From 0ffb4257258df236dc469ef086b1871fe7b5afba Mon Sep 17 00:00:00 2001 From: lloyd Date: Wed, 8 Oct 2008 20:40:40 +0000 Subject: Many improvements towards getting the CVC implementation from InSiTo compiling against mainline. Add several missing classes extracted from other files inside InSiTo. Add dependency note for ecdsa and asn1 --- src/cert/cvc/asn1_eac_str.cpp | 128 ++++++++++++ src/cert/cvc/asn1_eac_tm.cpp | 375 +++++++++++++++++++++++++++++++++ src/cert/cvc/cvc_ado.cpp | 246 +++++++++++----------- src/cert/cvc/cvc_ado.h | 3 +- src/cert/cvc/cvc_ca.cpp | 66 +++--- src/cert/cvc/cvc_ca.h | 30 +-- src/cert/cvc/cvc_cert.cpp | 176 ++++++++-------- src/cert/cvc/cvc_gen_cert.h | 14 +- src/cert/cvc/cvc_req.cpp | 98 ++++----- src/cert/cvc/cvc_self.cpp | 467 +++++++++++++++++++++--------------------- src/cert/cvc/cvc_self.h | 235 +++++++++++---------- src/cert/cvc/eac_asn_obj.h | 128 ++++++++++++ src/cert/cvc/eac_obj.h | 11 +- src/cert/cvc/info.txt | 9 +- src/cert/cvc/signed_obj.cpp | 64 ++++++ src/cert/cvc/signed_obj.h | 58 ++++++ 16 files changed, 1446 insertions(+), 662 deletions(-) create mode 100644 src/cert/cvc/asn1_eac_str.cpp create mode 100644 src/cert/cvc/asn1_eac_tm.cpp create mode 100644 src/cert/cvc/eac_asn_obj.h create mode 100644 src/cert/cvc/signed_obj.cpp create mode 100644 src/cert/cvc/signed_obj.h diff --git a/src/cert/cvc/asn1_eac_str.cpp b/src/cert/cvc/asn1_eac_str.cpp new file mode 100644 index 000000000..b367df394 --- /dev/null +++ b/src/cert/cvc/asn1_eac_str.cpp @@ -0,0 +1,128 @@ +/************************************************* +* Simple ASN.1 String Types Source File * +* (C) 2007 FlexSecure GmbH * +* 2008 Jack Lloyd * +*************************************************/ + +#include +#include +#include +#include +#include +#include + +namespace Botan { + +/************************************************* +* Create an ASN1_EAC_String * +*************************************************/ +ASN1_EAC_String::ASN1_EAC_String(const std::string& str, ASN1_Tag t) : tag(t) + { + iso_8859_str = Charset::transcode(str, LOCAL_CHARSET, LATIN1_CHARSET); + if (!sanity_check()) + { + throw Invalid_Argument("attempted to construct ASN1_EAC_String with illegal characters"); + } + } + +/************************************************* +* Return this string in ISO 8859-1 encoding * +*************************************************/ +std::string ASN1_EAC_String::iso_8859() const + { + return iso_8859_str; + } + +/************************************************* +* Return this string in local encoding * +*************************************************/ +std::string ASN1_EAC_String::value() const + { + return Charset::transcode(iso_8859_str, LATIN1_CHARSET, LOCAL_CHARSET); + } + +/************************************************* +* Return the type of this string object * +*************************************************/ +ASN1_Tag ASN1_EAC_String::tagging() const + { + return tag; + } + +/************************************************* +* DER encode an ASN1_EAC_String * +*************************************************/ +void ASN1_EAC_String::encode_into(DER_Encoder& encoder) const + { + std::string value = iso_8859(); + encoder.add_object(tagging(), APPLICATION, value); + } + +/************************************************* +* Decode a BER encoded ASN1_EAC_String * +*************************************************/ +void ASN1_EAC_String::decode_from(BER_Decoder& source) + { + BER_Object obj = source.get_next_object(); + if (obj.type_tag != this->tag) + { + + std::string message("decoding type mismatch for ASN1_EAC_String, tag is "); + std::stringstream ss; + std::string str_is; + ss << std::hex << obj.type_tag; + ss >> str_is; + message.append(str_is); + message.append(", while it should be "); + std::stringstream ss2; + std::string str_should; + ss2 << std::hex << this->tag; + ss2 >> str_should; + message.append(str_should); + throw Decoding_Error(message); + } + Character_Set charset_is; + charset_is = LATIN1_CHARSET; + + try + { + *this = ASN1_EAC_String( + Charset::transcode(ASN1::to_string(obj), charset_is, LOCAL_CHARSET), + obj.type_tag); + } + catch (Invalid_Argument inv_arg) + { + throw Decoding_Error(std::string("error while decoding ASN1_EAC_String: ") + std::string(inv_arg.what())); + } + } + +// checks for compliance to the alphabet defined in TR-03110 v1.10, 2007-08-20 +// p. 43 +bool ASN1_EAC_String::sanity_check() const + { + const byte* rep = reinterpret_cast(iso_8859_str.data()); + const u32bit rep_len = iso_8859_str.size(); + for (u32bit i=0; i= 0x7F) && (rep[i] < 0xA0))) + { + return false; + } + } + return true; + } + +bool operator==(const ASN1_EAC_String& lhs, const ASN1_EAC_String& rhs) + { + return (lhs.iso_8859() == rhs.iso_8859()); + } + +ASN1_Car::ASN1_Car(std::string const& str) + : ASN1_EAC_String(str, ASN1_Tag(2)) + {} + +ASN1_Chr::ASN1_Chr(std::string const& str) + : ASN1_EAC_String(str, ASN1_Tag(32)) + {} + +} diff --git a/src/cert/cvc/asn1_eac_tm.cpp b/src/cert/cvc/asn1_eac_tm.cpp new file mode 100644 index 000000000..81c99f190 --- /dev/null +++ b/src/cert/cvc/asn1_eac_tm.cpp @@ -0,0 +1,375 @@ +/************************************************* +* EAC Time Types Source File * +* (C) 2007 FlexSecure GmbH * +* 2008 Jack Lloyd * +*************************************************/ + +#include +#include +#include +#include +#include +#include +#include + +namespace Botan { + +namespace { + +/************************************************* +* Convert a time_t to a struct tm * +*************************************************/ +std::tm get_tm(u64bit timer) + { + std::time_t time_val = static_cast(timer); + + std::tm* tm_p = std::gmtime(&time_val); + if (tm_p == 0) + throw Encoding_Error("EAC_Time: gmtime could not encode " + + to_string(timer)); + return (*tm_p); + } +SecureVector enc_two_digit(u32bit in) + { + SecureVector result; + in %= 100; + if (in < 10) + { + result.append(0x00); + } + else + { + u32bit y_first_pos = (in - (in%10))/10; + result.append(static_cast(y_first_pos)); + } + u32bit y_sec_pos = in%10; + result.append(static_cast(y_sec_pos)); + return result; + } +u32bit dec_two_digit(byte b1, byte b2) + { + u32bit upper = (u32bit)b1; + u32bit lower = (u32bit)b2; + if (upper > 9 || lower > 9) + { + throw Invalid_Argument("u32bit dec_two_digit(byte b1, byte b2): value too large"); + } + return upper*10 + lower; + + } +} + +/************************************************* +* Create an EAC_Time * +*************************************************/ +EAC_Time::EAC_Time(u64bit timer, ASN1_Tag t) + :tag(t) + { + std::tm time_info = get_tm(timer); + + year = time_info.tm_year + 1900; + month = time_info.tm_mon + 1; + day = time_info.tm_mday; + + } + +/************************************************* +* Create an EAC_Time * +*************************************************/ +EAC_Time::EAC_Time(const std::string& t_spec, ASN1_Tag t) + :tag(t) + { + set_to(t_spec); + } +/************************************************* +* Create an EAC_Time * +*************************************************/ +EAC_Time::EAC_Time(u32bit y, u32bit m, u32bit d, ASN1_Tag t) + : year(y), + month(m), + day(d), + tag(t) + { + } + +/************************************************* +* Set the time with a human readable string * +*************************************************/ +void EAC_Time::set_to(const std::string& time_str) + { + if (time_str == "") + { + year = month = day = 0; + return; + } + + std::vector params; + std::string current; + + for (u32bit j = 0; j != time_str.size(); ++j) + { + if (Charset::is_digit(time_str[j])) + current += time_str[j]; + else + { + if (current != "") + params.push_back(current); + current.clear(); + } + } + if (current != "") + params.push_back(current); + + if (params.size() != 3) + throw Invalid_Argument("Invalid time specification " + time_str); + + year = to_u32bit(params[0]); + month = to_u32bit(params[1]); + day = to_u32bit(params[2]); + + if (!passes_sanity_check()) + throw Invalid_Argument("Invalid time specification " + time_str); + } + + +/************************************************* +* DER encode a EAC_Time * +*************************************************/ +void EAC_Time::encode_into(DER_Encoder& der) const + { + der.add_object(tag, APPLICATION, + encoded_eac_time()); + } + +/************************************************* +* Return a string representation of the time * +*************************************************/ +std::string EAC_Time::as_string() const + { + if (time_is_set() == false) + throw Invalid_State("EAC_Time::as_string: No time set"); + + std::string asn1rep; + asn1rep = to_string(year, 2); + + asn1rep += to_string(month, 2) + to_string(day, 2); + + return asn1rep; + } + +/************************************************* +* Return if the time has been set somehow * +*************************************************/ +bool EAC_Time::time_is_set() const + { + return (year != 0); + } + +/************************************************* +* Return a human readable string representation * +*************************************************/ +std::string EAC_Time::readable_string() const + { + if (time_is_set() == false) + throw Invalid_State("EAC_Time::readable_string: No time set"); + + std::string readable; + readable += to_string(year, 2) + "/"; + readable += to_string(month, 2) + "/"; + readable += to_string(day, 2) + " "; + + return readable; + } + +/************************************************* +* Do a general sanity check on the time * +*************************************************/ +bool EAC_Time::passes_sanity_check() const + { + if (year < 2000 || year > 2099) + return false; + if (month == 0 || month > 12) + return false; + if (day == 0 || day > 31) + return false; + + return true; + } + +/****************************************** +* modification functions * +******************************************/ + +void EAC_Time::add_years(u32bit years) + { + year += years; + } +void EAC_Time::add_months(u32bit months) + { + year += months/12; + month += months % 12; + if(month > 12) + { + year += 1; + month -= 12; + } + } + + +/************************************************* +* Compare this time against another * +*************************************************/ +s32bit EAC_Time::cmp(const EAC_Time& other) const + { + if (time_is_set() == false) + throw Invalid_State("EAC_Time::cmp: No time set"); + + const s32bit EARLIER = -1, LATER = 1, SAME_TIME = 0; + + if (year < other.year) return EARLIER; + if (year > other.year) return LATER; + if (month < other.month) return EARLIER; + if (month > other.month) return LATER; + if (day < other.day) return EARLIER; + if (day > other.day) return LATER; + + return SAME_TIME; + } + +/************************************************* +* Compare two EAC_Times for in various ways * +*************************************************/ +bool operator==(const EAC_Time& t1, const EAC_Time& t2) + { + return (t1.cmp(t2) == 0); + } +bool operator!=(const EAC_Time& t1, const EAC_Time& t2) + { + return (t1.cmp(t2) != 0); + } +bool operator<=(const EAC_Time& t1, const EAC_Time& t2) + { + return (t1.cmp(t2) <= 0); + } +bool operator>=(const EAC_Time& t1, const EAC_Time& t2) + { + return (t1.cmp(t2) >= 0); + } +bool operator>(const EAC_Time& t1, const EAC_Time& t2) + { + return (t1.cmp(t2) > 0); + } +bool operator<(const EAC_Time& t1, const EAC_Time& t2) + { + return (t1.cmp(t2) < 0); + } + +/************************************************* +* Do a validity check * +*************************************************/ +s32bit validity_check(const EAC_Time& start, const EAC_Time& end, + u64bit current_time) + { + + const s32bit NOT_YET_VALID = -1, VALID_TIME = 0, EXPIRED = 1; + + if (start.cmp(current_time) > 0) + return NOT_YET_VALID; + if (end.cmp(current_time) < 0) + return EXPIRED; + return VALID_TIME; + } + +/************************************************* +* Decode a BER encoded EAC_Time * +*************************************************/ +void EAC_Time::decode_from(BER_Decoder& source) + { + BER_Object obj = source.get_next_object(); + if (obj.type_tag != this->tag) + { + std::string message("decoding type mismatch for EAC_Time, tag is "); + std::stringstream ss; + std::string str_is; + ss << std::hex << obj.type_tag; + ss >> str_is; + message.append(str_is); + message.append(", while it should be "); + std::stringstream ss2; + std::string str_should; + ss2 << std::hex << this->tag; + ss2 >> str_should; + message.append(str_should); + throw Decoding_Error(message); + + } + if (obj.value.size() != 6) + { + throw Decoding_Error("EAC_Time decoding failed"); + } + try + { + u32bit tmp_year = dec_two_digit(obj.value[0], obj.value[1]); + u32bit tmp_mon = dec_two_digit(obj.value[2], obj.value[3]); + u32bit tmp_day = dec_two_digit(obj.value[4], obj.value[5]); + year = tmp_year + 2000; + month = tmp_mon; + day = tmp_day; + } + catch (Invalid_Argument) + { + throw Decoding_Error("EAC_Time decoding failed"); + } + + } + +u32bit EAC_Time::get_year() const + { + return year; + } +u32bit EAC_Time::get_month() const + { + return month; + } +u32bit EAC_Time::get_day() const + { + return day; + } + +/************************************************* +* make the value an octet string for encoding * +*************************************************/ +SecureVector EAC_Time::encoded_eac_time() const + { + SecureVector result; + result.append(enc_two_digit(year)); + result.append(enc_two_digit(month)); + result.append(enc_two_digit(day)); + return result; + } + +ASN1_Ced::ASN1_Ced(std::string const& str) + : EAC_Time(str, ASN1_Tag(37)) + {} + +ASN1_Ced::ASN1_Ced(u64bit val) + : EAC_Time(val, ASN1_Tag(37)) + {} + +ASN1_Ced::ASN1_Ced(EAC_Time const& other) + : EAC_Time(other.get_year(), other.get_month(), other.get_day(), ASN1_Tag(37)) + {} + +ASN1_Cex::ASN1_Cex(std::string const& str) + : EAC_Time(str, ASN1_Tag(36)) + {} + +ASN1_Cex::ASN1_Cex(u64bit val) + : EAC_Time(val, ASN1_Tag(36)) + {} + +ASN1_Cex::ASN1_Cex(EAC_Time const& other) + : EAC_Time(other.get_year(), other.get_month(), other.get_day(), ASN1_Tag(36)) + {} + +} diff --git a/src/cert/cvc/cvc_ado.cpp b/src/cert/cvc/cvc_ado.cpp index d5083d3ab..6ea8d59c2 100644 --- a/src/cert/cvc/cvc_ado.cpp +++ b/src/cert/cvc/cvc_ado.cpp @@ -1,119 +1,133 @@ +/************************************************* +* CVC Certificate Constructor * +* (C) 2007 FlexSecure GmbH * +* 2008 Jack Lloyd * +*************************************************/ + #include #include #include -/************************************************* - * CVC Certificate Constructor * - *************************************************/ - -namespace Botan - { - EAC1_1_ADO::EAC1_1_ADO(std::tr1::shared_ptr in) - { - init(in); - do_decode(); - } - EAC1_1_ADO::EAC1_1_ADO(const std::string& in) - { - std::tr1::shared_ptr stream(new DataSource_Stream(in, true)); - init(stream); - do_decode(); - } - void EAC1_1_ADO::force_decode() - { - SecureVector inner_cert; - BER_Decoder(tbs_bits) - .start_cons(ASN1_Tag(33)) - .raw_bytes(inner_cert) - .end_cons() - .decode(m_car) - .verify_end(); - - SecureVector req_bits = DER_Encoder() - .start_cons(ASN1_Tag(33), APPLICATION) - .raw_bytes(inner_cert) - .end_cons() - .get_contents(); - - std::tr1::shared_ptr req_source(new DataSource_Memory(req_bits)); - m_req = EAC1_1_Req(req_source); - sig_algo = m_req.sig_algo; - } - - MemoryVector EAC1_1_ADO::make_signed( - std::auto_ptr signer, - const MemoryRegion& tbs_bits) - { - SecureVector concat_sig = EAC1_1_obj::make_signature(signer, tbs_bits); - assert(concat_sig.size() % 2 == 0); - MemoryVector result = DER_Encoder() - .start_cons(ASN1_Tag(7), APPLICATION) - .raw_bytes(tbs_bits) - .encode(concat_sig, OCTET_STRING, ASN1_Tag(55), APPLICATION) - .end_cons() - .get_contents(); - return result; - } - ASN1_Car EAC1_1_ADO::get_car() const - { - return m_car; - } - void EAC1_1_ADO::decode_info(SharedPtrConverter source, SecureVector & res_tbs_bits, ECDSA_Signature & res_sig) - { - SecureVector concat_sig; - SecureVector cert_inner_bits; - ASN1_Car car; - BER_Decoder(source.get_shared()) - .start_cons(ASN1_Tag(7)) - .start_cons(ASN1_Tag(33)) - .raw_bytes(cert_inner_bits) - .end_cons() - .decode(car) - .decode(concat_sig, OCTET_STRING, ASN1_Tag(55), APPLICATION) - .end_cons(); - - SecureVector enc_cert = DER_Encoder() - .start_cons(ASN1_Tag(33), APPLICATION) - .raw_bytes(cert_inner_bits) - .end_cons() - .get_contents(); - SecureVector enc_car = DER_Encoder() - .encode(car) - .get_contents(); - res_tbs_bits = enc_cert; - res_tbs_bits.append(enc_car); - res_sig = decode_concatenation(concat_sig); - - - } - void EAC1_1_ADO::encode(Pipe& out, X509_Encoding encoding) const - { - SecureVector concat_sig(EAC1_1_obj::m_sig.get_concatenation()); - SecureVector der = DER_Encoder() - .start_cons(ASN1_Tag(7), APPLICATION) - .raw_bytes(tbs_bits) - .encode(concat_sig, OCTET_STRING, ASN1_Tag(55), APPLICATION) - .end_cons() - .get_contents(); - if(encoding == PEM) - throw Invalid_Argument("EAC1_1_ADO::encode() cannot PEM encode an EAC object"); - else - out.write(der); - } - SecureVector EAC1_1_ADO::tbs_data() const - { - return tbs_bits; - } - - bool EAC1_1_ADO::operator==(EAC1_1_ADO const& rhs) const - { - assert(((this->m_req == rhs.m_req) && (this->tbs_data() == rhs.tbs_data())) || - ((this->m_req != rhs.m_req) && (this->tbs_data() != rhs.tbs_data()))); - return (this->get_concat_sig() == rhs.get_concat_sig() - && this->tbs_data() == rhs.tbs_data() - && this->get_car() == rhs.get_car()); - } - EAC1_1_Req EAC1_1_ADO::get_request() const - { - return m_req; - } -}//namespace botan + +namespace Botan { + +EAC1_1_ADO::EAC1_1_ADO(std::tr1::shared_ptr in) + { + init(in); + do_decode(); + } + +EAC1_1_ADO::EAC1_1_ADO(const std::string& in) + { + std::tr1::shared_ptr stream(new DataSource_Stream(in, true)); + init(stream); + do_decode(); + } + +void EAC1_1_ADO::force_decode() + { + SecureVector inner_cert; + BER_Decoder(tbs_bits) + .start_cons(ASN1_Tag(33)) + .raw_bytes(inner_cert) + .end_cons() + .decode(m_car) + .verify_end(); + + SecureVector req_bits = DER_Encoder() + .start_cons(ASN1_Tag(33), APPLICATION) + .raw_bytes(inner_cert) + .end_cons() + .get_contents(); + + std::tr1::shared_ptr req_source(new DataSource_Memory(req_bits)); + m_req = EAC1_1_Req(req_source); + sig_algo = m_req.sig_algo; + } + +MemoryVector EAC1_1_ADO::make_signed( + std::auto_ptr signer, + const MemoryRegion& tbs_bits, + RandomNumberGenerator& rng) + { + SecureVector concat_sig = + EAC1_1_obj::make_signature(signer.get(), tbs_bits, rng); + assert(concat_sig.size() % 2 == 0); + MemoryVector result = DER_Encoder() + .start_cons(ASN1_Tag(7), APPLICATION) + .raw_bytes(tbs_bits) + .encode(concat_sig, OCTET_STRING, ASN1_Tag(55), APPLICATION) + .end_cons() + .get_contents(); + return result; + } + +ASN1_Car EAC1_1_ADO::get_car() const + { + return m_car; + } + +void EAC1_1_ADO::decode_info(SharedPtrConverter source, + SecureVector & res_tbs_bits, + ECDSA_Signature & res_sig) + { + SecureVector concat_sig; + SecureVector cert_inner_bits; + ASN1_Car car; + BER_Decoder(*source.get_ptr().get()) + .start_cons(ASN1_Tag(7)) + .start_cons(ASN1_Tag(33)) + .raw_bytes(cert_inner_bits) + .end_cons() + .decode(car) + .decode(concat_sig, OCTET_STRING, ASN1_Tag(55), APPLICATION) + .end_cons(); + + SecureVector enc_cert = DER_Encoder() + .start_cons(ASN1_Tag(33), APPLICATION) + .raw_bytes(cert_inner_bits) + .end_cons() + .get_contents(); + SecureVector enc_car = DER_Encoder() + .encode(car) + .get_contents(); + res_tbs_bits = enc_cert; + res_tbs_bits.append(enc_car); + res_sig = decode_concatenation(concat_sig); + + + } +void EAC1_1_ADO::encode(Pipe& out, X509_Encoding encoding) const + { + SecureVector concat_sig(EAC1_1_obj::m_sig.get_concatenation()); + SecureVector der = DER_Encoder() + .start_cons(ASN1_Tag(7), APPLICATION) + .raw_bytes(tbs_bits) + .encode(concat_sig, OCTET_STRING, ASN1_Tag(55), APPLICATION) + .end_cons() + .get_contents(); + if(encoding == PEM) + throw Invalid_Argument("EAC1_1_ADO::encode() cannot PEM encode an EAC object"); + else + out.write(der); + } + +SecureVector EAC1_1_ADO::tbs_data() const + { + return tbs_bits; + } + +bool EAC1_1_ADO::operator==(EAC1_1_ADO const& rhs) const + { + assert(((this->m_req == rhs.m_req) && (this->tbs_data() == rhs.tbs_data())) || + ((this->m_req != rhs.m_req) && (this->tbs_data() != rhs.tbs_data()))); + return (this->get_concat_sig() == rhs.get_concat_sig() + && this->tbs_data() == rhs.tbs_data() + && this->get_car() == rhs.get_car()); + } + +EAC1_1_Req EAC1_1_ADO::get_request() const + { + return m_req; + } + +} diff --git a/src/cert/cvc/cvc_ado.h b/src/cert/cvc/cvc_ado.h index e2e5395b5..de0fc7c13 100644 --- a/src/cert/cvc/cvc_ado.h +++ b/src/cert/cvc/cvc_ado.h @@ -44,7 +44,8 @@ class EAC1_1_ADO : public EAC1_1_obj */ static MemoryVector make_signed( std::auto_ptr signer, - const MemoryRegion& tbs_bits); + const MemoryRegion& tbs_bits, + RandomNumberGenerator& rng); /** * Get the CAR of this CVC ADO request * @result the CAR of this CVC ADO request diff --git a/src/cert/cvc/cvc_ca.cpp b/src/cert/cvc/cvc_ca.cpp index 19b35e074..638d3f984 100644 --- a/src/cert/cvc/cvc_ca.cpp +++ b/src/cert/cvc/cvc_ca.cpp @@ -5,38 +5,42 @@ #include namespace Botan { - EAC1_1_CVC EAC1_1_CVC_CA::make_cert( - std::auto_ptr signer, - MemoryRegion const& public_key, - ASN1_Car const& car, - ASN1_Chr const& chr, - byte holder_auth_templ, - ASN1_Ced ced, - ASN1_Cex cex - ) - { - OID chat_oid(OIDS::lookup("CertificateHolderAuthorizationTemplate")); - MemoryVector enc_chat_val; - enc_chat_val.append(holder_auth_templ); +EAC1_1_CVC EAC1_1_CVC_CA::make_cert(std::auto_ptr signer, + MemoryRegion const& public_key, + ASN1_Car const& car, + ASN1_Chr const& chr, + byte holder_auth_templ, + ASN1_Ced ced, + ASN1_Cex cex, + RandomNumberGenerator& rng) + { + OID chat_oid(OIDS::lookup("CertificateHolderAuthorizationTemplate")); + MemoryVector enc_chat_val; + enc_chat_val.append(holder_auth_templ); - MemoryVector enc_cpi; - enc_cpi.append(0x00); - MemoryVector tbs = DER_Encoder() - .encode(enc_cpi, OCTET_STRING, ASN1_Tag(41), APPLICATION) // cpi - .encode(car) - .raw_bytes(public_key) - .encode(chr) - .start_cons(ASN1_Tag(76), APPLICATION) - .encode(chat_oid) - .encode(enc_chat_val, OCTET_STRING, ASN1_Tag(19), APPLICATION) - .end_cons() - .encode(ced) - .encode(cex) - .get_contents(); + MemoryVector enc_cpi; + enc_cpi.append(0x00); + MemoryVector tbs = DER_Encoder() + .encode(enc_cpi, OCTET_STRING, ASN1_Tag(41), APPLICATION) // cpi + .encode(car) + .raw_bytes(public_key) + .encode(chr) + .start_cons(ASN1_Tag(76), APPLICATION) + .encode(chat_oid) + .encode(enc_chat_val, OCTET_STRING, ASN1_Tag(19), APPLICATION) + .end_cons() + .encode(ced) + .encode(cex) + .get_contents(); - MemoryVector signed_cert = EAC1_1_CVC::make_signed(signer, EAC1_1_CVC::build_cert_body(tbs)); - std::tr1::shared_ptr source(new DataSource_Memory(signed_cert)); - return EAC1_1_CVC(source); - } + MemoryVector signed_cert = + EAC1_1_CVC::make_signed(signer, + EAC1_1_CVC::build_cert_body(tbs), + rng); + + std::tr1::shared_ptr source(new DataSource_Memory(signed_cert)); + + return EAC1_1_CVC(source); + } } diff --git a/src/cert/cvc/cvc_ca.h b/src/cert/cvc/cvc_ca.h index 590cd4c91..ec70aab42 100644 --- a/src/cert/cvc/cvc_ca.h +++ b/src/cert/cvc/cvc_ca.h @@ -1,6 +1,7 @@ /************************************************* * EAC1.1 CVC Certificate Authority Header File * -* (C) 1999-2007 The Botan Project * +* (C) 2007 FlexSecure GmbH * +* 2008 Jack Lloyd * *************************************************/ #ifndef BOTAN_CVC_CA_H__ @@ -10,15 +11,15 @@ #include #include #include -namespace Botan - { - /** - * This class represents a CVC CA. - */ - class EAC1_1_CVC_CA - { - public: +namespace Botan { + +/** +* This class represents a CVC CA. +*/ +class EAC1_1_CVC_CA + { + public: /** * Create an arbitrary EAC 1.1 CVC. @@ -33,19 +34,18 @@ namespace Botan * @param ced the CED to appear in the certificate * @param ced the CEX to appear in the certificate */ - static EAC1_1_CVC make_cert( - std::auto_ptr signer, + static EAC1_1_CVC make_cert(std::auto_ptr signer, MemoryRegion const& public_key, ASN1_Car const& car, ASN1_Chr const& chr, byte holder_auth_templ, ASN1_Ced ced, - ASN1_Cex cex - ); + ASN1_Cex cex, + RandomNumberGenerator& rng); - private: + private: - }; + }; diff --git a/src/cert/cvc/cvc_cert.cpp b/src/cert/cvc/cvc_cert.cpp index 29b3661ba..11539ef1e 100644 --- a/src/cert/cvc/cvc_cert.cpp +++ b/src/cert/cvc/cvc_cert.cpp @@ -1,100 +1,100 @@ -#include +/* + (C) 2007 FlexSecure GmbH + 2008 Jack Lloyd +*/ + #include -#include -#include -#include -#include -#include -#include -#include #include -#include -#include -namespace Botan - { - ASN1_Car EAC1_1_CVC::get_car() const - { - return m_car; - } +#include + +namespace Botan { + +ASN1_Car EAC1_1_CVC::get_car() const + { + return m_car; + } + +ASN1_Ced EAC1_1_CVC::get_ced() const + { + return m_ced; + } +ASN1_Cex EAC1_1_CVC::get_cex() const + { + return m_cex; + } +u32bit EAC1_1_CVC::get_chat_value() const + { + return m_chat_val; + } + +/************************************************* +* Decode the TBSCertificate data * +*************************************************/ +void EAC1_1_CVC::force_decode() + { + SecureVector enc_pk; + SecureVector enc_chat_val; + u32bit cpi; + BER_Decoder tbs_cert(tbs_bits); + tbs_cert.decode(cpi, ASN1_Tag(41), APPLICATION) + .decode(m_car) + .start_cons(ASN1_Tag(73)) + .raw_bytes(enc_pk) + .end_cons() + .decode(m_chr) + .start_cons(ASN1_Tag(76)) + .decode(m_chat_oid) + .decode(enc_chat_val, OCTET_STRING, ASN1_Tag(19), APPLICATION) + .end_cons() + .decode(m_ced) + .decode(m_cex) + .verify_end(); - ASN1_Ced EAC1_1_CVC::get_ced() const - { - return m_ced; - } - ASN1_Cex EAC1_1_CVC::get_cex() const - { - return m_cex; - } - u32bit EAC1_1_CVC::get_chat_value() const - { - return m_chat_val; - } + if(enc_chat_val.size() != 1) + throw Decoding_Error("CertificateHolderAuthorizationValue was not of length 1"); - /************************************************* - * Decode the TBSCertificate data * - *************************************************/ - void EAC1_1_CVC::force_decode() - { - SecureVector enc_pk; - SecureVector enc_chat_val; - u32bit cpi; - BER_Decoder tbs_cert(tbs_bits); - tbs_cert.decode(cpi, ASN1_Tag(41), APPLICATION) - .decode(m_car) - .start_cons(ASN1_Tag(73)) - .raw_bytes(enc_pk) - .end_cons() - .decode(m_chr) - .start_cons(ASN1_Tag(76)) - .decode(m_chat_oid) - .decode(enc_chat_val, OCTET_STRING, ASN1_Tag(19), APPLICATION) - .end_cons() - .decode(m_ced) - .decode(m_cex) - .verify_end(); - if(enc_chat_val.size() != 1) + if(cpi != 0) + throw Decoding_Error("EAC1_1 certificate´s cpi was not 0"); + + // XXX: PK algos have no notion of EAC encoder/decoder currently +#if 0 + ECDSA_PublicKey tmp_pk; + std::auto_ptr dec = tmp_pk.cvc_eac1_1_decoder(); + sig_algo = dec->public_key(enc_pk); + + + m_pk = tmp_pk; + m_chat_val = enc_chat_val[0]; + self_signed = false; + if(m_car.iso_8859() == m_chr.iso_8859()) { - throw Decoding_Error("CertificateHolderAuthorizationValue was not of length 1"); + self_signed= true; } - if(cpi != 0) - { - throw Decoding_Error("EAC1_1 certificate´s cpi was not 0"); - } - ECDSA_PublicKey tmp_pk; - std::auto_ptr dec = tmp_pk.cvc_eac1_1_decoder(); - sig_algo = dec->public_key(enc_pk); +#endif + } +/************************************************* +* CVC Certificate Constructor * +*************************************************/ +EAC1_1_CVC::EAC1_1_CVC(std::tr1::shared_ptr& in) + { + init(in); + self_signed = false; + do_decode(); + } - m_pk = tmp_pk; - m_chat_val = enc_chat_val[0]; - self_signed = false; - if(m_car.iso_8859() == m_chr.iso_8859()) - { - self_signed= true; - } +EAC1_1_CVC::EAC1_1_CVC(const std::string& in) + { + std::tr1::shared_ptr stream(new DataSource_Stream(in, true)); + init(stream); + self_signed = false; + do_decode(); + } - } - /************************************************* - * CVC Certificate Constructor * - *************************************************/ - EAC1_1_CVC::EAC1_1_CVC(std::tr1::shared_ptr& in) - { - init(in); - self_signed = false; - do_decode(); - } - EAC1_1_CVC::EAC1_1_CVC(const std::string& in) - { - std::tr1::shared_ptr stream(new DataSource_Stream(in, true)); - init(stream); - self_signed = false; - do_decode(); - } - bool EAC1_1_CVC::operator==(EAC1_1_CVC const& rhs) const - { +bool EAC1_1_CVC::operator==(EAC1_1_CVC const& rhs) const + { return (tbs_data() == rhs.tbs_data() - && get_concat_sig() == rhs.get_concat_sig()); - } - + && get_concat_sig() == rhs.get_concat_sig()); + } } diff --git a/src/cert/cvc/cvc_gen_cert.h b/src/cert/cvc/cvc_gen_cert.h index 7a9ac86fa..7da99f197 100644 --- a/src/cert/cvc/cvc_gen_cert.h +++ b/src/cert/cvc/cvc_gen_cert.h @@ -8,10 +8,12 @@ #define BOTAN_EAC_CVC_GCERT_H__ #include +#include #include #include #include #include +#include namespace Botan { @@ -77,7 +79,8 @@ class EAC1_1_gen_CVC : public EAC1_1_obj // CRTP continuation from EAC1 */ static MemoryVector make_signed( std::auto_ptr signer, - const MemoryRegion& tbs_bits); + const MemoryRegion& tbs_bits, + RandomNumberGenerator& rng); virtual ~EAC1_1_gen_CVC() {} @@ -93,9 +96,10 @@ template bool EAC1_1_gen_CVC::is_self_signed() const } template MemoryVector EAC1_1_gen_CVC::make_signed( std::auto_ptr signer, - const MemoryRegion& tbs_bits) // static + const MemoryRegion& tbs_bits, + RandomNumberGenerator& rng) // static { - SecureVector concat_sig = EAC1_1_obj::make_signature(signer, tbs_bits); + SecureVector concat_sig = EAC1_1_obj::make_signature(signer.get(), tbs_bits, rng); assert(concat_sig.size() % 2 == 0); return DER_Encoder() .start_cons(ASN1_Tag(33), APPLICATION) @@ -144,14 +148,14 @@ void EAC1_1_gen_CVC::decode_info( ECDSA_Signature & res_sig) { SecureVector concat_sig; - BER_Decoder(source.get_shared()) + BER_Decoder(*source.get_shared().get()) .start_cons(ASN1_Tag(33)) .start_cons(ASN1_Tag(78)) .raw_bytes(res_tbs_bits) .end_cons() .decode(concat_sig, OCTET_STRING, ASN1_Tag(55), APPLICATION) .end_cons(); - res_sig = ecdsa::decode_concatenation(concat_sig); + res_sig = decode_concatenation(concat_sig); } } diff --git a/src/cert/cvc/cvc_req.cpp b/src/cert/cvc/cvc_req.cpp index 2d5172917..84ea3ba8a 100644 --- a/src/cert/cvc/cvc_req.cpp +++ b/src/cert/cvc/cvc_req.cpp @@ -1,66 +1,66 @@ -#include +/* + (C) 2007 FlexSecure GmbH + 2008 Jack Lloyd +*/ + #include #include #include #include #include -#include #include -#include #include #include #include #include -namespace Botan -{ +#include + +namespace Botan { +bool EAC1_1_Req::operator==(EAC1_1_Req const& rhs) const + { + return (this->tbs_data() == rhs.tbs_data() + && this->get_concat_sig() == rhs.get_concat_sig()); + } +void EAC1_1_Req::force_decode() + { + SecureVector enc_pk; + BER_Decoder tbs_cert(tbs_bits); + u32bit cpi; + tbs_cert.decode(cpi, ASN1_Tag(41), APPLICATION) + .start_cons(ASN1_Tag(73)) + .raw_bytes(enc_pk) + .end_cons() + .decode(m_chr) + .verify_end(); + if(cpi != 0) + { + throw Decoding_Error("EAC1_1 request´s cpi was not 0"); + } - bool EAC1_1_Req::operator==(EAC1_1_Req const& rhs) const - { - return (this->tbs_data() == rhs.tbs_data() - && this->get_concat_sig() == rhs.get_concat_sig()); - } + // XXX: No EAC support in ECDSA +#if 0 + ECDSA_PublicKey tmp_pk; + std::auto_ptr dec = tmp_pk.cvc_eac1_1_decoder(); + sig_algo = dec->public_key(enc_pk); + m_pk = tmp_pk; +#endif + } - /************************************************* - * Decode the TBSCertificate data * - *************************************************/ - void EAC1_1_Req::force_decode() - { - SecureVector enc_pk; - BER_Decoder tbs_cert(tbs_bits); - u32bit cpi; - tbs_cert.decode(cpi, ASN1_Tag(41), APPLICATION) - .start_cons(ASN1_Tag(73)) - .raw_bytes(enc_pk) - .end_cons() - .decode(m_chr) - .verify_end(); - if(cpi != 0) - { - throw Decoding_Error("EAC1_1 request´s cpi was not 0"); - } - ECDSA_PublicKey tmp_pk; - std::auto_ptr dec = tmp_pk.cvc_eac1_1_decoder(); - sig_algo = dec->public_key(enc_pk); - m_pk = tmp_pk; - } - /************************************************* - * X509_Certificate Constructor * - *************************************************/ - EAC1_1_Req::EAC1_1_Req(std::tr1::shared_ptr in) - { - init(in); - self_signed = true; - do_decode(); - } - EAC1_1_Req::EAC1_1_Req(const std::string& in) - { - std::tr1::shared_ptr stream(new DataSource_Stream(in, true)); - init(stream); - self_signed = true; - do_decode(); - } +EAC1_1_Req::EAC1_1_Req(std::tr1::shared_ptr in) + { + init(in); + self_signed = true; + do_decode(); + } +EAC1_1_Req::EAC1_1_Req(const std::string& in) + { + std::tr1::shared_ptr stream(new DataSource_Stream(in, true)); + init(stream); + self_signed = true; + do_decode(); + } } diff --git a/src/cert/cvc/cvc_self.cpp b/src/cert/cvc/cvc_self.cpp index 130ac6998..9ea561366 100644 --- a/src/cert/cvc/cvc_self.cpp +++ b/src/cert/cvc/cvc_self.cpp @@ -1,3 +1,8 @@ +/* + (C) 2007 FlexSecure GmbH + 2008 Jack Lloyd +*/ + #include #include #include @@ -8,264 +13,262 @@ #include #include #include -#include -#include #include -using namespace Botan; -namespace Botan - { - namespace - { - std::string padding_and_hash_from_oid(OID const& oid) - { - std::string padding_and_hash = OIDS::lookup(oid); // use the hash - assert(padding_and_hash.substr(0,6) == "ECDSA/"); // can only be ECDSA for now - assert(padding_and_hash.find("/",0) == 5); - padding_and_hash.erase(0, padding_and_hash.find("/",0) + 1); - return padding_and_hash; - } - std::string fixed_len_seqnr(u32bit seqnr, u32bit len) - { - std::stringstream ss; - std::string result; - ss << seqnr; - ss >> result; - if (result.size() > len) - { - throw Invalid_Argument("fixed_len_seqnr(): number too high to be encoded in provided length"); - } - while (result.size() < len) - { - result.insert(0,"0"); - } - return result; - } +namespace Botan { +namespace { + +std::string padding_and_hash_from_oid(OID const& oid) + { + std::string padding_and_hash = OIDS::lookup(oid); // use the hash + assert(padding_and_hash.substr(0,6) == "ECDSA/"); // can only be ECDSA for now + assert(padding_and_hash.find("/",0) == 5); + padding_and_hash.erase(0, padding_and_hash.find("/",0) + 1); + return padding_and_hash; + } +std::string fixed_len_seqnr(u32bit seqnr, u32bit len) + { + std::stringstream ss; + std::string result; + ss << seqnr; + ss >> result; + if (result.size() > len) + { + throw Invalid_Argument("fixed_len_seqnr(): number too high to be encoded in provided length"); } - namespace CVC_EAC + while (result.size() < len) { + result.insert(0,"0"); + } + return result; + } - EAC1_1_CVC create_self_signed_cert(Private_Key const& key, - EAC1_1_CVC_Options const& opt) - { - // NOTE: we ignore - // the value - // of opt.chr - ECDSA_PrivateKey const* priv_key = dynamic_cast(&key); +} +namespace CVC_EAC +{ - if (priv_key == 0) - { - throw Invalid_Argument("CVC_EAC::create_self_signed_cert(): unsupported key type"); - } +EAC1_1_CVC create_self_signed_cert(Private_Key const& key, + EAC1_1_CVC_Options const& opt) + { + // NOTE: we ignore + // the value + // of opt.chr + ECDSA_PrivateKey const* priv_key = dynamic_cast(&key); - ASN1_Chr chr(opt.car.value()); + if (priv_key == 0) + { + throw Invalid_Argument("CVC_EAC::create_self_signed_cert(): unsupported key type"); + } - AlgorithmIdentifier sig_algo; - std::string padding_and_hash(eac_cvc_emsa + "(" + opt.hash_alg + ")"); - sig_algo.oid = OIDS::lookup_bsi(priv_key->algo_name() + "/" + padding_and_hash); - sig_algo = AlgorithmIdentifier(sig_algo.oid, AlgorithmIdentifier::USE_NULL_PARAM); + ASN1_Chr chr(opt.car.value()); - std::auto_ptr signer = get_pk_signer(*priv_key, padding_and_hash); + AlgorithmIdentifier sig_algo; + std::string padding_and_hash(eac_cvc_emsa + "(" + opt.hash_alg + ")"); + sig_algo.oid = OIDS::lookup_bsi(priv_key->algo_name() + "/" + padding_and_hash); + sig_algo = AlgorithmIdentifier(sig_algo.oid, AlgorithmIdentifier::USE_NULL_PARAM); - std::auto_ptr enc(priv_key->cvc_eac1_1_encoder()); - MemoryVector enc_public_key = enc->public_key(sig_algo); - return EAC1_1_CVC_CA::make_cert(signer, enc_public_key, opt.car, chr, opt.holder_auth_templ, opt.ced, opt.cex); + std::auto_ptr signer(get_pk_signer(*priv_key, padding_and_hash)); - } + std::auto_ptr enc(priv_key->cvc_eac1_1_encoder()); + MemoryVector enc_public_key = enc->public_key(sig_algo); + return EAC1_1_CVC_CA::make_cert(signer, enc_public_key, opt.car, chr, opt.holder_auth_templ, opt.ced, opt.cex); - EAC1_1_Req create_cvc_req(Private_Key const& key, - ASN1_Chr const& chr, - std::string const& hash_alg) - { + } - ECDSA_PrivateKey const* priv_key = dynamic_cast(&key); - if (priv_key == 0) - { - throw Invalid_Argument("CVC_EAC::create_self_signed_cert(): unsupported key type"); - } - AlgorithmIdentifier sig_algo; - std::string padding_and_hash(eac_cvc_emsa + "(" + hash_alg + ")"); - sig_algo.oid = OIDS::lookup_bsi(priv_key->algo_name() + "/" + padding_and_hash); - sig_algo = AlgorithmIdentifier(sig_algo.oid, AlgorithmIdentifier::USE_NULL_PARAM); +EAC1_1_Req create_cvc_req(Private_Key const& key, + ASN1_Chr const& chr, + std::string const& hash_alg) + { - std::auto_ptr signer = get_pk_signer(*priv_key, padding_and_hash); + ECDSA_PrivateKey const* priv_key = dynamic_cast(&key); + if (priv_key == 0) + { + throw Invalid_Argument("CVC_EAC::create_self_signed_cert(): unsupported key type"); + } + AlgorithmIdentifier sig_algo; + std::string padding_and_hash(eac_cvc_emsa + "(" + hash_alg + ")"); + sig_algo.oid = OIDS::lookup_bsi(priv_key->algo_name() + "/" + padding_and_hash); + sig_algo = AlgorithmIdentifier(sig_algo.oid, AlgorithmIdentifier::USE_NULL_PARAM); - std::auto_ptr enc(priv_key->cvc_eac1_1_encoder()); - MemoryVector enc_public_key = enc->public_key(sig_algo); - MemoryVector enc_cpi; - enc_cpi.append(0x00); - MemoryVector tbs = DER_Encoder() - .encode(enc_cpi, OCTET_STRING, ASN1_Tag(41), APPLICATION) - .raw_bytes(enc_public_key) - .encode(chr) - .get_contents(); + std::auto_ptr signer = get_pk_signer(*priv_key, padding_and_hash); - MemoryVector signed_cert = EAC1_1_gen_CVC::make_signed(signer, EAC1_1_gen_CVC::build_cert_body(tbs)); - std::tr1::shared_ptr source(new DataSource_Memory(signed_cert)); - return EAC1_1_Req(source); - } + std::auto_ptr enc(priv_key->cvc_eac1_1_encoder()); + MemoryVector enc_public_key = enc->public_key(sig_algo); + MemoryVector enc_cpi; + enc_cpi.append(0x00); + MemoryVector tbs = DER_Encoder() + .encode(enc_cpi, OCTET_STRING, ASN1_Tag(41), APPLICATION) + .raw_bytes(enc_public_key) + .encode(chr) + .get_contents(); - EAC1_1_ADO create_ado_req(Private_Key const& key, - EAC1_1_Req const& req, - ASN1_Car const& car) - { + MemoryVector signed_cert = EAC1_1_gen_CVC::make_signed(signer, EAC1_1_gen_CVC::build_cert_body(tbs)); + std::tr1::shared_ptr source(new DataSource_Memory(signed_cert)); + return EAC1_1_Req(source); + } - ECDSA_PrivateKey const* priv_key = dynamic_cast(&key); - if (priv_key == 0) - { - throw Invalid_Argument("CVC_EAC::create_self_signed_cert(): unsupported key type"); - } - std::string padding_and_hash = padding_and_hash_from_oid(req.signature_algorithm().oid); - std::auto_ptr signer = get_pk_signer(*priv_key, padding_and_hash); - SecureVector tbs_bits = req.BER_encode(); - tbs_bits.append(DER_Encoder().encode(car).get_contents()); - MemoryVector signed_cert = EAC1_1_ADO::make_signed(signer, tbs_bits); - std::tr1::shared_ptr source(new DataSource_Memory(signed_cert)); - return EAC1_1_ADO(source); - } +EAC1_1_ADO create_ado_req(Private_Key const& key, + EAC1_1_Req const& req, + ASN1_Car const& car) + { - } // namespace CVC_EAC - namespace DE_EAC + ECDSA_PrivateKey const* priv_key = dynamic_cast(&key); + if (priv_key == 0) { - EAC1_1_CVC create_cvca(Private_Key const& key, std::string const& hash, ASN1_Car const& car, bool iris, bool fingerpr) - { - ECDSA_PrivateKey const* priv_key = dynamic_cast(&key); - if (priv_key == 0) - { - throw Invalid_Argument("CVC_EAC::create_self_signed_cert(): unsupported key type"); - } - EAC1_1_CVC_Options opts; - opts.car = car; - const u64bit current_time = system_time(); + throw Invalid_Argument("CVC_EAC::create_self_signed_cert(): unsupported key type"); + } + std::string padding_and_hash = padding_and_hash_from_oid(req.signature_algorithm().oid); + std::auto_ptr signer(get_pk_signer(*priv_key, padding_and_hash)); + SecureVector tbs_bits = req.BER_encode(); + tbs_bits.append(DER_Encoder().encode(car).get_contents()); + MemoryVector signed_cert = EAC1_1_ADO::make_signed(signer, tbs_bits); + std::tr1::shared_ptr source(new DataSource_Memory(signed_cert)); + return EAC1_1_ADO(source); + } - opts.ced = ASN1_Ced(current_time); - opts.cex = ASN1_Cex(opts.ced); - opts.cex.add_months(global_config().option_as_u32bit("eac/ca/cvca_validity_months")); - opts.holder_auth_templ = (CVCA | (iris * IRIS) | (fingerpr * FINGERPRINT)); - opts.hash_alg = hash; - return Botan::CVC_EAC::create_self_signed_cert(*priv_key, opts); - } +} // namespace CVC_EAC +namespace DE_EAC +{ +EAC1_1_CVC create_cvca(Private_Key const& key, std::string const& hash, ASN1_Car const& car, bool iris, bool fingerpr) + { + ECDSA_PrivateKey const* priv_key = dynamic_cast(&key); + if (priv_key == 0) + { + throw Invalid_Argument("CVC_EAC::create_self_signed_cert(): unsupported key type"); + } + EAC1_1_CVC_Options opts; + opts.car = car; + const u64bit current_time = system_time(); + opts.ced = ASN1_Ced(current_time); + opts.cex = ASN1_Cex(opts.ced); + opts.cex.add_months(global_config().option_as_u32bit("eac/ca/cvca_validity_months")); + opts.holder_auth_templ = (CVCA | (iris * IRIS) | (fingerpr * FINGERPRINT)); + opts.hash_alg = hash; + return Botan::CVC_EAC::create_self_signed_cert(*priv_key, opts); + } - EAC1_1_CVC link_cvca(EAC1_1_CVC const& signer, - Private_Key const& key, - EAC1_1_CVC const& signee) - { - ECDSA_PrivateKey const* priv_key = dynamic_cast(&key); - if (priv_key == 0) - { - throw Invalid_Argument("CVC_EAC::create_self_signed_cert(): unsupported key type"); - } - ASN1_Ced ced(system_time()); - ASN1_Cex cex(signee.get_cex()); - if (*static_cast(&ced) > *static_cast(&cex)) - { - std::string detail("link_cvca(): validity periods of provided certificates don´t overlap: currend time = ced = "); - detail += ced.as_string(); - detail += ", signee.cex = "; - detail += cex.as_string(); - throw Invalid_Argument(detail); - } - if (signer.signature_algorithm() != signee.signature_algorithm()) - { - throw Invalid_Argument("link_cvca(): signature algorithms of signer and signee don´t match"); - } - AlgorithmIdentifier sig_algo = signer.signature_algorithm(); - std::string padding_and_hash = padding_and_hash_from_oid(sig_algo.oid); - std::auto_ptr pk_signer = get_pk_signer(*priv_key, padding_and_hash); - std::auto_ptr pk = signee.subject_public_key(); - ECDSA_PublicKey* subj_pk = dynamic_cast(pk.get()); - subj_pk->set_parameter_encoding(ENC_EXPLICIT); - std::auto_ptr enc(subj_pk->cvc_eac1_1_encoder()); - MemoryVector enc_public_key = enc->public_key(sig_algo); - return EAC1_1_CVC_CA::make_cert(pk_signer, enc_public_key, - signer.get_car(), - signee.get_chr(), - signer.get_chat_value(), - ced, - cex); - } - EAC1_1_CVC sign_request(EAC1_1_CVC const& signer_cert, - Private_Key const& key, - EAC1_1_Req const& signee, - u32bit seqnr, - u32bit seqnr_len, - bool domestic) - { - ECDSA_PrivateKey const* priv_key = dynamic_cast(&key); - if (priv_key == 0) - { - throw Invalid_Argument("CVC_EAC::create_self_signed_cert(): unsupported key type"); - } - std::string chr_str = signee.get_chr().value(); - chr_str.append(fixed_len_seqnr(seqnr, seqnr_len)); - ASN1_Chr chr(chr_str); - std::string padding_and_hash = padding_and_hash_from_oid(signee.signature_algorithm().oid); - std::auto_ptr pk_signer = get_pk_signer(*priv_key, padding_and_hash); - std::auto_ptr pk = signee.subject_public_key(); - ECDSA_PublicKey* subj_pk = dynamic_cast(pk.get()); - std::auto_ptr signer_pk = signer_cert.subject_public_key(); +EAC1_1_CVC link_cvca(EAC1_1_CVC const& signer, + Private_Key const& key, + EAC1_1_CVC const& signee) + { + ECDSA_PrivateKey const* priv_key = dynamic_cast(&key); + if (priv_key == 0) + { + throw Invalid_Argument("CVC_EAC::create_self_signed_cert(): unsupported key type"); + } + ASN1_Ced ced(system_time()); + ASN1_Cex cex(signee.get_cex()); + if (*static_cast(&ced) > *static_cast(&cex)) + { + std::string detail("link_cvca(): validity periods of provided certificates don´t overlap: currend time = ced = "); + detail += ced.as_string(); + detail += ", signee.cex = "; + detail += cex.as_string(); + throw Invalid_Argument(detail); + } + if (signer.signature_algorithm() != signee.signature_algorithm()) + { + throw Invalid_Argument("link_cvca(): signature algorithms of signer and signee don´t match"); + } + AlgorithmIdentifier sig_algo = signer.signature_algorithm(); + std::string padding_and_hash = padding_and_hash_from_oid(sig_algo.oid); + std::auto_ptr pk_signer = get_pk_signer(*priv_key, padding_and_hash); + std::auto_ptr pk = signee.subject_public_key(); + ECDSA_PublicKey* subj_pk = dynamic_cast(pk.get()); + subj_pk->set_parameter_encoding(ENC_EXPLICIT); + std::auto_ptr enc(subj_pk->cvc_eac1_1_encoder()); + MemoryVector enc_public_key = enc->public_key(sig_algo); + return EAC1_1_CVC_CA::make_cert(pk_signer, enc_public_key, + signer.get_car(), + signee.get_chr(), + signer.get_chat_value(), + ced, + cex); + } + +EAC1_1_CVC sign_request(EAC1_1_CVC const& signer_cert, + Private_Key const& key, + EAC1_1_Req const& signee, + u32bit seqnr, + u32bit seqnr_len, + bool domestic) + { + ECDSA_PrivateKey const* priv_key = dynamic_cast(&key); + if (priv_key == 0) + { + throw Invalid_Argument("CVC_EAC::create_self_signed_cert(): unsupported key type"); + } + std::string chr_str = signee.get_chr().value(); + chr_str.append(fixed_len_seqnr(seqnr, seqnr_len)); + ASN1_Chr chr(chr_str); + std::string padding_and_hash = padding_and_hash_from_oid(signee.signature_algorithm().oid); + std::auto_ptr pk_signer = get_pk_signer(*priv_key, padding_and_hash); + std::auto_ptr pk = signee.subject_public_key(); + ECDSA_PublicKey* subj_pk = dynamic_cast(pk.get()); + std::auto_ptr signer_pk = signer_cert.subject_public_key(); + + // for the case that the domain parameters are not set... + // (we use those from the signer because they must fit) + subj_pk->set_domain_parameters(priv_key->get_domain_parameters()); - // for the case that the domain parameters are not set... - // (we use those from the signer because they must fit) - subj_pk->set_domain_parameters(priv_key->get_domain_parameters()); + subj_pk->set_parameter_encoding(ENC_IMPLICITCA); + std::auto_ptr enc(subj_pk->cvc_eac1_1_encoder()); + AlgorithmIdentifier sig_algo(signer_cert.signature_algorithm()); + MemoryVector enc_public_key = enc->public_key(sig_algo); + const u64bit current_time = system_time(); + ASN1_Ced ced(current_time); + u32bit chat_val; + u32bit chat_low = signer_cert.get_chat_value() & 0x3; // take the chat rights from signer + ASN1_Cex cex(ced); + if ((signer_cert.get_chat_value() & CVCA) == CVCA) + { + // we sign a dvca + cex.add_months(global_config().option_as_u32bit("eac/ca/dvca_validity_months")); + if (domestic) + { + chat_val = DVCA_domestic | chat_low; + } + else + { + chat_val = DVCA_foreign | chat_low; + } + } + else if ((signer_cert.get_chat_value() & DVCA_domestic) == DVCA_domestic || + (signer_cert.get_chat_value() & DVCA_foreign) == DVCA_foreign) + { + cex.add_months(global_config().option_as_u32bit("eac/ca/is_validity_months")); + chat_val = IS | chat_low; + } + else + { + throw Invalid_Argument("sign_request(): encountered illegal value for CHAT"); + // (IS cannot sign certificates) + } + return EAC1_1_CVC_CA::make_cert(pk_signer, enc_public_key, + ASN1_Car(signer_cert.get_chr().iso_8859()), + chr, + chat_val, + ced, + cex); + } +EAC1_1_Req create_cvc_req(Private_Key const& prkey, + ASN1_Chr const& chr, + std::string const& hash_alg) + { + ECDSA_PrivateKey const* priv_key = dynamic_cast(&prkey); + if (priv_key == 0) + { + throw Invalid_Argument("CVC_EAC::create_self_signed_cert(): unsupported key type"); + } + ECDSA_PrivateKey key(*priv_key); + key.set_parameter_encoding(ENC_IMPLICITCA); + return Botan::CVC_EAC::create_cvc_req(key, chr, hash_alg); + } - subj_pk->set_parameter_encoding(ENC_IMPLICITCA); - std::auto_ptr enc(subj_pk->cvc_eac1_1_encoder()); - AlgorithmIdentifier sig_algo(signer_cert.signature_algorithm()); - MemoryVector enc_public_key = enc->public_key(sig_algo); - const u64bit current_time = system_time(); - ASN1_Ced ced(current_time); - u32bit chat_val; - u32bit chat_low = signer_cert.get_chat_value() & 0x3; // take the chat rights from signer - ASN1_Cex cex(ced); - if ((signer_cert.get_chat_value() & CVCA) == CVCA) - { - // we sign a dvca - cex.add_months(global_config().option_as_u32bit("eac/ca/dvca_validity_months")); - if (domestic) - { - chat_val = DVCA_domestic | chat_low; - } - else - { - chat_val = DVCA_foreign | chat_low; - } - } - else if ((signer_cert.get_chat_value() & DVCA_domestic) == DVCA_domestic || - (signer_cert.get_chat_value() & DVCA_foreign) == DVCA_foreign) - { - cex.add_months(global_config().option_as_u32bit("eac/ca/is_validity_months")); - chat_val = IS | chat_low; - } - else - { - throw Invalid_Argument("sign_request(): encountered illegal value for CHAT"); - // (IS cannot sign certificates) - } - return EAC1_1_CVC_CA::make_cert(pk_signer, enc_public_key, - ASN1_Car(signer_cert.get_chr().iso_8859()), - chr, - chat_val, - ced, - cex); - } - EAC1_1_Req create_cvc_req(Private_Key const& prkey, - ASN1_Chr const& chr, - std::string const& hash_alg) - { - ECDSA_PrivateKey const* priv_key = dynamic_cast(&prkey); - if (priv_key == 0) - { - throw Invalid_Argument("CVC_EAC::create_self_signed_cert(): unsupported key type"); - } - ECDSA_PrivateKey key(*priv_key); - key.set_parameter_encoding(ENC_IMPLICITCA); - return Botan::CVC_EAC::create_cvc_req(key, chr, hash_alg); - } +} // namespace DE_EAC - } // namespace DE_EAC - } +} diff --git a/src/cert/cvc/cvc_self.h b/src/cert/cvc/cvc_self.h index 7caa96832..c2eaf9737 100644 --- a/src/cert/cvc/cvc_self.h +++ b/src/cert/cvc/cvc_self.h @@ -1,148 +1,147 @@ /************************************************* -* X.509 Self-Signed Certificate Header File * -* (C) 1999-2007 The Botan Project * +* CVC Self-Signed Certificate Header File * +* (C) 2007 FlexSecure GmbH * +* 2008 Jack Lloyd * *************************************************/ #ifndef BOTAN_CVC_EAC_SELF_H__ #define BOTAN_CVC_EAC_SELF_H__ -#include #include #include #include -#include +#include #include #include #include -namespace Botan - { - /** - * This class represents a set of options used for the creation of CVC certificates - */ - class EAC1_1_CVC_Options - { - public: +namespace Botan { - ASN1_Car car; - ASN1_Chr chr; - byte holder_auth_templ; - ASN1_Ced ced; - ASN1_Cex cex; - std::string hash_alg; - }; +/** +* This class represents a set of options used for the creation of CVC certificates +*/ +class EAC1_1_CVC_Options + { + public: + + ASN1_Car car; + ASN1_Chr chr; + byte holder_auth_templ; + ASN1_Ced ced; + ASN1_Cex cex; + std::string hash_alg; + }; /** * This namespace represents general EAC 1.1 convenience functions. */ - namespace CVC_EAC - { +namespace CVC_EAC +{ - /** - * Create a selfsigned CVCA - * @param key the ECDSA private key to be used to sign the certificate - * @param opts used to set several parameters. Necessary are: - * car, holder_auth_templ, hash_alg, ced, cex and hash_alg - * @result the self signed certificate - */ +/** +* Create a selfsigned CVCA +* @param key the ECDSA private key to be used to sign the certificate +* @param opts used to set several parameters. Necessary are: +* car, holder_auth_templ, hash_alg, ced, cex and hash_alg +* @result the self signed certificate +*/ EAC1_1_CVC create_self_signed_cert(Private_Key const& key, - EAC1_1_CVC_Options const& opts); - /** - * Create a CVC request. The key encoding will be according to the provided private key. - * @param priv_key the private key associated with the requesting entity - * @param chr the chr to appear in the certificate (to be provided without - * sequence number) - * @param hash_alg the string defining the hash algorithm to be used for the creation - * of the signature - * @result the new request - */ - EAC1_1_Req create_cvc_req(Private_Key const& priv_key, - ASN1_Chr const& chr, - std::string const& hash_alg); + EAC1_1_CVC_Options const& opts); +/** +* Create a CVC request. The key encoding will be according to the provided private key. +* @param priv_key the private key associated with the requesting entity +* @param chr the chr to appear in the certificate (to be provided without +* sequence number) +* @param hash_alg the string defining the hash algorithm to be used for the creation +* of the signature +* @result the new request +*/ +EAC1_1_Req create_cvc_req(Private_Key const& priv_key, + ASN1_Chr const& chr, + std::string const& hash_alg); - /** - * Create an ADO from a request object. - * @param priv_key the private key used to sign the ADO - * @param req the request forming the body of the ADO - * @param car the CAR forming the body of the ADO, i.e. the - * CHR of the entity associated with the provided private key - */ - EAC1_1_ADO create_ado_req(Private_Key const& priv_key, - EAC1_1_Req const& req, - ASN1_Car const& car); - } +/** +* Create an ADO from a request object. +* @param priv_key the private key used to sign the ADO +* @param req the request forming the body of the ADO +* @param car the CAR forming the body of the ADO, i.e. the +* CHR of the entity associated with the provided private key +*/ +EAC1_1_ADO create_ado_req(Private_Key const& priv_key, + EAC1_1_Req const& req, + ASN1_Car const& car); +} /** * This namespace represents EAC 1.1 CVC convenience functions following the specific german * requirements. */ - namespace DE_EAC - { - /** - * Create a CVCA certificate. - * @param priv_key the private key associated with the CVCA certificate - * to be created - * @param hash the string identifying the hash algorithm to be used - * for signing the certificate to be created - * @param car the CAR of the certificate to be created - * @param iris indicates whether the entity associated with the certificate - * shall be entitled to read the biometrical iris image - * @param fingerpr indicates whether the entity associated with the certificate - * shall be entitled to read the biometrical fingerprint image - * @result the CVCA certificate created - */ - EAC1_1_CVC create_cvca(Private_Key const& priv_key, - std::string const& hash, - ASN1_Car const& car, - bool iris, - bool fingerpr); - - /** - * Create a link certificate between two CVCA certificates. The key - * encoding will be implicitCA. - * @param signer the cvca certificate associated with the signing - * entity - * @param priv_key the private key associated with the signer - * @param to_be_signed the certificate which whose CAR/CHR will be - * the holder of the link certificate - */ - EAC1_1_CVC link_cvca(EAC1_1_CVC const& signer, - Private_Key const& priv_key, - EAC1_1_CVC const& to_be_signed); +namespace DE_EAC +{ +/** +* Create a CVCA certificate. +* @param priv_key the private key associated with the CVCA certificate +* to be created +* @param hash the string identifying the hash algorithm to be used +* for signing the certificate to be created +* @param car the CAR of the certificate to be created +* @param iris indicates whether the entity associated with the certificate +* shall be entitled to read the biometrical iris image +* @param fingerpr indicates whether the entity associated with the certificate +* shall be entitled to read the biometrical fingerprint image +* @result the CVCA certificate created +*/ +EAC1_1_CVC create_cvca(Private_Key const& priv_key, + std::string const& hash, + ASN1_Car const& car, + bool iris, + bool fingerpr); - /** - * Create a CVC request. The key encoding will be implicitCA. - * @param priv_key the private key associated with the requesting entity - * @param chr the chr to appear in the certificate (to be provided without - * sequence number) - * @param hash_alg the string defining the hash algorithm to be used for the creation - * of the signature - * @result the new request - */ - EAC1_1_Req create_cvc_req(Private_Key const& priv_key, - ASN1_Chr const& chr, - std::string const& hash_alg); - /** - * Sign a CVC request. - * @param signer_cert the certificate of the signing entity - * @param priv_key the private key of the signing entity - * @param req the request to be signed - * @param seqnr the sequence number of the certificate to be created - * @param seqnr_len the number of digits the sequence number will be - * encoded in - * @param domestic indicates whether to sign a domestic or a foreign certificate: - * set to true for domestic - * @result the new certificate - * - **/ - EAC1_1_CVC sign_request(EAC1_1_CVC const& signer_cert, - Private_Key const& priv_key, - EAC1_1_Req const& req, - u32bit seqnr, - u32bit seqnr_len, - bool domestic); - } +/** +* Create a link certificate between two CVCA certificates. The key +* encoding will be implicitCA. +* @param signer the cvca certificate associated with the signing +* entity +* @param priv_key the private key associated with the signer +* @param to_be_signed the certificate which whose CAR/CHR will be +* the holder of the link certificate +*/ +EAC1_1_CVC link_cvca(EAC1_1_CVC const& signer, + Private_Key const& priv_key, + EAC1_1_CVC const& to_be_signed); +/** +* Create a CVC request. The key encoding will be implicitCA. +* @param priv_key the private key associated with the requesting entity +* @param chr the chr to appear in the certificate (to be provided without +* sequence number) +* @param hash_alg the string defining the hash algorithm to be used for the creation +* of the signature +* @result the new request +*/ +EAC1_1_Req create_cvc_req(Private_Key const& priv_key, + ASN1_Chr const& chr, + std::string const& hash_alg); +/** +* Sign a CVC request. +* @param signer_cert the certificate of the signing entity +* @param priv_key the private key of the signing entity +* @param req the request to be signed +* @param seqnr the sequence number of the certificate to be created +* @param seqnr_len the number of digits the sequence number will be +* encoded in +* @param domestic indicates whether to sign a domestic or a foreign certificate: +* set to true for domestic +* @result the new certificate +* +**/ +EAC1_1_CVC sign_request(EAC1_1_CVC const& signer_cert, + Private_Key const& priv_key, + EAC1_1_Req const& req, + u32bit seqnr, + u32bit seqnr_len, + bool domestic); +} - } +} #endif diff --git a/src/cert/cvc/eac_asn_obj.h b/src/cert/cvc/eac_asn_obj.h new file mode 100644 index 000000000..6bb77cf7f --- /dev/null +++ b/src/cert/cvc/eac_asn_obj.h @@ -0,0 +1,128 @@ +/************************************************* +* Common ASN.1 Objects Header File * +* (C) 1999-2007 The Botan Project * +*************************************************/ + +#ifndef BOTAN_EAC_ASN1_OBJ_H__ +#define BOTAN_EAC_ASN1_OBJ_H__ + +#include +#include +#include + +namespace Botan { + +/************************************************* +* CVC EAC Time * +*************************************************/ +class EAC_Time : public ASN1_Object + { + public: + void encode_into(class DER_Encoder&) const; + void decode_from(class BER_Decoder&); + + std::string as_string() const; + std::string readable_string() const; + bool time_is_set() const; + + s32bit cmp(const EAC_Time&) const; + + void set_to(const std::string&); + //void set_to(const std::string&, ASN1_Tag); + void add_years(u32bit years); + void add_months(u32bit months); + + u32bit get_year() const; + u32bit get_month() const; + u32bit get_day() const; + + EAC_Time(u64bit, ASN1_Tag t = ASN1_Tag(0)); + //EAC_Time(const std::string& = ""); + EAC_Time(const std::string&, ASN1_Tag = ASN1_Tag(0)); + EAC_Time(u32bit year, u32bit month, u32bit day, ASN1_Tag = ASN1_Tag(0)); + virtual ~EAC_Time(){}; + private: + SecureVector encoded_eac_time() const; + bool passes_sanity_check() const; + u32bit year, month, day; + ASN1_Tag tag; + }; + +// function definitions in asn_eac_tm.cpp +class ASN1_Ced : public EAC_Time + { + public: + ASN1_Ced(std::string const& str=""); + ASN1_Ced(u64bit); + ASN1_Ced(EAC_Time const& other); + //ASN1_Ced(ASN1_Cex const& cex); + }; + +// function definitions in asn_eac_tm.cpp +class ASN1_Cex : public EAC_Time + { + public: + ASN1_Cex(std::string const& str=""); + ASN1_Cex(u64bit); + ASN1_Cex(EAC_Time const& other); + //ASN1_Cex(ASN1_Ced const& ced); + }; + +/************************************************* +* String for car/chr of cv certificates * +*************************************************/ +class ASN1_EAC_String: public ASN1_Object + { + public: + void encode_into(class DER_Encoder&) const; + void decode_from(class BER_Decoder&); + + std::string value() const; + std::string iso_8859() const; + + ASN1_Tag tagging() const; + ASN1_EAC_String(const std::string& str, ASN1_Tag the_tag); + + virtual ~ASN1_EAC_String() {} + protected: + bool sanity_check() const; + private: + std::string iso_8859_str; + ASN1_Tag tag; + }; + +// String tagged with 2 +// function definitions in asn1_eac_str.cpp +class ASN1_Car : public ASN1_EAC_String + { + public: + ASN1_Car(std::string const& str = ""); + }; + +// String tagged with 32 +// function definitions in asn1_eac_str.cpp +class ASN1_Chr : public ASN1_EAC_String + { + public: + ASN1_Chr(std::string const& str = ""); + }; + +/************************************************* +* Comparison Operations * +*************************************************/ +bool operator==(const EAC_Time&, const EAC_Time&); +bool operator!=(const EAC_Time&, const EAC_Time&); +bool operator<=(const EAC_Time&, const EAC_Time&); +bool operator>=(const EAC_Time&, const EAC_Time&); +bool operator>(const EAC_Time&, const EAC_Time&); +bool operator<(const EAC_Time&, const EAC_Time&); + +bool operator==(const ASN1_EAC_String&, const ASN1_EAC_String&); +inline bool operator!=(const ASN1_EAC_String& lhs, const ASN1_EAC_String& rhs) + { + return !(lhs == rhs); + } + +} + +#endif diff --git a/src/cert/cvc/eac_obj.h b/src/cert/cvc/eac_obj.h index 5b1912595..baf811d9d 100644 --- a/src/cert/cvc/eac_obj.h +++ b/src/cert/cvc/eac_obj.h @@ -9,7 +9,7 @@ #include #include -#include +#include #include #include #include @@ -27,14 +27,13 @@ const std::string eac_cvc_emsa("EMSA1_BSI"); * TR03110 v1.1 EAC CV Certificate * *************************************************/ template -class EAC1_1_obj : public X509_Object // CRTP is used enable the call sequence: +class EAC1_1_obj : public EAC_Signed_Object // CRTP is used enable the call sequence: { // data members first: protected: ECDSA_Signature m_sig; - // member functions here: public: /** @@ -53,7 +52,7 @@ class EAC1_1_obj : public X509_Object // CRTP is used enable the call sequence: protected: void init(SharedPtrConverter in); - static SecureVector make_signature(const PK_Signer* signer, + static SecureVector make_signature(PK_Signer* signer, const MemoryRegion& tbs_bits, RandomNumberGenerator& rng); @@ -65,7 +64,7 @@ template SecureVector EAC1_1_obj::get_concat_si { return m_sig.get_concatenation(); } -template SecureVector EAC1_1_obj::make_signature(const PK_Signer* signer, +template SecureVector EAC1_1_obj::make_signature(PK_Signer* signer, const MemoryRegion& tbs_bits, RandomNumberGenerator& rng) { @@ -115,7 +114,7 @@ template bool EAC1_1_obj::check_signature(Public_Key& { return false; } - std::auto_ptr enc = m_sig.x509_encoder(); + std::auto_ptr enc(m_sig.x509_encoder()); SecureVector seq_sig = enc->signature_bits(); SecureVector to_sign = tbs_data(); return verifier->verify_message(to_sign, seq_sig); diff --git a/src/cert/cvc/info.txt b/src/cert/cvc/info.txt index 6af8ff4e5..50483dc91 100644 --- a/src/cert/cvc/info.txt +++ b/src/cert/cvc/info.txt @@ -2,12 +2,16 @@ realname "Card Verifiable Certificates" define CARD_VERIFIABLE_CERTIFICATES -load_on request +load_on auto +asn1 +ecdsa +asn1_eac_str.cpp +asn1_eac_tm.cpp cvc_ado.cpp cvc_ado.h cvc_ca.cpp @@ -20,5 +24,8 @@ cvc_req.cpp cvc_req.h cvc_self.cpp cvc_self.h +eac_asn_obj.h eac_obj.h +signed_obj.cpp +signed_obj.h diff --git a/src/cert/cvc/signed_obj.cpp b/src/cert/cvc/signed_obj.cpp new file mode 100644 index 000000000..6a5952812 --- /dev/null +++ b/src/cert/cvc/signed_obj.cpp @@ -0,0 +1,64 @@ +/************************************************* +* X.509 SIGNED Object Source File * +* (C) 1999-2007 The Botan Project * +*************************************************/ + +#include + +namespace Botan { + +/************************************************* +* Return a BER encoded X.509 object * +*************************************************/ +SecureVector EAC_Signed_Object::BER_encode() const + { + Pipe ber; + ber.start_msg(); + encode(ber, RAW_BER); + ber.end_msg(); + return ber.read_all(); + } + +/************************************************* +* Return a PEM encoded X.509 object * +*************************************************/ +std::string EAC_Signed_Object::PEM_encode() const + { + Pipe pem; + pem.start_msg(); + encode(pem, PEM); + pem.end_msg(); + return pem.read_all_as_string(); + } + +/************************************************* +* Return the algorithm used to sign this object * +*************************************************/ +AlgorithmIdentifier EAC_Signed_Object::signature_algorithm() const + { + return sig_algo; + } + +/************************************************* +* Try to decode the actual information * +*************************************************/ +void EAC_Signed_Object::do_decode() + { + try { + force_decode(); + } + catch(Decoding_Error& e) + { + const std::string what = e.what(); + throw Decoding_Error(PEM_label_pref + " decoding failed (" + + what.substr(23, std::string::npos) + ")"); + } + catch(Invalid_Argument& e) + { + const std::string what = e.what(); + throw Decoding_Error(PEM_label_pref + " decoding failed (" + + what.substr(7, std::string::npos) + ")"); + } + } + +} diff --git a/src/cert/cvc/signed_obj.h b/src/cert/cvc/signed_obj.h new file mode 100644 index 000000000..9116b783e --- /dev/null +++ b/src/cert/cvc/signed_obj.h @@ -0,0 +1,58 @@ +/************************************************* +* EAC SIGNED Object Header File * +* (C) 2007 FlexSecure GmbH * +* 2008 Jack Lloyd * +*************************************************/ + +#ifndef BOTAN_EAC_SIGNED_OBJECT_H__ +#define BOTAN_EAC_SIGNED_OBJECT_H__ + +#include +#include +#include +#include +#include + +namespace Botan { + +/************************************************* +* EAC SIGNED Object * +*************************************************/ +class EAC_Signed_Object + { + public: + virtual SecureVector tbs_data() const = 0; + virtual SecureVector get_concat_sig() const = 0; // NOTE: this is here + // only because abstract + // signature objects have + // not yet been introduced + /** + * Get the signature algorithm identifier used to sign this object. + * @result the signature algorithm identifier + */ + AlgorithmIdentifier signature_algorithm() const; + + virtual bool check_signature(class Public_Key&) const = 0; + virtual void encode(Pipe&, X509_Encoding = PEM) const = 0; + SecureVector BER_encode() const; + std::string PEM_encode() const; + + EAC_Signed_Object(SharedPtrConverter, const std::string&); + EAC_Signed_Object(const std::string&, const std::string&); + virtual ~EAC_Signed_Object() {} + protected: + void do_decode(); + EAC_Signed_Object() {} + AlgorithmIdentifier sig_algo; + SecureVector tbs_bits; + std::string PEM_label_pref; + std::vector PEM_labels_allowed; + private: + + virtual void force_decode() = 0; + + }; + +} + +#endif -- cgit v1.2.3