org.bouncycastle.cert.plants

Class MTCCertificationAuthorityCertificate

java.lang.Object

org.bouncycastle.cert.plants.MTCCertificationAuthorityCertificate

public final class MTCCertificationAuthorityCertificate
extends java.lang.Object

Helpers for the CA certificate representation defined by Section 5.5 of draft-ietf-plants-merkle-tree-certs.

A Merkle Tree CA is represented as an X.509 certificate whose:

• subject is the CA ID encoded as a single-RDN distinguished name, using MTCObjectIdentifiers.id_rdna_trustAnchorID with a UTF8String value of the dotted-decimal trust anchor ID
• subjectPublicKeyInfo is the CA cosigner's public key
• extensions carries a critical MTCObjectIdentifiers.id_pe_mtcCertificationAuthority extension whose value is the MTCCertificationAuthority structure
• keyUsage (critical) asserts at least keyCertSign
• basicConstraints (critical) sets cA=true
• subjectKeyIdentifier (when present) SHOULD be the binary CA ID

Per Section 5.5 such certificates SHOULD NOT be self-signed; they are typically distributed as unsigned trust anchors. This helper does not sign the certificate — the caller supplies a ContentSigner to X509v3CertificateBuilder.build(org.bouncycastle.operator.ContentSigner) when finishing the chain (e.g. an unsigned-cert signer per draft-ietf-lamps-x509-alg-none, or an external CA).

Field Summary

Fields

Modifier and Type	Field and Description
static org.bouncycastle.asn1.ASN1ObjectIdentifier	EXTENSION_OID OID for the id-pe-mtcCertificationAuthority certificate extension.

Method Summary

Modifier and Type	Method and Description
static org.bouncycastle.asn1.x509.Extension	buildAuthorityExtension(org.bouncycastle.asn1.x509.MTCCertificationAuthority info) Builds the critical id-pe-mtcCertificationAuthority extension.
static org.bouncycastle.asn1.x509.MTCCertificationAuthority	extractAuthorityInfo(X509CertificateHolder cert) Extracts the MTCCertificationAuthority structure from the id-pe-mtcCertificationAuthority extension of a CA certificate.
static byte[]	extractCaId(X509CertificateHolder cert) Extracts the binary CA trust anchor ID from the subject field of a CA certificate.
static X509v3CertificateBuilder	newBuilder(org.bouncycastle.asn1.x500.X500Name issuer, java.math.BigInteger serial, java.util.Date notBefore, java.util.Date notAfter, byte[] caId, org.bouncycastle.asn1.x509.SubjectPublicKeyInfo cosignerSpki, org.bouncycastle.asn1.x509.MTCCertificationAuthority info) Prepares a fully-populated X509v3CertificateBuilder for an MTC CA certificate.
static org.bouncycastle.asn1.x500.X500Name	subjectName(byte[] caId) Builds the subject (or issuer) distinguished name for a CA whose binary trust anchor ID is caId, using the experimental encoding from Section 5.1.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

EXTENSION_OID

public static final org.bouncycastle.asn1.ASN1ObjectIdentifier EXTENSION_OID

OID for the id-pe-mtcCertificationAuthority certificate extension.

Method Detail

subjectName

public static org.bouncycastle.asn1.x500.X500Name subjectName(byte[] caId)

Builds the subject (or issuer) distinguished name for a CA whose binary trust anchor ID is caId, using the experimental encoding from Section 5.1.

buildAuthorityExtension

public static org.bouncycastle.asn1.x509.Extension buildAuthorityExtension(org.bouncycastle.asn1.x509.MTCCertificationAuthority info)
                                                                    throws java.io.IOException

Builds the critical id-pe-mtcCertificationAuthority extension.

Throws:

java.io.IOException

newBuilder

public static X509v3CertificateBuilder newBuilder(org.bouncycastle.asn1.x500.X500Name issuer,
                                                  java.math.BigInteger serial,
                                                  java.util.Date notBefore,
                                                  java.util.Date notAfter,
                                                  byte[] caId,
                                                  org.bouncycastle.asn1.x509.SubjectPublicKeyInfo cosignerSpki,
                                                  org.bouncycastle.asn1.x509.MTCCertificationAuthority info)
                                           throws java.io.IOException

Prepares a fully-populated X509v3CertificateBuilder for an MTC CA certificate. The caller must invoke build with an appropriate signer (e.g. an unsigned-cert signer, or an external CA signer).

Parameters:

issuer - the X.509 issuer (often the same as subject when the trust anchor is self-attested, or the OID of the chaining CA)

serial - certificate serial number

notBefore - validity start

notAfter - validity end

caId - binary CA trust anchor ID

cosignerSpki - the cosigner's SubjectPublicKeyInfo

info - the MTCCertificationAuthority extension value

Throws:

java.io.IOException

extractCaId

public static byte[] extractCaId(X509CertificateHolder cert)
                          throws java.io.IOException

Extracts the binary CA trust anchor ID from the subject field of a CA certificate. The encoding rules mirror MerkleTreeCertificateValidator.extractCaIdFromIssuer(org.bouncycastle.asn1.x500.X500Name), which reads the equivalent attribute from the issuer field of a Merkle Tree end-entity certificate.

Throws:

java.io.IOException

extractAuthorityInfo

public static org.bouncycastle.asn1.x509.MTCCertificationAuthority extractAuthorityInfo(X509CertificateHolder cert)
                                                                                 throws java.io.IOException

Extracts the MTCCertificationAuthority structure from the id-pe-mtcCertificationAuthority extension of a CA certificate.

Throws:

java.io.IOException - if the extension is absent, not marked critical, or cannot be parsed