Class MTCProof

java.lang.Object
org.bouncycastle.cert.plants.MTCProof
public class MTCProof extends Object
The MTCProof structure encoded in the X.509 certificate signatureValue per draft-ietf-plants-merkle-tree-certs, Section 6.1. 
opaque HashValue[HASH_SIZE];

struct {
    TrustAnchorID cosigner_id;
    opaque signature<0..2^16-1>;
} MTCSignature;

struct {
    MerkleTreeCertEntryExtension extensions<0..2^16-1>;
    uint48 start;
    uint48 end;
    HashValue inclusion_proof<0..2^16-1>;
    MTCSignature signatures<0..2^16-1>;
} MTCProof;

extensions carries the log entry's extension list, ordered by extension_type ascending with no duplicates. start and end are 6-byte unsigned big-endian integers (the draft shrank these from uint64). Entries of signatures MUST have unique cosigner_ids and MUST be ordered first by length (shorter byte strings before longer) and then lexicographically.

  • Field Details

    • UINT48_MAX

      public static final long UINT48_MAX
      Maximum value of a uint48 (2^48 - 1).
      See Also:

  • Constructor Details

    • MTCProof

      public MTCProof(long start, long end, byte[] inclusionProof, List<MTCSignature> signatures)
      Constructs an MTCProof with an empty extensions list.
      See Also:

    • MTCProof

      public MTCProof(long start, long end, byte[] inclusionProof, MTCSignature... signatures)
      Varargs convenience for the common case of constructing an MTCProof from a small fixed set of cosigner signatures (typically just one). Equivalent to MTCProof(long, long, byte[], List) with the signatures wrapped in a list; the same ordering rules in Section 6.1 apply.

    • MTCProof

      public MTCProof(MTCLog log, byte[] inclusionProof, MTCSignature... signatures)
      Convenience overload taking an MTCLog — equivalent to MTCProof(long, long, byte[], MTCSignature...) with start = log.getStart() and end = log.getEnd().

    • MTCProof

      public MTCProof(List<MerkleTreeCertEntryExtension> extensions, long start, long end, byte[] inclusionProof, List<MTCSignature> signatures)
      Constructs an MTCProof, validating uint48 range, ordering of the extensions list (ascending by extension_type, no duplicates) and canonical ordering of the signatures list.
      Throws:
      IllegalArgumentException - if start or end exceeds 2^48-1, if the extensions are unordered or duplicate, or if the signatures contain a duplicate cosigner_id or are not in canonical order

    • MTCProof

      public MTCProof(byte[] data) throws IOException
      Parses an MTCProof from its TLS wire encoding (the contents of the certificate's signatureValue BIT STRING, byte-aligned, with no unused-bits prefix).
      Throws:
      IOException - if parsing fails or if the extensions / signatures lists violate the ordering rules in Section 6.1

  • Method Details

    • encode

      public byte[] encode() throws IOException
      Returns:
      the TLS wire encoding of this MTCProof
      Throws:
      IOException - if a length constraint is violated

    • getStart

      public long getStart()

    • getEnd

      public long getEnd()

    • getInclusionProof

      public byte[] getInclusionProof()

    • getSignatures

      public List<MTCSignature> getSignatures()

    • getExtensions

      public List<MerkleTreeCertEntryExtension> getExtensions()

    • getExtensionsWire

      public byte[] getExtensionsWire()
      Returns:
      the on-wire encoding of the extensions field, including the 2-byte length prefix; equal to the leading bytes of encode(). Section 7.2 step (5.2) requires these bytes to be written into the leaf-entry hash unchanged.

    • getHashList

      public List<byte[]> getHashList(int hashSize)
      Splits the concatenated inclusion proof into individual hash values of the given size.

    • compareCosignerIds

      public static int compareCosignerIds(byte[] a, byte[] b)
      The canonical comparator on cosigner_id byte strings, per Section 6.1: shorter byte strings come first, ties are broken lexicographically (unsigned).