Skip to content

Commit c0b1d73

Browse files
peterdettmanpeterdettman
committed
Refactoring in TSP
1 parent f8cd3f3 commit c0b1d73

File tree

5 files changed

+144
-190
lines changed

5 files changed

+144
-190
lines changed

‎pkix/src/main/java/org/bouncycastle/tsp/TimeStampRequestGenerator.java‎

Lines changed: 50 additions & 92 deletions
Original file line numberDiff line numberDiff line change
@@ -13,57 +13,70 @@
1313
import org.bouncycastle.asn1.x509.Extensions;
1414
import org.bouncycastle.asn1.x509.ExtensionsGenerator;
1515
import org.bouncycastle.operator.DefaultDigestAlgorithmIdentifierFinder;
16+
import org.bouncycastle.operator.DigestAlgorithmIdentifierFinder;
1617

1718
/**
1819
* Generator for RFC 3161 Time Stamp Request objects.
1920
*/
2021
public class TimeStampRequestGenerator
2122
{
22-
private static final DefaultDigestAlgorithmIdentifierFinder dgstAlgFinder = new DefaultDigestAlgorithmIdentifierFinder();
23+
private static final DefaultDigestAlgorithmIdentifierFinder DEFAULT_DIGEST_ALG_FINDER =
24+
new DefaultDigestAlgorithmIdentifierFinder();
2325

24-
private ASN1ObjectIdentifier reqPolicy;
26+
private final ExtensionsGenerator extGenerator = new ExtensionsGenerator();
27+
28+
private final DigestAlgorithmIdentifierFinder digestAlgFinder;
2529

30+
private ASN1ObjectIdentifier reqPolicy;
2631
private ASN1Boolean certReq;
27-
private ExtensionsGenerator extGenerator = new ExtensionsGenerator();
2832

2933
public TimeStampRequestGenerator()
3034
{
35+
this(DEFAULT_DIGEST_ALG_FINDER);
36+
}
37+
38+
public TimeStampRequestGenerator(DigestAlgorithmIdentifierFinder digestAlgFinder)
39+
{
40+
if (digestAlgFinder == null)
41+
{
42+
throw new NullPointerException("'digestAlgFinder' cannot be null");
43+
}
44+
45+
this.digestAlgFinder = digestAlgFinder;
3146
}
3247

48+
public void setReqPolicy(ASN1ObjectIdentifier reqPolicy)
49+
{
50+
this.reqPolicy = reqPolicy;
51+
}
52+
3353
/**
3454
* @deprecated use method taking ASN1ObjectIdentifier
3555
* @param reqPolicy
3656
*/
37-
public void setReqPolicy(
38-
String reqPolicy)
57+
public void setReqPolicy(String reqPolicy)
3958
{
40-
this.reqPolicy= new ASN1ObjectIdentifier(reqPolicy);
59+
setReqPolicy(new ASN1ObjectIdentifier(reqPolicy));
4160
}
4261

43-
public void setReqPolicy(
44-
ASN1ObjectIdentifier reqPolicy)
62+
public void setCertReq(ASN1Boolean certReq)
4563
{
46-
this.reqPolicy= reqPolicy;
64+
this.certReq = certReq;
4765
}
4866

49-
public void setCertReq(
50-
boolean certReq)
67+
public void setCertReq(boolean certReq)
5168
{
52-
this.certReq = ASN1Boolean.getInstance(certReq);
69+
setCertReq(ASN1Boolean.getInstance(certReq));
5370
}
5471

5572
/**
5673
* add a given extension field for the standard extensions tag (tag 3)
5774
* @throws IOException
5875
* @deprecated use method taking ASN1ObjectIdentifier
5976
*/
60-
public void addExtension(
61-
String OID,
62-
boolean critical,
63-
ASN1Encodable value)
64-
throws IOException
77+
public void addExtension(String OID, boolean critical, ASN1Encodable value) throws IOException
6578
{
66-
this.addExtension(OID, critical, value.toASN1Primitive().getEncoded());
79+
addExtension(new ASN1ObjectIdentifier(OID), critical, value);
6780
}
6881

6982
/**
@@ -72,23 +85,16 @@ public void addExtension(
7285
* with the extension.
7386
* @deprecated use method taking ASN1ObjectIdentifier
7487
*/
75-
public void addExtension(
76-
String OID,
77-
boolean critical,
78-
byte[] value)
88+
public void addExtension(String OID, boolean critical, byte[] value)
7989
{
80-
extGenerator.addExtension(new ASN1ObjectIdentifier(OID), critical, value);
90+
addExtension(new ASN1ObjectIdentifier(OID), critical, value);
8191
}
8292

8393
/**
8494
* add a given extension field for the standard extensions tag (tag 3)
8595
* @throws TSPIOException
8696
*/
87-
public void addExtension(
88-
ASN1ObjectIdentifier oid,
89-
boolean isCritical,
90-
ASN1Encodable value)
91-
throws TSPIOException
97+
public void addExtension(ASN1ObjectIdentifier oid, boolean isCritical, ASN1Encodable value) throws TSPIOException
9298
{
9399
TSPUtil.addExtension(extGenerator, oid, isCritical, value);
94100
}
@@ -98,106 +104,58 @@ public void addExtension(
98104
* The value parameter becomes the contents of the octet string associated
99105
* with the extension.
100106
*/
101-
public void addExtension(
102-
ASN1ObjectIdentifier oid,
103-
boolean isCritical,
104-
byte[] value)
107+
public void addExtension(ASN1ObjectIdentifier oid, boolean isCritical, byte[] value)
105108
{
106109
extGenerator.addExtension(oid, isCritical, value);
107110
}
108111

109112
/**
110-
* @deprecated use method taking ANS1ObjectIdentifier
113+
* @deprecated use method taking ANS1ObjectIdentifier or AlgorithmIdentifier
111114
*/
112-
public TimeStampRequest generate(
113-
String digestAlgorithm,
114-
byte[] digest)
115+
public TimeStampRequest generate(String digestAlgorithm, byte[] digest)
115116
{
116-
return this.generate(digestAlgorithm, digest, null);
117+
return generate(digestAlgorithm, digest, null);
117118
}
118119

119120
/**
120-
* @deprecated use method taking ANS1ObjectIdentifier
121+
* @deprecated use method taking ANS1ObjectIdentifier or AlgorithmIdentifier
121122
*/
122-
public TimeStampRequest generate(
123-
String digestAlgorithmOID,
124-
byte[] digest,
125-
BigInteger nonce)
123+
public TimeStampRequest generate(String digestAlgorithmOID, byte[] digest, BigInteger nonce)
126124
{
127125
if (digestAlgorithmOID == null)
128126
{
129-
throw new IllegalArgumentException("No digest algorithm specified");
127+
throw new NullPointerException("'digestAlgorithmOID' cannot be null");
130128
}
131129

132-
ASN1ObjectIdentifier digestAlgOID = new ASN1ObjectIdentifier(digestAlgorithmOID);
133-
134-
AlgorithmIdentifier algID = dgstAlgFinder.find(digestAlgOID);
135-
MessageImprint messageImprint = new MessageImprint(algID, digest);
136-
137-
Extensions ext = null;
138-
139-
if (!extGenerator.isEmpty())
140-
{
141-
ext = extGenerator.generate();
142-
}
143-
144-
if (nonce != null)
145-
{
146-
return new TimeStampRequest(new TimeStampReq(messageImprint,
147-
reqPolicy, new ASN1Integer(nonce), certReq, ext));
148-
}
149-
else
150-
{
151-
return new TimeStampRequest(new TimeStampReq(messageImprint,
152-
reqPolicy, null, certReq, ext));
153-
}
130+
return generate(new ASN1ObjectIdentifier(digestAlgorithmOID), digest, nonce);
154131
}
155132

156133
public TimeStampRequest generate(ASN1ObjectIdentifier digestAlgorithm, byte[] digest)
157134
{
158-
return generate(dgstAlgFinder.find(digestAlgorithm), digest);
135+
return generate(digestAlgorithm, digest, null);
159136
}
160137

161138
public TimeStampRequest generate(ASN1ObjectIdentifier digestAlgorithm, byte[] digest, BigInteger nonce)
162139
{
163-
return generate(dgstAlgFinder.find(digestAlgorithm), digest, nonce);
140+
return generate(digestAlgFinder.find(digestAlgorithm), digest, nonce);
164141
}
165142

166-
public TimeStampRequest generate(
167-
AlgorithmIdentifier digestAlgorithmID,
168-
byte[] digest)
143+
public TimeStampRequest generate(AlgorithmIdentifier digestAlgorithmID, byte[] digest)
169144
{
170145
return generate(digestAlgorithmID, digest, null);
171146
}
172147

173-
public TimeStampRequest generate(
174-
AlgorithmIdentifier digestAlgorithmID,
175-
byte[] digest,
176-
BigInteger nonce)
148+
public TimeStampRequest generate(AlgorithmIdentifier digestAlgorithmID, byte[] digest, BigInteger nonce)
177149
{
178150
if (digestAlgorithmID == null)
179151
{
180-
throw new IllegalArgumentException("digest algorithm not specified");
152+
throw new NullPointerException("'digestAlgorithmID' cannot be null");
181153
}
182154

183155
MessageImprint messageImprint = new MessageImprint(digestAlgorithmID, digest);
156+
ASN1Integer reqNonce = nonce == null ? null : new ASN1Integer(nonce);
157+
Extensions ext = extGenerator.isEmpty() ? null : extGenerator.generate();
184158

185-
Extensions ext = null;
186-
187-
if (!extGenerator.isEmpty())
188-
{
189-
ext = extGenerator.generate();
190-
}
191-
192-
if (nonce != null)
193-
{
194-
return new TimeStampRequest(new TimeStampReq(messageImprint,
195-
reqPolicy, new ASN1Integer(nonce), certReq, ext));
196-
}
197-
else
198-
{
199-
return new TimeStampRequest(new TimeStampReq(messageImprint,
200-
reqPolicy, null, certReq, ext));
201-
}
159+
return new TimeStampRequest(new TimeStampReq(messageImprint, reqPolicy, reqNonce, certReq, ext));
202160
}
203161
}

‎pkix/src/main/java/org/bouncycastle/tsp/TimeStampToken.java‎

Lines changed: 14 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -6,20 +6,17 @@
66
import java.util.Collection;
77

88
import org.bouncycastle.asn1.ASN1Encoding;
9-
import org.bouncycastle.asn1.ASN1Primitive;
109
import org.bouncycastle.asn1.cms.Attribute;
1110
import org.bouncycastle.asn1.cms.AttributeTable;
1211
import org.bouncycastle.asn1.cms.ContentInfo;
13-
import org.bouncycastle.asn1.cms.IssuerAndSerialNumber;
1412
import org.bouncycastle.asn1.ess.ESSCertID;
1513
import org.bouncycastle.asn1.ess.ESSCertIDv2;
1614
import org.bouncycastle.asn1.ess.SigningCertificate;
1715
import org.bouncycastle.asn1.ess.SigningCertificateV2;
18-
import org.bouncycastle.asn1.oiw.OIWObjectIdentifiers;
1916
import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
2017
import org.bouncycastle.asn1.tsp.TSTInfo;
2118
import org.bouncycastle.asn1.x500.X500Name;
22-
import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
19+
import org.bouncycastle.asn1.x509.Certificate;
2320
import org.bouncycastle.asn1.x509.GeneralName;
2421
import org.bouncycastle.asn1.x509.IssuerSerial;
2522
import org.bouncycastle.cert.X509AttributeCertificateHolder;
@@ -47,7 +44,7 @@ public class TimeStampToken
4744

4845
TimeStampTokenInfo tstInfo;
4946

50-
CertID certID;
47+
ESSCertIDv2 certID;
5148

5249
public TimeStampToken(ContentInfo contentInfo)
5350
throws TSPException, IOException
@@ -96,15 +93,15 @@ public TimeStampToken(CMSSignedData signedData)
9693

9794
content.write(bOut);
9895

99-
this.tstInfo = new TimeStampTokenInfo(TSTInfo.getInstance(ASN1Primitive.fromByteArray(bOut.toByteArray())));
100-
96+
this.tstInfo = new TimeStampTokenInfo(TSTInfo.getInstance(bOut.toByteArray()));
97+
10198
Attribute attr = tsaSignerInfo.getSignedAttributes().get(PKCSObjectIdentifiers.id_aa_signingCertificate);
10299

103100
if (attr != null)
104101
{
105102
SigningCertificate signCert = SigningCertificate.getInstance(attr.getAttrValues().getObjectAt(0));
106103

107-
this.certID = new CertID(ESSCertID.getInstance(signCert.getCerts()[0]));
104+
this.certID = ESSCertIDv2.from(ESSCertID.getInstance(signCert.getCerts()[0]));
108105
}
109106
else
110107
{
@@ -117,7 +114,7 @@ public TimeStampToken(CMSSignedData signedData)
117114

118115
SigningCertificateV2 signCertV2 = SigningCertificateV2.getInstance(attr.getAttrValues().getObjectAt(0));
119116

120-
this.certID = new CertID(ESSCertIDv2.getInstance(signCertV2.getCerts()[0]));
117+
this.certID = ESSCertIDv2.getInstance(signCertV2.getCerts()[0]);
121118
}
122119
}
123120
catch (CMSException e)
@@ -195,7 +192,6 @@ public void validate(
195192
DigestCalculator calc = sigVerifier.getDigestCalculator(certID.getHashAlgorithm());
196193

197194
OutputStream cOut = calc.getOutputStream();
198-
199195
cOut.write(certHolder.getEncoded());
200196
cOut.close();
201197

@@ -204,21 +200,23 @@ public void validate(
204200
throw new TSPValidationException("certificate hash does not match certID hash.");
205201
}
206202

207-
if (certID.getIssuerSerial() != null)
203+
IssuerSerial issuerSerial = certID.getIssuerSerial();
204+
if (issuerSerial != null)
208205
{
209-
IssuerAndSerialNumber issuerSerial = new IssuerAndSerialNumber(certHolder.toASN1Structure());
206+
Certificate c = certHolder.toASN1Structure();
210207

211-
if (!certID.getIssuerSerial().getSerial().equals(issuerSerial.getSerialNumber()))
208+
if (!issuerSerial.getSerial().equals(c.getSerialNumber()))
212209
{
213210
throw new TSPValidationException("certificate serial number does not match certID for signature.");
214211
}
215212

216-
GeneralName[] names = certID.getIssuerSerial().getIssuer().getNames();
217-
boolean found = false;
213+
GeneralName[] names = issuerSerial.getIssuer().getNames();
214+
boolean found = false;
218215

219216
for (int i = 0; i != names.length; i++)
220217
{
221-
if (names[i].getTagNo() == 4 && X500Name.getInstance(names[i].getName()).equals(X500Name.getInstance(issuerSerial.getName())))
218+
if (names[i].getTagNo() == GeneralName.directoryName &&
219+
X500Name.getInstance(names[i].getName()).equals(c.getIssuer()))
222220
{
223221
found = true;
224222
break;
@@ -326,59 +324,4 @@ public byte[] getEncoded(String encoding)
326324
{
327325
return tsToken.getEncoded(encoding);
328326
}
329-
330-
// perhaps this should be done using an interface on the ASN.1 classes...
331-
private static class CertID
332-
{
333-
private ESSCertID certID;
334-
private ESSCertIDv2 certIDv2;
335-
336-
CertID(ESSCertID certID)
337-
{
338-
this.certID = certID;
339-
this.certIDv2 = null;
340-
}
341-
342-
CertID(ESSCertIDv2 certID)
343-
{
344-
this.certIDv2 = certID;
345-
this.certID = null;
346-
}
347-
348-
public AlgorithmIdentifier getHashAlgorithm()
349-
{
350-
if (certID != null)
351-
{
352-
return new AlgorithmIdentifier(OIWObjectIdentifiers.idSHA1);
353-
}
354-
else
355-
{
356-
return certIDv2.getHashAlgorithm();
357-
}
358-
}
359-
360-
public byte[] getCertHash()
361-
{
362-
if (certID != null)
363-
{
364-
return certID.getCertHash();
365-
}
366-
else
367-
{
368-
return certIDv2.getCertHash();
369-
}
370-
}
371-
372-
public IssuerSerial getIssuerSerial()
373-
{
374-
if (certID != null)
375-
{
376-
return certID.getIssuerSerial();
377-
}
378-
else
379-
{
380-
return certIDv2.getIssuerSerial();
381-
}
382-
}
383-
}
384327
}

0 commit comments

Comments
 (0)