Class MTCCertificationAuthorityCertificate

java.lang.Object
org.bouncycastle.cert.plants.MTCCertificationAuthorityCertificate
public final class MTCCertificationAuthorityCertificate extends Object
Helpers for the CA certificate representation defined by Section 5.5 of draft-ietf-plants-merkle-tree-certs.

A Merkle Tree CA is represented as an X.509 certificate whose:

  • subject is the CA ID encoded as a single-RDN distinguished name, using MTCObjectIdentifiers.id_rdna_trustAnchorID with a UTF8String value of the dotted-decimal trust anchor ID
  • subjectPublicKeyInfo is the CA cosigner's public key
  • extensions carries a critical MTCObjectIdentifiers.id_pe_mtcCertificationAuthority extension whose value is the MTCCertificationAuthority structure
  • keyUsage (critical) asserts at least keyCertSign
  • basicConstraints (critical) sets cA=true
  • subjectKeyIdentifier (when present) SHOULD be the binary CA ID

Per Section 5.5 such certificates SHOULD NOT be self-signed; they are typically distributed as unsigned trust anchors. This helper does not sign the certificate — the caller supplies a ContentSigner to X509v3CertificateBuilder.build(ContentSigner) when finishing the chain (e.g. an unsigned-cert signer per draft-ietf-lamps-x509-alg-none, or an external CA).

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final org.bouncycastle.asn1.ASN1ObjectIdentifier
    EXTENSION_OID
    OID for the id-pe-mtcCertificationAuthority certificate extension.

  • Method Summary

    Modifier and Type
    Method
    Description
    static org.bouncycastle.asn1.x509.Extension
    buildAuthorityExtension(org.bouncycastle.asn1.x509.MTCCertificationAuthority info)
    Builds the critical id-pe-mtcCertificationAuthority extension.
    static org.bouncycastle.asn1.x509.MTCCertificationAuthority
    extractAuthorityInfo(X509CertificateHolder cert)
    Extracts the MTCCertificationAuthority structure from the id-pe-mtcCertificationAuthority extension of a CA certificate.
    static byte[]
    extractCaId(X509CertificateHolder cert)
    Extracts the binary CA trust anchor ID from the subject field of a CA certificate.
    static X509v3CertificateBuilder
    newBuilder(org.bouncycastle.asn1.x500.X500Name issuer, BigInteger serial, Date notBefore, Date notAfter, byte[] caId, org.bouncycastle.asn1.x509.SubjectPublicKeyInfo cosignerSpki, org.bouncycastle.asn1.x509.MTCCertificationAuthority info)
    Prepares a fully-populated X509v3CertificateBuilder for an MTC CA certificate.
    static org.bouncycastle.asn1.x500.X500Name
    subjectName(byte[] caId)
    Builds the subject (or issuer) distinguished name for a CA whose binary trust anchor ID is caId, using the experimental encoding from Section 5.1.

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • EXTENSION_OID

      public static final org.bouncycastle.asn1.ASN1ObjectIdentifier EXTENSION_OID
      OID for the id-pe-mtcCertificationAuthority certificate extension.

  • Method Details

    • subjectName

      public static org.bouncycastle.asn1.x500.X500Name subjectName(byte[] caId)
      Builds the subject (or issuer) distinguished name for a CA whose binary trust anchor ID is caId, using the experimental encoding from Section 5.1.

    • buildAuthorityExtension

      public static org.bouncycastle.asn1.x509.Extension buildAuthorityExtension(org.bouncycastle.asn1.x509.MTCCertificationAuthority info) throws IOException
      Builds the critical id-pe-mtcCertificationAuthority extension.
      Throws:
      IOException

    • newBuilder

      public static X509v3CertificateBuilder newBuilder(org.bouncycastle.asn1.x500.X500Name issuer, BigInteger serial, Date notBefore, Date notAfter, byte[] caId, org.bouncycastle.asn1.x509.SubjectPublicKeyInfo cosignerSpki, org.bouncycastle.asn1.x509.MTCCertificationAuthority info) throws IOException
      Prepares a fully-populated X509v3CertificateBuilder for an MTC CA certificate. The caller must invoke build with an appropriate signer (e.g. an unsigned-cert signer, or an external CA signer).
      Parameters:
      issuer - the X.509 issuer (often the same as subject when the trust anchor is self-attested, or the OID of the chaining CA)
      serial - certificate serial number
      notBefore - validity start
      notAfter - validity end
      caId - binary CA trust anchor ID
      cosignerSpki - the cosigner's SubjectPublicKeyInfo
      info - the MTCCertificationAuthority extension value
      Throws:
      IOException

    • extractCaId

      public static byte[] extractCaId(X509CertificateHolder cert) throws IOException
      Extracts the binary CA trust anchor ID from the subject field of a CA certificate. The encoding rules mirror MerkleTreeCertificateValidator.extractCaIdFromIssuer(X500Name), which reads the equivalent attribute from the issuer field of a Merkle Tree end-entity certificate.
      Throws:
      IOException

    • extractAuthorityInfo

      public static org.bouncycastle.asn1.x509.MTCCertificationAuthority extractAuthorityInfo(X509CertificateHolder cert) throws IOException
      Extracts the MTCCertificationAuthority structure from the id-pe-mtcCertificationAuthority extension of a CA certificate.
      Throws:
      IOException - if the extension is absent, not marked critical, or cannot be parsed