Package org.bouncycastle.cert.plants

Class MTCSignatureVerifierProvider

java.lang.Object

org.bouncycastle.cert.plants.MTCSignatureVerifierProvider

All Implemented Interfaces:

ContentVerifierProvider

public class MTCSignatureVerifierProvider
extends java.lang.Object
implements ContentVerifierProvider

Single-cosigner ContentVerifierProvider adapter for MTC verification.

Wraps a single MTCCosignerVerifier so it can be plugged into the generic BC operator surface that accepts a ContentVerifierProvider. The provider has two modes, selected by which constructor is used:

• Manual mode (MTCSignatureVerifierProvider(MTCCosignerVerifier)) — get(AlgorithmIdentifier) returns the wrapped verifier directly. Callers drive cosignature verification themselves: write the MTCCosignedMessage bytes through ContentVerifier.getOutputStream() and call ContentVerifier.verify(byte[]) with the cosigner's signature.
• Certificate mode (MTCSignatureVerifierProvider(MTCCertAuth, MTCCosignerVerifier)) — get(AlgorithmIdentifier) returns a wrapping verifier that integrates with certHolder.isSignatureValid(provider) for an MTC certificate:
  1. The DER-encoded TBSCertificate is captured from ContentVerifier.getOutputStream().
  2. ContentVerifier.verify(byte[]) receives the MTCProof bytes (the cert's signatureValue), reparses them, recomputes the subtree hash via MerkleTreeCertificateValidator.computeSubtreeHash(byte[], byte[], org.bouncycastle.cert.plants.MerkleTreeHash), builds the MTCCosignedMessage for the MTCSignature whose cosigner_id matches the wrapped verifier's MTCCosignerVerifier.getCosignerId() (signatures naming any other cosigner are unrecognized and ignored), and returns true if that cosignature verifies. This matches single-cosigner deployments — a multi-cosigner / minCosignatures > 1 policy should continue to use MerkleTreeCertificateValidator.

The adapter has no associated certificate; hasAssociatedCertificate() returns false and getAssociatedCertificate() returns null.

See Also:

MTCCosignerVerifier

Constructor Summary

Constructors

Constructor	Description
MTCSignatureVerifierProvider(MTCCertAuth ca, MTCCosignerVerifier verifier)	Certificate-mode constructor — see class javadoc.
MTCSignatureVerifierProvider(MTCCosignerVerifier verifier)	Manual-mode constructor — see class javadoc.

Method Summary

Modifier and Type	Method	Description
ContentVerifier	get(org.bouncycastle.asn1.x509.AlgorithmIdentifier verifierAlgorithmIdentifier)	Return a ContentVerifier that matches the passed in algorithm identifier,
X509CertificateHolder	getAssociatedCertificate()	Return the associated certificate if there is one.
boolean	hasAssociatedCertificate()	Return whether or not this verifier has a certificate associated with it.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

MTCSignatureVerifierProvider

public MTCSignatureVerifierProvider(MTCCosignerVerifier verifier)

Manual-mode constructor — see class javadoc.

MTCSignatureVerifierProvider

public MTCSignatureVerifierProvider(MTCCertAuth ca,
                                    MTCCosignerVerifier verifier)

Certificate-mode constructor — see class javadoc. Use this when passing the provider to X509CertificateHolder.isSignatureValid(ContentVerifierProvider).

Method Detail

hasAssociatedCertificate

public boolean hasAssociatedCertificate()

Description copied from interface: ContentVerifierProvider

Return whether or not this verifier has a certificate associated with it.

Specified by:

hasAssociatedCertificate in interface ContentVerifierProvider

Returns:

true if there is an associated certificate, false otherwise.

getAssociatedCertificate

public X509CertificateHolder getAssociatedCertificate()

Description copied from interface: ContentVerifierProvider

Return the associated certificate if there is one.

Specified by:

getAssociatedCertificate in interface ContentVerifierProvider

Returns:

a holder containing the associated certificate if there is one, null if there is not.

get

public ContentVerifier get(org.bouncycastle.asn1.x509.AlgorithmIdentifier verifierAlgorithmIdentifier)

Description copied from interface: ContentVerifierProvider

Return a ContentVerifier that matches the passed in algorithm identifier,

Specified by:

get in interface ContentVerifierProvider

Parameters:

verifierAlgorithmIdentifier - the algorithm and parameters required.

Returns:

a matching ContentVerifier