Example usage for org.bouncycastle.asn1 ASN1InputStream readObject

Introduction

In this page you can find the example usage for org.bouncycastle.asn1 ASN1InputStream readObject.

Prototype

public ASN1Primitive readObject() throws IOException 

Source Link

Usage

From source file:at.asitplus.regkassen.common.util.CryptoUtil.java

License:Apache License

/**
 * Helper method to convert DER-encoded signature values (e.g. used by Java)
 * to concatenated signature values/*from w ww  .  ja va2s  . c o  m*/
 * (as used by the JWS-standard)
 *
 * @param derEncodedSignatureValue
 *          DER-encoded signature value
 * @return concatenated signature value (as used by JWS standard)
 * @throws IOException
 */
public static byte[] convertDEREncodedSignatureToJWSConcatenated(final byte[] derEncodedSignatureValue)
        throws IOException {
    final ASN1InputStream asn1InputStream = new ASN1InputStream(derEncodedSignatureValue);
    final ASN1Primitive asn1Primitive = asn1InputStream.readObject();
    asn1InputStream.close();
    final ASN1Sequence asn1Sequence = (ASN1Sequence.getInstance(asn1Primitive));
    final ASN1Integer rASN1 = (ASN1Integer) asn1Sequence.getObjectAt(0);
    final ASN1Integer sASN1 = (ASN1Integer) asn1Sequence.getObjectAt(1);
    final X9IntegerConverter x9IntegerConverter = new X9IntegerConverter();
    final byte[] r = x9IntegerConverter.integerToBytes(rASN1.getValue(), 32);
    final byte[] s = x9IntegerConverter.integerToBytes(sASN1.getValue(), 32);

    final byte[] concatenatedSignatureValue = new byte[64];
    System.arraycopy(r, 0, concatenatedSignatureValue, 0, 32);
    System.arraycopy(s, 0, concatenatedSignatureValue, 32, 32);

    return concatenatedSignatureValue;
}

---

From source file:at.asitplus.regkassen.core.base.util.CryptoUtil.java

License:Apache License

/**
 * Helper method to convert DER-encoded signature values (e.g. used by Java) to concatenated signature values
 * (as used by the JWS-standard)//from w  w w.  ja v  a2  s .com
 *
 * @param derEncodedSignatureValue DER-encoded signature value
 * @return concatenated signature value (as used by JWS standard)
 * @throws IOException
 */
public static byte[] convertDEREncodedSignatureToJWSConcatenated(byte[] derEncodedSignatureValue)
        throws IOException {
    ASN1InputStream asn1InputStream = new ASN1InputStream(derEncodedSignatureValue);
    ASN1Primitive asn1Primitive = asn1InputStream.readObject();
    ASN1Sequence asn1Sequence = (ASN1Sequence.getInstance(asn1Primitive));
    ASN1Integer rASN1 = (ASN1Integer) asn1Sequence.getObjectAt(0);
    ASN1Integer sASN1 = (ASN1Integer) asn1Sequence.getObjectAt(1);
    X9IntegerConverter x9IntegerConverter = new X9IntegerConverter();
    byte[] r = x9IntegerConverter.integerToBytes(rASN1.getValue(), 32);
    byte[] s = x9IntegerConverter.integerToBytes(sASN1.getValue(), 32);

    byte[] concatenatedSignatureValue = new byte[64];
    System.arraycopy(r, 0, concatenatedSignatureValue, 0, 32);
    System.arraycopy(s, 0, concatenatedSignatureValue, 32, 32);

    return concatenatedSignatureValue;
}

---

From source file:be.fedict.commons.eid.consumer.BeIDIntegrity.java

License:Open Source License

private boolean __verifyNonRepSignature(final byte[] expectedDigestValue, final byte[] signatureValue,
        final X509Certificate certificate) throws NoSuchAlgorithmException, NoSuchPaddingException,
        InvalidKeyException, IllegalBlockSizeException, BadPaddingException, IOException {
    final PublicKey publicKey = certificate.getPublicKey();

    final Cipher cipher = Cipher.getInstance("RSA");
    cipher.init(Cipher.DECRYPT_MODE, publicKey);
    final byte[] actualSignatureDigestInfoValue = cipher.doFinal(signatureValue);

    final ASN1InputStream asnInputStream = new ASN1InputStream(actualSignatureDigestInfoValue);
    final DigestInfo actualSignatureDigestInfo = new DigestInfo((ASN1Sequence) asnInputStream.readObject());
    asnInputStream.close();//from  w  w w.j  a v a  2 s . c o m

    final byte[] actualDigestValue = actualSignatureDigestInfo.getDigest();
    return Arrays.equals(expectedDigestValue, actualDigestValue);
}

---

From source file:be.fedict.eid.applet.service.impl.handler.AuthenticationDataMessageHandler.java

License:Open Source License

public Object handleMessage(AuthenticationDataMessage message, Map<String, String> httpHeaders,
        HttpServletRequest request, HttpSession session) throws ServletException {
    LOG.debug("authentication data message received");

    if (null == message.authnCert) {
        /*/* www  .  j  a  v a 2  s.c o m*/
         * Can be the case for future (Kids) eID cards that have some
         * certificates missing.
         */
        String msg = "authentication certificate not present";
        LOG.warn(msg);
        throw new ServletException(msg);
    }
    byte[] signatureValue = message.signatureValue;
    LOG.debug("authn signing certificate subject: " + message.authnCert.getSubjectX500Principal());
    PublicKey signingKey = message.authnCert.getPublicKey();

    if (this.sessionIdChannelBinding) {
        checkSessionIdChannelBinding(message, request);
        if (null == this.serverCertificate) {
            LOG.warn("adviced to use in combination with server certificate channel binding");
        }
    }

    ChannelBindingService channelBindingService = this.channelBindingServiceLocator.locateService();
    if (null != this.serverCertificate || null != channelBindingService) {
        LOG.debug("using server certificate channel binding");
    }

    if (false == this.sessionIdChannelBinding && null == this.serverCertificate
            && null == channelBindingService) {
        LOG.warn("not using any secure channel binding");
    }

    byte[] challenge;
    try {
        challenge = AuthenticationChallenge.getAuthnChallenge(session, this.maxMaturity);
    } catch (SecurityException e) {
        AuditService auditService = this.auditServiceLocator.locateService();
        if (null != auditService) {
            String remoteAddress = request.getRemoteAddr();
            auditService.authenticationError(remoteAddress, message.authnCert);
        }
        throw new ServletException("security error: " + e.getMessage(), e);
    }

    byte[] serverCertificateClientPOV = null;
    try {
        if (null != message.serverCertificate) {
            serverCertificateClientPOV = message.serverCertificate.getEncoded();
        }
    } catch (CertificateEncodingException e) {
        throw new ServletException("server cert decoding error: " + e.getMessage(), e);
    }
    /*
     * We validate the authentication contract using the client-side
     * communicated server SSL certificate in case of secure channel
     * binding.
     */
    AuthenticationContract authenticationContract = new AuthenticationContract(message.saltValue, this.hostname,
            this.inetAddress, message.sessionId, serverCertificateClientPOV, challenge);
    byte[] toBeSigned;
    try {
        toBeSigned = authenticationContract.calculateToBeSigned();
    } catch (IOException e) {
        throw new ServletException("IO error: " + e.getMessage(), e);
    }

    try {
        Signature signature = Signature.getInstance("SHA1withRSA");
        signature.initVerify(signingKey);
        signature.update(toBeSigned);
        boolean result = signature.verify(signatureValue);
        if (false == result) {
            AuditService auditService = this.auditServiceLocator.locateService();
            if (null != auditService) {
                String remoteAddress = request.getRemoteAddr();
                auditService.authenticationError(remoteAddress, message.authnCert);
            }
            throw new SecurityException("authn signature incorrect");
        }
    } catch (NoSuchAlgorithmException e) {
        throw new SecurityException("algo error");
    } catch (InvalidKeyException e) {
        throw new SecurityException("authn key error");
    } catch (SignatureException e) {
        throw new SecurityException("signature error");
    }

    RequestContext requestContext = new RequestContext(session);
    String transactionMessage = requestContext.getTransactionMessage();
    if (null != transactionMessage) {
        LOG.debug("verifying TransactionMessage signature");
        byte[] transactionMessageSignature = message.transactionMessageSignature;
        if (null == transactionMessageSignature) {
            throw new SecurityException("missing TransactionMessage signature");
        }
        try {
            Cipher cipher = Cipher.getInstance("RSA/ECB/PKCS1Padding");
            cipher.init(Cipher.DECRYPT_MODE, signingKey);
            byte[] signatureDigestInfoValue = cipher.doFinal(transactionMessageSignature);
            ASN1InputStream aIn = new ASN1InputStream(signatureDigestInfoValue);
            DigestInfo signatureDigestInfo = new DigestInfo((ASN1Sequence) aIn.readObject());
            if (false == PLAIN_TEXT_DIGEST_ALGO_OID
                    .equals(signatureDigestInfo.getAlgorithmId().getObjectId().getId())) {
                throw new SecurityException("TransactionMessage signature algo OID incorrect");
            }
            if (false == Arrays.equals(transactionMessage.getBytes(), signatureDigestInfo.getDigest())) {
                throw new SecurityException("signed TransactionMessage incorrect");
            }
            LOG.debug("TransactionMessage signature validated");
        } catch (Exception e) {
            LOG.error("error verifying TransactionMessage signature", e);
            AuditService auditService = this.auditServiceLocator.locateService();
            if (null != auditService) {
                String remoteAddress = request.getRemoteAddr();
                auditService.authenticationError(remoteAddress, message.authnCert);
            }
            throw new SecurityException("error verifying TransactionMessage signature: " + e.getMessage());
        }
    }

    /*
     * Secure channel binding verification.
     */
    if (null != channelBindingService) {
        X509Certificate serverCertificate = channelBindingService.getServerCertificate();
        if (null == serverCertificate) {
            LOG.warn("could not verify secure channel binding as the server does not know its identity yet");
        } else {
            if (false == serverCertificate.equals(message.serverCertificate)) {
                AuditService auditService = this.auditServiceLocator.locateService();
                if (null != auditService) {
                    String remoteAddress = request.getRemoteAddr();
                    auditService.authenticationError(remoteAddress, message.authnCert);
                }
                throw new SecurityException("secure channel binding identity mismatch");
            }
            LOG.debug("secure channel binding verified");
        }
    } else {
        if (null != this.serverCertificate) {
            if (false == this.serverCertificate.equals(message.serverCertificate)) {
                AuditService auditService = this.auditServiceLocator.locateService();
                if (null != auditService) {
                    String remoteAddress = request.getRemoteAddr();
                    auditService.authenticationError(remoteAddress, message.authnCert);
                }
                throw new SecurityException("secure channel binding identity mismatch");
            }
            LOG.debug("secure channel binding verified");
        }
    }

    AuthenticationService authenticationService = this.authenticationServiceLocator.locateService();
    List<X509Certificate> certificateChain = new LinkedList<X509Certificate>();
    certificateChain.add(message.authnCert);
    certificateChain.add(message.citizenCaCert);
    certificateChain.add(message.rootCaCert);
    try {
        authenticationService.validateCertificateChain(certificateChain);
    } catch (ExpiredCertificateSecurityException e) {
        return new FinishedMessage(ErrorCode.CERTIFICATE_EXPIRED);
    } catch (RevokedCertificateSecurityException e) {
        return new FinishedMessage(ErrorCode.CERTIFICATE_REVOKED);
    } catch (TrustCertificateSecurityException e) {
        return new FinishedMessage(ErrorCode.CERTIFICATE_NOT_TRUSTED);
    } catch (CertificateSecurityException e) {
        return new FinishedMessage(ErrorCode.CERTIFICATE);
    } catch (Exception e) {
        /*
         * We don't want to depend on the full JavaEE profile in this
         * artifact.
         */
        if ("javax.ejb.EJBException".equals(e.getClass().getName())) {
            Exception exception;
            try {
                Method getCausedByExceptionMethod = e.getClass().getMethod("getCausedByException",
                        new Class[] {});
                exception = (Exception) getCausedByExceptionMethod.invoke(e, new Object[] {});
            } catch (Exception e2) {
                LOG.debug("error: " + e.getMessage(), e);
                throw new SecurityException("error retrieving the root cause: " + e2.getMessage());
            }
            if (exception instanceof ExpiredCertificateSecurityException) {
                return new FinishedMessage(ErrorCode.CERTIFICATE_EXPIRED);
            }
            if (exception instanceof RevokedCertificateSecurityException) {
                return new FinishedMessage(ErrorCode.CERTIFICATE_REVOKED);
            }
            if (exception instanceof TrustCertificateSecurityException) {
                return new FinishedMessage(ErrorCode.CERTIFICATE_NOT_TRUSTED);
            }
            if (exception instanceof CertificateSecurityException) {
                return new FinishedMessage(ErrorCode.CERTIFICATE);
            }
        }
        throw new SecurityException("authn service error: " + e.getMessage());
    }

    String userId = UserIdentifierUtil.getUserId(message.authnCert);
    LOG.info("authenticated: " + userId + " @ " + request.getRemoteAddr());
    if (null != this.nrcidSecret) {
        userId = UserIdentifierUtil.getNonReversibleCitizenIdentifier(userId, this.nrcidOrgId, this.nrcidAppId,
                this.nrcidSecret);
    }
    /*
     * Some people state that you cannot use the national register number
     * without hashing. Problem is that hashing introduces hash collision
     * problems. The probability is very low, but what if it's your leg
     * they're cutting of because of a patient mismatch based on the SHA1 of
     * your national register number?
     */

    /*
     * Push authenticated used Id into the HTTP session.
     */
    session.setAttribute(AUTHENTICATED_USER_IDENTIFIER_SESSION_ATTRIBUTE, userId);

    EIdData eidData = (EIdData) session.getAttribute(IdentityDataMessageHandler.EID_SESSION_ATTRIBUTE);
    if (null == eidData) {
        eidData = new EIdData();
        session.setAttribute(IdentityDataMessageHandler.EID_SESSION_ATTRIBUTE, eidData);
    }
    eidData.identifier = userId;

    AuditService auditService = this.auditServiceLocator.locateService();
    if (null != auditService) {
        auditService.authenticated(userId);
    }

    boolean includeIdentity = requestContext.includeIdentity();
    boolean includeAddress = requestContext.includeAddress();
    boolean includeCertificates = requestContext.includeCertificates();
    boolean includePhoto = requestContext.includePhoto();

    /*
     * Also process the identity data in case it was requested.
     */
    if (includeIdentity) {
        if (null == message.identityData) {
            throw new ServletException("identity data not included while requested");
        }
    }
    if (includeAddress) {
        if (null == message.addressData) {
            throw new ServletException("address data not included while requested");
        }
    }
    if (includePhoto) {
        if (null == message.photoData) {
            throw new ServletException("photo data not included while requested");
        }
    }
    IdentityIntegrityService identityIntegrityService = this.identityIntegrityServiceLocator.locateService();
    if (null != identityIntegrityService) {
        if (null == message.rrnCertificate) {
            throw new ServletException("national registry certificate not included while requested");
        }
        List<X509Certificate> rrnCertificateChain = new LinkedList<X509Certificate>();
        rrnCertificateChain.add(message.rrnCertificate);
        rrnCertificateChain.add(message.rootCaCert);

        try {
            identityIntegrityService.checkNationalRegistrationCertificate(rrnCertificateChain);
        } catch (ExpiredCertificateSecurityException e) {
            return new FinishedMessage(ErrorCode.CERTIFICATE_EXPIRED);
        } catch (RevokedCertificateSecurityException e) {
            return new FinishedMessage(ErrorCode.CERTIFICATE_REVOKED);
        } catch (TrustCertificateSecurityException e) {
            return new FinishedMessage(ErrorCode.CERTIFICATE_NOT_TRUSTED);
        } catch (CertificateSecurityException e) {
            return new FinishedMessage(ErrorCode.CERTIFICATE);
        } catch (Exception e) {
            if ("javax.ejb.EJBException".equals(e.getClass().getName())) {
                Exception exception;
                try {
                    Method getCausedByExceptionMethod = e.getClass().getMethod("getCausedByException",
                            new Class[] {});
                    exception = (Exception) getCausedByExceptionMethod.invoke(e, new Object[] {});
                } catch (Exception e2) {
                    LOG.debug("error: " + e.getMessage(), e);
                    throw new SecurityException("error retrieving the root cause: " + e2.getMessage());
                }
                if (exception instanceof ExpiredCertificateSecurityException) {
                    return new FinishedMessage(ErrorCode.CERTIFICATE_EXPIRED);
                }
                if (exception instanceof RevokedCertificateSecurityException) {
                    return new FinishedMessage(ErrorCode.CERTIFICATE_REVOKED);
                }
                if (exception instanceof TrustCertificateSecurityException) {
                    return new FinishedMessage(ErrorCode.CERTIFICATE_NOT_TRUSTED);
                }
                if (exception instanceof CertificateSecurityException) {
                    return new FinishedMessage(ErrorCode.CERTIFICATE);
                }
            }
            throw new SecurityException("error checking the NRN certificate: " + e.getMessage(), e);
        }

        PublicKey rrnPublicKey = message.rrnCertificate.getPublicKey();
        if (includeIdentity) {
            if (null == message.identitySignatureData) {
                throw new ServletException("identity signature data not included while requested");
            }
            verifySignature(message.rrnCertificate.getSigAlgName(), message.identitySignatureData, rrnPublicKey,
                    request, message.identityData);
        }
        if (includeAddress) {
            if (null == message.addressSignatureData) {
                throw new ServletException("address signature data not included while requested");
            }
            byte[] addressFile = trimRight(message.addressData);
            verifySignature(message.rrnCertificate.getSigAlgName(), message.addressSignatureData, rrnPublicKey,
                    request, addressFile, message.identitySignatureData);
        }
    }
    if (includeIdentity) {
        Identity identity = TlvParser.parse(message.identityData, Identity.class);
        if (false == UserIdentifierUtil.getUserId(message.authnCert).equals(identity.nationalNumber)) {
            throw new ServletException("national number mismatch");
        }
        session.setAttribute(IdentityDataMessageHandler.IDENTITY_SESSION_ATTRIBUTE, identity);
        eidData.identity = identity;
        auditService = this.auditServiceLocator.locateService();
        if (null != auditService) {
            auditService.identified(identity.nationalNumber);
        }
    }
    if (includeAddress) {
        Address address = TlvParser.parse(message.addressData, Address.class);
        session.setAttribute(IdentityDataMessageHandler.ADDRESS_SESSION_ATTRIBUTE, address);
        eidData.address = address;
    }
    if (includePhoto) {
        if (includeIdentity) {
            byte[] expectedPhotoDigest = eidData.identity.photoDigest;
            byte[] actualPhotoDigest = digestPhoto(getDigestAlgo(expectedPhotoDigest.length),
                    message.photoData);
            if (false == Arrays.equals(expectedPhotoDigest, actualPhotoDigest)) {
                throw new ServletException("photo digest incorrect");
            }
        }
        session.setAttribute(IdentityDataMessageHandler.PHOTO_SESSION_ATTRIBUTE, message.photoData);
        eidData.photo = message.photoData;
    }
    if (includeCertificates) {
        if (includeIdentity) {
            eidData.certs = new EIdCertsData();
            eidData.certs.authn = message.authnCert;
            eidData.certs.ca = message.citizenCaCert;
            eidData.certs.root = message.rootCaCert;
            eidData.certs.sign = message.signCert;
        }
        session.setAttribute(IdentityDataMessageHandler.AUTHN_CERT_SESSION_ATTRIBUTE, message.authnCert);
        session.setAttribute(IdentityDataMessageHandler.CA_CERT_SESSION_ATTRIBUTE, message.citizenCaCert);
        session.setAttribute(IdentityDataMessageHandler.ROOT_CERT_SESSION_ATTRIBTUE, message.rootCaCert);
        session.setAttribute(IdentityDataMessageHandler.SIGN_CERT_SESSION_ATTRIBUTE, message.signCert);
    }

    if (this.includeDataFiles) {
        session.setAttribute(IdentityDataMessageHandler.EID_DATA_IDENTITY_SESSION_ATTRIBUTE,
                message.identityData);
        session.setAttribute(IdentityDataMessageHandler.EID_DATA_ADDRESS_SESSION_ATTRIBUTE,
                message.addressData);
    }

    AuthenticationSignatureService authenticationSignatureService = this.authenticationSignatureServiceLocator
            .locateService();
    if (null != authenticationSignatureService) {
        List<X509Certificate> authnCertificateChain;
        if (null != message.authnCert) {
            authnCertificateChain = new LinkedList<X509Certificate>();
            authnCertificateChain.add(message.authnCert);
            authnCertificateChain.add(message.citizenCaCert);
            authnCertificateChain.add(message.rootCaCert);
        } else {
            authnCertificateChain = null;
        }
        AuthenticationSignatureContext authenticationSignatureContext = new AuthenticationSignatureContextImpl(
                session);
        PreSignResult preSignResult = authenticationSignatureService.preSign(authnCertificateChain,
                authenticationSignatureContext);
        if (null == preSignResult) {
            return new FinishedMessage();
        }
        boolean logoff = preSignResult.getLogoff();
        byte[] computedDigestValue = preSignResult.getDigestInfo().digestValue;
        String digestAlgo = preSignResult.getDigestInfo().digestAlgo;
        String authnMessage = preSignResult.getDigestInfo().description;
        AuthSignRequestMessage authSignRequestMessage = new AuthSignRequestMessage(computedDigestValue,
                digestAlgo, authnMessage, logoff);
        return authSignRequestMessage;
    }
    return new FinishedMessage();
}

---

From source file:be.fedict.eid.applet.service.signer.facets.XAdESXLSignatureFacet.java

License:Open Source License

private BigInteger getCrlNumber(X509CRL crl) {
    byte[] crlNumberExtensionValue = crl.getExtensionValue(X509Extensions.CRLNumber.getId());
    if (null == crlNumberExtensionValue) {
        return null;
    }//from   ww w.  j  av  a  2s .c  o m
    try {
        ASN1InputStream asn1InputStream = new ASN1InputStream(crlNumberExtensionValue);
        ASN1OctetString octetString = (ASN1OctetString) asn1InputStream.readObject();
        byte[] octets = octetString.getOctets();
        DERInteger integer = (DERInteger) new ASN1InputStream(octets).readObject();
        BigInteger crlNumber = integer.getPositiveValue();
        return crlNumber;
    } catch (IOException e) {
        throw new RuntimeException("I/O error: " + e.getMessage(), e);
    }
}

---

From source file:be.fedict.eid.tsl.Tsl2PdfExporter.java

License:Open Source License

private static List<String> getCrlDistributionPoints(final X509Certificate cert) throws IOException {
    final byte[] extValue = cert.getExtensionValue(X509Extensions.CRLDistributionPoints.getId());
    if (extValue != null) {
        final ASN1InputStream oAsnInStream = new ASN1InputStream(new ByteArrayInputStream(extValue));
        final DERObject derObj = oAsnInStream.readObject();
        final DEROctetString dos = (DEROctetString) derObj;
        final byte[] val2 = dos.getOctets();
        final ASN1InputStream oAsnInStream2 = new ASN1InputStream(new ByteArrayInputStream(val2));
        final DERObject derObj2 = oAsnInStream2.readObject();
        return getDERValue(derObj2);
    } else {//w  w  w .  jav a 2  s  . c om
        return Collections.emptyList();
    }
}

---

From source file:be.fedict.trust.constraints.CodeSigningCertificateConstraint.java

License:Open Source License

@Override
public void check(X509Certificate certificate) throws TrustLinkerResultException, Exception {
    byte[] extension = certificate.getExtensionValue(Extension.extendedKeyUsage.getId());
    if (null == extension) {
        throw new TrustLinkerResultException(TrustLinkerResultReason.CONSTRAINT_VIOLATION,
                "missing ExtendedKeyUsage extension");
    }//from   w w w. ja va 2s . c  o  m
    if (false == certificate.getCriticalExtensionOIDs().contains(Extension.extendedKeyUsage.getId())) {
        throw new TrustLinkerResultException(TrustLinkerResultReason.CONSTRAINT_VIOLATION,
                "ExtendedKeyUsage should be critical");
    }
    ASN1InputStream asn1InputStream = new ASN1InputStream(new ByteArrayInputStream(extension));
    asn1InputStream = new ASN1InputStream(
            new ByteArrayInputStream(((ASN1OctetString) asn1InputStream.readObject()).getOctets()));
    ExtendedKeyUsage extendedKeyUsage = ExtendedKeyUsage.getInstance(asn1InputStream.readObject());
    if (false == extendedKeyUsage.hasKeyPurposeId(KeyPurposeId.id_kp_codeSigning)) {
        throw new TrustLinkerResultException(TrustLinkerResultReason.CONSTRAINT_VIOLATION,
                "missing codeSigning ExtendedKeyUsage");
    }
    if (1 != extendedKeyUsage.size()) {
        throw new TrustLinkerResultException(TrustLinkerResultReason.CONSTRAINT_VIOLATION,
                "ExtendedKeyUsage not solely codeSigning");
    }
}

---

From source file:be.fedict.trust.service.bean.HarvesterMDB.java

License:Open Source License

/**
 * Added for as {@link X509CRL#getRevokedCertificates()} is memory intensive
 * because it is returning a complete set, for huge CRL's this can get kinda
 * out of hand. So we return an enumeration of the DER
 * {@link TBSCertList.CRLEntry} objects.
 * /*from  w ww.  j av  a  2  s  . c  o  m*/
 * @param crl
 *            the CRL
 * @return {@link Enumeration} of {@link TBSCertList.CRLEntry}'s.
 * @throws IOException
 *             something went wrong parsing.
 * @throws CRLException
 *             something went wrong parsing.
 */
@SuppressWarnings("unchecked")
private Enumeration<TBSCertList.CRLEntry> getRevokedCertificatesEnum(X509CRL crl)
        throws IOException, CRLException {
    byte[] certList = crl.getTBSCertList();
    ByteArrayInputStream bais = new ByteArrayInputStream(certList);
    ASN1InputStream aIn = new ASN1InputStream(bais, Integer.MAX_VALUE, true);
    ASN1Sequence seq = (ASN1Sequence) aIn.readObject();
    TBSCertList cl = TBSCertList.getInstance(seq);
    return cl.getRevokedCertificateEnumeration();
}

---

From source file:bluecrystal.bcdeps.helper.DerEncoder.java

License:Open Source License

private static DLSequence getEncodedIssuer(final byte[] enc) {
    try {/*from  w  ww .j  av  a 2s  . c  om*/
        final ASN1InputStream in = new ASN1InputStream(new ByteArrayInputStream(enc));
        final ASN1Sequence seq = (ASN1Sequence) in.readObject();
        return (DLSequence) seq.getObjectAt(seq.getObjectAt(0) instanceof DERTaggedObject ? 3 : 2);
    } catch (final IOException e) {
        return null;
    }
}

---

From source file:bluecrystal.bcdeps.helper.DerEncoder.java

License:Open Source License

private void buildCerts(ASN1EncodableVector body, List<X509Certificate> chain)
        throws IOException, CertificateEncodingException {
    // -------- Certificados
    ASN1EncodableVector certVector = new ASN1EncodableVector();
    for (X509Certificate next : chain) {

        ASN1InputStream tempstream = new ASN1InputStream(new ByteArrayInputStream(next.getEncoded()));
        certVector.add(tempstream.readObject()); // 5 CERT (SEQ)
    }/*from  w  w  w  .j  a v  a  2 s.  com*/

    final DERSet dercertificates = new DERSet(certVector); // 4 SET
    body.add(new DERTaggedObject(false, 0, dercertificates)); // 3 CS
}

---

• «
• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23
• 24
• 25
• 26
• 27
• 28
• 29
• 30
• 31
• 32
• 33
• 34
• 35
• 36
• 37
• 38
• 39
• 40
• 41
• 42
• 43
• 44
• 45
• 46
• 47
• 48
• 49
• 50
• »