org.bouncycastle.pkcs

Class DeltaCertAttributeUtils

java.lang.Object

org.bouncycastle.pkcs.DeltaCertAttributeUtils

public class DeltaCertAttributeUtils
extends java.lang.Object

Helpers for working with the delta certificate request attribute carried by a paired ("chameleon") PKCS#10 request — see draft-bonnell-lamps-chameleon-certs.

Constructor Summary

Constructors

Constructor and Description
DeltaCertAttributeUtils()

Method Summary

Modifier and Type	Method and Description
static boolean	isDeltaRequestSignatureValid(PKCS10CertificationRequest baseRequest, ContentVerifierProvider contentVerifierProvider) Verify the delta signature attached to a base PKCS#10 request.
static DeltaCertificateRequestAttributeValue	trimDeltaCertificateRequest(DeltaCertificateRequestAttributeValue delta, PKCS10CertificationRequest baseRequest) Return a copy of delta with subject, signatureAlgorithm and extensions fields stripped when they match the corresponding fields of baseRequest.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

DeltaCertAttributeUtils

public DeltaCertAttributeUtils()

Method Detail

isDeltaRequestSignatureValid

public static boolean isDeltaRequestSignatureValid(PKCS10CertificationRequest baseRequest,
                                                   ContentVerifierProvider contentVerifierProvider)
                                            throws PKCSException

Verify the delta signature attached to a base PKCS#10 request. Reconstructs the delta CertificationRequest from the base — stripping the delta-signature attribute — and validates the delta signature with the supplied verifier provider.

Parameters:

baseRequest - the base PKCS#10 request carrying the delta attributes.

contentVerifierProvider - provider able to verify the delta signature algorithm.

Returns:

true if the delta signature is valid, false otherwise.

Throws:

PKCSException - if the signature cannot be processed.

trimDeltaCertificateRequest

public static DeltaCertificateRequestAttributeValue trimDeltaCertificateRequest(DeltaCertificateRequestAttributeValue delta,
                                                                                PKCS10CertificationRequest baseRequest)

Return a copy of delta with subject, signatureAlgorithm and extensions fields stripped when they match the corresponding fields of baseRequest.

Mirrors the cert-side rule in DeltaCertificateTool.trimDeltaCertificateDescriptor(org.bouncycastle.asn1.x509.DeltaCertificateDescriptor, org.bouncycastle.asn1.x509.TBSCertificate, org.bouncycastle.asn1.x509.Extensions): draft-bonnell-lamps-chameleon-certs §4.1 says the extensions field MUST NOT contain any extension which has the same criticality and DER-encoded value as the base, whose type does not appear in the base, or which is the DCD extension type itself.