Package org.bouncycastle.cert.plants

Class TrustAnchorIDs

  • public final class TrustAnchorIDs
extends java.lang.Object
    Utilities for constructing and parsing the binary trust anchor IDs reserved by Section 5.1 of draft-ietf-plants-merkle-tree-certs under each CA ID:
    • {caID 0 N} — issuance log N (Section 5.2)
    • {caID 1 N L} — landmark L of log N (Section 8.2)
    • {caID 2 N L} — landmark group containing landmark L and earlier (Section 8.2.1)

    The binary representation is the base-128 OID-component encoding used inside ASN.1 RELATIVE-OID contents (Section 3 of draft-ietf-tls-trust-anchor-ids); it has no ASN.1 tag or length prefix.

    • Field Summary

      Fields 
      Modifier and Type Field Description
      static int LANDMARK_GROUPS_ARC
      OID component for the landmark-groups arc (Section 8.2.1).
      static int LANDMARKS_ARC
      OID component for the landmarks arc (per-landmark IDs, Section 8.2).
      static int LOGS_ARC
      OID component for the logs arc.
      static int MAX_ID_LENGTH
      Maximum length, in bytes, of a trust anchor ID's binary representation.

    • Method Summary

      All Methods Static Methods Concrete Methods 
      Modifier and Type Method Description
      static java.math.BigInteger certSerial​(long logNumber, long index)
      Composes the 64-bit certificate serial number per Section 6.1 of draft-ietf-plants-merkle-tree-certs:
      static java.math.BigInteger certSerial​(MTCLog log, long index)
      Equivalent to certSerial(long, long) with the log number taken from log.getLogNumber().
      static byte[] encodeComponent​(long value)
      Encodes a non-negative integer as a single OID component using base-128 with continuation bits, as defined for RELATIVE-OID contents in Section 8.20 of X.690.
      static byte[] fromDottedDecimal​(java.lang.String dotted)
      Converts a dotted-decimal trust anchor ID (e.g.
      static org.bouncycastle.asn1.x500.X500Name issuerName​(java.lang.String caTrustAnchorIdDotted)
      Builds the issuer X500Name for a Merkle Tree certificate, using the experimental id_rdna_trustAnchorID attribute with a UTF8String value of the CA's dotted-decimal trust anchor ID (Section 5.1 of draft-ietf-plants-merkle-tree-certs).
      static byte[] landmarkGroupId​(byte[] caId, long logNumber, long landmarkNumber)
      Builds the binary trust anchor ID of a landmark group (Section 8.2.1).
      static byte[] landmarkId​(byte[] caId, long logNumber, long landmarkNumber)
      Builds the binary trust anchor ID of a landmark (Section 8.2).
      static byte[] logId​(byte[] caId, long logNumber)
      Builds the binary trust anchor ID of an issuance log.
      static java.lang.String toDottedDecimal​(byte[] binaryId)
      Converts a binary trust anchor ID into the dotted-decimal form used in ASCII representations (e.g. for the issuer field UTF8String value and inside CosignedMessage cosigner_name / log_origin).

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Field Detail

      • LOGS_ARC

        public static final int LOGS_ARC
        OID component for the logs arc.
        See Also:
        Constant Field Values

      • LANDMARKS_ARC

        public static final int LANDMARKS_ARC
        OID component for the landmarks arc (per-landmark IDs, Section 8.2).
        See Also:
        Constant Field Values

      • LANDMARK_GROUPS_ARC

        public static final int LANDMARK_GROUPS_ARC
        OID component for the landmark-groups arc (Section 8.2.1).
        See Also:
        Constant Field Values

      • MAX_ID_LENGTH

        public static final int MAX_ID_LENGTH
        Maximum length, in bytes, of a trust anchor ID's binary representation. A trust anchor ID is transmitted as opaque TrustAnchorID<1..2^8-1> (Section 4.1 of draft-ietf-tls-trust-anchor-ids) and Section 3 states its binary representation "MUST NOT exceed 255 bytes", so a valid trust anchor ID is 1..255 bytes.
        See Also:
        Constant Field Values

    • Method Detail

      • logId

        public static byte[] logId​(byte[] caId,
                           long logNumber)
        Builds the binary trust anchor ID of an issuance log.
        Parameters:
        caId - binary trust anchor ID of the CA
        logNumber - log number (1 <= logNumber <= 2^16-1, Section 5.2)

      • certSerial

        public static java.math.BigInteger certSerial​(MTCLog log,
                                              long index)
        Equivalent to certSerial(long, long) with the log number taken from log.getLogNumber().

      • landmarkId

        public static byte[] landmarkId​(byte[] caId,
                                long logNumber,
                                long landmarkNumber)
        Builds the binary trust anchor ID of a landmark (Section 8.2). Section 5.1 allocates these OIDs for positive landmark numbers only — landmark 0 always has tree size zero and no landmark subtrees, so it never needs an ID.
        Parameters:
        caId - binary trust anchor ID of the CA
        logNumber - log number
        landmarkNumber - landmark number (landmarkNumber >= 1)

      • landmarkGroupId

        public static byte[] landmarkGroupId​(byte[] caId,
                                     long logNumber,
                                     long landmarkNumber)
        Builds the binary trust anchor ID of a landmark group (Section 8.2.1). As with landmarkId(byte[], long, long), Section 5.1 allocates these OIDs for positive landmark numbers only.
        Parameters:
        caId - binary trust anchor ID of the CA
        logNumber - log number
        landmarkNumber - landmark number that names the group's high end (landmarkNumber >= 1)

      • issuerName

        public static org.bouncycastle.asn1.x500.X500Name issuerName​(java.lang.String caTrustAnchorIdDotted)
        Builds the issuer X500Name for a Merkle Tree certificate, using the experimental id_rdna_trustAnchorID attribute with a UTF8String value of the CA's dotted-decimal trust anchor ID (Section 5.1 of draft-ietf-plants-merkle-tree-certs). The validator concatenates this with the cert serial's log_number to recover the issuance log's full trust anchor ID.

        For the production encoding the attribute value is a RELATIVE-OID rather than a UTF8String; both are accepted on the verifier side by MerkleTreeCertificateValidator.extractCaIdFromIssuer(X500Name).

        Parameters:
        caTrustAnchorIdDotted - dotted-decimal form of the CA's trust anchor ID (e.g. "32473.1")

      • toDottedDecimal

        public static java.lang.String toDottedDecimal​(byte[] binaryId)
        Converts a binary trust anchor ID into the dotted-decimal form used in ASCII representations (e.g. for the issuer field UTF8String value and inside CosignedMessage cosigner_name / log_origin).

      • fromDottedDecimal

        public static byte[] fromDottedDecimal​(java.lang.String dotted)
        Converts a dotted-decimal trust anchor ID (e.g. "32473.1.0.1") into its binary form: the base-128 encoded OID-component bytes with no ASN.1 tag or length prefix (Section 3 of draft-ietf-tls-trust-anchor-ids).

      • encodeComponent

        public static byte[] encodeComponent​(long value)
        Encodes a non-negative integer as a single OID component using base-128 with continuation bits, as defined for RELATIVE-OID contents in Section 8.20 of X.690.