Package org.bouncycastle.cert.plants

Merkle Tree Certificate types per draft-ietf-plants-merkle-tree-certs.

JCA-free and lightweight-crypto-free operator abstractions, plus the proof / cosigner validation pipeline. Lightweight bindings live in org.bouncycastle.cert.plants.bc and JCA bindings in org.bouncycastle.cert.plants.jcajce.

Interface Summary

Interface	Description
MerkleTreeHash	Operator interface for the hash function used in the Merkle tree, as defined by Section 4 of draft-ietf-plants-merkle-tree-certs.
MTCCosigner	Operator interface for producing a cosigner signature over the subtree [start, end) of an MTC issuance log, per Section 5.3 of draft-ietf-plants-merkle-tree-certs.
MTCCosignerVerifier	Operator that verifies a single cosigner's signature over a CosignedMessage as defined by Section 5.3.1 of draft-ietf-plants-merkle-tree-certs.
MTCCosignerVerifierProvider	Looks up an MTCCosignerVerifier for a given cosigner trust anchor ID.
MTCSignatureVerifier	Operator interface for verifying a single cosigner signature over a pre-encoded CosignedMessage, per Section 5.3.1 of draft-ietf-plants-merkle-tree-certs.

Class Summary

Class	Description
LandmarkCertificateManager	Issuance- and relying-party-side helpers for landmark subtrees, per Sections 6.3 and 7.4 of draft-ietf-plants-merkle-tree-certs.
LandmarkCertificateManager.TrustedSubtreeEntry	A trusted subtree along with the reference checkpoint that proved its consistency, per Section 7.4.
LandmarkCertificateManager.TrustedSubtreeManager	Maintains a relying-party-side list of trusted subtrees by accepting new landmarks that come with a cosigned reference checkpoint and a subtree consistency proof.
LandmarkCertificateManager.TrustedSubtreeManager.Checkpoint	A snapshot of the log: tree size and root hash.
LandmarkSequence	The published landmark sequence for a single issuance log, as defined by Section 6.3 of draft-ietf-plants-merkle-tree-certs.
MerkleTreeCertEntry	Parses (and encodes) a single log entry per Section 5.2.1 of draft-ietf-plants-merkle-tree-certs:
MerkleTreeCertEntryExtension	A single Merkle Tree certificate log-entry extension, per Section 5.2.1 of draft-ietf-plants-merkle-tree-certs:
MerkleTreeCertEntryType	Constants for the MerkleTreeCertEntryType enum defined in Section 5.2.1 of draft-ietf-plants-merkle-tree-certs:
MerkleTreeCertificateValidator	Validates a Merkle Tree Certificate (MTC) per Section 7.2 of draft-ietf-plants-merkle-tree-certs.
MerkleTreeCertificateValidator.RevokedRange	A half-open range [start, end) of revoked certificate serial numbers, per Section 7.5 of the draft.
MerkleTreeCertificateValidator.TrustedSubtree	Represents a trusted subtree (typically a landmark subtree predistributed to the relying party).
MerkleTreeCertificateValidator.ValidationParams	Parameters supplied by the relying party for certificate validation.
MerkleTreePrimitives	Merkle Tree primitives for Merkle Tree Certificates (PLANTS).
MerkleTreePrimitives.SubtreeInfo	Simple container for a subtree interval (start inclusive, end exclusive).
MTCCertAuth	Identity-side helper for an MTC Certification Authority, per Section 5 of draft-ietf-plants-merkle-tree-certs.
MTCCertificationAuthorityCertificate	Helpers for the CA certificate representation defined by Section 5.5 of draft-ietf-plants-merkle-tree-certs.
MTCContentSigner	Issuer-side ContentSigner that emits an MTC signatureValue (an encoded MTCProof) for an EE Merkle Tree certificate per Section 6.1 of draft-ietf-plants-merkle-tree-certs.
MTCCosignedMessage	Wire encoder for the CosignedMessage struct defined by Section 5.3.1 of draft-ietf-plants-merkle-tree-certs:
MTCLog	Immutable identifier for an MTC issuance-log subtree window: the CA that operates the log, the log number (the upper 16 bits of the cert serial per Section 6.1 of draft-ietf-plants-merkle-tree-certs) and the subtree's [start, end) index range (uint48).
MTCProof	The MTCProof structure encoded in the X.509 certificate signatureValue per draft-ietf-plants-merkle-tree-certs, Section 6.1.
MTCSignature	A single cosigner signature, as it appears inside the TLS-encoded MTCProof defined by draft-ietf-plants-merkle-tree-certs, Section 6.1:
MTCSignatureAlgorithm	String constants for the cosigner signature algorithms defined by Section 5.3.2 of draft-ietf-plants-merkle-tree-certs.
MTCSignatureVerifierProvider	Single-cosigner ContentVerifierProvider adapter for MTC verification.
TrustAnchorIDs	Utilities for constructing and parsing the binary trust anchor IDs reserved by Section 5.1 of draft-ietf-plants-merkle-tree-certs under each CA ID: {caID 0 N} — issuance log N (Section 5.2) {caID 1 N L} — landmark L of log N (Section 8.2) {caID 2 N L} — landmark group containing landmark L and earlier (Section 8.2.1)

Exception Summary

Exception	Description
InvalidProofException	Thrown when a Merkle tree inclusion or consistency proof fails validation.