org.bouncycastle.pkcs
Class DeltaCertAttributeUtils

java.lang.Object
  org.bouncycastle.pkcs.DeltaCertAttributeUtils

public class DeltaCertAttributeUtils

extends java.lang.Object

Helpers for working with the delta certificate request attribute carried by a paired ("chameleon") PKCS#10 request — see draft-bonnell-lamps-chameleon-certs.

Constructor Summary

DeltaCertAttributeUtils()

Method Summary

static boolean	isDeltaRequestSignatureValid(PKCS10CertificationRequest baseRequest, ContentVerifierProvider contentVerifierProvider) Verify the delta signature attached to a base PKCS#10 request.
static DeltaCertificateRequestAttributeValue	trimDeltaCertificateRequest(DeltaCertificateRequestAttributeValue delta, PKCS10CertificationRequest baseRequest) Return a copy of with subject, signatureAlgorithm and extensions fields stripped when they match the corresponding fields of .

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

DeltaCertAttributeUtils

public DeltaCertAttributeUtils()

Method Detail

isDeltaRequestSignatureValid

public static boolean isDeltaRequestSignatureValid(PKCS10CertificationRequest baseRequest,
                                                   ContentVerifierProvider contentVerifierProvider)
                                            throws PKCSException

Verify the delta signature attached to a base PKCS#10 request. Reconstructs the delta CertificationRequest from the base — stripping the delta-signature attribute — and validates the delta signature with the supplied verifier provider.

Parameters:

baseRequest - the base PKCS#10 request carrying the delta attributes.

contentVerifierProvider - provider able to verify the delta signature algorithm.

Returns:

if the delta signature is valid, otherwise.

Throws:

PKCSException - if the signature cannot be processed.

trimDeltaCertificateRequest

public static DeltaCertificateRequestAttributeValue trimDeltaCertificateRequest(DeltaCertificateRequestAttributeValue delta,
                                                                                PKCS10CertificationRequest baseRequest)

Return a copy of with subject, signatureAlgorithm and extensions fields stripped when they match the corresponding fields of .

Mirrors the cert-side rule in DeltaCertificateTool.trimDeltaCertificateDescriptor(org.bouncycastle.asn1.x509.DeltaCertificateDescriptor, org.bouncycastle.asn1.x509.TBSCertificate, org.bouncycastle.asn1.x509.Extensions): draft-bonnell-lamps-chameleon-certs §4.1 says the extensions field MUST NOT contain any extension which has the same criticality and DER-encoded value as the base, whose type does not appear in the base, or which is the DCD extension type itself.