/**
     * Зашифрование PKCS7 (Enveloped).
     * <p>
     * //     * @param recipientAlias - алиас получателя (сертификат).
     *
     * @param fileToEncrypt - файл для шифрования
     * @return зашифрованное PKCS7 (Enveloped).
     * @throws Exception
     */
    public Path EncryptPKCS7(Path fileToEncrypt) throws Exception {
        final byte[] pkcs7Data = FileUtils.readFileToByteArray(fileToEncrypt.toFile());
        final X509Certificate recipientCert = loadCert(clientCertPath);

        byte[] encryptedData = EncryptPKCS7(recipientCert, pkcs7Data);

        Path encryptedFile = fileToEncrypt.resolveSibling(fileToEncrypt.getFileName() + FileStoreService.ENC_EXT);
        Array.writeFile(encryptedFile.toFile(), encryptedData);
        return encryptedFile;
    }

    public static byte[] EncryptPKCS7(X509Certificate recipientCert, byte[] pkcs7) throws Exception {

        final PublicKey recipientPublic = recipientCert.getPublicKey();

        // Генерирование симметричного ключа с параметрами
        // шифрования из контрольной панели.

        final KeyGenerator kg = KeyGenerator.getInstance(CMStools.SEC_KEY_ALG_NAME, CRYPT_PROVIDER_NAME);
        final ParamsInterface paramss = AlgIdSpec.getDefaultCryptParams();

        kg.init(paramss);
        final SecretKey simm = kg.generateKey();

        // Зашифрование текста на симметричном ключе.

        Cipher cipher = Cipher.getInstance(CIPHER_MODE, CRYPT_PROVIDER_NAME);
        cipher.init(Cipher.ENCRYPT_MODE, simm, (SecureRandom) null);

        final byte[] iv = cipher.getIV();
        final byte[] text = cipher.doFinal(pkcs7, 0, pkcs7.length);

        // Зашифрование симметричного ключа.

        final byte[] keyTransport = wrap(simm, recipientPublic);

        // Формирование CMS-сообщения.

        final ContentInfo all = new ContentInfo();
        all.contentType = new Asn1ObjectIdentifier(new OID(CMStools.STR_CMS_OID_ENVELOPED).value);

        final EnvelopedData cms = new EnvelopedData();

        all.content = cms;
        cms.version = new CMSVersion(0);

        cms.recipientInfos = new RecipientInfos(1);
        cms.recipientInfos.elements = new RecipientInfo[1];
        cms.recipientInfos.elements[0] = new RecipientInfo();

        final KeyTransRecipientInfo keytrans = new KeyTransRecipientInfo();
        keytrans.version = new CMSVersion(0);

        final Asn1BerEncodeBuffer ebuf = new Asn1BerEncodeBuffer();

        final AlgIdInterface algid = new AlgIdSpec(JCP.GOST_EL_KEY_OID);
        final AlgorithmIdentifier id = (AlgorithmIdentifier) algid.getDecoded();
        id.encode(ebuf);

        Asn1BerDecodeBuffer dbuf = new Asn1BerDecodeBuffer(ebuf.getMsgCopy());
        keytrans.keyEncryptionAlgorithm = new KeyEncryptionAlgorithmIdentifier();
        keytrans.keyEncryptionAlgorithm.decode(dbuf);

        ebuf.reset();
        dbuf.reset();

        keytrans.rid = new RecipientIdentifier();
        final IssuerAndSerialNumber issuer = new IssuerAndSerialNumber();

        final X500Principal issuerName = recipientCert.getIssuerX500Principal();
        dbuf = new Asn1BerDecodeBuffer(issuerName.getEncoded());

        issuer.issuer = new Name();
        final RDNSequence rnd = new RDNSequence();
        rnd.decode(dbuf);

        issuer.issuer.set_rdnSequence(rnd);
        issuer.serialNumber = new CertificateSerialNumber(recipientCert.getSerialNumber());

        keytrans.rid.set_issuerAndSerialNumber(issuer);
        dbuf.reset();

        keytrans.encryptedKey = new EncryptedKey(keyTransport);
        ebuf.reset();

        cms.recipientInfos.elements[0].set_ktri(keytrans);
        cms.encryptedContentInfo = new EncryptedContentInfo();

        final OID contentType = new OID(CMStools.STR_CMS_OID_DATA);
        cms.encryptedContentInfo.contentType = new ContentType(contentType.value);

        final Gost28147_89_Parameters params = new Gost28147_89_Parameters();
        params.iv = new Gost28147_89_IV(iv);

        params.encryptionParamSet = new Gost28147_89_ParamSet(paramss.getOID().value);
        cms.encryptedContentInfo.contentEncryptionAlgorithm = new ContentEncryptionAlgorithmIdentifier(
                _Gost28147_89_EncryptionSyntaxValues.id_Gost28147_89, params);

        cms.encryptedContentInfo.encryptedContent = new EncryptedContent(text);
        all.encode(ebuf);

        return ebuf.getMsgCopy();
    }

    private static byte[] wrap(SecretKey secretKey, Key recipientKey) throws Exception {

        // Генерация эфемерной пары.

        KeyPairGenerator kgp = KeyPairGenerator.getInstance(
                JCP.GOST_EL_DH_EPH_NAME,
                CRYPT_PROVIDER_NAME
        );

        // Устанавливаем нужные параметры, как у получателя.

        kgp.initialize(new X509PublicKeySpec(recipientKey.getEncoded()));

        // Генерируем эфемерную пару.

        KeyPair ephPair = kgp.generateKeyPair();

        PrivateKey privateKey = ephPair.getPrivate();
        PublicKey publicKey = ephPair.getPublic();

        byte[] syncro = new byte[8];
        SecureRandom random = SecureRandom.getInstance(JCP.CP_RANDOM, PROVIDER_NAME);
        random.nextBytes(syncro);

        IvParameterSpec iv = new IvParameterSpec(syncro);
        OID oid = CryptParamsSpec.OID_Crypt_VerbaO;

        // Выработка ключа согласования.

        KeyAgreement ka = KeyAgreement.getInstance(privateKey.getAlgorithm(), CRYPT_PROVIDER_NAME);
        ka.init(privateKey, iv);

        ka.doPhase(recipientKey, true);
        Key dh = ka.generateSecret(CIPHER);

        //Зашифрование симметричного ключа на ключе согласования
        // отправителя.

        final Cipher cipher = Cipher.getInstance(CIPHER, CRYPT_PROVIDER_NAME);
        cipher.init(Cipher.WRAP_MODE, dh, (SecureRandom) null);

        final byte[] wrappedKey = cipher.wrap(secretKey);

        // Упаковка параметров и ключа.

        Gost28147_89_EncryptedKey encryptedKey = new Gost28147_89_EncryptedKey();
        Asn1BerDecodeBuffer decoder = new Asn1BerDecodeBuffer(wrappedKey);
        encryptedKey.decode(decoder);

        byte[] imita = encryptedKey.macKey.value;
        byte[] wrapperKeyBytes = encryptedKey.encryptedKey.value;

        // Кодирование открытого ключа в SubjectPublicKeyInfo.

        byte[] publicKeyBytes = publicKey.getEncoded();
        SubjectPublicKeyInfo publicKeyInfo = new SubjectPublicKeyInfo();

        decoder = new Asn1BerDecodeBuffer(publicKeyBytes);
        publicKeyInfo.decode(decoder);

        // Кодирование GostR3410_KeyTransport.

        GostR3410_KeyTransport keyTransport = new GostR3410_KeyTransport();
        Asn1BerEncodeBuffer encoder = new Asn1BerEncodeBuffer();

        keyTransport.sessionEncryptedKey = new Gost28147_89_EncryptedKey(wrapperKeyBytes, imita);
        keyTransport.transportParameters = new GostR3410_TransportParameters(
                new Gost28147_89_ParamSet(oid.value),
                publicKeyInfo,
                new Asn1OctetString(iv.getIV()));

        keyTransport.encode(encoder);
        return encoder.getMsgCopy();

    }

OID oid = CryptParamsSpec.OID_Gost28147_89_Rosstandart_TC26_Z_ParamSet