org.bouncycastle.asn1.x509
Class PKIXCRLValidator

java.lang.Object
  org.bouncycastle.asn1.x509.PKIXCRLValidator

public class PKIXCRLValidator

extends java.lang.Object

Validator for the CRL scope rules of RFC 5280 sec. 6.3.3: the (b)(1) cRLIssuer check, the (b)(2) issuing distribution point checks, the (c) delta CRL consistency checks and the (d) reasons intersection. The methods work purely on ASN.1 structures so the JCA cert path implementations in the provider and in the PKIX revocation checker can share them - the scope analogue of PKIXNameConstraintValidator.

Field Summary

static int

ALL_REASONS A reasons mask asserting all revocation reasons.

Constructor Summary

PKIXCRLValidator()

Method Summary

static void	checkCRLIssuer(DistributionPoint dp, byte[] crlIssuerEncoded, boolean isIndirect) RFC 5280 sec. 6.3.3 (b)(1), cRLIssuer present in the DP: verify that the issuer field in the complete CRL matches cRLIssuer in the DP and that the CRL is an indirect CRL.
static void	checkDeltaAuthorityKeyIdentifiers(ASN1Primitive completeKeyIdentifier, ASN1Primitive deltaKeyIdentifier) RFC 5280 sec. 6.3.3 (c)(3): the complete CRL and delta CRL must both carry an authority key identifier, and the two must match.
static void	checkDeltaIssuingDistributionPoint(IssuingDistributionPoint completeIDP, IssuingDistributionPoint deltaIDP) RFC 5280 sec. 6.3.3 (c)(2): the complete CRL and delta CRL must carry matching issuing distribution point extensions (or both omit them).
static void	checkDistributionPointName(IssuingDistributionPoint idp, DistributionPoint dp, X500Name crlIssuer, X500Name certIssuer) RFC 5280 sec. 6.3.3 (b)(2)(i): if the distribution point name is present in the IDP CRL extension and the distribution field is present in the DP, verify that one of the names in the IDP matches one of the names in the DP; if the distribution field is omitted from the DP, verify that one of the names in the IDP matches one of the names in the cRLIssuer field of the DP.
static void	checkOnlyContains(IssuingDistributionPoint idp, BasicConstraints certBasicConstraints, boolean isCertificate) RFC 5280 sec. 6.3.3 (b)(2)(ii)-(iv): the onlyContainsUserCerts, onlyContainsCACerts and onlyContainsAttributeCerts checks.
static int	intersectReasons(IssuingDistributionPoint idp, DistributionPoint dp) RFC 5280 sec. 6.3.3 (d)(1)-(d)(4): intersect the reasons asserted by the CRL's issuing distribution point and the certificate's distribution point; absent reasons are interpreted as all reasons.
static boolean	requiresCertificateIssuer(IssuingDistributionPoint idp, DistributionPoint dp) Return true if checkDistributionPointName(org.bouncycastle.asn1.x509.IssuingDistributionPoint, org.bouncycastle.asn1.x509.DistributionPoint, org.bouncycastle.asn1.x500.X500Name, org.bouncycastle.asn1.x500.X500Name) will need the certificate issuer name for the passed in issuing distribution point and distribution point - i.e. the DP name is relative to the CRL issuer and the DP carries no cRLIssuer to resolve it against.
static boolean	requiresCRLIssuer(IssuingDistributionPoint idp) Return true if checkDistributionPointName(org.bouncycastle.asn1.x509.IssuingDistributionPoint, org.bouncycastle.asn1.x509.DistributionPoint, org.bouncycastle.asn1.x500.X500Name, org.bouncycastle.asn1.x500.X500Name) will need the CRL issuer name for the passed in issuing distribution point - i.e. its distribution point name is relative to the CRL issuer.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

ALL_REASONS

public static final int ALL_REASONS

A reasons mask asserting all revocation reasons.

See Also:

Constant Field Values

Constructor Detail

PKIXCRLValidator

public PKIXCRLValidator()

Method Detail

requiresCRLIssuer

public static boolean requiresCRLIssuer(IssuingDistributionPoint idp)

Return true if checkDistributionPointName(org.bouncycastle.asn1.x509.IssuingDistributionPoint, org.bouncycastle.asn1.x509.DistributionPoint, org.bouncycastle.asn1.x500.X500Name, org.bouncycastle.asn1.x500.X500Name) will need the CRL issuer name for the passed in issuing distribution point - i.e. its distribution point name is relative to the CRL issuer.

requiresCertificateIssuer

public static boolean requiresCertificateIssuer(IssuingDistributionPoint idp,
                                                DistributionPoint dp)

Return true if checkDistributionPointName(org.bouncycastle.asn1.x509.IssuingDistributionPoint, org.bouncycastle.asn1.x509.DistributionPoint, org.bouncycastle.asn1.x500.X500Name, org.bouncycastle.asn1.x500.X500Name) will need the certificate issuer name for the passed in issuing distribution point and distribution point - i.e. the DP name is relative to the CRL issuer and the DP carries no cRLIssuer to resolve it against.

checkDistributionPointName

public static void checkDistributionPointName(IssuingDistributionPoint idp,
                                              DistributionPoint dp,
                                              X500Name crlIssuer,
                                              X500Name certIssuer)
                                       throws CRLValidatorException

RFC 5280 sec. 6.3.3 (b)(2)(i): if the distribution point name is present in the IDP CRL extension and the distribution field is present in the DP, verify that one of the names in the IDP matches one of the names in the DP; if the distribution field is omitted from the DP, verify that one of the names in the IDP matches one of the names in the cRLIssuer field of the DP.

Parameters:

idp - the CRL's issuing distribution point (may be null - no checks apply).

dp - the distribution point from the certificate.

crlIssuer - the CRL issuer name; only required when requiresCRLIssuer(org.bouncycastle.asn1.x509.IssuingDistributionPoint).

certIssuer - the certificate issuer name; only required when requiresCertificateIssuer(org.bouncycastle.asn1.x509.IssuingDistributionPoint, org.bouncycastle.asn1.x509.DistributionPoint).

Throws:

CRLValidatorException - if no match is found or the DP is malformed.

checkOnlyContains

public static void checkOnlyContains(IssuingDistributionPoint idp,
                                     BasicConstraints certBasicConstraints,
                                     boolean isCertificate)
                              throws CRLValidatorException

RFC 5280 sec. 6.3.3 (b)(2)(ii)-(iv): the onlyContainsUserCerts, onlyContainsCACerts and onlyContainsAttributeCerts checks.

Parameters:

idp - the CRL's issuing distribution point (may be null - no checks apply).

certBasicConstraints - the certificate's basic constraints extension, null if absent.

isCertificate - true for a public key certificate, false for an attribute certificate.

Throws:

CRLValidatorException - if the certificate is outside the CRL's asserted scope.

checkCRLIssuer

public static void checkCRLIssuer(DistributionPoint dp,
                                  byte[] crlIssuerEncoded,
                                  boolean isIndirect)
                           throws CRLValidatorException

RFC 5280 sec. 6.3.3 (b)(1), cRLIssuer present in the DP: verify that the issuer field in the complete CRL matches cRLIssuer in the DP and that the CRL is an indirect CRL.

Parameters:

dp - the distribution point, with a cRLIssuer field present.

crlIssuerEncoded - the DER encoding of the CRL's issuer name.

isIndirect - whether the CRL's issuing distribution point asserts indirectCRL.

Throws:

CRLValidatorException - if the issuer does not match or the CRL is not indirect.

checkDeltaIssuingDistributionPoint

public static void checkDeltaIssuingDistributionPoint(IssuingDistributionPoint completeIDP,
                                                      IssuingDistributionPoint deltaIDP)
                                               throws CRLValidatorException

RFC 5280 sec. 6.3.3 (c)(2): the complete CRL and delta CRL must carry matching issuing distribution point extensions (or both omit them).

Throws:

CRLValidatorException - if the issuing distribution points do not match.

checkDeltaAuthorityKeyIdentifiers

public static void checkDeltaAuthorityKeyIdentifiers(ASN1Primitive completeKeyIdentifier,
                                                     ASN1Primitive deltaKeyIdentifier)
                                              throws CRLValidatorException

RFC 5280 sec. 6.3.3 (c)(3): the complete CRL and delta CRL must both carry an authority key identifier, and the two must match.

Throws:

CRLValidatorException - if either key identifier is absent or they do not match.

intersectReasons

public static int intersectReasons(IssuingDistributionPoint idp,
                                   DistributionPoint dp)

RFC 5280 sec. 6.3.3 (d)(1)-(d)(4): intersect the reasons asserted by the CRL's issuing distribution point and the certificate's distribution point; absent reasons are interpreted as all reasons.

Returns:

the intersected ReasonFlags reasons.