Package org.bouncycastle.tsp.ers

Class ERSEvidenceRecord

java.lang.Object

org.bouncycastle.tsp.ers.ERSEvidenceRecord

public class ERSEvidenceRecord
extends java.lang.Object

Carrier for an RFC 4998 EvidenceRecord - the ArchiveTimeStampSequence of ArchiveTimeStampChains that provides long-term, renewable proof of existence for one or more data objects. The first time-stamp of the first chain is the "primary" archive time-stamp that fixes the original data; subsequent time-stamps within a chain provide time-stamp renewal, and additional chains provide hash-tree renewal when a digest algorithm weakens. This class exposes presence validation and the renewal operations.

Constructor Summary

Constructors

Constructor	Description
ERSEvidenceRecord(byte[] evidenceRecord, DigestCalculatorProvider digestCalculatorProvider)	Create an evidence record from an encoded EvidenceRecord.
ERSEvidenceRecord(java.io.InputStream ersIn, DigestCalculatorProvider digestCalculatorProvider)	Create an evidence record by reading and parsing an encoded EvidenceRecord.
ERSEvidenceRecord(org.bouncycastle.asn1.tsp.EvidenceRecord evidenceRecord, DigestCalculatorProvider digestCalculatorProvider)	Create an evidence record from a parsed EvidenceRecord structure.

Method Summary

Modifier and Type	Method	Description
TimeStampRequest	generateHashRenewalRequest(DigestCalculator digCalc, ERSData data, TimeStampRequestGenerator tspReqGen)	Generate a hash renewal request (RFC 4998 hash-tree renewal) for use when the digest algorithm itself weakens.
TimeStampRequest	generateHashRenewalRequest(DigestCalculator digCalc, ERSData data, TimeStampRequestGenerator tspReqGen, java.math.BigInteger nonce)	Generate a hash renewal request with the passed in nonce.
TimeStampRequest	generateTimeStampRenewalRequest(TimeStampRequestGenerator tspReqGen)	Generate a time-stamp renewal request (RFC 4998 timestamp renewal) over the existing time-stamps in the current chain, for use when the time-stamp or its signature algorithm weakens.
TimeStampRequest	generateTimeStampRenewalRequest(TimeStampRequestGenerator tspReqGen, java.math.BigInteger nonce)	Generate a time-stamp renewal request with the passed in nonce.
byte[]	getEncoded()	return the ASN.1 encoded representation of this object.
byte[]	getPrimaryRootHash()	Return the timestamp imprint for the initial ArchiveTimeStamp in this evidence record.
X509CertificateHolder	getSigningCertificate()	Return the TimeStamp signing certificate if it is present.
boolean	isContaining(ERSData data, java.util.Date date)	Return true if the hash of data appears in the primary archive time stamp for the current chain.
boolean	isRelatedTo(ERSEvidenceRecord er)	Return true if this evidence record is related to the passed in one.
ERSEvidenceRecord	renewHash(DigestCalculator digCalc, ERSData data, TimeStampResponse tspResp)	Apply a hash-tree renewal: append a new ArchiveTimeStampChain built from the renewal time-stamp (obtained for a generateHashRenewalRequest(DigestCalculator, ERSData, TimeStampRequestGenerator)) to the ArchiveTimeStampSequence, returning the updated record.
ERSEvidenceRecord	renewTimeStamp(TimeStampResponse tspResp)	Apply a time-stamp renewal: append the time-stamp from the passed in response (obtained for a generateTimeStampRenewalRequest(TimeStampRequestGenerator)) as a new ArchiveTimeStamp on the current chain, returning the updated record.
org.bouncycastle.asn1.tsp.EvidenceRecord	toASN1Structure()	Return the underlying ASN.1 EvidenceRecord structure.
void	validate(SignerInformationVerifier verifier)	Validate the current time stamp associated with this evidence record.
void	validatePresent(boolean isDataGroup, byte[] hash, java.util.Date atDate)	Validate that a particular data object/group is present by hash.
void	validatePresent(ERSData data, java.util.Date atDate)	Validate that a particular data object/group is present.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

ERSEvidenceRecord

public ERSEvidenceRecord(java.io.InputStream ersIn,
                         DigestCalculatorProvider digestCalculatorProvider)
                  throws TSPException,
                         ERSException,
                         java.io.IOException

Create an evidence record by reading and parsing an encoded EvidenceRecord.

Parameters:

ersIn - stream to read the encoded evidence record from.

digestCalculatorProvider - provider for the digest calculators needed to process the record.

Throws:

TSPException

ERSException

java.io.IOException

ERSEvidenceRecord

public ERSEvidenceRecord(byte[] evidenceRecord,
                         DigestCalculatorProvider digestCalculatorProvider)
                  throws TSPException,
                         ERSException

Create an evidence record from an encoded EvidenceRecord.

Parameters:

evidenceRecord - the DER encoded evidence record.

digestCalculatorProvider - provider for the digest calculators needed to process the record.

Throws:

TSPException

ERSException

ERSEvidenceRecord

public ERSEvidenceRecord(org.bouncycastle.asn1.tsp.EvidenceRecord evidenceRecord,
                         DigestCalculatorProvider digestCalculatorProvider)
                  throws TSPException,
                         ERSException

Create an evidence record from a parsed EvidenceRecord structure. The chains are validated on construction (RFC 4998 Section 5.3) - each chain must contain at least one time-stamp, use a consistent digest algorithm, and each successive time-stamp must cover the previous one.

Parameters:

evidenceRecord - the parsed evidence record.

digestCalculatorProvider - provider for the digest calculators needed to process the record.

Throws:

ERSException - if the sequence/chain structure is invalid or a renewal is malformed.

TSPException - on a time-stamp processing error.

Method Detail

getPrimaryRootHash

public byte[] getPrimaryRootHash()
                          throws TSPException,
                                 ERSException

Return the timestamp imprint for the initial ArchiveTimeStamp in this evidence record.

Returns:

initial hash root.

Throws:

TSPException

ERSException

isRelatedTo

public boolean isRelatedTo(ERSEvidenceRecord er)

Return true if this evidence record is related to the passed in one.

Parameters:

er - the evidence record to be checked.

Returns:

true if the primary time stamp has the same value, false otherwise.

isContaining

public boolean isContaining(ERSData data,
                            java.util.Date date)
                     throws ERSException

Return true if the hash of data appears in the primary archive time stamp for the current chain.

Parameters:

data - the data of interest.

date - date at which the data is supposed to be valid.

Returns:

true if the data is present and the time-stamp is not in the future relative to date, false otherwise.

Throws:

ERSException - if an error occurs processing the record.

validatePresent

public void validatePresent(ERSData data,
                            java.util.Date atDate)
                     throws ERSException

Validate that a particular data object/group is present.

Parameters:

data - the data object/group.

atDate - date at which data is supposed to be valid.

Throws:

ERSException - if the object cannot be found or the record is invalid.

validatePresent

public void validatePresent(boolean isDataGroup,
                            byte[] hash,
                            java.util.Date atDate)
                     throws ERSException

Validate that a particular data object/group is present by hash.

Parameters:

isDataGroup - true if hash represents a data group.

hash - expected hash value

atDate - date at which value is supposed to be valid.

Throws:

ERSException - if the object cannot be found or the record is invalid.

getSigningCertificate

public X509CertificateHolder getSigningCertificate()

Return the TimeStamp signing certificate if it is present.

Returns:

the TimeStamp signing certificate.

validate

public void validate(SignerInformationVerifier verifier)
              throws TSPException

Validate the current time stamp associated with this evidence record.

Parameters:

verifier - signer verifier for the contained time stamp.

Throws:

TSPException - in case of validation failure or error.

toASN1Structure

public org.bouncycastle.asn1.tsp.EvidenceRecord toASN1Structure()

Return the underlying ASN.1 EvidenceRecord structure.

Returns:

the EvidenceRecord this object wraps.

getEncoded

public byte[] getEncoded()
                  throws java.io.IOException

return the ASN.1 encoded representation of this object.

Throws:

java.io.IOException

generateTimeStampRenewalRequest

public TimeStampRequest generateTimeStampRenewalRequest(TimeStampRequestGenerator tspReqGen)
                                                 throws TSPException,
                                                        ERSException

Generate a time-stamp renewal request (RFC 4998 timestamp renewal) over the existing time-stamps in the current chain, for use when the time-stamp or its signature algorithm weakens. The resulting time-stamp, once obtained, is added to the current chain via renewTimeStamp(TimeStampResponse).

Parameters:

tspReqGen - generator to use for building the time-stamp request.

Returns:

a time-stamp request over the current chain's time-stamps.

Throws:

TSPException - on a time-stamp processing error.

ERSException - on an error building the request.

generateTimeStampRenewalRequest

public TimeStampRequest generateTimeStampRenewalRequest(TimeStampRequestGenerator tspReqGen,
                                                        java.math.BigInteger nonce)
                                                 throws ERSException,
                                                        TSPException

Generate a time-stamp renewal request with the passed in nonce.

Parameters:

tspReqGen - generator to use for building the time-stamp request.

nonce - nonce to include in the request, or null.

Returns:

a time-stamp request over the current chain's time-stamps.

Throws:

ERSException - on an error building the request.

TSPException - on a time-stamp processing error.

renewTimeStamp

public ERSEvidenceRecord renewTimeStamp(TimeStampResponse tspResp)
                                 throws ERSException,
                                        TSPException

Apply a time-stamp renewal: append the time-stamp from the passed in response (obtained for a generateTimeStampRenewalRequest(TimeStampRequestGenerator)) as a new ArchiveTimeStamp on the current chain, returning the updated record.

Parameters:

tspResp - the response carrying the renewal time-stamp.

Returns:

a new ERSEvidenceRecord with the renewal time-stamp added to the current chain.

Throws:

ERSException - if the response cannot be processed.

TSPException - on a time-stamp processing error.

generateHashRenewalRequest

public TimeStampRequest generateHashRenewalRequest(DigestCalculator digCalc,
                                                   ERSData data,
                                                   TimeStampRequestGenerator tspReqGen)
                                            throws ERSException,
                                                   TSPException,
                                                   java.io.IOException

Generate a hash renewal request (RFC 4998 hash-tree renewal) for use when the digest algorithm itself weakens. A new digest is taken (with the supplied calculator) over the data re-hashed together with the existing ArchiveTimeStampSequence; the resulting time-stamp starts a new chain via renewHash(DigestCalculator, ERSData, TimeStampResponse).

Parameters:

digCalc - digest calculator for the new (stronger) algorithm.

data - the data object/group being carried forward; must already be present in the record.

tspReqGen - generator to use for building the time-stamp request.

Returns:

a time-stamp request over the re-hashed data and existing sequence.

Throws:

ERSException - if the data is not present in the record.

TSPException - on a time-stamp processing error.

java.io.IOException - on an encoding error.

generateHashRenewalRequest

public TimeStampRequest generateHashRenewalRequest(DigestCalculator digCalc,
                                                   ERSData data,
                                                   TimeStampRequestGenerator tspReqGen,
                                                   java.math.BigInteger nonce)
                                            throws ERSException,
                                                   TSPException,
                                                   java.io.IOException

Generate a hash renewal request with the passed in nonce.

Parameters:

digCalc - digest calculator for the new (stronger) algorithm.

data - the data object/group being carried forward; must already be present in the record.

tspReqGen - generator to use for building the time-stamp request.

nonce - nonce to include in the request, or null.

Returns:

a time-stamp request over the re-hashed data and existing sequence.

Throws:

ERSException - if the data is not present in the record.

TSPException - on a time-stamp processing error.

java.io.IOException - on an encoding error.

renewHash

public ERSEvidenceRecord renewHash(DigestCalculator digCalc,
                                   ERSData data,
                                   TimeStampResponse tspResp)
                            throws ERSException,
                                   TSPException

Apply a hash-tree renewal: append a new ArchiveTimeStampChain built from the renewal time-stamp (obtained for a generateHashRenewalRequest(DigestCalculator, ERSData, TimeStampRequestGenerator)) to the ArchiveTimeStampSequence, returning the updated record.

Parameters:

digCalc - digest calculator for the new algorithm.

data - the data object/group being carried forward; must already be present in the record.

tspResp - the response carrying the renewal time-stamp.

Returns:

a new ERSEvidenceRecord with a new chain added to the sequence.

Throws:

ERSException - if the data is not present or the response cannot be processed.

TSPException - on a time-stamp processing error.