Class TlsUniqueAttributeUtil

java.lang.Object

org.bouncycastle.est.TlsUniqueAttributeUtil

public class TlsUniqueAttributeUtil
extends Object

Helper for emitting the EST transport-identity-linking attribute (RFC 7030 §3.5) into a PKCS#10 certification request, with RFC 7894-aware selection of the attribute type.

RFC 7030 §3.5 originally tunnelled the tls-unique value through the overloaded PKCS#9 challengePassword attribute. RFC 7894 §3.3 introduced id-aa-estIdentityLinking as the unambiguous attribute for the same purpose. Per RFC 7894 §4, clients that see estIdentityLinking in the server's CSR-Attributes response SHOULD prefer it and SHOULD NOT also include challengePassword; clients that do not have a response (or whose response does not advertise it) should continue to use the legacy attribute for compatibility.

Method Summary

Modifier and Type	Method	Description
static void	setTlsUniqueAttribute(PKCS10CertificationRequestBuilder builder, byte[] tlsUnique, CSRAttributesResponse csrAttrs)	Set the EST transport-identity-linking attribute on builder from the supplied tls-unique channel-binding value.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

setTlsUniqueAttribute

public static void setTlsUniqueAttribute(PKCS10CertificationRequestBuilder builder,
 byte[] tlsUnique,
 CSRAttributesResponse csrAttrs)

Set the EST transport-identity-linking attribute on builder from the supplied tls-unique channel-binding value. The attribute type is chosen per RFC 7894 §4:

• If csrAttrs is non-null and advertises PKCSObjectIdentifiers.id_aa_estIdentityLinking, the value goes into an id-aa-estIdentityLinking attribute (preferred).
• Otherwise the value goes into the legacy PKCSObjectIdentifiers.pkcs_9_at_challengePassword attribute for compatibility with pre-RFC-7894 servers.

In both cases the value carried is the Base64 encoding of tlsUnique.

Parameters:

builder - the PKCS#10 request builder being assembled.

tlsUnique - the raw tls-unique bytes (RFC 5929) for the current TLS session.

csrAttrs - the CSR-Attributes response previously fetched from the server, or null if none is available.