addCertificates(new CollectionStore(certs));
+                signedDataGenerator.addCRLs(new CollectionStore(crls));
+                signedDataGenerator.addAttributeCertificates(new CollectionStore(attrCerts));
+            }
+            else
+            {
+                signedDataGenerator.addCRLs(new CollectionStore(crls));
+            }
+
+            signedDataGenerator.addSignerInfoGenerator(signerInfoGen);
+
+            byte[] derEncodedTSTInfo = tstInfo.getEncoded(ASN1Encoding.DER);
+
+            CMSSignedData signedData = signedDataGenerator.generate(new CMSProcessableByteArray(PKCSObjectIdentifiers.id_ct_TSTInfo, derEncodedTSTInfo), true);
+
+            return new TimeStampToken(signedData);
+        }
+        catch (CMSException cmsEx)
+        {
+            throw new TSPException("Error generating time-stamp token", cmsEx);
+        }
+        catch (IOException e)
+        {
+            throw new TSPException("Exception encoding info", e);
+        }
+    }
+}
diff --git a/crypto/j2me/org/bouncycastle/tsp/TimeStampTokenInfo.java b/crypto/j2me/org/bouncycastle/tsp/TimeStampTokenInfo.java
new file mode 100644
index 000000000..739794b07
--- /dev/null
+++ b/crypto/j2me/org/bouncycastle/tsp/TimeStampTokenInfo.java
@@ -0,0 +1,112 @@
+package org.bouncycastle.tsp;
+
+import java.io.IOException;
+import java.math.BigInteger;
+import java.util.Date;
+
+import org.bouncycastle.asn1.ASN1ObjectIdentifier;
+import org.bouncycastle.asn1.tsp.Accuracy;
+import org.bouncycastle.asn1.tsp.TSTInfo;
+import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
+import org.bouncycastle.asn1.x509.GeneralName;
+
+public class TimeStampTokenInfo
+{
+    TSTInfo tstInfo;
+    Date    genTime;
+    
+    TimeStampTokenInfo(TSTInfo tstInfo)
+        throws TSPException, IOException
+    {
+        this.tstInfo = tstInfo;
+        this.genTime = tstInfo.getGenTime().getDate();
+    }
+
+    public boolean isOrdered()
+    {
+        return tstInfo.getOrdering().isTrue();
+    }
+
+    public Accuracy getAccuracy()
+    {
+        return tstInfo.getAccuracy();
+    }
+
+    public Date getGenTime()
+    {
+        return genTime;
+    }
+
+    public GenTimeAccuracy getGenTimeAccuracy()
+    {
+        if (this.getAccuracy() != null)
+        {
+            return new GenTimeAccuracy(this.getAccuracy());
+        }
+        
+        return null;
+    }
+    
+    public ASN1ObjectIdentifier getPolicy()
+    {
+        return tstInfo.getPolicy();
+    }
+    
+    public BigInteger getSerialNumber()
+    {
+        return tstInfo.getSerialNumber().getValue();
+    }
+
+    public GeneralName getTsa()
+    {
+        return tstInfo.getTsa();
+    }
+
+    /**
+     * @return the nonce value, null if there isn't one.
+     */
+    public BigInteger getNonce()
+    {
+        if (tstInfo.getNonce() != null)
+        {
+            return tstInfo.getNonce().getValue();
+        }
+
+        return null;
+    }
+
+    public AlgorithmIdentifier getHashAlgorithm()
+    {
+        return tstInfo.getMessageImprint().getHashAlgorithm();
+    }
+
+    public ASN1ObjectIdentifier getMessageImprintAlgOID()
+    {
+        return tstInfo.getMessageImprint().getHashAlgorithm().getAlgorithm();
+    }
+
+    public byte[] getMessageImprintDigest()
+    {
+        return tstInfo.getMessageImprint().getHashedMessage();
+    }
+
+    public byte[] getEncoded() 
+        throws IOException
+    {
+        return tstInfo.getEncoded();
+    }
+
+    /**
+     * @deprecated use toASN1Structure
+     * @return
+     */
+    public TSTInfo toTSTInfo()
+    {
+        return tstInfo;
+    }
+
+    public TSTInfo toASN1Structure()
+    {
+        return tstInfo;
+    }
+}
diff --git a/crypto/j2me/org/bouncycastle/tsp/cms/CMSTimeStampedData.java b/crypto/j2me/org/bouncycastle/tsp/cms/CMSTimeStampedData.java
new file mode 100644
index 000000000..073b6138f
--- /dev/null
+++ b/crypto/j2me/org/bouncycastle/tsp/cms/CMSTimeStampedData.java
@@ -0,0 +1,201 @@
+package org.bouncycastle.tsp.cms;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+
+import org.bouncycastle.asn1.ASN1InputStream;
+import org.bouncycastle.asn1.DERIA5String;
+import org.bouncycastle.asn1.cms.AttributeTable;
+import org.bouncycastle.asn1.cms.CMSObjectIdentifiers;
+import org.bouncycastle.asn1.cms.ContentInfo;
+import org.bouncycastle.asn1.cms.Evidence;
+import org.bouncycastle.asn1.cms.TimeStampAndCRL;
+import org.bouncycastle.asn1.cms.TimeStampTokenEvidence;
+import org.bouncycastle.asn1.cms.TimeStampedData;
+import org.bouncycastle.cms.CMSException;
+import org.bouncycastle.operator.DigestCalculator;
+import org.bouncycastle.operator.DigestCalculatorProvider;
+import org.bouncycastle.operator.OperatorCreationException;
+import org.bouncycastle.tsp.TimeStampToken;
+
+public class CMSTimeStampedData
+{
+    private TimeStampedData timeStampedData;
+    private ContentInfo contentInfo;
+    private TimeStampDataUtil util;
+
+    public CMSTimeStampedData(ContentInfo contentInfo)
+    {
+        this.initialize(contentInfo);
+    }
+
+    public CMSTimeStampedData(InputStream in)
+        throws IOException
+    {
+        try
+        {
+            initialize(ContentInfo.getInstance(new ASN1InputStream(in).readObject()));
+        }
+        catch (ClassCastException e)
+        {
+            throw new IOException("Malformed content: " + e);
+        }
+        catch (IllegalArgumentException e)
+        {
+            throw new IOException("Malformed content: " + e);
+        }
+    }
+
+    public CMSTimeStampedData(byte[] baseData)
+        throws IOException
+    {
+        this(new ByteArrayInputStream(baseData));
+    }
+
+    private void initialize(ContentInfo contentInfo)
+    {
+        this.contentInfo = contentInfo;
+
+        if (CMSObjectIdentifiers.timestampedData.equals(contentInfo.getContentType()))
+        {
+            this.timeStampedData = TimeStampedData.getInstance(contentInfo.getContent());
+        }
+        else
+        {
+            throw new IllegalArgumentException("Malformed content - type must be " + CMSObjectIdentifiers.timestampedData.getId());
+        }
+
+        util = new TimeStampDataUtil(this.timeStampedData);
+    }
+
+    public byte[] calculateNextHash(DigestCalculator calculator)
+        throws CMSException
+    {
+        return util.calculateNextHash(calculator);
+    }
+
+    /**
+     * Return a new timeStampedData object with the additional token attached.
+     *
+     * @throws CMSException
+     */
+    public CMSTimeStampedData addTimeStamp(TimeStampToken token)
+        throws CMSException
+    {
+        TimeStampAndCRL[] timeStamps = util.getTimeStamps();
+        TimeStampAndCRL[] newTimeStamps = new TimeStampAndCRL[timeStamps.length + 1];
+
+        System.arraycopy(timeStamps, 0, newTimeStamps, 0, timeStamps.length);
+
+        newTimeStamps[timeStamps.length] = new TimeStampAndCRL(token.toCMSSignedData().getContentInfo());
+
+        return new CMSTimeStampedData(new ContentInfo(CMSObjectIdentifiers.timestampedData, new TimeStampedData(timeStampedData.getDataUri(), timeStampedData.getMetaData(), timeStampedData.getContent(), new Evidence(new TimeStampTokenEvidence(newTimeStamps)))));
+    }
+
+    public byte[] getContent()
+    {
+        if (timeStampedData.getContent() != null)
+        {
+            return timeStampedData.getContent().getOctets();
+        }
+
+        return null;
+    }
+
+    public String getDataUri()
+    {
+        DERIA5String dataURI = this.timeStampedData.getDataUri();
+
+        if (dataURI != null)
+        {
+            return dataURI.getString();
+        }
+
+        return null;
+    }
+
+    public String getFileName()
+    {
+        return util.getFileName();
+    }
+
+    public String getMediaType()
+    {
+        return util.getMediaType();
+    }
+
+    public AttributeTable getOtherMetaData()
+    {
+        return util.getOtherMetaData();
+    }
+
+    public TimeStampToken[] getTimeStampTokens()
+        throws CMSException
+    {
+        return util.getTimeStampTokens();
+    }
+
+    /**
+     * Initialise the passed in calculator with the MetaData for this message, if it is
+     * required as part of the initial message imprint calculation.
+     *
+     * @param calculator the digest calculator to be initialised.
+     * @throws CMSException if the MetaData is required and cannot be processed
+     */
+    public void initialiseMessageImprintDigestCalculator(DigestCalculator calculator)
+        throws CMSException
+    {
+        util.initialiseMessageImprintDigestCalculator(calculator);
+    }
+
+    /**
+     * Returns an appropriately initialised digest calculator based on the message imprint algorithm
+     * described in the first time stamp in the TemporalData for this message. If the metadata is required
+     * to be included in the digest calculation, the returned calculator will be pre-initialised.
+     *
+     * @param calculatorProvider  a provider of DigestCalculator objects.
+     * @return an initialised digest calculator.
+     * @throws OperatorCreationException if the provider is unable to create the calculator.
+     */
+    public DigestCalculator getMessageImprintDigestCalculator(DigestCalculatorProvider calculatorProvider)
+        throws OperatorCreationException
+    {
+        return util.getMessageImprintDigestCalculator(calculatorProvider);
+    }
+
+    /**
+     * Validate the digests present in the TimeStampTokens contained in the CMSTimeStampedData.
+     *
+     * @param calculatorProvider provider for digest calculators
+     * @param dataDigest the calculated data digest for the message
+     * @throws ImprintDigestInvalidException if an imprint digest fails to compare
+     * @throws CMSException  if an exception occurs processing the message.
+     */
+    public void validate(DigestCalculatorProvider calculatorProvider, byte[] dataDigest)
+        throws ImprintDigestInvalidException, CMSException
+    {
+        util.validate(calculatorProvider, dataDigest);
+    }
+
+    /**
+     * Validate the passed in timestamp token against the tokens and data present in the message.
+     *
+     * @param calculatorProvider provider for digest calculators
+     * @param dataDigest the calculated data digest for the message.
+     * @param timeStampToken  the timestamp token of interest.
+     * @throws ImprintDigestInvalidException if the token is not present in the message, or an imprint digest fails to compare.
+     * @throws CMSException if an exception occurs processing the message.
+     */
+    public void validate(DigestCalculatorProvider calculatorProvider, byte[] dataDigest, TimeStampToken timeStampToken)
+        throws ImprintDigestInvalidException, CMSException
+    {
+        util.validate(calculatorProvider, dataDigest, timeStampToken);
+    }
+
+    public byte[] getEncoded()
+        throws IOException
+    {
+        return contentInfo.getEncoded();
+    }
+}
diff --git a/crypto/j2me/org/bouncycastle/tsp/cms/CMSTimeStampedDataParser.java b/crypto/j2me/org/bouncycastle/tsp/cms/CMSTimeStampedDataParser.java
new file mode 100644
index 000000000..63988f793
--- /dev/null
+++ b/crypto/j2me/org/bouncycastle/tsp/cms/CMSTimeStampedDataParser.java
@@ -0,0 +1,204 @@
+package org.bouncycastle.tsp.cms;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+
+import org.bouncycastle.asn1.BERTags;
+import org.bouncycastle.asn1.DERIA5String;
+import org.bouncycastle.asn1.cms.AttributeTable;
+import org.bouncycastle.asn1.cms.CMSObjectIdentifiers;
+import org.bouncycastle.asn1.cms.ContentInfoParser;
+import org.bouncycastle.asn1.cms.TimeStampedDataParser;
+import org.bouncycastle.cms.CMSContentInfoParser;
+import org.bouncycastle.cms.CMSException;
+import org.bouncycastle.operator.DigestCalculator;
+import org.bouncycastle.operator.DigestCalculatorProvider;
+import org.bouncycastle.operator.OperatorCreationException;
+import org.bouncycastle.tsp.TimeStampToken;
+import org.bouncycastle.util.io.Streams;
+
+public class CMSTimeStampedDataParser
+    extends CMSContentInfoParser
+{
+    private TimeStampedDataParser timeStampedData;
+    private TimeStampDataUtil util;
+
+    public CMSTimeStampedDataParser(InputStream in)
+        throws CMSException
+    {
+        super(in);
+
+        initialize(_contentInfo);
+    }
+
+    public CMSTimeStampedDataParser(byte[] baseData)
+        throws CMSException
+    {
+        this(new ByteArrayInputStream(baseData));
+    }
+
+    private void initialize(ContentInfoParser contentInfo)
+        throws CMSException
+    {
+        try
+        {
+            if (CMSObjectIdentifiers.timestampedData.equals(contentInfo.getContentType()))
+            {
+                this.timeStampedData = TimeStampedDataParser.getInstance(contentInfo.getContent(BERTags.SEQUENCE));
+            }
+            else
+            {
+                throw new IllegalArgumentException("Malformed content - type must be " + CMSObjectIdentifiers.timestampedData.getId());
+            }
+        }
+        catch (IOException e)
+        {
+            throw new CMSException("parsing exception: " + e.getMessage(), e);
+        }
+    }
+
+    public byte[] calculateNextHash(DigestCalculator calculator)
+        throws CMSException
+    {
+        return util.calculateNextHash(calculator);
+    }
+
+    public InputStream getContent()
+    {
+        if (timeStampedData.getContent() != null)
+        {
+            return timeStampedData.getContent().getOctetStream();
+        }
+
+        return null;
+    }
+
+    public String getDataUri()
+    {
+        DERIA5String dataURI = this.timeStampedData.getDataUri();
+
+        if (dataURI != null)
+        {
+           return dataURI.getString();
+        }
+
+        return null;
+    }
+
+    public String getFileName()
+    {
+        return util.getFileName();
+    }
+
+    public String getMediaType()
+    {
+        return util.getMediaType();
+    }
+
+    public AttributeTable getOtherMetaData()
+    {
+        return util.getOtherMetaData();
+    }
+
+    /**
+     * Initialise the passed in calculator with the MetaData for this message, if it is
+     * required as part of the initial message imprint calculation.
+     *
+     * @param calculator the digest calculator to be initialised.
+     * @throws CMSException if the MetaData is required and cannot be processed
+     */
+    public void initialiseMessageImprintDigestCalculator(DigestCalculator calculator)
+        throws CMSException
+    {
+        util.initialiseMessageImprintDigestCalculator(calculator);
+    }
+
+    /**
+     * Returns an appropriately initialised digest calculator based on the message imprint algorithm
+     * described in the first time stamp in the TemporalData for this message. If the metadata is required
+     * to be included in the digest calculation, the returned calculator will be pre-initialised.
+     *
+     * @param calculatorProvider  a provider of DigestCalculator objects.
+     * @return an initialised digest calculator.
+     * @throws OperatorCreationException if the provider is unable to create the calculator.
+     */
+    public DigestCalculator getMessageImprintDigestCalculator(DigestCalculatorProvider calculatorProvider)
+        throws OperatorCreationException
+    {
+        try
+        {
+            parseTimeStamps();
+        }
+        catch (CMSException e)
+        {
+            throw new OperatorCreationException("unable to extract algorithm ID: " + e.getMessage(), e);
+        }
+
+        return util.getMessageImprintDigestCalculator(calculatorProvider);
+    }
+
+    public TimeStampToken[] getTimeStampTokens()
+        throws CMSException
+    {
+        parseTimeStamps();
+
+        return util.getTimeStampTokens();
+    }
+
+    /**
+     * Validate the digests present in the TimeStampTokens contained in the CMSTimeStampedData.
+     *
+     * @param calculatorProvider provider for digest calculators
+     * @param dataDigest the calculated data digest for the message
+     * @throws ImprintDigestInvalidException if an imprint digest fails to compare
+     * @throws CMSException  if an exception occurs processing the message.
+     */
+    public void validate(DigestCalculatorProvider calculatorProvider, byte[] dataDigest)
+        throws ImprintDigestInvalidException, CMSException
+    {
+        parseTimeStamps();
+
+        util.validate(calculatorProvider, dataDigest);
+    }
+
+    /**
+     * Validate the passed in timestamp token against the tokens and data present in the message.
+     *
+     * @param calculatorProvider provider for digest calculators
+     * @param dataDigest the calculated data digest for the message.
+     * @param timeStampToken  the timestamp token of interest.
+     * @throws ImprintDigestInvalidException if the token is not present in the message, or an imprint digest fails to compare.
+     * @throws CMSException if an exception occurs processing the message.
+     */
+    public void validate(DigestCalculatorProvider calculatorProvider, byte[] dataDigest, TimeStampToken timeStampToken)
+        throws ImprintDigestInvalidException, CMSException
+    {
+        parseTimeStamps();
+
+        util.validate(calculatorProvider, dataDigest, timeStampToken);
+    }
+
+    private void parseTimeStamps()
+        throws CMSException
+    {
+        try
+        {
+            if (util == null)
+            {
+                InputStream cont = this.getContent();
+
+                if (cont != null)
+                {
+                    Streams.drain(cont);
+                }
+
+                util = new TimeStampDataUtil(timeStampedData);
+            }
+        }
+        catch (IOException e)
+        {
+            throw new CMSException("unable to parse evidence block: " + e.getMessage(), e);
+        }
+    }
+}
diff --git a/crypto/j2me/org/bouncycastle/tsp/cms/CMSTimeStampedGenerator.java b/crypto/j2me/org/bouncycastle/tsp/cms/CMSTimeStampedGenerator.java
new file mode 100644
index 000000000..cef63ee88
--- /dev/null
+++ b/crypto/j2me/org/bouncycastle/tsp/cms/CMSTimeStampedGenerator.java
@@ -0,0 +1,86 @@
+package org.bouncycastle.tsp.cms;
+
+import org.bouncycastle.asn1.DERBoolean;
+import org.bouncycastle.asn1.DERIA5String;
+import org.bouncycastle.asn1.DERUTF8String;
+import org.bouncycastle.asn1.cms.Attributes;
+import org.bouncycastle.asn1.cms.MetaData;
+import org.bouncycastle.cms.CMSException;
+import org.bouncycastle.operator.DigestCalculator;
+
+public class CMSTimeStampedGenerator
+{
+    protected MetaData metaData;
+    protected String dataUri;
+
+    /**
+     * Set the dataURI to be included in message.
+     *
+     * @param dataUri URI for the data the initial message imprint digest is based on.
+     */
+    public void setDataUri(String dataUri)
+    {
+        this.dataUri = dataUri;
+    }
+
+    /**
+     * Set the MetaData for the generated message.
+     *
+     * @param hashProtected true if the MetaData should be included in first imprint calculation, false otherwise.
+     * @param fileName optional file name, may be null.
+     * @param mediaType optional media type, may be null.
+     */
+    public void setMetaData(boolean hashProtected, String fileName, String mediaType)
+    {
+        setMetaData(hashProtected, fileName, mediaType, null);
+    }
+
+    /**
+     * Set the MetaData for the generated message.
+     *
+     * @param hashProtected true if the MetaData should be included in first imprint calculation, false otherwise.
+     * @param fileName optional file name, may be null.
+     * @param mediaType optional media type, may be null.
+     * @param attributes optional attributes, may be null.
+     */
+    public void setMetaData(boolean hashProtected, String fileName, String mediaType, Attributes attributes)
+    {
+        DERUTF8String asn1FileName = null;
+
+        if (fileName != null)
+        {
+            asn1FileName = new DERUTF8String(fileName);
+        }
+
+        DERIA5String asn1MediaType = null;
+
+        if (mediaType != null)
+        {
+            asn1MediaType = new DERIA5String(mediaType);
+        }
+
+        setMetaData(hashProtected, asn1FileName, asn1MediaType, attributes);
+    }
+
+    private void setMetaData(boolean hashProtected, DERUTF8String fileName, DERIA5String mediaType, Attributes attributes)
+    {
+        this.metaData = new MetaData(new DERBoolean(hashProtected), fileName, mediaType, attributes);
+    }
+
+    /**
+     * Initialise the passed in calculator with the MetaData for this message, if it is
+     * required as part of the initial message imprint calculation. After initialisation the
+     * calculator can then be used to calculate the initial message imprint digest for the first
+     * timestamp.
+     *
+     * @param calculator the digest calculator to be initialised.
+     * @throws CMSException if the MetaData is required and cannot be processed
+     */
+    public void initialiseMessageImprintDigestCalculator(DigestCalculator calculator)
+        throws CMSException
+    {
+        MetaDataUtil util = new MetaDataUtil(metaData);
+
+        util.initialiseMessageImprintDigestCalculator(calculator);
+    }
+}