Examples with ProofOfPossession com.github.zhenwei.pkix.util.asn1.crmf.ProofOfPossession used on opensource projects

Example 6 with ProofOfPossession

use of com.github.zhenwei.pkix.util.asn1.crmf.ProofOfPossession in project xipki by xipki.

the class BaseCmpResponder method verifyPop.

protected boolean verifyPop(CertificateRequestMessage certRequest, SubjectPublicKeyInfo spki, boolean allowRaPop) {
    int popType = certRequest.getProofOfPossessionType();
    if (popType == CertificateRequestMessage.popRaVerified && allowRaPop) {
        return true;
    }
    if (popType != CertificateRequestMessage.popSigningKey) {
        LOG.error("unsupported POP type: " + popType);
        return false;
    }
    // check the POP signature algorithm
    ProofOfPossession pop = certRequest.toASN1Structure().getPop();
    POPOSigningKey popSign = POPOSigningKey.getInstance(pop.getObject());
    SignAlgo popAlg;
    try {
        popAlg = SignAlgo.getInstance(popSign.getAlgorithmIdentifier());
    } catch (NoSuchAlgorithmException ex) {
        LogUtil.error(LOG, ex, "Cannot parse POP signature algorithm");
        return false;
    }
    AlgorithmValidator algoValidator = getCa().getPopAlgoValidator();
    if (!algoValidator.isAlgorithmPermitted(popAlg)) {
        LOG.error("POP signature algorithm {} not permitted", popAlg.getJceName());
        return false;
    }
    try {
        PublicKey publicKey = securityFactory.generatePublicKey(spki);
        PopControl popControl = getCa().getCaInfo().getPopControl();
        DHSigStaticKeyCertPair kaKeyAndCert = null;
        if (SignAlgo.DHPOP_X25519 == popAlg || SignAlgo.DHPOP_X448 == popAlg) {
            if (popControl != null) {
                DhSigStatic dhSigStatic = DhSigStatic.getInstance(popSign.getSignature().getBytes());
                IssuerAndSerialNumber isn = dhSigStatic.getIssuerAndSerial();
                ASN1ObjectIdentifier keyAlgOid = spki.getAlgorithm().getAlgorithm();
                kaKeyAndCert = popControl.getDhKeyCertPair(isn.getName(), isn.getSerialNumber().getValue(), EdECConstants.getName(keyAlgOid));
            }
            if (kaKeyAndCert == null) {
                return false;
            }
        }
        ContentVerifierProvider cvp = securityFactory.getContentVerifierProvider(publicKey, kaKeyAndCert);
        return certRequest.isValidSigningKeyPOP(cvp);
    } catch (InvalidKeyException | IllegalStateException | CRMFException ex) {
        LogUtil.error(LOG, ex);
    }
    return false;
}

Example 7 with ProofOfPossession

use of com.github.zhenwei.pkix.util.asn1.crmf.ProofOfPossession in project LinLong-Java by zhenwei1108.

the class CertificateRequestMessageBuilder method build.

public CertificateRequestMessage build() throws CRMFException {
    ASN1EncodableVector v = new ASN1EncodableVector();
    v.add(new ASN1Integer(certReqId));
    if (!extGenerator.isEmpty()) {
        templateBuilder.setExtensions(extGenerator.generate());
    }
    v.add(templateBuilder.build());
    if (!controls.isEmpty()) {
        ASN1EncodableVector controlV = new ASN1EncodableVector();
        for (Iterator it = controls.iterator(); it.hasNext(); ) {
            Control control = (Control) it.next();
            controlV.add(new AttributeTypeAndValue(control.getType(), control.getValue()));
        }
        v.add(new DERSequence(controlV));
    }
    CertRequest request = CertRequest.getInstance(new DERSequence(v));
    v = new ASN1EncodableVector();
    v.add(request);
    if (popSigner != null) {
        CertTemplate template = request.getCertTemplate();
        if (template.getSubject() == null || template.getPublicKey() == null) {
            SubjectPublicKeyInfo pubKeyInfo = request.getCertTemplate().getPublicKey();
            ProofOfPossessionSigningKeyBuilder builder = new ProofOfPossessionSigningKeyBuilder(pubKeyInfo);
            if (sender != null) {
                builder.setSender(sender);
            } else {
                PKMACValueGenerator pkmacGenerator = new PKMACValueGenerator(pkmacBuilder);
                builder.setPublicKeyMac(pkmacGenerator, password);
            }
            v.add(new ProofOfPossession(builder.build(popSigner)));
        } else {
            ProofOfPossessionSigningKeyBuilder builder = new ProofOfPossessionSigningKeyBuilder(request);
            v.add(new ProofOfPossession(builder.build(popSigner)));
        }
    } else if (popoPrivKey != null) {
        v.add(new ProofOfPossession(popoType, popoPrivKey));
    } else if (agreeMAC != null) {
        v.add(new ProofOfPossession(ProofOfPossession.TYPE_KEY_AGREEMENT, POPOPrivKey.getInstance(new DERTaggedObject(false, POPOPrivKey.agreeMAC, agreeMAC))));
    } else if (popRaVerified != null) {
        v.add(new ProofOfPossession());
    }
    return new CertificateRequestMessage(CertReqMsg.getInstance(new DERSequence(v)));
}