title: PKCS7 and "NONEwithRSA" signature
body: <p>I need to compute some data signature, using un-encapsulated pkcs7 with sha256 and RSA.
  No problem with raw content, using :</p>
  
  <pre><code>public byte[] signRawContent(final byte[] content)
      throws CMSException, IOException, OperatorCreationException, CertificateEncodingException {
  
      // Create generator of pkcs7-signature message
      CMSSignedDataGenerator generator = new CMSSignedDataGenerator();
      ContentSigner signer = new JcaContentSignerBuilder("SHA256WithRSA").setProvider("BC").build(privateKey);
      generator.addSignerInfoGenerator(
          new JcaSignerInfoGeneratorBuilder(new JcaDigestCalculatorProviderBuilder().setProvider("BC").build()).build(signer, certificate));
      generator.addCertificate(new X509CertificateHolder(certificate.getEncoded()));
  
      CMSTypedData cmsTypedData = new CMSProcessableByteArray(content);
      CMSSignedData cmsSignedData = generator.generate(cmsTypedData, false);
      return cmsSignedData.getEncoded();
  }
  </code></pre>
  
  <p>But I have another user cases, where I don't have the raw content, only its hash (sha256)
  Bouncycastle doesn't support "NONEwithRSA" or "RSA" for pkcs7 signature, 
  so I tried to use a custom ContentSigner, without obtaining the same 
  signature that with the raw content version.</p>
  
  <pre><code>public byte[] signHash(final byte[] sha256) throws IOException,
      OperatorCreationException, CertificateEncodingException, CMSException {
  
      // Create generator of pkcs7-signature message
      CMSSignedDataGenerator generator = new CMSSignedDataGenerator();
      // custom content signer to bypass hash
      ContentSigner signer = new ContentSigner() {
          @Override public AlgorithmIdentifier getAlgorithmIdentifier() {
              return new DefaultSignatureAlgorithmIdentifierFinder().find("SHA256WithRSA");
          }
  
          @Override public OutputStream getOutputStream() {
              return new ByteArrayOutputStream();
          }
  
          @Override public byte[] getSignature() {
              try {
                  Signature signer = Signature.getInstance("NONEwithRSA");
                  signer.initSign(privateKey);
                  signer.update(sha256);
                  return signer.sign();
              } catch (Exception e){
              throw new RuntimeOperatorException("exception obtaining signature: " + e.getMessage(), e);
              }
          }
      };
  
      generator.addSignerInfoGenerator(
          new JcaSignerInfoGeneratorBuilder(new JcaDigestCalculatorProviderBuilder().setProvider("BC").build()).build(signer, certificate));
      generator.addCertificate(new X509CertificateHolder(certificate.getEncoded()));
  
      CMSTypedData cmsTypedData = new CMSProcessableByteArray(sha256);
      CMSSignedData cmsSignedData = generator.generate(cmsTypedData, false);
      return cmsSignedData.getEncoded();
  }
  </code></pre>
  
  <p>I even tried to rebuild the content digest, no luck</p>
  
  <pre><code> // build digest
   MessageDigest messageDigest = MessageDigest.getInstance("SHA-256");
   messageDigest.update(sha256);
   byte[] outputDigest = messageDigest.digest();
   AlgorithmIdentifier sha256Aid = new AlgorithmIdentifier(NISTObjectIdentifiers.id_sha256, DERNull.INSTANCE);
   DigestInfo di = new DigestInfo(sha256Aid, outputDigest);
  
   //sign SHA256 with RSA
   Signature rsaSignature = Signature.getInstance("RSA");
   rsaSignature.initSign(privateKey);
   byte[] encodedDigestInfo = di.toASN1Primitive().getEncoded();
   rsaSignature.update(encodedDigestInfo);
   return rsaSignature.sign();
  </code></pre>
  
  <p>So is there a way to get a pkcs7 form a sha256?
  Thanks</p>