Class MerkleTreeCertEntry

java.lang.Object
org.bouncycastle.cert.plants.MerkleTreeCertEntry
public class MerkleTreeCertEntry extends Object
Parses (and encodes) a single log entry per Section 5.2.1 of draft-ietf-plants-merkle-tree-certs: 
struct {
    MerkleTreeCertEntryExtension extensions<0..2^16-1>;
    MerkleTreeCertEntryType type;
    select (type) {
       case null_entry: Empty;
       case tbs_cert_entry: opaque tbs_cert_entry_data[N];
    }
} MerkleTreeCertEntry;

For tbs_cert_entry, the body is the DER contents octets of a TBSCertificateLogEntry — that is, the SEQUENCE tag and length octets are stripped. getTbsCertEntry() reattaches a DER SEQUENCE wrapper and decodes it for callers who want the structured form.

MerkleTreeCertEntry is parsed in a length-framed context (the caller knows how many bytes belong to it); the byte-array constructor therefore consumes its full input.

  • Constructor Details

    • MerkleTreeCertEntry

      public MerkleTreeCertEntry(List<MerkleTreeCertEntryExtension> extensions, int type, byte[] body)
      Constructs an entry from its component parts.
      Parameters:
      extensions - ordered (ascending extension_type, no duplicates)
      type - a MerkleTreeCertEntryType value (uint16)
      body - the type-specific body bytes (empty for null_entry, the tbs_cert_entry_data contents for tbs_cert_entry)

    • MerkleTreeCertEntry

      public MerkleTreeCertEntry(byte[] data) throws IOException
      Parses a MerkleTreeCertEntry from its TLS wire encoding. The input MUST contain exactly one entry; trailing bytes are rejected.
      Throws:
      IOException

  • Method Details

    • getExtensions

      public List<MerkleTreeCertEntryExtension> getExtensions()

    • getType

      public int getType()

    • getBody

      public byte[] getBody()
      Returns:
      the type-specific body bytes — empty for null_entry, the tbs_cert_entry_data contents (DER body of a TBSCertificateLogEntry without its SEQUENCE wrapper) for tbs_cert_entry, or the raw bytes for any future type

    • getTbsCertEntry

      public org.bouncycastle.asn1.x509.TBSCertificateLogEntry getTbsCertEntry() throws IOException
      Reattaches a DER SEQUENCE wrapper to getBody() and decodes the result as a TBSCertificateLogEntry.
      Throws:
      IllegalStateException - if getType() is not tbs_cert_entry
      IOException - if the wrapped bytes do not decode as a TBSCertificateLogEntry

    • encode

      public byte[] encode() throws IOException
      Returns:
      the TLS wire encoding of this entry
      Throws:
      IOException - if a length constraint is violated