Class TrustAnchorIDs

java.lang.Object
org.bouncycastle.cert.plants.TrustAnchorIDs
public final class TrustAnchorIDs extends Object
Utilities for constructing and parsing the binary trust anchor IDs reserved by Section 5.1 of draft-ietf-plants-merkle-tree-certs under each CA ID:
  • {caID 0 N} — issuance log N (Section 5.2)
  • {caID 1 N L} — landmark L of log N (Section 8.2)
  • {caID 2 N L} — landmark group containing landmark L and earlier (Section 8.2.1)

The binary representation is the base-128 OID-component encoding used inside ASN.1 RELATIVE-OID contents (Section 3 of draft-ietf-tls-trust-anchor-ids); it has no ASN.1 tag or length prefix.

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final int
    LANDMARK_GROUPS_ARC
    OID component for the landmark-groups arc (Section 8.2.1).
    static final int
    LANDMARKS_ARC
    OID component for the landmarks arc (per-landmark IDs, Section 8.2).
    static final int
    LOGS_ARC
    OID component for the logs arc.
    static final int
    MAX_ID_LENGTH
    Maximum length, in bytes, of a trust anchor ID's binary representation.

  • Method Summary

    Modifier and Type
    Method
    Description
    static BigInteger
    certSerial(long logNumber, long index)
    Composes the 64-bit certificate serial number per Section 6.1 of draft-ietf-plants-merkle-tree-certs:
    static BigInteger
    certSerial(MTCLog log, long index)
    Equivalent to certSerial(long, long) with the log number taken from log.getLogNumber().
    static byte[]
    encodeComponent(long value)
    Encodes a non-negative integer as a single OID component using base-128 with continuation bits, as defined for RELATIVE-OID contents in Section 8.20 of X.690.
    static byte[]
    fromDottedDecimal(String dotted)
    Converts a dotted-decimal trust anchor ID (e.g.
    static org.bouncycastle.asn1.x500.X500Name
    issuerName(String caTrustAnchorIdDotted)
    Builds the issuer X500Name for a Merkle Tree certificate, using the experimental id_rdna_trustAnchorID attribute with a UTF8String value of the CA's dotted-decimal trust anchor ID (Section 5.1 of draft-ietf-plants-merkle-tree-certs).
    static byte[]
    landmarkGroupId(byte[] caId, long logNumber, long landmarkNumber)
    Builds the binary trust anchor ID of a landmark group (Section 8.2.1).
    static byte[]
    landmarkId(byte[] caId, long logNumber, long landmarkNumber)
    Builds the binary trust anchor ID of a landmark (Section 8.2).
    static byte[]
    logId(byte[] caId, long logNumber)
    Builds the binary trust anchor ID of an issuance log.
    static String
    toDottedDecimal(byte[] binaryId)
    Converts a binary trust anchor ID into the dotted-decimal form used in ASCII representations (e.g. for the issuer field UTF8String value and inside CosignedMessage cosigner_name / log_origin).

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • LOGS_ARC

      public static final int LOGS_ARC
      OID component for the logs arc.
      See Also:

    • LANDMARKS_ARC

      public static final int LANDMARKS_ARC
      OID component for the landmarks arc (per-landmark IDs, Section 8.2).
      See Also:

    • LANDMARK_GROUPS_ARC

      public static final int LANDMARK_GROUPS_ARC
      OID component for the landmark-groups arc (Section 8.2.1).
      See Also:

    • MAX_ID_LENGTH

      public static final int MAX_ID_LENGTH
      Maximum length, in bytes, of a trust anchor ID's binary representation. A trust anchor ID is transmitted as opaque TrustAnchorID<1..2^8-1> (Section 4.1 of draft-ietf-tls-trust-anchor-ids) and Section 3 states its binary representation "MUST NOT exceed 255 bytes", so a valid trust anchor ID is 1..255 bytes.
      See Also:

  • Method Details

    • logId

      public static byte[] logId(byte[] caId, long logNumber)
      Builds the binary trust anchor ID of an issuance log.
      Parameters:
      caId - binary trust anchor ID of the CA
      logNumber - log number (1 <= logNumber <= 2^16-1, Section 5.2)

    • certSerial

      public static BigInteger certSerial(long logNumber, long index)
      Composes the 64-bit certificate serial number per Section 6.1 of draft-ietf-plants-merkle-tree-certs: 
          serial = (log_number << 48) | index
      The validator decodes the same encoding in MerkleTreeCertificateValidator.validateCertificate(X509CertificateHolder, MerkleTreeCertificateValidator.ValidationParams); this method is the issuer-side counterpart.
      Parameters:
      logNumber - log number (1 <= logNumber <= 2^16-1, Section 5.2)
      index - entry index in the log (0 <= index <= 2^48-1)

    • certSerial

      public static BigInteger certSerial(MTCLog log, long index)
      Equivalent to certSerial(long, long) with the log number taken from log.getLogNumber().

    • landmarkId

      public static byte[] landmarkId(byte[] caId, long logNumber, long landmarkNumber)
      Builds the binary trust anchor ID of a landmark (Section 8.2). Section 5.1 allocates these OIDs for positive landmark numbers only — landmark 0 always has tree size zero and no landmark subtrees, so it never needs an ID.
      Parameters:
      caId - binary trust anchor ID of the CA
      logNumber - log number
      landmarkNumber - landmark number (landmarkNumber >= 1)

    • landmarkGroupId

      public static byte[] landmarkGroupId(byte[] caId, long logNumber, long landmarkNumber)
      Builds the binary trust anchor ID of a landmark group (Section 8.2.1). As with landmarkId(byte[], long, long), Section 5.1 allocates these OIDs for positive landmark numbers only.
      Parameters:
      caId - binary trust anchor ID of the CA
      logNumber - log number
      landmarkNumber - landmark number that names the group's high end (landmarkNumber >= 1)

    • issuerName

      public static org.bouncycastle.asn1.x500.X500Name issuerName(String caTrustAnchorIdDotted)
      Builds the issuer X500Name for a Merkle Tree certificate, using the experimental id_rdna_trustAnchorID attribute with a UTF8String value of the CA's dotted-decimal trust anchor ID (Section 5.1 of draft-ietf-plants-merkle-tree-certs). The validator concatenates this with the cert serial's log_number to recover the issuance log's full trust anchor ID.

      For the production encoding the attribute value is a RELATIVE-OID rather than a UTF8String; both are accepted on the verifier side by MerkleTreeCertificateValidator.extractCaIdFromIssuer(X500Name).

      Parameters:
      caTrustAnchorIdDotted - dotted-decimal form of the CA's trust anchor ID (e.g. "32473.1")

    • toDottedDecimal

      public static String toDottedDecimal(byte[] binaryId)
      Converts a binary trust anchor ID into the dotted-decimal form used in ASCII representations (e.g. for the issuer field UTF8String value and inside CosignedMessage cosigner_name / log_origin).

    • fromDottedDecimal

      public static byte[] fromDottedDecimal(String dotted)
      Converts a dotted-decimal trust anchor ID (e.g. "32473.1.0.1") into its binary form: the base-128 encoded OID-component bytes with no ASN.1 tag or length prefix (Section 3 of draft-ietf-tls-trust-anchor-ids).

    • encodeComponent

      public static byte[] encodeComponent(long value)
      Encodes a non-negative integer as a single OID component using base-128 with continuation bits, as defined for RELATIVE-OID contents in Section 8.20 of X.690.