org.bouncycastle.cert.plants

Class LandmarkCertificateManager

java.lang.Object

org.bouncycastle.cert.plants.LandmarkCertificateManager

public class LandmarkCertificateManager
extends java.lang.Object

Issuance- and relying-party-side helpers for landmark subtrees, per Sections 6.3 and 7.4 of draft-ietf-plants-merkle-tree-certs.

buildLandmarkCertificate(long, long, org.bouncycastle.asn1.x509.TBSCertificateLogEntry, org.bouncycastle.asn1.x509.SubjectPublicKeyInfo, org.bouncycastle.cert.plants.MerkleTreePrimitives.SubtreeInfo, java.util.List<byte[]>, org.bouncycastle.cert.plants.MerkleTreeHash) produces a landmark-relative certificate (an X.509 wrapper around an MTCProof whose inclusion proof targets a predistributed landmark subtree). The nested LandmarkCertificateManager.TrustedSubtreeManager maintains a relying party's set of trusted landmarks, accepting a new landmark once it has been related to a sufficiently-cosigned reference checkpoint via a subtree consistency proof.

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	LandmarkCertificateManager.TrustedSubtreeEntry A trusted subtree along with the reference checkpoint that proved its consistency, per Section 7.4.
static class	LandmarkCertificateManager.TrustedSubtreeManager Maintains a relying-party-side list of trusted subtrees by accepting new landmarks that come with a cosigned reference checkpoint and a subtree consistency proof.

Constructor Summary

Constructors

Constructor and Description
LandmarkCertificateManager()

Method Summary

Modifier and Type	Method and Description
static X509CertificateHolder	buildLandmarkCertificate(long logNumber, long index, org.bouncycastle.asn1.x509.TBSCertificateLogEntry tbsCertEntry, org.bouncycastle.asn1.x509.SubjectPublicKeyInfo subjectPublicKeyInfo, MerkleTreePrimitives.SubtreeInfo landmarkSubtree, java.util.List<byte[]> inclusionProof, MerkleTreeHash hashFunc) Builds a landmark-relative certificate (no signatures, only an inclusion proof to a predistributed landmark subtree, Section 6.3.4).
static X509CertificateHolder	buildLandmarkCertificate(MTCLog log, long index, org.bouncycastle.asn1.x509.TBSCertificateLogEntry tbsCertEntry, org.bouncycastle.asn1.x509.SubjectPublicKeyInfo subjectPublicKeyInfo, java.util.List<byte[]> inclusionProof) Convenience overload of buildLandmarkCertificate(long, long, TBSCertificateLogEntry, SubjectPublicKeyInfo, MerkleTreePrimitives.SubtreeInfo, List, MerkleTreeHash) taking the log number, landmark subtree window and hash function from an MTCLog whose [start, end) is the landmark subtree.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

LandmarkCertificateManager

public LandmarkCertificateManager()

Method Detail

buildLandmarkCertificate

public static X509CertificateHolder buildLandmarkCertificate(long logNumber,
                                                             long index,
                                                             org.bouncycastle.asn1.x509.TBSCertificateLogEntry tbsCertEntry,
                                                             org.bouncycastle.asn1.x509.SubjectPublicKeyInfo subjectPublicKeyInfo,
                                                             MerkleTreePrimitives.SubtreeInfo landmarkSubtree,
                                                             java.util.List<byte[]> inclusionProof,
                                                             MerkleTreeHash hashFunc)
                                                      throws java.io.IOException

Builds a landmark-relative certificate (no signatures, only an inclusion proof to a predistributed landmark subtree, Section 6.3.4). The certificate serial number is packed from the log number and the entry's index per Section 6.1: serial = (log_number << 48) | index.

Parameters:

logNumber - number of the issuance log containing the entry (1 <= logNumber <= 2^16-1)

index - the entry's index in the log (0 <= index <= 2^48-1)

tbsCertEntry - the TBSCertificateLogEntry describing the entry

subjectPublicKeyInfo - the actual subject public key (its hash must match tbsCertEntry.subjectPublicKeyInfoHash)

landmarkSubtree - the landmark subtree containing the entry

inclusionProof - inclusion proof hashes from the entry to landmarkSubtree

hashFunc - the log's hash function

Returns:

the landmark-relative certificate

Throws:

java.io.IOException

buildLandmarkCertificate

public static X509CertificateHolder buildLandmarkCertificate(MTCLog log,
                                                             long index,
                                                             org.bouncycastle.asn1.x509.TBSCertificateLogEntry tbsCertEntry,
                                                             org.bouncycastle.asn1.x509.SubjectPublicKeyInfo subjectPublicKeyInfo,
                                                             java.util.List<byte[]> inclusionProof)
                                                      throws java.io.IOException

Convenience overload of buildLandmarkCertificate(long, long, TBSCertificateLogEntry, SubjectPublicKeyInfo, MerkleTreePrimitives.SubtreeInfo, List, MerkleTreeHash) taking the log number, landmark subtree window and hash function from an MTCLog whose [start, end) is the landmark subtree.

Throws:

java.io.IOException