Class MTCCertAuth

java.lang.Object
org.bouncycastle.cert.plants.MTCCertAuth
public class MTCCertAuth extends Object
Identity-side helper for an MTC Certification Authority, per Section 5 of draft-ietf-plants-merkle-tree-certs. Bundles the CA's trust anchor ID (in both dotted-decimal and binary forms) along with the log hash and cosigner signature algorithm identifiers, and exposes the per-issuance derivations that depend on this identity:
  • logId(long) — the issuance log's binary trust anchor ID
  • issuerName() — the X.500 Name used in the cert's issuer field
  • certSerial(long, long) — a packed (log_number, index) cert serial
  • invalid reference 
    #authorityInfo(BigInteger)
    — the MTCCertificationAuthority extension value the relying party needs out-of-band

Identity-only: the CA's signing keypair stays separate so the same MTCCertAuth can be shared between an issuer (which holds the private key for cosigning) and a relying party (which holds the matching public key for verification).

  • Constructor Details

    • MTCCertAuth

      public MTCCertAuth(String dottedCaId, MerkleTreeHash hashFunc, org.bouncycastle.asn1.ASN1ObjectIdentifier sigAlgOid)
      Parameters:
      dottedCaId - dotted-decimal form of the CA's trust anchor ID (e.g. "32473.1")
      hashFunc - hash function used by all issuance logs operated by this CA (Section 5.5) — its algorithm identifier is published in the CA's logHash
      sigAlgOid - CA cosigner's signature algorithm (Section 5.5)

    • MTCCertAuth

      public MTCCertAuth(byte[] caId, MerkleTreeHash hashFunc, org.bouncycastle.asn1.ASN1ObjectIdentifier sigAlgOid)
      Parameters:
      caId - binary form of the CA's trust anchor ID
      hashFunc - hash function used by all issuance logs operated by this CA (Section 5.5)
      sigAlgOid - CA cosigner's signature algorithm (Section 5.5)

  • Method Details

    • getCaId

      public byte[] getCaId()
      Returns:
      the CA's binary trust anchor ID (defensive copy).

    • getDottedCaId

      public String getDottedCaId()
      Returns:
      the CA's trust anchor ID in dotted-decimal form.

    • getHashFunc

      public MerkleTreeHash getHashFunc()
      Returns:
      the hash function used by all issuance logs operated by this CA.

    • logId

      public byte[] logId(long logNumber)
      Parameters:
      logNumber - log number (1 <= logNumber <= 2^16-1, Section 5.2)
      Returns:
      the binary trust anchor ID of issuance log logNumber operated by this CA

    • issuerName

      public org.bouncycastle.asn1.x500.X500Name issuerName()
      Returns:
      the issuer X500Name for certs issued by this CA, carrying the trust anchor ID via the experimental id_rdna_trustAnchorID attribute

    • certSerial

      public BigInteger certSerial(long logNumber, long index)
      Parameters:
      logNumber - log number (1 <= logNumber <= 2^16-1)
      index - entry index in the log (0 <= index <= 2^48-1)
      Returns:
      the 64-bit cert serial composed per Section 6.1

    • certSerial

      public BigInteger certSerial(MTCLog log, long index)
      Equivalent to certSerial(long, long) with the log number taken from log.getLogNumber().

    • authorityInfo

      public org.bouncycastle.asn1.x509.MTCCertificationAuthority authorityInfo(BigInteger minSerial, BigInteger maxSerial)
      Builds the MTCCertificationAuthority extension value that the relying party needs to validate certs from this CA. Combines the CA's log hash and cosigner signature algorithm with the supplied serial range.
      Parameters:
      minSerial - minimum allowed cert serial from this CA (Section 5.5 / 6.1)
      maxSerial - maximum allowed cert serial from this CA (Section 5.5 / 6.1)