Examples with ASN1OctetString org.openecard.bouncycastle.asn1.ASN1OctetString used on opensource projects

Example 86 with ASN1OctetString

use of org.openecard.bouncycastle.asn1.ASN1OctetString in project zm-mailbox by Zimbra.

the class UBIDModificationList method modifyAttr.

@Override
public void modifyAttr(String name, String[] value, boolean containsBinaryData, boolean isBinaryTransfer) {
    List<ASN1OctetString> valuesToMod = new ArrayList<ASN1OctetString>();
    for (int i = 0; i < value.length; i++) {
        valuesToMod.add(UBIDUtil.newASN1OctetString(containsBinaryData, value[i]));
    }
    String transferAttrName = LdapUtil.attrNameToBinaryTransferAttrName(isBinaryTransfer, name);
    Modification mod = new Modification(ModificationType.REPLACE, transferAttrName, valuesToMod.toArray(new ASN1OctetString[valuesToMod.size()]));
    modList.add(mod);
}

Example 87 with ASN1OctetString

use of org.openecard.bouncycastle.asn1.ASN1OctetString in project ddf by codice.

the class SamlAssertionValidatorImpl method validateHolderOfKeyConfirmation.

private void validateHolderOfKeyConfirmation(SamlAssertionWrapper assertion, X509Certificate[] x509Certs) throws SecurityServiceException {
    List<String> confirmationMethods = assertion.getConfirmationMethods();
    boolean hasHokMethod = false;
    for (String method : confirmationMethods) {
        if (OpenSAMLUtil.isMethodHolderOfKey(method)) {
            hasHokMethod = true;
        }
    }
    if (hasHokMethod) {
        if (x509Certs != null && x509Certs.length > 0) {
            List<SubjectConfirmation> subjectConfirmations = assertion.getSaml2().getSubject().getSubjectConfirmations();
            for (SubjectConfirmation subjectConfirmation : subjectConfirmations) {
                if (OpenSAMLUtil.isMethodHolderOfKey(subjectConfirmation.getMethod())) {
                    Element dom = subjectConfirmation.getSubjectConfirmationData().getDOM();
                    Node keyInfo = dom.getFirstChild();
                    Node x509Data = keyInfo.getFirstChild();
                    Node dataNode = x509Data.getFirstChild();
                    Node dataText = dataNode.getFirstChild();
                    X509Certificate tlsCertificate = x509Certs[0];
                    if (dataNode.getLocalName().equals("X509Certificate")) {
                        String textContent = dataText.getTextContent();
                        byte[] byteValue = Base64.getMimeDecoder().decode(textContent);
                        try {
                            CertificateFactory cf = CertificateFactory.getInstance("X.509");
                            X509Certificate cert = (X509Certificate) cf.generateCertificate(new ByteArrayInputStream(byteValue));
                            // check that the certificate is still valid
                            cert.checkValidity();
                            // if the certs aren't the same, verify
                            if (!tlsCertificate.equals(cert)) {
                                // verify that the cert was signed by the same private key as the TLS cert
                                cert.verify(tlsCertificate.getPublicKey());
                            }
                        } catch (CertificateException | NoSuchAlgorithmException | InvalidKeyException | SignatureException | NoSuchProviderException e) {
                            throw new SecurityServiceException("Unable to validate Holder of Key assertion with certificate.");
                        }
                    } else if (dataNode.getLocalName().equals("X509SubjectName")) {
                        String textContent = dataText.getTextContent();
                        // the assertion.
                        if (!tlsCertificate.getSubjectDN().getName().equals(textContent)) {
                            throw new SecurityServiceException("Unable to validate Holder of Key assertion with subject DN.");
                        }
                    } else if (dataNode.getLocalName().equals("X509IssuerSerial")) {
                        // we have no way to support this confirmation type so we have to throw an error
                        throw new SecurityServiceException("Unable to validate Holder of Key assertion with issuer serial. NOT SUPPORTED");
                    } else if (dataNode.getLocalName().equals("X509SKI")) {
                        String textContent = dataText.getTextContent();
                        byte[] tlsSKI = tlsCertificate.getExtensionValue("2.5.29.14");
                        byte[] assertionSKI = Base64.getMimeDecoder().decode(textContent);
                        if (tlsSKI != null && tlsSKI.length > 0) {
                            ASN1OctetString tlsOs = ASN1OctetString.getInstance(tlsSKI);
                            ASN1OctetString assertionOs = ASN1OctetString.getInstance(assertionSKI);
                            SubjectKeyIdentifier tlsSubjectKeyIdentifier = SubjectKeyIdentifier.getInstance(tlsOs.getOctets());
                            SubjectKeyIdentifier assertSubjectKeyIdentifier = SubjectKeyIdentifier.getInstance(assertionOs.getOctets());
                            // assertion.
                            if (!Arrays.equals(tlsSubjectKeyIdentifier.getKeyIdentifier(), assertSubjectKeyIdentifier.getKeyIdentifier())) {
                                throw new SecurityServiceException("Unable to validate Holder of Key assertion with subject key identifier.");
                            }
                        } else {
                            throw new SecurityServiceException("Unable to validate Holder of Key assertion with subject key identifier.");
                        }
                    }
                }
            }
        } else {
            throw new SecurityServiceException("Holder of Key assertion, must be used with 2-way TLS.");
        }
    }
}

Example 88 with ASN1OctetString

use of org.openecard.bouncycastle.asn1.ASN1OctetString in project fabric-sdk-java by hyperledger.

the class HFCAClient method revokeInternal.

private String revokeInternal(User revoker, Enrollment enrollment, String reason, boolean genCRL) throws RevocationException, InvalidArgumentException {
    if (cryptoSuite == null) {
        throw new InvalidArgumentException("Crypto primitives not set.");
    }
    if (enrollment == null) {
        throw new InvalidArgumentException("revokee enrollment is not set");
    }
    if (revoker == null) {
        throw new InvalidArgumentException("revoker is not set");
    }
    logger.debug(format("revoke revoker: %s, reason: %s, url: %s", revoker.getName(), reason, url));
    try {
        setUpSSL();
        // get cert from to-be-revoked enrollment
        BufferedInputStream pem = new BufferedInputStream(new ByteArrayInputStream(enrollment.getCert().getBytes()));
        CertificateFactory certFactory = CertificateFactory.getInstance(Config.getConfig().getCertificateFormat());
        X509Certificate certificate = (X509Certificate) certFactory.generateCertificate(pem);
        // get its serial number
        String serial = DatatypeConverter.printHexBinary(certificate.getSerialNumber().toByteArray());
        // get its aki
        // 2.5.29.35 : AuthorityKeyIdentifier
        byte[] extensionValue = certificate.getExtensionValue(Extension.authorityKeyIdentifier.getId());
        ASN1OctetString akiOc = ASN1OctetString.getInstance(extensionValue);
        String aki = DatatypeConverter.printHexBinary(AuthorityKeyIdentifier.getInstance(akiOc.getOctets()).getKeyIdentifier());
        // build request body
        RevocationRequest req = new RevocationRequest(caName, null, serial, aki, reason, genCRL);
        String body = req.toJson();
        // send revoke request
        JsonObject resp = httpPost(url + HFCA_REVOKE, body, revoker);
        logger.debug("revoke done");
        if (genCRL) {
            if (resp.isEmpty()) {
                throw new RevocationException("Failed to return CRL, revoke response is empty");
            }
            if (resp.isNull("CRL")) {
                throw new RevocationException("Failed to return CRL");
            }
            return resp.getString("CRL");
        }
        return null;
    } catch (CertificateException e) {
        logger.error("Cannot validate certificate. Error is: " + e.getMessage());
        throw new RevocationException("Error while revoking cert. " + e.getMessage(), e);
    } catch (Exception e) {
        logger.error(e.getMessage(), e);
        throw new RevocationException("Error while revoking the user. " + e.getMessage(), e);
    }
}

Example 89 with ASN1OctetString

use of org.openecard.bouncycastle.asn1.ASN1OctetString in project oxAuth by GluuFederation.

the class OCSPCertificateVerifier method getExtensionValue.

/**
 * @param certificate
 *            the certificate from which we need the ExtensionValue
 * @param oid
 *            the Object Identifier value for the extension.
 * @return the extension value as an ASN1Primitive object
 * @throws IOException
 */
private static ASN1Primitive getExtensionValue(X509Certificate certificate, String oid) throws IOException {
    byte[] bytes = certificate.getExtensionValue(oid);
    if (bytes == null) {
        return null;
    }
    ASN1InputStream aIn = new ASN1InputStream(new ByteArrayInputStream(bytes));
    ASN1OctetString octs = (ASN1OctetString) aIn.readObject();
    aIn = new ASN1InputStream(new ByteArrayInputStream(octs.getOctets()));
    return aIn.readObject();
}

Example 90 with ASN1OctetString

use of org.openecard.bouncycastle.asn1.ASN1OctetString in project open-ecard by ecsec.

the class ExplicitDomainParameters method loadECDHParameter.

private void loadECDHParameter(ASN1Sequence seq) {
    // ASN1Integer version = (ASN1Integer) seq.getObjectAt(0);
    // ASN1Sequence modulus = (ASN1Sequence) seq.getObjectAt(1);
    // ASN1Sequence coefficient = (ASN1Sequence) seq.getObjectAt(2);
    // ASN1OctetString basepoint = (ASN1OctetString) seq.getObjectAt(3);
    ASN1Integer order = (ASN1Integer) seq.getObjectAt(4);
    ASN1Integer cofactor = (ASN1Integer) seq.getObjectAt(5);
    try {
        // BigInteger p = new BigInteger(modulus.getObjectAt(1).toASN1Primitive().getEncoded());
        // BigInteger a = new BigInteger(coefficient.getObjectAt(0).toASN1Primitive().getEncoded());
        // BigInteger b = new BigInteger(coefficient.getObjectAt(1).toASN1Primitive().getEncoded());
        BigInteger r = order.getValue();
        BigInteger f = cofactor.getValue();
        X9ECParameters ECParameters = X9ECParameters.getInstance(seq);
        ECCurve curve = ECParameters.getCurve();
        domainParameter = new ECParameterSpec(curve, ECParameters.getG(), r, f);
    } catch (Exception e) {
        _logger.error("Failed to load proprietary domain parameters", e);
    }
}