Package org.bouncycastle.cert.plants

Class MTCCertificationAuthorityCertificate

  • public final class MTCCertificationAuthorityCertificate
extends java.lang.Object
    Helpers for the CA certificate representation defined by Section 5.5 of draft-ietf-plants-merkle-tree-certs.

    A Merkle Tree CA is represented as an X.509 certificate whose:

    • subject is the CA ID encoded as a single-RDN distinguished name, using MTCObjectIdentifiers.id_rdna_trustAnchorID with a UTF8String value of the dotted-decimal trust anchor ID
    • subjectPublicKeyInfo is the CA cosigner's public key
    • extensions carries a critical MTCObjectIdentifiers.id_pe_mtcCertificationAuthority extension whose value is the MTCCertificationAuthority structure
    • keyUsage (critical) asserts at least keyCertSign
    • basicConstraints (critical) sets cA=true
    • subjectKeyIdentifier (when present) SHOULD be the binary CA ID

    Per Section 5.5 such certificates SHOULD NOT be self-signed; they are typically distributed as unsigned trust anchors. This helper does not sign the certificate — the caller supplies a ContentSigner to X509v3CertificateBuilder.build(org.bouncycastle.operator.ContentSigner) when finishing the chain (e.g. an unsigned-cert signer per draft-ietf-lamps-x509-alg-none, or an external CA).

    • Field Summary

      Fields 
      Modifier and Type Field Description
      static org.bouncycastle.asn1.ASN1ObjectIdentifier EXTENSION_OID
      OID for the id-pe-mtcCertificationAuthority certificate extension.

    • Method Summary

      All Methods Static Methods Concrete Methods 
      Modifier and Type Method Description
      static org.bouncycastle.asn1.x509.Extension buildAuthorityExtension​(org.bouncycastle.asn1.x509.MTCCertificationAuthority info)
      Builds the critical id-pe-mtcCertificationAuthority extension.
      static org.bouncycastle.asn1.x509.MTCCertificationAuthority extractAuthorityInfo​(X509CertificateHolder cert)
      Extracts the MTCCertificationAuthority structure from the id-pe-mtcCertificationAuthority extension of a CA certificate.
      static byte[] extractCaId​(X509CertificateHolder cert)
      Extracts the binary CA trust anchor ID from the subject field of a CA certificate.
      static X509v3CertificateBuilder newBuilder​(org.bouncycastle.asn1.x500.X500Name issuer, java.math.BigInteger serial, java.util.Date notBefore, java.util.Date notAfter, byte[] caId, org.bouncycastle.asn1.x509.SubjectPublicKeyInfo cosignerSpki, org.bouncycastle.asn1.x509.MTCCertificationAuthority info)
      Prepares a fully-populated X509v3CertificateBuilder for an MTC CA certificate.
      static org.bouncycastle.asn1.x500.X500Name subjectName​(byte[] caId)
      Builds the subject (or issuer) distinguished name for a CA whose binary trust anchor ID is caId, using the experimental encoding from Section 5.1.

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Field Detail

      • EXTENSION_OID

        public static final org.bouncycastle.asn1.ASN1ObjectIdentifier EXTENSION_OID
        OID for the id-pe-mtcCertificationAuthority certificate extension.

    • Method Detail

      • subjectName

        public static org.bouncycastle.asn1.x500.X500Name subjectName​(byte[] caId)
        Builds the subject (or issuer) distinguished name for a CA whose binary trust anchor ID is caId, using the experimental encoding from Section 5.1.

      • buildAuthorityExtension

        public static org.bouncycastle.asn1.x509.Extension buildAuthorityExtension​(org.bouncycastle.asn1.x509.MTCCertificationAuthority info)
                                                                    throws java.io.IOException
        Builds the critical id-pe-mtcCertificationAuthority extension.
        Throws:
        java.io.IOException

      • newBuilder

        public static X509v3CertificateBuilder newBuilder​(org.bouncycastle.asn1.x500.X500Name issuer,
                                                  java.math.BigInteger serial,
                                                  java.util.Date notBefore,
                                                  java.util.Date notAfter,
                                                  byte[] caId,
                                                  org.bouncycastle.asn1.x509.SubjectPublicKeyInfo cosignerSpki,
                                                  org.bouncycastle.asn1.x509.MTCCertificationAuthority info)
                                           throws java.io.IOException
        Prepares a fully-populated X509v3CertificateBuilder for an MTC CA certificate. The caller must invoke build with an appropriate signer (e.g. an unsigned-cert signer, or an external CA signer).
        Parameters:
        issuer - the X.509 issuer (often the same as subject when the trust anchor is self-attested, or the OID of the chaining CA)
        serial - certificate serial number
        notBefore - validity start
        notAfter - validity end
        caId - binary CA trust anchor ID
        cosignerSpki - the cosigner's SubjectPublicKeyInfo
        info - the MTCCertificationAuthority extension value
        Throws:
        java.io.IOException

      • extractAuthorityInfo

        public static org.bouncycastle.asn1.x509.MTCCertificationAuthority extractAuthorityInfo​(X509CertificateHolder cert)
                                                                                 throws java.io.IOException
        Extracts the MTCCertificationAuthority structure from the id-pe-mtcCertificationAuthority extension of a CA certificate.
        Throws:
        java.io.IOException - if the extension is absent, not marked critical, or cannot be parsed