org.bouncycastle.cert.plants

Class MTCCertAuth

java.lang.Object

org.bouncycastle.cert.plants.MTCCertAuth

public class MTCCertAuth
extends java.lang.Object

Identity-side helper for an MTC Certification Authority, per Section 5 of draft-ietf-plants-merkle-tree-certs. Bundles the CA's trust anchor ID (in both dotted-decimal and binary forms) along with the log hash and cosigner signature algorithm identifiers, and exposes the per-issuance derivations that depend on this identity:

• logId(long) — the issuance log's binary trust anchor ID
• issuerName() — the X.500 Name used in the cert's issuer field
• certSerial(long, long) — a packed (log_number, index) cert serial
• #authorityInfo(BigInteger) — the MTCCertificationAuthority extension value the relying party needs out-of-band

Identity-only: the CA's signing keypair stays separate so the same MTCCertAuth can be shared between an issuer (which holds the private key for cosigning) and a relying party (which holds the matching public key for verification).

Constructor Summary

Constructors

Constructor and Description
MTCCertAuth(byte[] caId, MerkleTreeHash hashFunc, org.bouncycastle.asn1.ASN1ObjectIdentifier sigAlgOid)
MTCCertAuth(java.lang.String dottedCaId, MerkleTreeHash hashFunc, org.bouncycastle.asn1.ASN1ObjectIdentifier sigAlgOid)

Method Summary

Modifier and Type	Method and Description
org.bouncycastle.asn1.x509.MTCCertificationAuthority	authorityInfo(java.math.BigInteger minSerial, java.math.BigInteger maxSerial) Builds the MTCCertificationAuthority extension value that the relying party needs to validate certs from this CA.
java.math.BigInteger	certSerial(long logNumber, long index)
java.math.BigInteger	certSerial(MTCLog log, long index) Equivalent to certSerial(long, long) with the log number taken from log.getLogNumber().
byte[]	getCaId()
java.lang.String	getDottedCaId()
MerkleTreeHash	getHashFunc()
org.bouncycastle.asn1.x500.X500Name	issuerName()
byte[]	logId(long logNumber)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

MTCCertAuth

public MTCCertAuth(java.lang.String dottedCaId,
                   MerkleTreeHash hashFunc,
                   org.bouncycastle.asn1.ASN1ObjectIdentifier sigAlgOid)

Parameters:

dottedCaId - dotted-decimal form of the CA's trust anchor ID (e.g. "32473.1")

hashFunc - hash function used by all issuance logs operated by this CA (Section 5.5) — its algorithm identifier is published in the CA's logHash

sigAlgOid - CA cosigner's signature algorithm (Section 5.5)

MTCCertAuth

public MTCCertAuth(byte[] caId,
                   MerkleTreeHash hashFunc,
                   org.bouncycastle.asn1.ASN1ObjectIdentifier sigAlgOid)

Parameters:

caId - binary form of the CA's trust anchor ID

hashFunc - hash function used by all issuance logs operated by this CA (Section 5.5)

sigAlgOid - CA cosigner's signature algorithm (Section 5.5)

Method Detail

getCaId

public byte[] getCaId()

Returns:

the CA's binary trust anchor ID (defensive copy).

getDottedCaId

public java.lang.String getDottedCaId()

Returns:

the CA's trust anchor ID in dotted-decimal form.

getHashFunc

public MerkleTreeHash getHashFunc()

Returns:

the hash function used by all issuance logs operated by this CA.

logId

public byte[] logId(long logNumber)

Parameters:

logNumber - log number (1 <= logNumber <= 2^16-1, Section 5.2)

Returns:

the binary trust anchor ID of issuance log logNumber operated by this CA

issuerName

public org.bouncycastle.asn1.x500.X500Name issuerName()

Returns:

the issuer X500Name for certs issued by this CA, carrying the trust anchor ID via the experimental id_rdna_trustAnchorID attribute

certSerial

public java.math.BigInteger certSerial(long logNumber,
                                       long index)

Parameters:

logNumber - log number (1 <= logNumber <= 2^16-1)

index - entry index in the log (0 <= index <= 2^48-1)

Returns:

the 64-bit cert serial composed per Section 6.1

certSerial

public java.math.BigInteger certSerial(MTCLog log,
                                       long index)

Equivalent to certSerial(long, long) with the log number taken from log.getLogNumber().

authorityInfo

public org.bouncycastle.asn1.x509.MTCCertificationAuthority authorityInfo(java.math.BigInteger minSerial,
                                                                          java.math.BigInteger maxSerial)

Builds the MTCCertificationAuthority extension value that the relying party needs to validate certs from this CA. Combines the CA's log hash and cosigner signature algorithm with the supplied serial range.

Parameters:

minSerial - minimum allowed cert serial from this CA (Section 5.5 / 6.1)

maxSerial - maximum allowed cert serial from this CA (Section 5.5 / 6.1)