The Holder object.
Holder ::= SEQUENCE {
baseCertificateID [0] IssuerSerial OPTIONAL,
-- the issuer and serial number of
-- the holder's Public Key Certificate
entityName [1] GeneralNames OPTIONAL,
-- the name of the claimant or role
objectDigestInfo [2] ObjectDigestInfo OPTIONAL
-- used to directly authenticate the holder,
-- for example, an executable
}
Constructs a holder for v2 attribute certificates with a hash value for
some type of object.
digestedObjectType can be one of the following:
- 0 - publicKey - A hash of the public key of the holder must be
passed.
- 1 - publicKeyCert - A hash of the public key certificate of the
holder must be passed.
- 2 - otherObjectDigest - A hash of some other object type must be
passed.
otherObjectTypeID must not be empty.
This cannot be used if a v1 attribute certificate is used.
@param digestedObjectType The digest object type.
@param digestAlgorithm The algorithm identifier for the hash.
@param otherObjectTypeID The object type ID if
digestedObjectType is
otherObjectDigest.
@param objectDigest The hash value.
Returns the digest object type if an object digest info is used.
- 0 - publicKey - A hash of the public key of the holder must be
passed.
- 1 - publicKeyCert - A hash of the public key certificate of the
holder must be passed.
- 2 - otherObjectDigest - A hash of some other object type must be
passed.
otherObjectTypeID must not be empty.
@return The digest object type or -1 if no object digest info is set.
Returns the other object type ID if an object digest info is used.
@return The other object type ID or null if no object
digest info is set.
Returns the hash if an object digest info is used.
@return The hash or null if no object digest info is set.
Returns the digest algorithm ID if an object digest info is used.
@return The digest algorithm ID or null if no object
digest info is set.
Return any principal objects inside the attribute certificate holder entity names field.
@return an array of IPrincipal objects (usually X500Name), null if no entity names field is set.
Return the principals associated with the issuer attached to this holder
@return an array of principals, null if no BaseCertificateID is set.
Return the serial number associated with the issuer attached to this holder.
@return the certificate serial number, null if no BaseCertificateID is set.
Carrying class for an attribute certificate issuer.
Set the issuer directly with the ASN.1 structure.
@param issuer The issuer
Return any principal objects inside the attribute certificate issuer object.
An array of IPrincipal objects (usually X509Principal).
Copy constructor. This will copy the state of the provided
message digest.
reset the chaining variables
Construct a selector with the value of a public key's subjectKeyId.
@param subjectKeyId a subjectKeyId
Construct a signer ID based on the issuer and serial number of the signer's associated
certificate.
@param issuer the issuer of the signer's associated certificate.
@param serialNumber the serial number of the signer's associated certificate.
Construct a signer ID based on the issuer and serial number of the signer's associated
certificate.
@param issuer the issuer of the signer's associated certificate.
@param serialNumber the serial number of the signer's associated certificate.
@param subjectKeyId the subject key identifier to use to match the signers associated certificate.
Class for carrying the values in an X.509 Attribute.
@param at an object representing an attribute.
Create an X.509 Attribute with the type given by the passed in oid and
the value represented by an ASN.1 Set containing value.
@param oid type of the attribute
@param value value object to go into the atribute's value set.
Create an X.59 Attribute with the type given by the passed in oid and the
value represented by an ASN.1 Set containing the objects in value.
@param oid type of the attribute
@param value vector of values to go in the attribute's value set.
An Object representing an X509 Certificate.
Has static methods for loading Certificates encoded in many forms that return X509Certificate Objects.
Return true if the current time is within the start and end times nominated on the certificate.
true id certificate is valid for the current time.
Return true if the nominated time is within the start and end times nominated on the certificate.
The time to test validity against.
True if certificate is valid for nominated time.
Checks if the current date is within certificate's validity period.
Checks if the given date is within certificate's validity period.
if the certificate is expired by given date
if the certificate is not yet valid on given date
Return the certificate's version.
An integer whose value Equals the version of the cerficate.
Return a BigInteger containing the serial number.
The Serial number.
Get the Issuer Distinguished Name. (Who signed the certificate.)
And X509Object containing name and value pairs.
Get the subject of this certificate.
An X509Name object containing name and value pairs.
The time that this certificate is valid from.
A DateTime object representing that time in the local time zone.
The time that this certificate is valid up to.
A DateTime object representing that time in the local time zone.
Return the Der encoded TbsCertificate data.
This is the certificate component less the signature.
To Get the whole certificate call the GetEncoded() member.
A byte array containing the Der encoded Certificate component.
The signature.
A byte array containg the signature of the certificate.
A meaningful version of the Signature Algorithm. (EG SHA1WITHRSA)
A sting representing the signature algorithm.
Get the Signature Algorithms Object ID.
A string containg a '.' separated object id.
Get the signature algorithms parameters. (EG DSA Parameters)
A byte array containing the Der encoded version of the parameters or null if there are none.
Get the issuers UID.
A DerBitString.
Get the subjects UID.
A DerBitString.
Get a key usage guidlines.
Return the plain SubjectPublicKeyInfo that holds the encoded public key.
Get the public key of the subject of the certificate.
The public key parameters.
Return a Der encoded version of this certificate.
A byte array.
Verify the certificate's signature using a verifier created using the passed in verifier provider.
An appropriate provider for verifying the certificate's signature.
True if the signature is valid.
If verifier provider is not appropriate or the certificate algorithm is invalid.
Create loading data from byte array.
Create loading data from byte array.
Generates a certificate object and initializes it with the data
read from the input stream inStream.
Returns a (possibly empty) collection view of the certificates
read from the given input stream inStream.
The following extensions are listed in RFC 2459 as relevant to CRLs
Authority Key Identifier
Issuer Alternative Name
CRL Number
Delta CRL Indicator (critical)
Issuing Distribution Point (critical)
Verify the CRL's signature using a verifier created using the passed in verifier provider.
An appropriate provider for verifying the CRL's signature.
True if the signature is valid.
If verifier provider is not appropriate or the CRL algorithm is invalid.
Returns a string representation of this CRL.
@return a string representation of this CRL.
Checks whether the given certificate is on this CRL.
@param cert the certificate to check for.
@return true if the given certificate is on this CRL,
false otherwise.
The following extensions are listed in RFC 2459 as relevant to CRL Entries
ReasonCode Hode Instruction Code Invalidity Date Certificate Issuer
(critical)
Constructor for CRLEntries of indirect CRLs. If isIndirect
is false {@link #getCertificateIssuer()} will always
return null, previousCertificateIssuer is
ignored. If this isIndirect is specified and this CrlEntry
has no certificate issuer CRL entry extension
previousCertificateIssuer is returned by
{@link #getCertificateIssuer()}.
@param c
TbsCertificateList.CrlEntry object.
@param isIndirect
true if the corresponding CRL is a indirect
CRL.
@param previousCertificateIssuer
Certificate issuer of the previous CrlEntry.
Get non critical extensions.
A set of non critical extension oids.
Get any critical extensions.
A set of critical extension oids.
Get the value of a given extension.
The object ID of the extension.
An Asn1OctetString object if that extension is found or null if not.
General utility methods for generating X.509 certificates.
Base constructor.
The digest factory to base key info/identifier calculations on.
Create an AuthorityKeyIdentifier from the passed in arguments.
the issuer certificate that the AuthorityKeyIdentifier should refer to.
an AuthorityKeyIdentifier.
Create an AuthorityKeyIdentifier from the passed in public key.
the public key to base the key identifier on.
an AuthorityKeyIdentifier.
Create an AuthorityKeyIdentifier from the passed in SubjectPublicKeyInfo.
the SubjectPublicKeyInfo to base the key identifier on.
an AuthorityKeyIdentifier.
Create an AuthorityKeyIdentifier from the passed in arguments.
the SubjectPublicKeyInfo to base the key identifier on.
the general names to associate with the issuer cert's issuer.
the serial number of the issuer cert.
an AuthorityKeyIdentifier.
Return a RFC 5280 type 1 key identifier. As in: "(1) The keyIdentifier is composed of the 160-bit SHA-1 hash of the
value of the BIT STRING subjectPublicKey(excluding the tag, length, and number of unused bits)."
the public key to base the identifier on.
the key identifier.
Return a RFC 5280 type 1 key identifier. As in: "(1) The keyIdentifier is composed of the 160-bit SHA-1 hash of the
value of the BIT STRING subjectPublicKey(excluding the tag, length, and number of unused bits)."
the key info object containing the subjectPublicKey field.
the key identifier.
Return a RFC 5280 type 2 key identifier. As in: "(2) The keyIdentifier is composed of a four bit type field with
the value 0100 followed by the least significant 60 bits of the SHA-1 hash of the value of the BIT STRING subjectPublicKey.
the key info object containing the subjectPublicKey field.
the key identifier.
Class to Generate X509V1 Certificates.
Default Constructor.
Reset the generator.
Set the certificate's serial number.
Make serial numbers long, if you have no serial number policy make sure the number is at least 16 bytes of secure random data.
You will be surprised how ugly a serial number collision can get.
The serial number.
Set the issuer distinguished name.
The issuer is the entity whose private key is used to sign the certificate.
The issuers DN.
Set the date that this certificate is to be valid from.
Date from which a generated certificate is valid.
Set the date after which this certificate will no longer be valid.
Date after which a generated certificate will expire.
Set the DN of the entity that is represented by the generated certificate's public key.
The X.500 name of the generated certificate's subject.
Set the public key that this certificate identifies.
The public key to be carried by the generated certificate.
Generate a new X509Certificate using the passed in SignatureCalculator.
A signature calculator factory with the necessary algorithm details.
An X509Certificate.
An implementation of a version 2 X.509 Attribute Certificate.
Verify the certificate's signature using a verifier created using the passed in verifier provider.
An appropriate provider for verifying the certificate's signature.
True if the signature is valid.
If verifier provider is not appropriate or the certificate algorithm is invalid.
Class to produce an X.509 Version 2 AttributeCertificate.
Reset the generator
Set the Holder of this Attribute Certificate.
Set the issuer.
Set the serial number for the certificate.
Add an attribute.
Add a given extension field for the standard extensions tag.
Add a given extension field for the standard extensions tag.
The value parameter becomes the contents of the octet string associated
with the extension.
Generate a new X.509 Attribute Certificate using the passed in SignatureCalculator.
A signature calculator factory with the necessary algorithm details.
An IX509AttributeCertificate.
Generator for an X.509 Version 2 CRL.
Base constructor.
Reset the generator.
Set the issuer distinguished name - the issuer is the entity whose private key is used to sign the
certificate.
The issuer name.
Add a CRL entry with a CrlReason extension.
Reason being as indicated by CrlReason, i.e.CrlReason.KeyCompromise or 0 if CrlReason is not to be used
The serial number of the certificate being revoked.
The date of revocation.
The reason for revocation.
Add a CRL entry with an Invalidity Date extension as well as a CrlReason extension.
Reason being as indicated by CrlReason, i.e.CrlReason.KeyCompromise or 0 if CrlReason is not to be used
The serial number of the certificate being revoked.
The date of revocation.
The reason for revocation.
The invalidity date.
Add a CRL entry with extensions.
Serial number of certificate to be revoked.
Revocation date of the certificate.
The extensions to be associated with the CRL entry.
Add the CRLEntry objects contained in a previous CRL.
A source CRL for CRL entry objects.
Add a given extension field for the standard extensions tag (tag 0)
The object identifier identifying the extension type.
true if the extension should be regarded as critical, false otherwise.
The ASN.1 object to be encoded as the extension's value.
Add a given extension field for the standard extensions tag (tag 0)
Its Object Identifier.
Is it critical.
byte[] containing the value of this extension.
Generate a new X509CRL using the passed in SignatureCalculator.
A signature calculator factory with the necessary algorithm details.
An X509CRL.
A class to Generate Version 3 X509Certificates.
Base constructor.
Reset the Generator.
Set the certificate's serial number.
Make serial numbers long, if you have no serial number policy make sure the number is at least 16 bytes of secure random data.
You will be surprised how ugly a serial number collision can Get.
The serial number.
Set the distinguished name of the issuer.
The issuer is the entity which is signing the certificate.
The issuer's DN.
Set the date that this certificate is to be valid from.
Date from which a generated certificate is valid.
Set the date after which this certificate will no longer be valid.
Date after which a generated certificate will expire.
Set the DN of the entity that is represented by the generated certificate's public key.
The X.500 name of the generated certificate's subject.
Set the public key that this certificate identifies.
The public key to be carried by the generated certificate.
Set the subject unique ID - note: it is very rare that it is correct to do this.
The subject unique ID.
Set the issuer unique ID - note: it is very rare that it is correct to do this.
The issuer unique ID.
Add the given extension details to the certificate.
The object identifier identifying the extension type.
true if the extension should be regarded as critical, false otherwise.
The ASN.1 object to be encoded as the extension's value.
Add an extension to this certificate.
Its Object Identifier.
true, if the extension should be regarded as critical critical.
byte[] containing the value octets of this extension.
Add a given extension field for the standard extensions tag (tag 3),
copying the extension value from another certificate.
The object identifier of the extension to be copied.
true, if the copied extension should be regarded as critical critical.
The source certificate to copy the extension from.
If the extension cannot be extracted.
Generate a new X509Certificate using the passed in SignatureCalculator.
A signature calculator factory with the necessary algorithm details.
An X509Certificate.
Default, IterationCount = 1000, OIW=IdSha1, Mac=HmacSHA1
Defaults with IPKMacPrimitivesProvider
Create.
The Mac provider
Digest Algorithm Id
Mac Algorithm Id
Create a PKMAC builder enforcing a ceiling on the maximum iteration count.
supporting calculator
max allowable value for iteration count.
Set the salt length in octets.
@param saltLength length in octets of the salt to be generated.
@return the generator
Set the iteration count.
the iteration count.
this
if iteration count is less than 100
Set PbmParameters
The parameters.
this
The Secure random
The random.
this
Build an IMacFactory.
The password.
IMacFactory
Wrapper for a PKIMessage with protection attached to it.
Wrap a general message.
If the general message does not have protection.
The General message
Wrap a PKI message.
If the PKI message does not have protection.
The PKI message
Message header
Message Body
Return the underlying ASN.1 structure contained in this object.
PKI Message structure
Determine whether the message is protected by a password based MAC. Use verify(PKMACBuilder, char[])
to verify the message if this method returns true.
true if protection MAC PBE based, false otherwise.
Return the extra certificates associated with this message.
an array of extra certificates, zero length if none present.
Verify a message with a public key based signature attached.
a factory of signature verifiers.
true if the provider is able to create a verifier that validates the signature, false otherwise.
Verify a message with password based MAC protection.
MAC builder that can be used to construct the appropriate MacCalculator
the MAC password
true if the passed in password and MAC builder verify the message, false otherwise.
if algorithm not MAC based, or an exception is thrown verifying the MAC.
Wrap a PKIMessage ASN.1 structure.
PKI message.
Create a PKIMessage from the passed in bytes.
BER/DER encoding of the PKIMessage
Return true if this message has protection bits on it. A return value of true
indicates the message can be used to construct a ProtectedPKIMessage.
Close the underlying data stream.
@throws IOException if the close fails.
Return the ContentInfo
The underlying ContentInfo object.
base constructor
generate an encrypted object that contains an Cms Encrypted Data structure.
@param content the content to be encrypted
@param contentEncryptor the symmetric key based encryptor to encrypt the content with.
base constructor
containing class for an CMS Enveloped Data object
return the object identifier for the content encryption algorithm.
return a store of the intended recipients for this message
Return the underlying ASN.1 structure for this object.
A ContentInfo object.
return a table of the unprotected attributes indexed by
the OID of the attribute.
return the ASN.1 encoded representation of this object.
General class for generating a CMS enveloped-data message.
base constructor
Generate an enveloped object that contains an CMS Enveloped Data object using the given provider.
The content to be encrypted
The symmetric key based encryptor to encrypt the content with.
A new CMS EnvelopedData object.
General class for generating a CMS enveloped-data message.
base constructor
Add a generator to produce the recipient info required.
@param recipientGenerator a generator of a recipient info object.
general class for handling a pkcs7-signature message.
A simple example of usage - note, in the example below the validity of
the certificate isn't verified, just the fact that one of the certs
matches the given signer...
IX509Store certs = s.GetCertificates();
SignerInformationStore signers = s.GetSignerInfos();
foreach (SignerInformation signer in signers.GetSigners())
{
ArrayList certList = new ArrayList(certs.GetMatches(signer.SignerID));
X509Certificate cert = (X509Certificate) certList[0];
if (signer.Verify(cert.GetPublicKey()))
{
verified++;
}
}
Base constructor - with encapsulated content
A byte array containing a ContentInfo containing a signedData object.
Base constructor - with detached signature.
The content that was signed.
A byte array containing a ContentInfo containing a signedData object.
Content with detached signature, digests precomputed in hashes.
A map of precomputed digests for content indexed by name of hash.
The content info signature object.
Stream constructor - with detached signature.
The content that was signed.
A stream representing a ContentInfo containing a signedData object.
Stream constructor - with encapsulated content
A stream representing a ContentInfo containing a signedData object.
ContentInfo constructor - with detached signature.
The content that was signed.
A ContentInfo containing a signedData object.
ContentInfo with detached signature, digests precomputed in hashes.
A map of precomputed digests for content indexed by name of hash.
A ContentInfo containing a signedData object.
ContentInfo constructor - with encapsulated content
A ContentInfo containing a signedData object.
Return the version number for this object.
Return true if this message represents a detached signature, false otherwise.
Return true if this is object represents a certificate management message.
Return the collection of signers that are associated with the signatures for the message.
A (possibly empty) collection of signers.
return a X509Store containing the attribute certificates, if any, contained
in this message.
@param type type of store to create
@return a store of attribute certificates
@exception NoSuchStoreException if the store type isn't available.
@exception CmsException if a general exception prevents creation of the X509Store
return a Store containing the public key certificates, if any, contained
in this message.
@param type type of store to create
@return a store of public key certificates
@exception NoSuchStoreException if the store type isn't available.
@exception CmsException if a general exception prevents creation of the X509Store
return a Store containing CRLs, if any, contained
in this message.
@param type type of store to create
@return a store of CRLs
@exception NoSuchStoreException if the store type isn't available.
@exception CmsException if a general exception prevents creation of the X509Store
Return the ASN.1 encoded representation of this object.
A BER encoded byte arrary representing the object.
Return the underlying ASN.1 structure for this object.
A ContentInfo object.
Replace the signerinformation store associated with this
CmsSignedData object with the new one passed in. You would
probably only want to do this if you wanted to change the unsigned
attributes associated with a signer, or perhaps delete one.
@param signedData the signed data object to be used as a base.
@param signerInformationStore the new signer information store to use.
@return a new signed data object.
Replace the certificate and CRL information associated with this
CmsSignedData object with the new one passed in.
@param signedData the signed data object to be used as a base.
@param x509Certs the new certificates to be used.
@param x509Crls the new CRLs to be used.
@return a new signed data object.
@exception CmsException if there is an error processing the stores
* general class for generating a pkcs7-signature message.
*
* A simple example of usage.
*
*
* IX509Store certs...
* IX509Store crls...
* CmsSignedDataGenerator gen = new CmsSignedDataGenerator();
*
* gen.AddSigner(privKey, cert, CmsSignedGenerator.DigestSha1);
* gen.AddCertificates(certs);
* gen.AddCrls(crls);
*
* CmsSignedData data = gen.Generate(content);
*
*
Base constructor.
generate a signed object that for a CMS Signed Data object
generate a signed object that for a CMS Signed Data
object - if encapsulate is true a copy
of the message will be included in the signature. The content type
is set according to the OID represented by the string signedContentType.
generate a set of one or more SignerInformation objects representing counter signatures on
the passed in SignerInformation object.
@param signer the signer to be countersigned
@param sigProvider the provider to be used for counter signing.
@return a store containing the signers.
Parsing class for an CMS Signed Data object from an input stream.
Note: that because we are in a streaming mode only one signer can be tried and it is important
that the methods on the parser are called in the appropriate order.
A simple example of usage for an encapsulated signature.
Two notes: first, in the example below the validity of
the certificate isn't verified, just the fact that one of the certs
matches the given signer, and, second, because we are in a streaming
mode the order of the operations is important.
CmsSignedDataParser sp = new CmsSignedDataParser(encapSigData);
sp.GetSignedContent().Drain();
IX509Store certs = sp.GetCertificates();
SignerInformationStore signers = sp.GetSignerInfos();
foreach (SignerInformation signer in signers.GetSigners())
{
ArrayList certList = new ArrayList(certs.GetMatches(signer.SignerID));
X509Certificate cert = (X509Certificate) certList[0];
Console.WriteLine("verify returns: " + signer.Verify(cert));
}
Note also: this class does not introduce buffering - if you are processing large files you should create
the parser with:
CmsSignedDataParser ep = new CmsSignedDataParser(new BufferedInputStream(encapSigData, bufSize));
where bufSize is a suitably large buffer size.
base constructor - with encapsulated content
base constructor
@param signedContent the content that was signed.
@param sigData the signature object.
Return the version number for the SignedData object
@return the version number
return the collection of signers that are associated with the
signatures for the message.
@throws CmsException
return a X509Store containing the attribute certificates, if any, contained
in this message.
@param type type of store to create
@return a store of attribute certificates
@exception org.bouncycastle.x509.NoSuchStoreException if the store type isn't available.
@exception CmsException if a general exception prevents creation of the X509Store
return a X509Store containing the public key certificates, if any, contained
in this message.
@param type type of store to create
@return a store of public key certificates
@exception NoSuchStoreException if the store type isn't available.
@exception CmsException if a general exception prevents creation of the X509Store
return a X509Store containing CRLs, if any, contained
in this message.
@param type type of store to create
@return a store of CRLs
@exception NoSuchStoreException if the store type isn't available.
@exception CmsException if a general exception prevents creation of the X509Store
Return the DerObjectIdentifier associated with the encapsulated
content info structure carried in the signed data.
Replace the certificate and CRL information associated with this
CMSSignedData object with the new one passed in.
The output stream is returned unclosed.
@param original the signed data stream to be used as a base.
@param certsAndCrls the new certificates and CRLs to be used.
@param out the stream to Write the new signed data object to.
@return out.
@exception CmsException if there is an error processing the CertStore
Default type for the signed data.
Add the attribute certificates contained in the passed in store to the
generator.
@param store a store of Version 2 attribute certificates
@throws CmsException if an error occurse processing the store.
Add a store of precalculated signers to the generator.
@param signerStore store of signers
Return a map of oids and byte arrays representing the digests calculated on the content during
the last generate.
@return a map of oids (as String objects) and byte[] representing digests.
Return the digest algorithm using one of the standard JCA string
representations rather than the algorithm identifier (if possible).
Return the digest encryption algorithm using one of the standard
JCA string representations rather than the algorithm identifier (if
possible).
Default signed attributes generator.
Initialise to use all defaults
Initialise with some extra attributes or overrides.
@param attributeTable initial attribute table to use.
Create a standard attribute table from the passed in parameters - this will
normally include contentType, signingTime, and messageDigest. If the constructor
using an AttributeTable was used, entries in it for contentType, signingTime, and
messageDigest will override the generated ones.
@param parameters source parameters for table generation.
@return a filled in Hashtable of attributes.
@param parameters source parameters
@return the populated attribute table
The 'Signature' parameter is only available when generating unsigned attributes.
Base interface for a CMS Attribute table generator.
Construct an AttributeTable from the passed in dictionary of (key, value) pairs.
The (key, value) pairs to construct the returned table from.
A new attribute table.
generic routine to copy out the data we want processed - the OutputStream
passed in will do the handling on it's own.
Note: this routine may be called multiple times.
Return the type code for this recipient ID.
Finder which is used to look up the algorithm identifiers representing the encryption algorithms that
are associated with a particular signature algorithm.
Return the encryption algorithm identifier associated with the passed in signatureAlgorithm
the algorithm identifier of the signature of interest
the algorithm identifier to be associated with the encryption algorithm used in signature creation.
Construct a key trans recipient ID with the value of a public key's subjectKeyId.
a subjectKeyId
Construct a key trans recipient ID based on the issuer and serial number of the recipient's associated certificate.
The issuer of the recipient's associated certificate.
The serial number of the recipient's associated certificate.
Construct a key trans recipient ID based on the issuer and serial number of the recipient's associated certificate.
The recipient's associated certificate.
Construct a key trans recipient ID based on the issuer and serial number of the recipient's associated certificate.
The issuer of the recipient's associated certificate.
The serial number of the recipient's associated certificate.
The subject key identifier to use to match the recipients associated certificate.
the KeyTransRecipientInformation class for a recipient who has been sent a secret
key encrypted using their public key that needs to be used to
extract the message.
Return the content digest calculated during the read of the content if one has been generated. This will
only happen if we are dealing with authenticated data and authenticated attributes are present.
@return byte array containing the digest.
Return the MAC calculated for the recipient. Note: this call is only meaningful once all
the content has been read.
byte array containing the mac.
Return the decrypted/encapsulated content in the EnvelopedData after recovering the content
encryption/MAC key using the passed in Recipient.
Recipient object to use to recover content encryption key
The content inside the EnvelopedData this RecipientInformation is associated with.
Return a CmsTypedStream representing the content in the EnvelopedData after recovering the content
encryption/MAC key using the passed in Recipient.
Recipient object to use to recover content encryption key
The content inside the EnvelopedData this RecipientInformation is associated with.
A store collection class for RecipientInformation objects.
Create a store containing a collection of RecipientInformation objects.
A collection of recipient information objects to contain.
Return the first RecipientInformation object that matches the
passed in selector. Null if there are no matches.
@param selector to identify a recipient
@return a single RecipientInformation object. Null if none matches.
Return the number of recipients in the collection.
@return number of recipients identified.
Return all recipients in the collection
@return a collection of recipients.
Return possible empty collection with recipients matching the passed in RecipientID
@param selector a recipient id to select against.
@return a collection of RecipientInformation objects.
a basic index for a signer.
Construct a signer ID with the value of a public key's subjectKeyId.
@param subjectKeyId a subjectKeyId
Construct a signer ID based on the issuer and serial number of the signer's associated
certificate.
@param issuer the issuer of the signer's associated certificate.
@param serialNumber the serial number of the signer's associated certificate.
Construct a signer ID based on the issuer and serial number of the signer's associated
certificate.
@param issuer the issuer of the signer's associated certificate.
@param serialNumber the serial number of the signer's associated certificate.
@param subjectKeyId the subject key identifier to use to match the signers associated certificate.
Base constructor.
@param digestProvider a provider of digest calculators for the algorithms required in the signature and attribute calculations.
Base constructor.
@param digestProvider a provider of digest calculators for the algorithms required in the signature and attribute calculations.
If the passed in flag is true, the signer signature will be based on the data, not
a collection of signed attributes, and no signed attributes will be included.
@return the builder object
Provide a custom signed attribute generator.
@param signedGen a generator of signed attributes.
@return the builder object
Provide a generator of unsigned attributes.
@param unsignedGen a generator for signed attributes.
@return the builder object
Build a generator with the passed in certificate issuer and serial number as the signerIdentifier.
operator for generating the final signature in the SignerInfo with.
carrier for the X.509 certificate related to the contentSigner.
a SignerInfoGenerator
Build a generator with the passed in subjectKeyIdentifier as the signerIdentifier. If used you should
try to follow the calculation described in RFC 5280 section 4.2.1.2.
operator factory for generating the final signature in the SignerInfo with.
key identifier to identify the public key for verifying the signature.
a SignerInfoGenerator
An expanded SignerInfo block from a CMS Signed message
Return the version number for this objects underlying SignerInfo structure.
Return the signature, or digest encryption, algorithm
Return the digest algorithm details associated with the signature.
Return the content digest that was calculated during verification.
The content digest resulting from the last verify call.
return a table of the signed attributes - indexed by
the OID of the attribute.
return a table of the unsigned attributes indexed by
the OID of the attribute.
return the encoded signature
Return a SignerInformationStore containing the counter signatures attached to this
signer. If no counter signatures are present an empty store is returned.
return the DER encoding of the signed attributes.
@throws IOException if an encoding error occurs.
Return the base ASN.1 CMS structure that this object contains.
@return an object containing a CMS SignerInfo structure.
Return a signer information object with the passed in unsigned
attributes replacing the ones that are current associated with
the object passed in.
@param signerInformation the signerInfo to be used as the basis.
@param unsignedAttributes the unsigned attributes to add.
@return a copy of the original SignerInformationObject with the changed attributes.
Return a signer information object with passed in SignerInformationStore representing counter
signatures attached as an unsigned attribute.
@param signerInformation the signerInfo to be used as the basis.
@param counterSigners signer info objects carrying counter signature.
@return a copy of the original SignerInformationObject with the changed attributes.
A store collection class for SignerInformation objects.
Create a store containing a single SignerInformation object.
The signer information to contain.
Create a store containing a collection of SignerInformation objects.
A collection of signer information objects to contain.
The number of signers in the collection.
An ICollection of all signers in the collection
Return the first SignerInformation object that matches the
passed in selector. Null if there are no matches.
@param selector to identify a signer
@return a single SignerInformation object. Null if none matches.
Basic constructor - build from a UTF-8 string representing the token.
UTF-8 string representing the token.
Basic constructor - build from a string representing the token.
string representing the token.
Return the type of this control.
Return the token associated with this control (a UTF8String).
Create a CertificateRequestMessage from the passed in bytes.
BER/DER encoding of the CertReqMsg structure.
Return the underlying ASN.1 object defining this CertificateRequestMessage object.
A CertReqMsg
Return the certificate template contained in this message.
a CertTemplate structure.
Return whether or not this request has control values associated with it.
true if there are control values present, false otherwise.
Return whether or not this request has a specific type of control value.
the type OID for the control value we are checking for.
true if a control value of type is present, false otherwise.
Return a control value of the specified type.
the type OID for the control value we are checking for.
the control value if present, null otherwise.
Return whether or not this request message has a proof-of-possession field in it.
true if proof-of-possession is present, false otherwise.
Return the type of the proof-of-possession this request message provides.
one of: popRaVerified, popSigningKey, popKeyEncipherment, popKeyAgreement
Return whether or not the proof-of-possession (POP) is of the type popSigningKey and
it has a public key MAC associated with it.
true if POP is popSigningKey and a PKMAC is present, false otherwise.
Return whether or not a signing key proof-of-possession (POP) is valid.
a provider that can produce content verifiers for the signature contained in this POP.
true if the POP is valid, false otherwise.
if there is a problem in verification or content verifier creation.
if POP not appropriate.
Return the ASN.1 encoding of the certReqMsg we wrap.
a byte array containing the binary encoding of the certReqMsg.
OptionalValidity ::= SEQUENCE {
notBefore [0] Time OPTIONAL,
notAfter [1] Time OPTIONAL } --at least one MUST be present
@return a basic ASN.1 object representation.
Create an instance of OptionalValidity
Create a builder that makes EncryptedValue structures.
wrapper a wrapper for key used to encrypt the actual data contained in the EncryptedValue.
encryptor an output encryptor to encrypt the actual data contained in the EncryptedValue.
Create a builder that makes EncryptedValue structures with fixed length blocks padded using the passed in padder.
a wrapper for key used to encrypt the actual data contained in the EncryptedValue.
encryptor an output encryptor to encrypt the actual data contained in the EncryptedValue.
padder a padder to ensure that the EncryptedValue created will always be a constant length.
Build an EncryptedValue structure containing the passed in pass phrase.
a revocation pass phrase.
an EncryptedValue containing the encrypted pass phrase.
Build an EncryptedValue structure containing the certificate contained in
the passed in holder.
a holder containing a certificate.
an EncryptedValue containing the encrypted certificate.
on a failure to encrypt the data, or wrap the symmetric key for this value.
Build an EncryptedValue structure containing the private key contained in
the passed info structure.
a PKCS#8 private key info structure.
an EncryptedValue containing an EncryptedPrivateKeyInfo structure.
on a failure to encrypt the data, or wrap the symmetric key for this value.
Generic interface for a CertificateRequestMessage control value.
Return the type of this control.
Return the value contained in this control object.
Return a byte array of padded data.
the data to be padded.
a padded byte array containing data.
Return a byte array of with padding removed.
the data to be padded.
an array containing the original unpadded data.
Basic constructor - build from an PKIArchiveOptions structure.
the ASN.1 structure that will underlie this control.
Return the type of this control.
CRMFObjectIdentifiers.id_regCtrl_pkiArchiveOptions
Return the underlying ASN.1 object.
a PKIArchiveOptions structure.
Return the archive control type, one of: encryptedPrivKey,keyGenParameters,or archiveRemGenPrivKey.
the archive control type.
Return whether this control contains enveloped data.
true if the control contains enveloped data, false otherwise.
Return the enveloped data structure contained in this control.
a CMSEnvelopedData object.
Basic constructor - specify the contents of the PKIArchiveControl structure.
the private key to be archived.
the general name to be associated with the private key.
Add a recipient generator to this control.
recipient generator created for a specific recipient.
this builder object.
Build the PKIArchiveControl using the passed in encryptor to encrypt its contents.
a suitable content encryptor.
a PKIArchiveControl object.
Basic constructor - build from a UTF-8 string representing the token.
UTF-8 string representing the token.
Basic constructor - build from a string representing the token.
string representing the token.
Return the type of this control.
CRMFObjectIdentifiers.id_regCtrl_regToken
Return the token associated with this control (a UTF8String).
a UTF8String.
BasicOcspResponse ::= SEQUENCE {
tbsResponseData ResponseData,
signatureAlgorithm AlgorithmIdentifier,
signature BIT STRING,
certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL
}
The DER encoding of the tbsResponseData field.
In the event of an encoding error.
The certificates, if any, associated with the response.
In the event of an encoding error.
Verify the responses's signature using a verifier created using the passed in verifier provider.
An appropriate provider for verifying the responses's signature.
true is the signature on the response verifies, false otherwise.
If verifier provider is not appropriate, the response's algorithm is invalid.
The ASN.1 encoded representation of this object.
Generator for basic OCSP response objects.
basic constructor
construct with the responderID to be the SHA-1 keyHash of the passed in public key.
Add a response for a particular Certificate ID.
@param certID certificate ID details
@param certStatus status of the certificate - null if okay
Add a response for a particular Certificate ID.
@param certID certificate ID details
@param certStatus status of the certificate - null if okay
@param singleExtensions optional extensions
Add a response for a particular Certificate ID.
@param certID certificate ID details
@param nextUpdate date when next update should be requested
@param certStatus status of the certificate - null if okay
@param singleExtensions optional extensions
Add a response for a particular Certificate ID.
@param certID certificate ID details
@param thisUpdate date this response was valid on
@param nextUpdate date when next update should be requested
@param certStatus status of the certificate - null if okay
@param singleExtensions optional extensions
Set the extensions for the response.
@param responseExtensions the extension object to carry.
Generate the signed response using the passed in signature calculator.
Implementation of signing calculator factory.
The certificate chain associated with the response signer.
"produced at" date.
Return an IEnumerable of the signature names supported by the generator.
@return an IEnumerable containing recognised names.
create from an issuer certificate and the serial number of the
certificate it signed.
@exception OcspException if any problems occur creating the id fields.
return the serial number for the certificate associated
with this request.
Create a new CertificateID for a new serial number derived from a previous one
calculated for the same CA certificate.
@param original the previously calculated CertificateID for the CA.
@param newSerialNumber the serial number for the new certificate of interest.
@return a new CertificateID for newSerialNumber
OcspRequest ::= SEQUENCE {
tbsRequest TBSRequest,
optionalSignature [0] EXPLICIT Signature OPTIONAL }
TBSRequest ::= SEQUENCE {
version [0] EXPLICIT Version DEFAULT v1,
requestorName [1] EXPLICIT GeneralName OPTIONAL,
requestList SEQUENCE OF Request,
requestExtensions [2] EXPLICIT Extensions OPTIONAL }
Signature ::= SEQUENCE {
signatureAlgorithm AlgorithmIdentifier,
signature BIT STRING,
certs [0] EXPLICIT SEQUENCE OF Certificate OPTIONAL}
Version ::= INTEGER { v1(0) }
Request ::= SEQUENCE {
reqCert CertID,
singleRequestExtensions [0] EXPLICIT Extensions OPTIONAL }
CertID ::= SEQUENCE {
hashAlgorithm AlgorithmIdentifier,
issuerNameHash OCTET STRING, -- Hash of Issuer's DN
issuerKeyHash OCTET STRING, -- Hash of Issuers public key
serialNumber CertificateSerialNumber }
Return the DER encoding of the tbsRequest field.
@return DER encoding of tbsRequest
@throws OcspException in the event of an encoding error.
return the object identifier representing the signature algorithm
If the request is signed return a possibly empty CertStore containing the certificates in the
request. If the request is not signed the method returns null.
@return null if not signed, a CertStore otherwise
@throws OcspException
Return whether or not this request is signed.
@return true if signed false otherwise.
Verify the signature against the TBSRequest object we contain.
return the ASN.1 encoded representation of this object.
Add a request for the given CertificateID.
@param certId certificate ID of interest
Add a request with extensions
@param certId certificate ID of interest
@param singleRequestExtensions the extensions to attach to the request
Set the requestor name to the passed in X509Principal
@param requestorName a X509Principal representing the requestor name.
Generate an unsigned request
@return the OcspReq
@throws OcspException
Return an IEnumerable of the signature names supported by the generator.
@return an IEnumerable containing recognised names.
return the ASN.1 encoded representation of this object.
base generator for an OCSP response - at the moment this only supports the
generation of responses containing BasicOCSP responses.
note 4 is not used.
Carrier for a ResponderID.
Wrapper for the RevokedInfo object
Return the revocation reason, if there is one.
This field is optional; test for it with first.
The revocation reason, if available.
If no revocation reason is available.
Return the status object for the response - null indicates good.
@return the status object for the response, null if it is good.
return the NextUpdate value - note: this is an optional field so may
be returned as null.
@return nextUpdate, or null if not present.
wrapper for the UnknownInfo object
Pem generator for the original set of Pem objects used in Open SSL.
Class for parsing OpenSSL Pem encoded streams containing X509 certificates, PKCS8 encoded keys and PKCS7 objects.
In the case of PKCS7 objects the reader will return a CMS ContentInfo object. Public keys will be returned as
well formed SubjectPublicKeyInfo objects, private keys will be returned as well formed PrivateKeyInfo objects.In the
case of a private key a PemKeyPair will normally be returned if the encoding contains both the private and public
key definition.CRLs, Certificates, PKCS#10 requests, and Attribute Certificates will generate the appropriate BC holder class.
Create a new PemReader
@param reader the Reader
Return the next object in the reader, null if there are no more left.
The next object in the reader, null at end of data.
Read a Key Pair
Reads in a X509Certificate.
@return the X509Certificate
Reads in a X509Certificate.
@return the X509Certificate
Reads in a X509CRL.
@return the X509Certificate
Reads in a PKCS10 certification request.
@return the certificate request.
Reads in a PKCS7 object. This returns a ContentInfo object suitable for use with the CMS
API.
@return the X509Certificate
Reads in an EncryptedPrivateKeyInfo
@return the X509Certificate
Writer for OpenSSL style PEM objects.
Base constructor.
The underlying TextWriter to output PEM data to.
Encode the passed in object and write it in PEM format.
The object to be encoded.
Encode and encrypt the passed in object and write it in PEM format.
The object to be encoded and encrypted.
The PEM encryptor to use.
Holder for an OpenSSL trusted certificate block.
Base constructor - from a certificate and a trust block.
The certificate to contain.
The trust block to associate with the certififace.
Base constructor - from a byte encoding.
A byte encoding of a trusted certificate block.
Return a binary encoding of the trusted certificate block.
A byte array containing the encoded object.
Return the certificate associated with this Trusted Certificate
The certificate.
Return the trust block associated with this Trusted Certificate
The trust block.
Base constructor - just the private key.
The private key to use.
Constructor with a random source for blinding operations on the private key.
The private key to use.
A source of randomness.
Provider class for OpenSSL PEM decryptors.
Base construcor.
password to configure any produced decryptor for.
Create a cipher builder configured for our password and the passed in DEK-Info.
The DEK-Info describing the cipher and the IV.
A cipher builder for decryptors.
Builder for OpenSSL encryptors, used to encrypt PEM objects.
Base constructor.
The basic DEK-Info describing the cipher.
Configure a SecureRandom for this encryptor builder.
The SecureRandom to use.
The current builder instance.
Create a cipher builder configured for our DEK-Info and the passed in password.
The password to key the cipher builder with.
A cipher builder for encryptors.
OpenSSL supported OpenSSL-PBE algorithms for PEM files.
Builder for factories producing PBE based MAC calculators PKCS#12 style.
Base constructor - default SHA-1
Constructor specifying the particular digest to use.
Digest to use as the basis of the MAC algorithm
Set the initialisation vector for the underlying key deriviation used.
IV or salt for key derivation
The current builder.
Set the iteration count for the underlying key deriviation used.
The current builder.
Build a MAC factory based on the current configuration, keyed using password.
the password to derive the MAC key from.
a new MAC factory for PKCS#12
Verifier class for signature verification in ASN.1 based profiles that use an AlgorithmIdentifier to preserve
signature algorithm details which is also backed by a certificate.
Base constructor.
Return the algorithm details for the wrapped verifier factory object as an AlgorithmIdentifier object.
Return a calculator generated from the wrapped verifier factory object.
A calculator to use for verifying a signature
Check if the certificate this verifier is based on is valid at the passed in dateTime,
returning true if it is.
Time to check at.
true if our underlying certificate is valid, false otherwise.
Builder class for creating a provider of password based decryptors based on AlgorithmIdentifier objects found in
encrypted structures.
Base constructor.
Build a provider of decryptors keyed by password.
The password to configure the decryptor for.
A provider for decryptors that will be keyed by password.
Basic constructor - UTF8 conversion with HMAC SHA-384 as the PRF, unless the algorithm specifies otherwise.
Calculator factory class for signature generation in ASN.1 based profiles that use an AlgorithmIdentifier to preserve
signature algorithm details.
Base constructor.
The base factory to be used in the signing operation.
Base constructor, using an string version of the algorithm name.
The name of the signature algorithm to use.
The underlying signature factory used in this signature factory.
Return the algorithm identifier representation for the signature factory.
Return a collection of the signature names supported by the signature factory.
Verifier class for signature verification in ASN.1 based profiles that use an AlgorithmIdentifier to preserve
signature algorithm details.
Base constructor.
Return the algorithm details for the wrapped verifier factory object as an AlgorithmIdentifier object.
Return a calculator generated from the wrapped verifier factory object.
A calculator to use for verifying a signature
Provider class which supports dynamic creation of signature verifiers.
Base constructor - specify the public key to be used in verification.
The public key to be used in creating verifiers provided by this object.
Base constructor - specify the certificate containing the public key to be used in verification.
The certificate holding the public key to be used.
Return a verifier factory that produces verifiers conforming to algorithmDetails.
The configuration parameters for verifiers produced by the resulting factory.
A new verifier factory.
Signer Utility class contains methods that can not be specifically grouped into other classes.
Return the digest algorithm using one of the standard JCA string
representations rather than the algorithm identifier (if possible).
Attempt to find the digest oid for a signature oid.
For example: PkcsObjectIdentifiers.Sha256WithRsaEncryption => NistObjectIdentifiers.IdSha256
Oid of the signature algorithm.
The digest oid or null if it cannot be resolved.
Base interface for a finder of digests algorithm identifiers used with signatures.
Find the digest algorithm identifier that matches with the passed in signature algorithm identifier.
the signature algorithm of interest.
an algorithm identifier for the corresponding digest.
Find the algorithm identifier that matches with the passed in digest name.
the name of the digest algorithm of interest.
an algorithm identifier for the digest signature.
Holding class for a PKCS#10 certification request.
Create a Pkcs10CertificationRequestHolder from an underlying ASN.1 structure.
The underlying ASN.1 structure representing a request.
Create a Pkcs10CertificationRequestHolder from the passed in bytes.
BER/DER encoding of the CertificationRequest structure.
Return the underlying ASN.1 structure for this request.
A CertificateRequest object.
Return the subject on this request.
Return the details of the signature algorithm used to create this request.
Return the bytes making up the signature associated with this request.
The request signature bytes.
Return the SubjectPublicKeyInfo describing the public key this request is carrying.
Return the attributes, if any associated with this request.
An array of Attribute, zero length if none present.
Return an array of attributes matching the passed in type OID.
The type of the attribute being looked for.
An array of Attribute of the requested type, zero length if none present.
Validate the signature on the Pkcs10 certification request in this holder.
A ContentVerifierProvider that can generate a verifier for the signature.
true if the signature is valid, false otherwise.
A class for creating PKCS#10 Certification requests.
CertificationRequest ::= SEQUENCE {
certificationRequestInfo CertificationRequestInfo,
signatureAlgorithm AlgorithmIdentifier{ { SignatureAlgorithms } },
signature BIT STRING
}
CertificationRequestInfo ::= SEQUENCE {
version INTEGER { v1(0) }
subject Name,
subjectPKInfo SubjectPublicKeyInfo{ { PKInfoAlgorithms } },
attributes[0] Attributes{ { CRIAttributes } }
}
Attributes
{ ATTRIBUTE:IOSet } ::= SET OF Attribute{{ IOSet }}
Attribute
{ ATTRIBUTE:IOSet } ::= SEQUENCE {
type ATTRIBUTE.&id({ IOSet}),
values SET SIZE(1..MAX) OF ATTRIBUTE.&Type({ IOSet}{\@type})
}
Constructor using an encoded subject public key info.
The subject for the certification request.
An encoding of the public key to go in the final certificate.
Constructor using a subject public key info.
The subject for the certification request.
The public key to go in the final certificate and be associated with the subject.
Add an attribute to the certification request we are building.
the OID giving the type of the attribute.
the ASN.1 structure that forms the value of the attribute.
The current builder instance.
Add an attribute with multiple values to the certification request we are building.
the OID giving the type of the attribute.
an array of ASN.1 structures that form the value of the attribute.
The current builder instance.
The attributes field in Pkcs10 should encoded to an empty tagged set if there are
no attributes. Some CAs will reject requests with the attribute field present.
true if empty attributes should be left out of the encoding false otherwise.
The current builder instance.
Generate an PKCS#10 request based on the past in signer.
the content signer to be used to generate the signature validating the certificate.
a holder containing the resulting PKCS#10 certification request.
A holding class for the Pkcs12 Pfx structure.
Return the content infos in the AuthenticatedSafe contained in this Pfx.
@return an array of ContentInfo.
Return whether or not there is MAC attached to this file.
@return true if there is, false otherwise.
Return the algorithm identifier describing the MAC algorithm
@return the AlgorithmIdentifier representing the MAC algorithm, null if none present.
Verify the MacData attached to the PFX is consistent with what is expected.
@param macCalcProviderBuilder provider builder for the calculator for the MAC
@return true if mac data is valid, false otherwise.
@throws PkcsException if there is a problem evaluating the MAC.
@throws IllegalStateException if no MAC is actually present
Return the underlying ASN.1 object.
@return a Pfx object.
Return a Pfx with the outer wrapper encoded as asked for. For example, Pfx is a usually
a BER encoded object, to get one with DefiniteLength encoding use:
getEncoded(Asn1Encoding.DL)
@param encoding encoding style (Asn1Encoding.DER, Asn1Encoding.DL, Asn1Encoding.BER)
@return a byte array containing the encoded object.
@throws IOException
A builder for the Pkcs#12 Pfx key and certificate store.
Add a SafeBag that is to be included as is.
the SafeBag to add.
this builder.
Add a SafeBag that is to be wrapped in a EncryptedData object.
the encryptor to use for encoding the data.
the SafeBag to include.
this builder.
Add a set of SafeBags that are to be wrapped in a EncryptedData object.
The encryptor to use for encoding the data.
the SafeBags to include.
this builder.
Build the Pfx structure, protecting it with a MAC calculated against the passed in password.
a builder for a Pkcs12 mac calculator.
A Pfx object.
Return the underlying ASN.1 structure for this safe bag.
@return a SafeBag
Return the BagId giving the type of content in the bag.
@return the bagId
A holding class for a PKCS#8 encrypted private key info object that allows for its decryption.
Base constructor from a PKCS#8 EncryptedPrivateKeyInfo object.
A PKCS#8 EncryptedPrivateKeyInfo object.
Base constructor from a BER encoding of a PKCS#8 EncryptedPrivateKeyInfo object.
A BER encoding of a PKCS#8 EncryptedPrivateKeyInfo objects.
Returns a copy of the encrypted data in this structure.
Return a copy of the encrypted data in this object.
Returns the underlying ASN.1 structure inside this object.
Return the EncryptedPrivateKeyInfo structure in this object.
Return a binary ASN.1 encoding of the EncryptedPrivateKeyInfo structure in this object.
A byte array containing the encoded object.
Get a decryptor from the passed in provider and decrypt the encrypted private key info, returning the result.
A provider to query for decryptors for the object.
The decrypted private key info structure.
A class for creating EncryptedPrivateKeyInfo structures.
EncryptedPrivateKeyInfo ::= SEQUENCE {
encryptionAlgorithm AlgorithmIdentifier { { KeyEncryptionAlgorithms } },
encryptedData EncryptedData
}
EncryptedData ::= OCTET STRING
KeyEncryptionAlgorithms ALGORITHM-IDENTIFIER::= {
... -- For local profiles
}
Constructor using an encoded PrivateKeyInfo object.
a ASN.1 BER encoded PrivateKeyInfo object.
Constructor using a PrivateKeyInfo object.
the PrivateKeyInfo to be processed.
Create the encrypted private key info using the passed in encryptor.
The encryptor to use.
An encrypted private key info containing the original private key info.
Base exception for PKCS related issues.
Base exception for parsing related issues in the PKCS namespace.
Returns the revocationDate.
Returns the certStatus.
Get all critical extension values, by oid
IDictionary with string (OID) keys and Asn1OctetString values
Get all non-critical extension values, by oid
IDictionary with string (OID) keys and Asn1OctetString values
Returns an immutable Set of X.509 attribute certificate
extensions that this PkixAttrCertChecker supports or
null if no extensions are supported.
Each element of the set is a String representing the
Object Identifier (OID) of the X.509 extension that is supported.
All X.509 attribute certificate extensions that a
PkixAttrCertChecker might possibly be able to process
should be included in the set.
@return an immutable Set of X.509 extension OIDs (in
String format) supported by this
PkixAttrCertChecker, or null if no
extensions are supported
Performs checks on the specified attribute certificate. Every handled
extension is rmeoved from the unresolvedCritExts
collection.
@param attrCert The attribute certificate to be checked.
@param certPath The certificate path which belongs to the attribute
certificate issuer public key certificate.
@param holderCertPath The certificate path which belongs to the holder
certificate.
@param unresolvedCritExts a Collection of OID strings
representing the current set of unresolved critical extensions
@throws CertPathValidatorException if the specified attribute certificate
does not pass the check.
Returns a clone of this object.
@return a copy of this PkixAttrCertChecker
Summary description for PkixBuilderParameters.
Returns an instance of PkixBuilderParameters.
This method can be used to get a copy from other
PKIXBuilderParameters, PKIXParameters,
and ExtendedPKIXParameters instances.
@param pkixParams The PKIX parameters to create a copy of.
@return An PkixBuilderParameters instance.
Excluded certificates are not used for building a certification path.
the excluded certificates.
Sets the excluded certificates which are not used for building a
certification path. If the ISet is null an
empty set is assumed.
The given set is cloned to protect it against subsequent modifications.
The excluded certificates to set.
Can alse handle ExtendedPKIXBuilderParameters and
PKIXBuilderParameters.
@param params Parameters to set.
@see org.bouncycastle.x509.ExtendedPKIXParameters#setParams(java.security.cert.PKIXParameters)
Makes a copy of this PKIXParameters object. Changes to the
copy will not affect the original and vice versa.
@return a copy of this PKIXParameters object
Local copies of functions that are either in the module but internal or do not exist in the module and are required by PKIX.
An immutable sequence of certificates (a certification path).
This is an abstract class that defines the methods common to all CertPaths.
Subclasses can handle different kinds of certificates (X.509, PGP, etc.).
All CertPath objects have a type, a list of Certificates, and one or more
supported encodings. Because the CertPath class is immutable, a CertPath
cannot change in any externally visible way after being constructed. This
stipulation applies to all public fields and methods of this class and any
added or overridden by subclasses.
The type is a string that identifies the type of Certificates in the
certification path. For each certificate cert in a certification path
certPath, cert.getType().equals(certPath.getType()) must be true.
The list of Certificates is an ordered List of zero or more Certificates.
This List and all of the Certificates contained in it must be immutable.
Each CertPath object must support one or more encodings so that the object
can be translated into a byte array for storage or transmission to other
parties. Preferably, these encodings should be well-documented standards
(such as PKCS#7). One of the encodings supported by a CertPath is considered
the default encoding. This encoding is used if no encoding is explicitly
requested (for the {@link #getEncoded()} method, for instance).
All CertPath objects are also Serializable. CertPath objects are resolved
into an alternate {@link CertPathRep} object during serialization. This
allows a CertPath object to be serialized into an equivalent representation
regardless of its underlying implementation.
CertPath objects can be created with a CertificateFactory or they can be
returned by other classes, such as a CertPathBuilder.
By convention, X.509 CertPaths (consisting of X509Certificates), are ordered
starting with the target certificate and ending with a certificate issued by
the trust anchor. That is, the issuer of one certificate is the subject of
the following one. The certificate representing the
{@link TrustAnchor TrustAnchor} should not be included in the certification
path. Unvalidated X.509 CertPaths may not follow these conventions. PKIX
CertPathValidators will detect any departure from these conventions that
cause the certification path to be invalid and throw a
CertPathValidatorException.
Concurrent Access
All CertPath objects must be thread-safe. That is, multiple threads may
concurrently invoke the methods defined in this class on a single CertPath
object (or more than one) with no ill effects. This is also true for the List
returned by CertPath.getCertificates.
Requiring CertPath objects to be immutable and thread-safe allows them to be
passed around to various pieces of code without worrying about coordinating
access. Providing this thread-safety is generally not difficult, since the
CertPath and List objects in question are immutable.
@see CertificateFactory
@see CertPathBuilder
CertPath implementation for X.509 certificates.
@param certs
Creates a CertPath of the specified type.
This constructor is protected because most users should use
a CertificateFactory to create CertPaths.
@param type the standard name of the type of Certificatesin this path
Creates a CertPath of the specified type.
This constructor is protected because most users should use
a CertificateFactory to create CertPaths.
@param type the standard name of the type of Certificatesin this path
Returns an iteration of the encodings supported by this
certification path, with the default encoding
first. Attempts to modify the returned Iterator via its
remove method result in an UnsupportedOperationException.
@return an Iterator over the names of the supported encodings (as Strings)
Compares this certification path for equality with the specified object.
Two CertPaths are equal if and only if their types are equal and their
certificate Lists (and by implication the Certificates in those Lists)
are equal. A CertPath is never equal to an object that is not a CertPath.
This algorithm is implemented by this method. If it is overridden, the
behavior specified here must be maintained.
@param other
the object to test for equality with this certification path
@return true if the specified object is equal to this certification path,
false otherwise
@see Object#hashCode() Object.hashCode()
Returns the encoded form of this certification path, using
the default encoding.
@return the encoded bytes
@exception CertificateEncodingException if an encoding error occurs
Returns the encoded form of this certification path, using
the specified encoding.
@param encoding the name of the encoding to use
@return the encoded bytes
@exception CertificateEncodingException if an encoding error
occurs or the encoding requested is not supported
Returns the list of certificates in this certification
path.
Return a DERObject containing the encoded certificate.
@param cert the X509Certificate object to be encoded
@return the DERObject
Build and validate a CertPath using the given parameter.
@param params PKIXBuilderParameters object containing all information to
build the CertPath
* Initializes the internal state of this PKIXCertPathChecker.
*
* The forward flag specifies the order that certificates
* will be passed to the {@link #check check} method (forward or reverse). A
* PKIXCertPathChecker must support reverse checking
* and may support forward checking.
*
*
* @param forward
* the order that certificates are presented to the
* check method. If true,
* certificates are presented from target to most-trusted CA
* (forward); if false, from most-trusted CA to
* target (reverse).
* @exception CertPathValidatorException
* if this PKIXCertPathChecker is unable to
* check certificates in the specified order; it should never
* be thrown if the forward flag is false since reverse
* checking must be supported
Indicates if forward checking is supported. Forward checking refers to
the ability of the PKIXCertPathChecker to perform its
checks when certificates are presented to the check method
in the forward direction (from target to most-trusted CA).
@return true if forward checking is supported,
false otherwise
* Returns an immutable Set of X.509 certificate extensions
* that this PKIXCertPathChecker supports (i.e. recognizes,
* is able to process), or null if no extensions are
* supported.
*
* Each element of the set is a String representing the
* Object Identifier (OID) of the X.509 extension that is supported. The OID
* is represented by a set of nonnegative integers separated by periods.
*
* All X.509 certificate extensions that a PKIXCertPathChecker
* might possibly be able to process should be included in the set.
*
*
* @return an immutable Set of X.509 extension OIDs (in
* String format) supported by this
* PKIXCertPathChecker, or null if no
* extensions are supported
Performs the check(s) on the specified certificate using its internal
state and removes any critical extensions that it processes from the
specified collection of OID strings that represent the unresolved
critical extensions. The certificates are presented in the order
specified by the init method.
@param cert
the Certificate to be checked
@param unresolvedCritExts
a Collection of OID strings representing the
current set of unresolved critical extensions
@exception CertPathValidatorException
if the specified certificate does not pass the check
Returns a clone of this object. Calls the Object.clone()
method. All subclasses which maintain state must support and override
this method, if necessary.
@return a copy of this PKIXCertPathChecker
The Service Provider Interface (SPI)
for the {@link CertPathValidator CertPathValidator} class. All
CertPathValidator implementations must include a class (the
SPI class) that extends this class (CertPathValidatorSpi)
and implements all of its methods. In general, instances of this class
should only be accessed through the CertPathValidator class.
For details, see the Java Cryptography Architecture.
Concurrent Access
Instances of this class need not be protected against concurrent
access from multiple threads. Threads that need to access a single
CertPathValidatorSpi instance concurrently should synchronize
amongst themselves and provide the necessary locking before calling the
wrapping CertPathValidator object.
However, implementations of CertPathValidatorSpi may still
encounter concurrency issues, since multiple threads each
manipulating a different CertPathValidatorSpi instance need not
synchronize.
CertPathValidatorSpi implementation for X.509 Certificate validation a la RFC
3280.
An exception indicating one of a variety of problems encountered when
validating a certification path.
A CertPathValidatorException provides support for wrapping
exceptions. The {@link #getCause getCause} method returns the throwable,
if any, that caused this exception to be thrown.
A CertPathValidatorException may also include the
certification path that was being validated when the exception was thrown
and the index of the certificate in the certification path that caused the
exception to be thrown. Use the {@link #getCertPath getCertPath} and
{@link #getIndex getIndex} methods to retrieve this information.
Concurrent Access
Unless otherwise specified, the methods defined in this class are not
thread-safe. Multiple threads that need to access a single
object concurrently should synchronize amongst themselves and
provide the necessary locking. Multiple threads each manipulating
separate objects need not synchronize.
@see CertPathValidator
Creates a PkixCertPathValidatorException with the given detail
message. A detail message is a String that describes this
particular exception.
the detail message
Creates a PkixCertPathValidatorException with the specified
detail message and cause.
the detail message
the cause (which is saved for later retrieval by the
{@link #getCause getCause()} method). (A null
value is permitted, and indicates that the cause is
nonexistent or unknown.)
Creates a PkixCertPathValidatorException with the specified
detail message, cause, certification path, and index.
the detail message (or null if none)
the cause (or null if none)
the certification path that was in the process of being
validated when the error was encountered
the index of the certificate in the certification path that *
Returns the detail message for this CertPathValidatorException.
the detail message, or null if neither the message nor cause were specified
Returns the certification path that was being validated when the
exception was thrown.
@return the CertPath that was being validated when the
exception was thrown (or null if not specified)
Returns the index of the certificate in the certification path that
caused the exception to be thrown. Note that the list of certificates in
a CertPath is zero based. If no index has been set, -1 is
returned.
@return the index that has been set, or -1 if none has been set
Summary description for PkixCertPathValidatorUtilities.
key usage bits
Search the given Set of TrustAnchor's for one that is the
issuer of the given X509 certificate.
the X509 certificate
a Set of TrustAnchor's
the TrustAnchor object if found or
null if not.
@exception
Returns the issuer of an attribute certificate or certificate.
The attribute certificate or certificate.
The issuer as X500Principal.
Return the next working key inheriting DSA parameters if necessary.
This methods inherits DSA parameters from the indexed certificate or
previous certificates in the certificate chain to the returned
PublicKey. The list is searched upwards, meaning the end
certificate is at position 0 and previous certificates are following.
If the indexed certificate does not contain a DSA key this method simply
returns the public key. If the DSA key already contains DSA parameters
the key is also only returned.
@param certs The certification path.
@param index The index of the certificate which contains the public key
which should be extended with DSA parameters.
@return The public key of the certificate in list position
index extended with DSA parameters if applicable.
@throws Exception if DSA parameters cannot be inherited.
Return a Collection of all certificates or attribute certificates found
in the X509Store's that are matching the certSelect criteriums.
a {@link Selector} object that will be used to select
the certificates
a List containing only X509Store objects. These
are used to search for certificates.
a Collection of all found objects.
May be empty but never null.
Add the CRL issuers from the cRLIssuer field of the distribution point or
from the certificate if not given to the issuer criterion of the
selector.
The issuerPrincipals are a collection with a single
X500Principal for X509Certificates. For
{@link X509AttributeCertificate}s the issuer may contain more than one
X500Principal.
@param dp The distribution point.
@param issuerPrincipals The issuers of the certificate or attribute
certificate which contains the distribution point.
@param selector The CRL selector.
@param pkixParams The PKIX parameters containing the cert stores.
@throws Exception if an exception occurs while processing.
@throws ClassCastException if issuerPrincipals does not
contain only X500Principals.
Fetches complete CRLs according to RFC 3280.
@param dp The distribution point for which the complete CRL
@param cert The X509Certificate or
{@link org.bouncycastle.x509.X509AttributeCertificate} for
which the CRL should be searched.
@param currentDate The date for which the delta CRLs must be valid.
@param paramsPKIX The extended PKIX parameters.
@return A Set of X509CRLs with complete
CRLs.
@throws Exception if an exception occurs while picking the CRLs
or no CRLs are found.
Fetches delta CRLs according to RFC 3280 section 5.2.4.
@param currentDate The date for which the delta CRLs must be valid.
@param paramsPKIX The extended PKIX parameters.
@param completeCRL The complete CRL the delta CRL is for.
@return A Set of X509CRLs with delta CRLs.
@throws Exception if an exception occurs while picking the delta
CRLs.
Find the issuer certificates of a given certificate.
@param cert
The certificate for which an issuer should be found.
@param pkixParams
@return A Collection object containing the issuer
X509Certificates. Never null.
@exception Exception
if an error occurs.
Extract the value of the given extension, if it exists.
The extension object.
The object identifier to obtain.
Asn1Object
if the extension cannot be read.
crl checking
Return a Collection of all CRLs found in the X509Store's that are
matching the crlSelect criteriums.
a {@link X509CRLStoreSelector} object that will be used
to select the CRLs
a List containing only {@link org.bouncycastle.x509.X509Store
X509Store} objects. These are used to search for CRLs
a Collection of all found {@link X509CRL X509CRL} objects. May be
empty but never null.
Returns the intersection of the permitted IP ranges in
permitted with ip.
@param permitted A Set of permitted IP addresses with
their subnet mask as byte arrays.
@param ips The IP address with its subnet mask.
@return The Set of permitted IP ranges intersected with
ip.
Returns the union of the excluded IP ranges in excluded
with ip.
@param excluded A Set of excluded IP addresses with their
subnet mask as byte arrays.
@param ip The IP address with its subnet mask.
@return The Set of excluded IP ranges unified with
ip as byte arrays.
Calculates the union if two IP ranges.
@param ipWithSubmask1 The first IP address with its subnet mask.
@param ipWithSubmask2 The second IP address with its subnet mask.
@return A Set with the union of both addresses.
Calculates the interesction if two IP ranges.
@param ipWithSubmask1 The first IP address with its subnet mask.
@param ipWithSubmask2 The second IP address with its subnet mask.
@return A Set with the single IP address with its subnet
mask as a byte array or an empty Set.
Concatenates the IP address with its subnet mask.
@param ip The IP address.
@param subnetMask Its subnet mask.
@return The concatenated IP address with its subnet mask.
Splits the IP addresses and their subnet mask.
@param ipWithSubmask1 The first IP address with the subnet mask.
@param ipWithSubmask2 The second IP address with the subnet mask.
@return An array with two elements. Each element contains the IP address
and the subnet mask in this order.
Based on the two IP addresses and their subnet masks the IP range is
computed for each IP address - subnet mask pair and returned as the
minimum IP address and the maximum address of the range.
@param ip1 The first IP address.
@param subnetmask1 The subnet mask of the first IP address.
@param ip2 The second IP address.
@param subnetmask2 The subnet mask of the second IP address.
@return A array with two elements. The first/second element contains the
min and max IP address of the first/second IP address and its
subnet mask.
Checks if the IP ip is included in the permitted ISet
permitted.
@param permitted A Set of permitted IP addresses with
their subnet mask as byte arrays.
@param ip The IP address.
@throws PkixNameConstraintValidatorException
if the IP is not permitted.
Checks if the IP ip is included in the excluded ISet
excluded.
@param excluded A Set of excluded IP addresses with their
subnet mask as byte arrays.
@param ip The IP address.
@throws PkixNameConstraintValidatorException
if the IP is excluded.
Checks if the IP address ip is constrained by
constraint.
@param ip The IP address.
@param constraint The constraint. This is an IP address concatenated with
its subnetmask.
@return true if constrained, false
otherwise.
The common part of email1 and email2 is
added to the union union. If email1 and
email2 have nothing in common they are added both.
@param email1 Email address constraint 1.
@param email2 Email address constraint 2.
@param union The union.
The most restricting part from email1 and
email2 is added to the intersection intersect.
@param email1 Email address constraint 1.
@param email2 Email address constraint 2.
@param intersect The intersection.
Checks if the given GeneralName is in the permitted ISet.
@param name The GeneralName
@throws PkixNameConstraintValidatorException
If the name
Check if the given GeneralName is contained in the excluded ISet.
@param name The GeneralName.
@throws PkixNameConstraintValidatorException
If the name is
excluded.
Updates the permitted ISet of these name constraints with the intersection
with the given subtree.
@param permitted The permitted subtrees
Adds a subtree to the excluded ISet of these name constraints.
@param subtree A subtree with an excluded GeneralName.
Returns the maximum IP address.
@param ip1 The first IP address.
@param ip2 The second IP address.
@return The maximum IP address.
Returns the minimum IP address.
@param ip1 The first IP address.
@param ip2 The second IP address.
@return The minimum IP address.
Compares IP address ip1 with ip2. If ip1
is equal to ip2 0 is returned. If ip1 is bigger 1 is returned, -1
otherwise.
@param ip1 The first IP address.
@param ip2 The second IP address.
@return 0 if ip1 is equal to ip2, 1 if ip1 is bigger, -1 otherwise.
Returns the logical OR of the IP addresses ip1 and
ip2.
@param ip1 The first IP address.
@param ip2 The second IP address.
@return The OR of ip1 and ip2.
Stringifies an IPv4 or v6 address with subnet mask.
@param ip The IP with subnet mask.
@return The stringified IP address.
This is the default PKIX validity model. Actually there are two variants
of this: The PKIX model and the modified PKIX model. The PKIX model
verifies that all involved certificates must have been valid at the
current time. The modified PKIX model verifies that all involved
certificates were valid at the signing time. Both are indirectly choosen
with the {@link PKIXParameters#setDate(java.util.Date)} method, so this
methods sets the Date when all certificates must have been
valid.
This model uses the following validity model. Each certificate must have
been valid at the moment where is was used. That means the end
certificate must have been valid at the time the signature was done. The
CA certificate which signed the end certificate must have been valid,
when the end certificate was signed. The CA (or Root CA) certificate must
have been valid, when the CA certificate was signed and so on. So the
{@link PKIXParameters#setDate(java.util.Date)} method sets the time, when
the end certificate must have been valid. It is used e.g.
in the German signature law.
Creates an instance of PKIXParameters with the specified Set of
most-trusted CAs. Each element of the set is a TrustAnchor.
Note that the Set is copied to protect against subsequent modifications.
@param trustAnchors
a Set of TrustAnchors
@exception InvalidAlgorithmParameterException
if the specified Set is empty
(trustAnchors.isEmpty() == true)
@exception NullPointerException
if the specified Set is null
@exception ClassCastException
if any of the elements in the Set are not of type
java.security.cert.TrustAnchor
Returns the required constraints on the target certificate. The
constraints are returned as an instance of CertSelector. If
null, no constraints are defined.
Note that the CertSelector returned is cloned to protect against
subsequent modifications.
@return a CertSelector specifying the constraints on the target
certificate (or null)
@see #setTargetCertConstraints(CertSelector)
Sets the required constraints on the target certificate. The constraints
are specified as an instance of CertSelector. If null, no constraints are
defined.
Note that the CertSelector specified is cloned to protect against
subsequent modifications.
@param selector
a CertSelector specifying the constraints on the target
certificate (or null)
@see #getTargetCertConstraints()
Returns an immutable Set of initial policy identifiers (OID strings),
indicating that any one of these policies would be acceptable to the
certificate user for the purposes of certification path processing. The
default return value is an empty Set, which is
interpreted as meaning that any policy would be acceptable.
@return an immutable Set of initial policy OIDs in String
format, or an empty Set (implying any policy is
acceptable). Never returns null.
@see #setInitialPolicies(java.util.Set)
Sets the Set of initial policy identifiers (OID strings),
indicating that any one of these policies would be acceptable to the
certificate user for the purposes of certification path processing. By
default, any policy is acceptable (i.e. all policies), so a user that
wants to allow any policy as acceptable does not need to call this
method, or can call it with an empty Set (or
null).
Note that the Set is copied to protect against subsequent modifications.
@param initialPolicies
a Set of initial policy OIDs in String format (or
null)
@exception ClassCastException
if any of the elements in the set are not of type String
@see #getInitialPolicies()
Sets a List of additional certification path checkers. If
the specified List contains an object that is not a PKIXCertPathChecker,
it is ignored.
Each PKIXCertPathChecker specified implements additional
checks on a certificate. Typically, these are checks to process and
verify private extensions contained in certificates. Each
PKIXCertPathChecker should be instantiated with any
initialization parameters needed to execute the check.
This method allows sophisticated applications to extend a PKIX
CertPathValidator or CertPathBuilder. Each
of the specified PKIXCertPathCheckers will be called, in turn, by a PKIX
CertPathValidator or CertPathBuilder for
each certificate processed or validated.
Regardless of whether these additional PKIXCertPathCheckers are set, a
PKIX CertPathValidator or CertPathBuilder
must perform all of the required PKIX checks on each certificate. The one
exception to this rule is if the RevocationEnabled flag is set to false
(see the {@link #setRevocationEnabled(boolean) setRevocationEnabled}
method).
Note that the List supplied here is copied and each PKIXCertPathChecker
in the list is cloned to protect against subsequent modifications.
@param checkers
a List of PKIXCertPathCheckers. May be null, in which case no
additional checkers will be used.
@exception ClassCastException
if any of the elements in the list are not of type
java.security.cert.PKIXCertPathChecker
@see #getCertPathCheckers()
Returns the List of certification path checkers. Each PKIXCertPathChecker
in the returned IList is cloned to protect against subsequent modifications.
@return an immutable List of PKIXCertPathCheckers (may be empty, but not
null)
@see #setCertPathCheckers(java.util.List)
Adds a PKIXCertPathChecker to the list of certification
path checkers. See the {@link #setCertPathCheckers setCertPathCheckers}
method for more details.
Note that the PKIXCertPathChecker is cloned to protect
against subsequent modifications.
@param checker a PKIXCertPathChecker to add to the list of
checks. If null, the checker is ignored (not added to list).
Method to support Clone() under J2ME.
super.Clone() does not exist and fields are not copied.
@param params Parameters to set. If this are
ExtendedPkixParameters they are copied to.
Whether delta CRLs should be used for checking the revocation status.
Defaults to false.
The validity model.
@see #CHAIN_VALIDITY_MODEL
@see #PKIX_VALIDITY_MODEL
Sets the Bouncy Castle Stores for finding CRLs, certificates, attribute
certificates or cross certificates.
The IList is cloned.
@param stores A list of stores to use.
@see #getStores
@throws ClassCastException if an element of stores is not
a {@link Store}.
Adds a Bouncy Castle {@link Store} to find CRLs, certificates, attribute
certificates or cross certificates.
This method should be used to add local stores, like collection based
X.509 stores, if available. Local stores should be considered first,
before trying to use additional (remote) locations, because they do not
need possible additional network traffic.
If store is null it is ignored.
@param store The store to add.
@see #getStores
Add a CRL store.
The crl store to add.
Return an unmodifiable collection of the CRL stores.
A copy of the crl stores.
Returns an IList of Bouncy Castle
Stores used for finding CRLs, certificates, attribute
certificates or cross certificates.
@return an immutable IList of Bouncy Castle
Stores. Never null.
@see #setStores(IList)
Returns if additional {@link X509Store}s for locations like LDAP found
in certificates or CRLs should be used.
@return Returns true if additional stores are used.
Sets if additional {@link X509Store}s for locations like LDAP found in
certificates or CRLs should be used.
@param enabled true if additional stores are used.
Returns the required constraints on the target certificate or attribute
certificate. The constraints are returned as an instance of
IX509Selector. If null, no constraints are
defined.
The target certificate in a PKIX path may be a certificate or an
attribute certificate.
Note that the IX509Selector returned is cloned to protect
against subsequent modifications.
@return a IX509Selector specifying the constraints on the
target certificate or attribute certificate (or null)
@see #setTargetConstraints
@see X509CertStoreSelector
@see X509AttributeCertStoreSelector
Sets the required constraints on the target certificate or attribute
certificate. The constraints are specified as an instance of
IX509Selector. If null, no constraints are
defined.
The target certificate in a PKIX path may be a certificate or an
attribute certificate.
Note that the IX509Selector specified is cloned to protect
against subsequent modifications.
@param selector a IX509Selector specifying the constraints on
the target certificate or attribute certificate (or
null)
@see #getTargetConstraints
@see X509CertStoreSelector
@see X509AttributeCertStoreSelector
Returns the trusted attribute certificate issuers. If attribute
certificates is verified the trusted AC issuers must be set.
The returned ISet consists of TrustAnchors.
The returned ISet is immutable. Never null
@return Returns an immutable set of the trusted AC issuers.
Sets the trusted attribute certificate issuers. If attribute certificates
is verified the trusted AC issuers must be set.
The trustedACIssuers must be a ISet of
TrustAnchor
The given set is cloned.
@param trustedACIssuers The trusted AC issuers to set. Is never
null.
@throws ClassCastException if an element of stores is not
a TrustAnchor.
Returns the necessary attributes which must be contained in an attribute
certificate.
The returned ISet is immutable and contains
Strings with the OIDs.
@return Returns the necessary AC attributes.
Sets the necessary which must be contained in an attribute certificate.
The ISet must contain Strings with the
OIDs.
The set is cloned.
@param necessaryACAttributes The necessary AC attributes to set.
@throws ClassCastException if an element of
necessaryACAttributes is not a
String.
Returns the attribute certificates which are not allowed.
The returned ISet is immutable and contains
Strings with the OIDs.
@return Returns the prohibited AC attributes. Is never null.
Sets the attribute certificates which are not allowed.
The ISet must contain Strings with the
OIDs.
The set is cloned.
@param prohibitedACAttributes The prohibited AC attributes to set.
@throws ClassCastException if an element of
prohibitedACAttributes is not a
String.
Returns the attribute certificate checker. The returned set contains
{@link PKIXAttrCertChecker}s and is immutable.
@return Returns the attribute certificate checker. Is never
null.
Sets the attribute certificate checkers.
All elements in the ISet must a {@link PKIXAttrCertChecker}.
The given set is cloned.
@param attrCertCheckers The attribute certificate checkers to set. Is
never null.
@throws ClassCastException if an element of attrCertCheckers
is not a PKIXAttrCertChecker.
Constructors
This class helps to handle CRL revocation reasons mask. Each CRL handles a
certain set of revocation reasons.
Constructs are reason mask with the reasons.
The reasons.
A reason mask with no reason.
A mask with all revocation reasons.
Adds all reasons from the reasons mask to this mask.
@param mask The reasons mask to add.
Returns true if this reasons mask contains all possible
reasons.
true if this reasons mask contains all possible reasons.
Intersects this mask with the given reasons mask.
mask The mask to intersect with.
The intersection of this and teh given mask.
Returns true if the passed reasons mask has new reasons.
The reasons mask which should be tested for new reasons.
true if the passed reasons mask has new reasons.
Returns the reasons in this mask.
If the complete CRL includes an issuing distribution point (IDP) CRL
extension check the following:
(i) If the distribution point name is present in the IDP CRL extension
and the distribution field is present in the DP, then verify that one of
the names in the IDP matches one of the names in the DP. If the
distribution point name is present in the IDP CRL extension and the
distribution field is omitted from the DP, then verify that one of the
names in the IDP matches one of the names in the cRLIssuer field of the
DP.
(ii) If the onlyContainsUserCerts boolean is asserted in the IDP CRL
extension, verify that the certificate does not include the basic
constraints extension with the cA boolean asserted.
(iii) If the onlyContainsCACerts boolean is asserted in the IDP CRL
extension, verify that the certificate includes the basic constraints
extension with the cA boolean asserted.
(iv) Verify that the onlyContainsAttributeCerts boolean is not asserted.
@param dp The distribution point.
@param cert The certificate.
@param crl The CRL.
@throws AnnotatedException if one of the conditions is not met or an error occurs.
If the DP includes cRLIssuer, then verify that the issuer field in the
complete CRL matches cRLIssuer in the DP and that the complete CRL
contains an
g distribution point extension with the indirectCRL
boolean asserted. Otherwise, verify that the CRL issuer matches the
certificate issuer.
@param dp The distribution point.
@param cert The certificate ot attribute certificate.
@param crl The CRL for cert.
@throws AnnotatedException if one of the above conditions does not apply or an error
occurs.
Obtain and validate the certification path for the complete CRL issuer.
If a key usage extension is present in the CRL issuer's certificate,
verify that the cRLSign bit is set.
@param crl CRL which contains revocation information for the certificate
cert.
@param cert The attribute certificate or certificate to check if it is
revoked.
@param defaultCRLSignCert The issuer certificate of the certificate cert.
@param defaultCRLSignKey The public key of the issuer certificate
defaultCRLSignCert.
@param paramsPKIX paramsPKIX PKIX parameters.
@param certPathCerts The certificates on the certification path.
@return A Set with all keys of possible CRL issuer
certificates.
@throws AnnotatedException if the CRL is not valid or the status cannot be checked or
some error occurs.
Checks a distribution point for revocation information for the
certificate cert.
@param dp The distribution point to consider.
@param paramsPKIX PKIX parameters.
@param cert Certificate to check if it is revoked.
@param validDate The date when the certificate revocation status should be
checked.
@param defaultCRLSignCert The issuer certificate of the certificate cert.
@param defaultCRLSignKey The public key of the issuer certificate
defaultCRLSignCert.
@param certStatus The current certificate revocation status.
@param reasonMask The reasons mask which is already checked.
@param certPathCerts The certificates of the certification path.
@throws AnnotatedException if the certificate is revoked or the status cannot be checked
or some error occurs.
Checks a certificate if it is revoked.
@param paramsPKIX PKIX parameters.
@param cert Certificate to check if it is revoked.
@param validDate The date when the certificate revocation status should be
checked.
@param sign The issuer certificate of the certificate cert.
@param workingPublicKey The public key of the issuer certificate sign.
@param certPathCerts The certificates of the certification path.
@throws AnnotatedException if the certificate is revoked or the status cannot be checked
or some error occurs.
If use-deltas is set, verify the issuer and scope of the delta CRL.
@param deltaCRL The delta CRL.
@param completeCRL The complete CRL.
@param pkixParams The PKIX paramaters.
@throws AnnotatedException if an exception occurs.
Checks if an attribute certificate is revoked.
@param attrCert Attribute certificate to check if it is revoked.
@param paramsPKIX PKIX parameters.
@param issuerCert The issuer certificate of the attribute certificate
attrCert.
@param validDate The date when the certificate revocation status should
be checked.
@param certPathCerts The certificates of the certification path to be
checked.
@throws CertPathValidatorException if the certificate is revoked or the
status cannot be checked or some error occurs.
Searches for a holder public key certificate and verifies its
certification path.
@param attrCert the attribute certificate.
@param pkixParams The PKIX parameters.
@return The certificate path of the holder certificate.
@throws Exception if
- no public key certificate can be found although holder
information is given by an entity name or a base certificate
ID
- support classes cannot be created
- no certification path for the public key certificate can
be built
Checks a distribution point for revocation information for the
certificate attrCert.
@param dp The distribution point to consider.
@param attrCert The attribute certificate which should be checked.
@param paramsPKIX PKIX parameters.
@param validDate The date when the certificate revocation status should
be checked.
@param issuerCert Certificate to check if it is revoked.
@param reasonMask The reasons mask which is already checked.
@param certPathCerts The certificates of the certification path to be
checked.
@throws Exception if the certificate is revoked or the status
cannot be checked or some error occurs.
A trust anchor or most-trusted Certification Authority (CA).
This class represents a "most-trusted CA", which is used as a trust anchor
for validating X.509 certification paths. A most-trusted CA includes the
public key of the CA, the CA's name, and any constraints upon the set of
paths which may be validated using this key. These parameters can be
specified in the form of a trusted X509Certificate or as individual
parameters.
Creates an instance of TrustAnchor with the specified X509Certificate and
optional name constraints, which are intended to be used as additional
constraints when validating an X.509 certification path.
The name constraints are specified as a byte array. This byte array
should contain the DER encoded form of the name constraints, as they
would appear in the NameConstraints structure defined in RFC 2459 and
X.509. The ASN.1 definition of this structure appears below.
NameConstraints ::= SEQUENCE {
permittedSubtrees [0] GeneralSubtrees OPTIONAL,
excludedSubtrees [1] GeneralSubtrees OPTIONAL }
GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
GeneralSubtree ::= SEQUENCE {
base GeneralName,
minimum [0] BaseDistance DEFAULT 0,
maximum [1] BaseDistance OPTIONAL }
BaseDistance ::= INTEGER (0..MAX)
GeneralName ::= CHOICE {
otherName [0] OtherName,
rfc822Name [1] IA5String,
dNSName [2] IA5String,
x400Address [3] ORAddress,
directoryName [4] Name,
ediPartyName [5] EDIPartyName,
uniformResourceIdentifier [6] IA5String,
iPAddress [7] OCTET STRING,
registeredID [8] OBJECT IDENTIFIER}
Note that the name constraints byte array supplied is cloned to protect
against subsequent modifications.
a trusted X509Certificate
a byte array containing the ASN.1 DER encoding of a
NameConstraints extension to be used for checking name
constraints. Only the value of the extension is included, not
the OID or criticality flag. Specify null to omit the
parameter.
if the specified X509Certificate is null
Creates an instance of TrustAnchor where the
most-trusted CA is specified as an X500Principal and public key.
Name constraints are an optional parameter, and are intended to be used
as additional constraints when validating an X.509 certification path.
The name constraints are specified as a byte array. This byte array
contains the DER encoded form of the name constraints, as they
would appear in the NameConstraints structure defined in RFC 2459
and X.509. The ASN.1 notation for this structure is supplied in the
documentation for the other constructors.
Note that the name constraints byte array supplied here is cloned to
protect against subsequent modifications.
the name of the most-trusted CA as X509Name
the public key of the most-trusted CA
a byte array containing the ASN.1 DER encoding of a NameConstraints extension to
be used for checking name constraints. Only the value of the extension is included,
not the OID or criticality flag. Specify null to omit the parameter.
if caPrincipal or pubKey is null
Creates an instance of TrustAnchor where the most-trusted
CA is specified as a distinguished name and public key. Name constraints
are an optional parameter, and are intended to be used as additional
constraints when validating an X.509 certification path.
The name constraints are specified as a byte array. This byte array
contains the DER encoded form of the name constraints, as they would
appear in the NameConstraints structure defined in RFC 2459 and X.509.
the X.500 distinguished name of the most-trusted CA in RFC
2253 string format
the public key of the most-trusted CA
a byte array containing the ASN.1 DER encoding of a
NameConstraints extension to be used for checking name
constraints. Only the value of the extension is included, not
the OID or criticality flag. Specify null to omit the
parameter.
throws NullPointerException, IllegalArgumentException
Returns the most-trusted CA certificate.
Returns the name of the most-trusted CA as an X509Name.
Returns the name of the most-trusted CA in RFC 2253 string format.
Returns the public key of the most-trusted CA.
Decode the name constraints and clone them if not null.
Returns a formatted string describing the TrustAnchor.
a formatted string describing the TrustAnchor
country code - StringType(SIZE(2))
organization - StringType(SIZE(1..64))
organizational unit name - StringType(SIZE(1..64))
Title
common name - StringType(SIZE(1..64))
street - StringType(SIZE(1..64))
device serial number name - StringType(SIZE(1..64))
locality name - StringType(SIZE(1..64))
state, or province name - StringType(SIZE(1..64))
Naming attributes of type X520name
businessCategory - DirectoryString(SIZE(1..128)
postalCode - DirectoryString(SIZE(1..40)
dnQualifier - DirectoryString(SIZE(1..64)
RFC 3039 Pseudonym - DirectoryString(SIZE(1..64)
RFC 3039 DateOfBirth - GeneralizedTime - YYYYMMDD000000Z
RFC 3039 PlaceOfBirth - DirectoryString(SIZE(1..128)
RFC 3039 DateOfBirth - PrintableString (SIZE(1)) -- "M", "F", "m" or "f"
RFC 3039 CountryOfCitizenship - PrintableString (SIZE (2)) -- ISO 3166
codes only
RFC 3039 CountryOfCitizenship - PrintableString (SIZE (2)) -- ISO 3166
codes only
s
ISIS-MTT NameAtBirth - DirectoryString(SIZE(1..64)
RFC 3039 PostalAddress - SEQUENCE SIZE (1..6) OF
DirectoryString(SIZE(1..30))
RFC 2256 dmdName
id-at-telephoneNumber
id-at-organizationIdentifier
id-at-name
Email address (RSA PKCS#9 extension) - IA5String.
Note: if you're trying to be ultra orthodox, don't use this! It shouldn't be in here.
more from PKCS#9
email address in Verisign certificates
LDAP User id.
default look up table translating OID values into their common symbols following
the convention in RFC 2253 with a few extras
look up table translating OID values into their common symbols following the convention in RFC 2253
look up table translating OID values into their common symbols following the convention in RFC 1779
look up table translating common symbols into their OIDS.
Decides if the given attribute certificate should be selected.
The attribute certificate to be checked.
true if the object matches this selector.
The attribute certificate which must be matched.
If null is given, any will do.
The criteria for validity
If null is given any will do.
The holder.
If null is given any will do.
The issuer.
If null is given any will do.
The serial number.
If null is given any will do.
Adds a target name criterion for the attribute certificate to the target
information extension criteria. The X509AttributeCertificate
must contain at least one of the specified target names.
Each attribute certificate may contain a target information extension
limiting the servers where this attribute certificate can be used. If
this extension is not present, the attribute certificate is not targeted
and may be accepted by any server.
@param name The name as a GeneralName (not null)
Adds a target name criterion for the attribute certificate to the target
information extension criteria. The X509AttributeCertificate
must contain at least one of the specified target names.
Each attribute certificate may contain a target information extension
limiting the servers where this attribute certificate can be used. If
this extension is not present, the attribute certificate is not targeted
and may be accepted by any server.
@param name a byte array containing the name in ASN.1 DER encoded form of a GeneralName
@throws IOException if a parsing error occurs.
Adds a collection with target names criteria. If null is
given any will do.
The collection consists of either GeneralName objects or byte[] arrays representing
DER encoded GeneralName structures.
@param names A collection of target names.
@throws IOException if a parsing error occurs.
@see #AddTargetName(byte[])
@see #AddTargetName(GeneralName)
Gets the target names. The collection consists of Lists
made up of an Integer in the first entry and a DER encoded
byte array or a String in the second entry.
The returned collection is immutable.
@return The collection of target names
@see #setTargetNames(Collection)
Adds a target group criterion for the attribute certificate to the target
information extension criteria. The X509AttributeCertificate
must contain at least one of the specified target groups.
Each attribute certificate may contain a target information extension
limiting the servers where this attribute certificate can be used. If
this extension is not present, the attribute certificate is not targeted
and may be accepted by any server.
@param group The group as GeneralName form (not null)
Adds a target group criterion for the attribute certificate to the target
information extension criteria. The X509AttributeCertificate
must contain at least one of the specified target groups.
Each attribute certificate may contain a target information extension
limiting the servers where this attribute certificate can be used. If
this extension is not present, the attribute certificate is not targeted
and may be accepted by any server.
@param name a byte array containing the group in ASN.1 DER encoded form of a GeneralName
@throws IOException if a parsing error occurs.
Adds a collection with target groups criteria. If null is
given any will do.
The collection consists of GeneralName objects or byte[]
representing DER encoded GeneralNames.
@param names A collection of target groups.
@throws IOException if a parsing error occurs.
@see #AddTargetGroup(byte[])
@see #AddTargetGroup(GeneralName)
Gets the target groups. The collection consists of Lists
made up of an Integer in the first entry and a DER encoded
byte array or a String in the second entry.
The returned collection is immutable.
@return The collection of target groups.
@see #setTargetGroups(Collection)
An ISet of DerObjectIdentifier objects.
Basic constructor.
@param collection - initial contents for the store, this is copied.
Return the matches in the collection for the passed in selector.
@param selector the selector to match against.
@return a possibly empty collection of matching objects.
Basic constructor.
@param collection - initial contents for the store, this is copied.
Return the matches in the collection for the passed in selector.
@param selector the selector to match against.
@return a possibly empty collection of matching objects.
An ICollection of X509Name objects
The attribute certificate being checked. This is not a criterion.
Rather, it is optional information that may help a {@link X509Store} find
CRLs that would be relevant when checking revocation for the specified
attribute certificate. If null is specified, then no such
optional information is provided.
@param attrCert the IX509AttributeCertificate being checked (or
null)
@see #getAttrCertificateChecking()
If true only complete CRLs are returned. Defaults to
false.
@return true if only complete CRLs are returned.
Returns if this selector must match CRLs with the delta CRL indicator
extension set. Defaults to false.
@return Returns true if only CRLs with the delta CRL
indicator extension are selected.
The issuing distribution point.
The issuing distribution point extension is a CRL extension which
identifies the scope and the distribution point of a CRL. The scope
contains among others information about revocation reasons contained in
the CRL. Delta CRLs and complete CRLs must have matching issuing
distribution points.
The byte array is cloned to protect against subsequent modifications.
You must also enable or disable this criteria with
{@link #setIssuingDistributionPointEnabled(bool)}.
@param issuingDistributionPoint The issuing distribution point to set.
This is the DER encoded OCTET STRING extension value.
@see #getIssuingDistributionPoint()
Whether the issuing distribution point criteria should be applied.
Defaults to false.
You may also set the issuing distribution point criteria if not a missing
issuing distribution point should be assumed.
@return Returns if the issuing distribution point check is enabled.
The maximum base CRL number. Defaults to null.
@return Returns the maximum base CRL number.
@see #setMaxBaseCRLNumber(BigInteger)
Parse a single CRL from the source.
Source must be either byte[] or stream.
A CRL.
Parse a list of CRLs.
source must be either byte[] or stream.
A collection o X509Crls.
Create loading data from byte array.
Create loading data from byte array.
Generates a certificate revocation list (CRL) object and initializes
it with the data read from the input stream inStream.
Returns a (possibly empty) collection view of the CRLs read from
the given input stream inStream.
The inStream may contain a sequence of DER-encoded CRLs, or
a PKCS#7 CRL set. This is a PKCS#7 SignedData object, with the
only significant field being crls. In particular the signature
and the contents are ignored.