Package org.bouncycastle.cert.plants

Class MTCCertAuth

  • public class MTCCertAuth
extends java.lang.Object
    Identity-side helper for an MTC Certification Authority, per Section 5 of draft-ietf-plants-merkle-tree-certs. Bundles the CA's trust anchor ID (in both dotted-decimal and binary forms) along with the log hash and cosigner signature algorithm identifiers, and exposes the per-issuance derivations that depend on this identity:
    • logId(long) — the issuance log's binary trust anchor ID
    • issuerName() — the X.500 Name used in the cert's issuer field
    • certSerial(long, long) — a packed (log_number, index) cert serial
    • #authorityInfo(BigInteger) — the MTCCertificationAuthority extension value the relying party needs out-of-band

    Identity-only: the CA's signing keypair stays separate so the same MTCCertAuth can be shared between an issuer (which holds the private key for cosigning) and a relying party (which holds the matching public key for verification).

    • Constructor Summary

      Constructors 
      Constructor Description
      MTCCertAuth​(byte[] caId, MerkleTreeHash hashFunc, org.bouncycastle.asn1.ASN1ObjectIdentifier sigAlgOid)  
      MTCCertAuth​(java.lang.String dottedCaId, MerkleTreeHash hashFunc, org.bouncycastle.asn1.ASN1ObjectIdentifier sigAlgOid)  

    • Method Summary

      All Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      org.bouncycastle.asn1.x509.MTCCertificationAuthority authorityInfo​(java.math.BigInteger minSerial, java.math.BigInteger maxSerial)
      Builds the MTCCertificationAuthority extension value that the relying party needs to validate certs from this CA.
      java.math.BigInteger certSerial​(long logNumber, long index)  
      java.math.BigInteger certSerial​(MTCLog log, long index)
      Equivalent to certSerial(long, long) with the log number taken from log.getLogNumber().
      byte[] getCaId()  
      java.lang.String getDottedCaId()  
      MerkleTreeHash getHashFunc()  
      org.bouncycastle.asn1.x500.X500Name issuerName()  
      byte[] logId​(long logNumber)  

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Constructor Detail

      • MTCCertAuth

        public MTCCertAuth​(java.lang.String dottedCaId,
                   MerkleTreeHash hashFunc,
                   org.bouncycastle.asn1.ASN1ObjectIdentifier sigAlgOid)
        Parameters:
        dottedCaId - dotted-decimal form of the CA's trust anchor ID (e.g. "32473.1")
        hashFunc - hash function used by all issuance logs operated by this CA (Section 5.5) — its algorithm identifier is published in the CA's logHash
        sigAlgOid - CA cosigner's signature algorithm (Section 5.5)

      • MTCCertAuth

        public MTCCertAuth​(byte[] caId,
                   MerkleTreeHash hashFunc,
                   org.bouncycastle.asn1.ASN1ObjectIdentifier sigAlgOid)
        Parameters:
        caId - binary form of the CA's trust anchor ID
        hashFunc - hash function used by all issuance logs operated by this CA (Section 5.5)
        sigAlgOid - CA cosigner's signature algorithm (Section 5.5)

    • Method Detail

      • getCaId

        public byte[] getCaId()
        Returns:
        the CA's binary trust anchor ID (defensive copy).

      • getDottedCaId

        public java.lang.String getDottedCaId()
        Returns:
        the CA's trust anchor ID in dotted-decimal form.

      • getHashFunc

        public MerkleTreeHash getHashFunc()
        Returns:
        the hash function used by all issuance logs operated by this CA.

      • logId

        public byte[] logId​(long logNumber)
        Parameters:
        logNumber - log number (1 <= logNumber <= 2^16-1, Section 5.2)
        Returns:
        the binary trust anchor ID of issuance log logNumber operated by this CA

      • issuerName

        public org.bouncycastle.asn1.x500.X500Name issuerName()
        Returns:
        the issuer X500Name for certs issued by this CA, carrying the trust anchor ID via the experimental id_rdna_trustAnchorID attribute

      • certSerial

        public java.math.BigInteger certSerial​(long logNumber,
                                       long index)
        Parameters:
        logNumber - log number (1 <= logNumber <= 2^16-1)
        index - entry index in the log (0 <= index <= 2^48-1)
        Returns:
        the 64-bit cert serial composed per Section 6.1

      • certSerial

        public java.math.BigInteger certSerial​(MTCLog log,
                                       long index)
        Equivalent to certSerial(long, long) with the log number taken from log.getLogNumber().

      • authorityInfo

        public org.bouncycastle.asn1.x509.MTCCertificationAuthority authorityInfo​(java.math.BigInteger minSerial,
                                                                          java.math.BigInteger maxSerial)
        Builds the MTCCertificationAuthority extension value that the relying party needs to validate certs from this CA. Combines the CA's log hash and cosigner signature algorithm with the supplied serial range.
        Parameters:
        minSerial - minimum allowed cert serial from this CA (Section 5.5 / 6.1)
        maxSerial - maximum allowed cert serial from this CA (Section 5.5 / 6.1)