Class ERSEvidenceRecord

java.lang.Object
org.bouncycastle.tsp.ers.ERSEvidenceRecord
public class ERSEvidenceRecord extends Object
Carrier for an RFC 4998 EvidenceRecord - the ArchiveTimeStampSequence of ArchiveTimeStampChains that provides long-term, renewable proof of existence for one or more data objects. The first time-stamp of the first chain is the "primary" archive time-stamp that fixes the original data; subsequent time-stamps within a chain provide time-stamp renewal, and additional chains provide hash-tree renewal when a digest algorithm weakens. This class exposes presence validation and the renewal operations.

  • Constructor Details

    • ERSEvidenceRecord

      public ERSEvidenceRecord(InputStream ersIn, DigestCalculatorProvider digestCalculatorProvider) throws TSPException, ERSException, IOException
      Create an evidence record by reading and parsing an encoded EvidenceRecord.
      Parameters:
      ersIn - stream to read the encoded evidence record from.
      digestCalculatorProvider - provider for the digest calculators needed to process the record.
      Throws:
      TSPException
      ERSException
      IOException

    • ERSEvidenceRecord

      public ERSEvidenceRecord(byte[] evidenceRecord, DigestCalculatorProvider digestCalculatorProvider) throws TSPException, ERSException
      Create an evidence record from an encoded EvidenceRecord.
      Parameters:
      evidenceRecord - the DER encoded evidence record.
      digestCalculatorProvider - provider for the digest calculators needed to process the record.
      Throws:
      TSPException
      ERSException

    • ERSEvidenceRecord

      public ERSEvidenceRecord(org.bouncycastle.asn1.tsp.EvidenceRecord evidenceRecord, DigestCalculatorProvider digestCalculatorProvider) throws TSPException, ERSException
      Create an evidence record from a parsed EvidenceRecord structure. The chains are validated on construction (RFC 4998 Section 5.3) - each chain must contain at least one time-stamp, use a consistent digest algorithm, and each successive time-stamp must cover the previous one.
      Parameters:
      evidenceRecord - the parsed evidence record.
      digestCalculatorProvider - provider for the digest calculators needed to process the record.
      Throws:
      ERSException - if the sequence/chain structure is invalid or a renewal is malformed.
      TSPException - on a time-stamp processing error.

  • Method Details

    • getPrimaryRootHash

      public byte[] getPrimaryRootHash() throws TSPException, ERSException
      Return the timestamp imprint for the initial ArchiveTimeStamp in this evidence record.
      Returns:
      initial hash root.
      Throws:
      TSPException
      ERSException

    • isRelatedTo

      public boolean isRelatedTo(ERSEvidenceRecord er)
      Return true if this evidence record is related to the passed in one.
      Parameters:
      er - the evidence record to be checked.
      Returns:
      true if the primary time stamp has the same value, false otherwise.

    • isContaining

      public boolean isContaining(ERSData data, Date date) throws ERSException
      Return true if the hash of data appears in the primary archive time stamp for the current chain.
      Parameters:
      data - the data of interest.
      date - date at which the data is supposed to be valid.
      Returns:
      true if the data is present and the time-stamp is not in the future relative to date, false otherwise.
      Throws:
      ERSException - if an error occurs processing the record.

    • validatePresent

      public void validatePresent(ERSData data, Date atDate) throws ERSException
      Validate that a particular data object/group is present.
      Parameters:
      data - the data object/group.
      atDate - date at which data is supposed to be valid.
      Throws:
      ERSException - if the object cannot be found or the record is invalid.

    • validatePresent

      public void validatePresent(boolean isDataGroup, byte[] hash, Date atDate) throws ERSException
      Validate that a particular data object/group is present by hash.
      Parameters:
      isDataGroup - true if hash represents a data group.
      hash - expected hash value
      atDate - date at which value is supposed to be valid.
      Throws:
      ERSException - if the object cannot be found or the record is invalid.

    • getSigningCertificate

      public X509CertificateHolder getSigningCertificate()
      Return the TimeStamp signing certificate if it is present.
      Returns:
      the TimeStamp signing certificate.

    • validate

      public void validate(SignerInformationVerifier verifier) throws TSPException
      Validate the current time stamp associated with this evidence record.
      Parameters:
      verifier - signer verifier for the contained time stamp.
      Throws:
      TSPException - in case of validation failure or error.

    • toASN1Structure

      public org.bouncycastle.asn1.tsp.EvidenceRecord toASN1Structure()
      Return the underlying ASN.1 EvidenceRecord structure.
      Returns:
      the EvidenceRecord this object wraps.

    • getEncoded

      public byte[] getEncoded() throws IOException
      return the ASN.1 encoded representation of this object.
      Throws:
      IOException

    • generateTimeStampRenewalRequest

      public TimeStampRequest generateTimeStampRenewalRequest(TimeStampRequestGenerator tspReqGen) throws TSPException, ERSException
      Generate a time-stamp renewal request (RFC 4998 timestamp renewal) over the existing time-stamps in the current chain, for use when the time-stamp or its signature algorithm weakens. The resulting time-stamp, once obtained, is added to the current chain via renewTimeStamp(TimeStampResponse).
      Parameters:
      tspReqGen - generator to use for building the time-stamp request.
      Returns:
      a time-stamp request over the current chain's time-stamps.
      Throws:
      TSPException - on a time-stamp processing error.
      ERSException - on an error building the request.

    • generateTimeStampRenewalRequest

      public TimeStampRequest generateTimeStampRenewalRequest(TimeStampRequestGenerator tspReqGen, BigInteger nonce) throws ERSException, TSPException
      Generate a time-stamp renewal request with the passed in nonce.
      Parameters:
      tspReqGen - generator to use for building the time-stamp request.
      nonce - nonce to include in the request, or null.
      Returns:
      a time-stamp request over the current chain's time-stamps.
      Throws:
      ERSException - on an error building the request.
      TSPException - on a time-stamp processing error.

    • renewTimeStamp

      public ERSEvidenceRecord renewTimeStamp(TimeStampResponse tspResp) throws ERSException, TSPException
      Apply a time-stamp renewal: append the time-stamp from the passed in response (obtained for a generateTimeStampRenewalRequest(TimeStampRequestGenerator)) as a new ArchiveTimeStamp on the current chain, returning the updated record.
      Parameters:
      tspResp - the response carrying the renewal time-stamp.
      Returns:
      a new ERSEvidenceRecord with the renewal time-stamp added to the current chain.
      Throws:
      ERSException - if the response cannot be processed.
      TSPException - on a time-stamp processing error.

    • generateHashRenewalRequest

      public TimeStampRequest generateHashRenewalRequest(DigestCalculator digCalc, ERSData data, TimeStampRequestGenerator tspReqGen) throws ERSException, TSPException, IOException
      Generate a hash renewal request (RFC 4998 hash-tree renewal) for use when the digest algorithm itself weakens. A new digest is taken (with the supplied calculator) over the data re-hashed together with the existing ArchiveTimeStampSequence; the resulting time-stamp starts a new chain via renewHash(DigestCalculator, ERSData, TimeStampResponse).
      Parameters:
      digCalc - digest calculator for the new (stronger) algorithm.
      data - the data object/group being carried forward; must already be present in the record.
      tspReqGen - generator to use for building the time-stamp request.
      Returns:
      a time-stamp request over the re-hashed data and existing sequence.
      Throws:
      ERSException - if the data is not present in the record.
      TSPException - on a time-stamp processing error.
      IOException - on an encoding error.

    • generateHashRenewalRequest

      public TimeStampRequest generateHashRenewalRequest(DigestCalculator digCalc, ERSData data, TimeStampRequestGenerator tspReqGen, BigInteger nonce) throws ERSException, TSPException, IOException
      Generate a hash renewal request with the passed in nonce.
      Parameters:
      digCalc - digest calculator for the new (stronger) algorithm.
      data - the data object/group being carried forward; must already be present in the record.
      tspReqGen - generator to use for building the time-stamp request.
      nonce - nonce to include in the request, or null.
      Returns:
      a time-stamp request over the re-hashed data and existing sequence.
      Throws:
      ERSException - if the data is not present in the record.
      TSPException - on a time-stamp processing error.
      IOException - on an encoding error.

    • renewHash

      public ERSEvidenceRecord renewHash(DigestCalculator digCalc, ERSData data, TimeStampResponse tspResp) throws ERSException, TSPException
      Apply a hash-tree renewal: append a new ArchiveTimeStampChain built from the renewal time-stamp (obtained for a generateHashRenewalRequest(DigestCalculator, ERSData, TimeStampRequestGenerator)) to the ArchiveTimeStampSequence, returning the updated record.
      Parameters:
      digCalc - digest calculator for the new algorithm.
      data - the data object/group being carried forward; must already be present in the record.
      tspResp - the response carrying the renewal time-stamp.
      Returns:
      a new ERSEvidenceRecord with a new chain added to the sequence.
      Throws:
      ERSException - if the data is not present or the response cannot be processed.
      TSPException - on a time-stamp processing error.