org.bouncycastle.cert.plants

Class TrustAnchorIDs

java.lang.Object

org.bouncycastle.cert.plants.TrustAnchorIDs

public final class TrustAnchorIDs
extends java.lang.Object

Utilities for constructing and parsing the binary trust anchor IDs reserved by Section 5.1 of draft-ietf-plants-merkle-tree-certs under each CA ID:

• {caID 0 N} — issuance log N (Section 5.2)
• {caID 1 N L} — landmark L of log N (Section 8.2)
• {caID 2 N L} — landmark group containing landmark L and earlier (Section 8.2.1)

The binary representation is the base-128 OID-component encoding used inside ASN.1 RELATIVE-OID contents (Section 3 of draft-ietf-tls-trust-anchor-ids); it has no ASN.1 tag or length prefix.

Field Summary

Fields

Modifier and Type	Field and Description
static int	LANDMARK_GROUPS_ARC OID component for the landmark-groups arc (Section 8.2.1).
static int	LANDMARKS_ARC OID component for the landmarks arc (per-landmark IDs, Section 8.2).
static int	LOGS_ARC OID component for the logs arc.
static int	MAX_ID_LENGTH Maximum length, in bytes, of a trust anchor ID's binary representation.

Method Summary

Modifier and Type	Method and Description
static java.math.BigInteger	certSerial(long logNumber, long index) Composes the 64-bit certificate serial number per Section 6.1 of draft-ietf-plants-merkle-tree-certs: serial = (log_number << 48) | index The validator decodes the same encoding in MerkleTreeCertificateValidator.validateCertificate(org.bouncycastle.cert.X509CertificateHolder, org.bouncycastle.cert.plants.MerkleTreeCertificateValidator.ValidationParams); this method is the issuer-side counterpart.
static java.math.BigInteger	certSerial(MTCLog log, long index) Equivalent to certSerial(long, long) with the log number taken from log.getLogNumber().
static byte[]	encodeComponent(long value) Encodes a non-negative integer as a single OID component using base-128 with continuation bits, as defined for RELATIVE-OID contents in Section 8.20 of X.690.
static byte[]	fromDottedDecimal(java.lang.String dotted) Converts a dotted-decimal trust anchor ID (e.g.
static org.bouncycastle.asn1.x500.X500Name	issuerName(java.lang.String caTrustAnchorIdDotted) Builds the issuer X500Name for a Merkle Tree certificate, using the experimental id_rdna_trustAnchorID attribute with a UTF8String value of the CA's dotted-decimal trust anchor ID (Section 5.1 of draft-ietf-plants-merkle-tree-certs).
static byte[]	landmarkGroupId(byte[] caId, long logNumber, long landmarkNumber) Builds the binary trust anchor ID of a landmark group (Section 8.2.1).
static byte[]	landmarkId(byte[] caId, long logNumber, long landmarkNumber) Builds the binary trust anchor ID of a landmark (Section 8.2).
static byte[]	logId(byte[] caId, long logNumber) Builds the binary trust anchor ID of an issuance log.
static java.lang.String	toDottedDecimal(byte[] binaryId) Converts a binary trust anchor ID into the dotted-decimal form used in ASCII representations (e.g. for the issuer field UTF8String value and inside CosignedMessage cosigner_name / log_origin).

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

LOGS_ARC

public static final int LOGS_ARC

OID component for the logs arc.

See Also:

Constant Field Values

LANDMARKS_ARC

public static final int LANDMARKS_ARC

OID component for the landmarks arc (per-landmark IDs, Section 8.2).

See Also:

Constant Field Values

LANDMARK_GROUPS_ARC

public static final int LANDMARK_GROUPS_ARC

OID component for the landmark-groups arc (Section 8.2.1).

See Also:

Constant Field Values

MAX_ID_LENGTH

public static final int MAX_ID_LENGTH

Maximum length, in bytes, of a trust anchor ID's binary representation. A trust anchor ID is transmitted as opaque TrustAnchorID<1..2^8-1> (Section 4.1 of draft-ietf-tls-trust-anchor-ids) and Section 3 states its binary representation "MUST NOT exceed 255 bytes", so a valid trust anchor ID is 1..255 bytes.

See Also:

Constant Field Values

Method Detail

logId

public static byte[] logId(byte[] caId,
                           long logNumber)

Builds the binary trust anchor ID of an issuance log.

Parameters:

caId - binary trust anchor ID of the CA

logNumber - log number (1 <= logNumber <= 2^16-1, Section 5.2)

certSerial

public static java.math.BigInteger certSerial(long logNumber,
                                              long index)

Composes the 64-bit certificate serial number per Section 6.1 of draft-ietf-plants-merkle-tree-certs:

     serial = (log_number << 48) | index
 

The validator decodes the same encoding in MerkleTreeCertificateValidator.validateCertificate(org.bouncycastle.cert.X509CertificateHolder, org.bouncycastle.cert.plants.MerkleTreeCertificateValidator.ValidationParams); this method is the issuer-side counterpart.

Parameters:

logNumber - log number (1 <= logNumber <= 2^16-1, Section 5.2)

index - entry index in the log (0 <= index <= 2^48-1)

certSerial

public static java.math.BigInteger certSerial(MTCLog log,
                                              long index)

Equivalent to certSerial(long, long) with the log number taken from log.getLogNumber().

landmarkId

public static byte[] landmarkId(byte[] caId,
                                long logNumber,
                                long landmarkNumber)

Builds the binary trust anchor ID of a landmark (Section 8.2). Section 5.1 allocates these OIDs for positive landmark numbers only — landmark 0 always has tree size zero and no landmark subtrees, so it never needs an ID.

Parameters:

caId - binary trust anchor ID of the CA

logNumber - log number

landmarkNumber - landmark number (landmarkNumber >= 1)

landmarkGroupId

public static byte[] landmarkGroupId(byte[] caId,
                                     long logNumber,
                                     long landmarkNumber)

Builds the binary trust anchor ID of a landmark group (Section 8.2.1). As with landmarkId(byte[], long, long), Section 5.1 allocates these OIDs for positive landmark numbers only.

Parameters:

caId - binary trust anchor ID of the CA

logNumber - log number

landmarkNumber - landmark number that names the group's high end (landmarkNumber >= 1)

issuerName

public static org.bouncycastle.asn1.x500.X500Name issuerName(java.lang.String caTrustAnchorIdDotted)

Builds the issuer X500Name for a Merkle Tree certificate, using the experimental id_rdna_trustAnchorID attribute with a UTF8String value of the CA's dotted-decimal trust anchor ID (Section 5.1 of draft-ietf-plants-merkle-tree-certs). The validator concatenates this with the cert serial's log_number to recover the issuance log's full trust anchor ID.

For the production encoding the attribute value is a RELATIVE-OID rather than a UTF8String; both are accepted on the verifier side by MerkleTreeCertificateValidator.extractCaIdFromIssuer(X500Name).

Parameters:

caTrustAnchorIdDotted - dotted-decimal form of the CA's trust anchor ID (e.g. "32473.1")

toDottedDecimal

public static java.lang.String toDottedDecimal(byte[] binaryId)

Converts a binary trust anchor ID into the dotted-decimal form used in ASCII representations (e.g. for the issuer field UTF8String value and inside CosignedMessage cosigner_name / log_origin).

fromDottedDecimal

public static byte[] fromDottedDecimal(java.lang.String dotted)

Converts a dotted-decimal trust anchor ID (e.g. "32473.1.0.1") into its binary form: the base-128 encoded OID-component bytes with no ASN.1 tag or length prefix (Section 3 of draft-ietf-tls-trust-anchor-ids).

encodeComponent

public static byte[] encodeComponent(long value)

Encodes a non-negative integer as a single OID component using base-128 with continuation bits, as defined for RELATIVE-OID contents in Section 8.20 of X.690.