org.bouncycastle.cert.plants

Class MerkleTreeCertificateValidator.RevokedRange

java.lang.Object

org.bouncycastle.cert.plants.MerkleTreeCertificateValidator.RevokedRange

Enclosing class:

MerkleTreeCertificateValidator

public static class MerkleTreeCertificateValidator.RevokedRange
extends java.lang.Object

A half-open range [start, end) of revoked certificate serial numbers, per Section 7.5 of the draft. The serial packs the log number into the upper 16 bits and the entry index into the lower 48 (Section 6.1), so ranges can revoke spans of entries within one log, whole logs, or spans of logs. The relying party's list of ranges is checked against the full serial before it is decomposed (Section 7.2 step 4).

Serial numbers are unsigned 64-bit values, so bounds are BigIntegers; 0 <= start < end <= 2^64.

Constructor Summary

Constructors

Constructor and Description
RevokedRange(java.math.BigInteger startInclusive, java.math.BigInteger endExclusive)

Method Summary

Modifier and Type	Method and Description
static MerkleTreeCertificateValidator.RevokedRange	before(java.math.BigInteger endExclusive) The range [0, endExclusive) — the shape of the CA's published minSerial floor (Section 7.1).
boolean	contains(java.math.BigInteger serial)
static MerkleTreeCertificateValidator.RevokedRange	from(java.math.BigInteger startInclusive) The range [startInclusive, 2^64) — distrust everything from a serial onwards, the analogue of the SCTNotAfter mechanism cited in Section 7.5.
java.math.BigInteger	getEnd()
java.math.BigInteger	getStart()
static MerkleTreeCertificateValidator.RevokedRange	ofIndices(long logNumber, long startIndex, long endIndex) Indices [startIndex, endIndex) of issuance log logNumber.
static MerkleTreeCertificateValidator.RevokedRange	ofLog(long logNumber) Every serial of issuance log logNumber: [logNumber << 48, (logNumber + 1) << 48).
static MerkleTreeCertificateValidator.RevokedRange	single(java.math.BigInteger serial) The single serial [serial, serial + 1).

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

RevokedRange

public RevokedRange(java.math.BigInteger startInclusive,
                    java.math.BigInteger endExclusive)

Parameters:

startInclusive - first revoked serial

endExclusive - first serial past the range (at most 2^64)

Method Detail

before

public static MerkleTreeCertificateValidator.RevokedRange before(java.math.BigInteger endExclusive)

The range [0, endExclusive) — the shape of the CA's published minSerial floor (Section 7.1).

from

public static MerkleTreeCertificateValidator.RevokedRange from(java.math.BigInteger startInclusive)

The range [startInclusive, 2^64) — distrust everything from a serial onwards, the analogue of the SCTNotAfter mechanism cited in Section 7.5.

ofLog

public static MerkleTreeCertificateValidator.RevokedRange ofLog(long logNumber)

Every serial of issuance log logNumber: [logNumber << 48, (logNumber + 1) << 48).

ofIndices

public static MerkleTreeCertificateValidator.RevokedRange ofIndices(long logNumber,
                                                                    long startIndex,
                                                                    long endIndex)

Indices [startIndex, endIndex) of issuance log logNumber.

Parameters:

startIndex - first revoked index (0 <= startIndex < 2^48)

endIndex - first index past the range (startIndex < endIndex <= 2^48)

single

public static MerkleTreeCertificateValidator.RevokedRange single(java.math.BigInteger serial)

The single serial [serial, serial + 1).

getStart

public java.math.BigInteger getStart()

getEnd

public java.math.BigInteger getEnd()

contains

public boolean contains(java.math.BigInteger serial)