Botan 1.10.17

x509_ca.cpp
Go to the documentation of this file.
1 /*
2 * X.509 Certificate Authority
3 * (C) 1999-2010 Jack Lloyd
4 *
5 * Distributed under the terms of the Botan license
6 */
7
8 #include <botan/x509_ca.h>
9 #include <botan/pubkey.h>
10 #include <botan/der_enc.h>
11 #include <botan/ber_dec.h>
12 #include <botan/bigint.h>
13 #include <botan/parsing.h>
14 #include <botan/lookup.h>
15 #include <botan/oids.h>
16 #include <botan/time.h>
17 #include <algorithm>
18 #include <typeinfo>
19 #include <iterator>
20 #include <memory>
21 #include <set>
22
23 namespace Botan {
24
25 /*
26 * Load the certificate and private key
27 */
28 X509_CA::X509_CA(const X509_Certificate& c,
29 const Private_Key& key,
30 const std::string& hash_fn) : cert(c)
31 {
32 if(!cert.is_CA_cert())
33 throw Invalid_Argument("X509_CA: This certificate is not for a CA");
34
35 signer = choose_sig_format(key, hash_fn, ca_sig_algo);
36 }
37
38 /*
39 * X509_CA Destructor
40 */
41 X509_CA::~X509_CA()
42 {
43 delete signer;
44 }
45
46 /*
47 * Sign a PKCS #10 certificate request
48 */
49 X509_Certificate X509_CA::sign_request(const PKCS10_Request& req,
50 RandomNumberGenerator& rng,
51 const X509_Time& not_before,
52 const X509_Time& not_after)
53 {
54 Key_Constraints constraints;
55 if(req.is_CA())
56 constraints = Key_Constraints(KEY_CERT_SIGN | CRL_SIGN);
57 else
58 {
59 std::auto_ptr<Public_Key> key(req.subject_public_key());
60 constraints = X509::find_constraints(*key, req.constraints());
61 }
62
63 Extensions extensions;
64
65 extensions.add(
66 new Cert_Extension::Basic_Constraints(req.is_CA(), req.path_limit()),
67 true);
68
69 extensions.add(new Cert_Extension::Key_Usage(constraints), true);
70
71 extensions.add(new Cert_Extension::Authority_Key_ID(cert.subject_key_id()));
72 extensions.add(new Cert_Extension::Subject_Key_ID(req.raw_public_key()));
73
74 extensions.add(
75 new Cert_Extension::Subject_Alternative_Name(req.subject_alt_name()));
76
77 extensions.add(
78 new Cert_Extension::Extended_Key_Usage(req.ex_constraints()));
79
80 return make_cert(signer, rng, ca_sig_algo,
81 req.raw_public_key(),
82 not_before, not_after,
83 cert.subject_dn(), req.subject_dn(),
84 extensions);
85 }
86
87 /*
88 * Create a new certificate
89 */
90 X509_Certificate X509_CA::make_cert(PK_Signer* signer,
91 RandomNumberGenerator& rng,
92 const AlgorithmIdentifier& sig_algo,
93 const MemoryRegion<byte>& pub_key,
94 const X509_Time& not_before,
95 const X509_Time& not_after,
96 const X509_DN& issuer_dn,
97 const X509_DN& subject_dn,
98 const Extensions& extensions)
99 {
100 const size_t X509_CERT_VERSION = 3;
101 const size_t SERIAL_BITS = 128;
102
103 BigInt serial_no(rng, SERIAL_BITS);
104
105 DataSource_Memory source(X509_Object::make_signed(signer, rng, sig_algo,
106 DER_Encoder().start_cons(SEQUENCE)
107 .start_explicit(0)
108 .encode(X509_CERT_VERSION-1)
109 .end_explicit()
110
111 .encode(serial_no)
112
113 .encode(sig_algo)
114 .encode(issuer_dn)
115
116 .start_cons(SEQUENCE)
117 .encode(not_before)
118 .encode(not_after)
119 .end_cons()
120
121 .encode(subject_dn)
122 .raw_bytes(pub_key)
123
124 .start_explicit(3)
125 .start_cons(SEQUENCE)
126 .encode(extensions)
127 .end_cons()
128 .end_explicit()
129 .end_cons()
130 .get_contents()
131 ));
132
133 return X509_Certificate(source);
134 }
135
136 /*
137 * Create a new, empty CRL
138 */
139 X509_CRL X509_CA::new_crl(RandomNumberGenerator& rng,
140 u32bit next_update) const
141 {
142 std::vector<CRL_Entry> empty;
143 return make_crl(empty, 1, next_update, rng);
144 }
145
146 /*
147 * Update a CRL with new entries
148 */
149 X509_CRL X509_CA::update_crl(const X509_CRL& crl,
150 const std::vector<CRL_Entry>& new_revoked,
151 RandomNumberGenerator& rng,
152 u32bit next_update) const
153 {
154 std::vector<CRL_Entry> revoked = crl.get_revoked();
155
156 std::copy(new_revoked.begin(), new_revoked.end(),
157 std::back_inserter(revoked));
158
159 return make_crl(revoked, crl.crl_number() + 1, next_update, rng);
160 }
161
162 /*
163 * Create a CRL
164 */
165 X509_CRL X509_CA::make_crl(const std::vector<CRL_Entry>& revoked,
166 u32bit crl_number, u32bit next_update,
167 RandomNumberGenerator& rng) const
168 {
169 const size_t X509_CRL_VERSION = 2;
170
171 if(next_update == 0)
172 next_update = timespec_to_u32bit("7d");
173
174 // Totally stupid: ties encoding logic to the return of std::time!!
175 const u64bit current_time = system_time();
176
177 Extensions extensions;
178 extensions.add(
179 new Cert_Extension::Authority_Key_ID(cert.subject_key_id()));
180 extensions.add(new Cert_Extension::CRL_Number(crl_number));
181
182 DataSource_Memory source(X509_Object::make_signed(signer, rng, ca_sig_algo,
183 DER_Encoder().start_cons(SEQUENCE)
184 .encode(X509_CRL_VERSION-1)
185 .encode(ca_sig_algo)
186 .encode(cert.issuer_dn())
187 .encode(X509_Time(current_time))
188 .encode(X509_Time(current_time + next_update))
189 .encode_if(revoked.size() > 0,
190 DER_Encoder()
191 .start_cons(SEQUENCE)
192 .encode_list(revoked)
193 .end_cons()
194 )
195 .start_explicit(0)
196 .start_cons(SEQUENCE)
197 .encode(extensions)
198 .end_cons()
199 .end_explicit()
200 .end_cons()
201 .get_contents()
202 ));
203
204 return X509_CRL(source);
205 }
206
207 /*
208 * Return the CA's certificate
209 */
210 X509_Certificate X509_CA::ca_certificate() const
211 {
212 return cert;
213 }
214
215 /*
216 * Choose a signing format for the key
217 */
218 PK_Signer* choose_sig_format(const Private_Key& key,
219 const std::string& hash_fn,
220 AlgorithmIdentifier& sig_algo)
221 {
222 std::string padding;
223
224 const std::string algo_name = key.algo_name();
225
226 const HashFunction* proto_hash = retrieve_hash(hash_fn);
227 if(!proto_hash)
228 throw Algorithm_Not_Found(hash_fn);
229
230 if(key.max_input_bits() < proto_hash->output_length()*8)
231 throw Invalid_Argument("Key is too small for chosen hash function");
232
233 if(algo_name == "RSA")
234 padding = "EMSA3";
235 else if(algo_name == "DSA")
236 padding = "EMSA1";
237 else if(algo_name == "ECDSA")
238 padding = "EMSA1_BSI";
239 else
240 throw Invalid_Argument("Unknown X.509 signing key type: " + algo_name);
241
242 Signature_Format format =
243 (key.message_parts() > 1) ? DER_SEQUENCE : IEEE_1363;
244
245 padding = padding + '(' + proto_hash->name() + ')';
246
247 sig_algo.oid = OIDS::lookup(algo_name + "/" + padding);
248 sig_algo.parameters = key.algorithm_identifier().parameters;
249
250 return new PK_Signer(key, padding, format);
251 }
252
253 }
Botan::X509_Certificate::issuer_dn
X509_DN issuer_dn() const
Definition: x509cert.cpp:274
Botan::Cert_Extension::Key_Usage
Definition: x509_ext.h:121
Botan::X509_Certificate::subject_dn
X509_DN subject_dn() const
Definition: x509cert.cpp:282
Botan::X509_Certificate::subject_key_id
MemoryVector< byte > subject_key_id() const
Definition: x509cert.cpp:258
Botan::DER_Encoder::encode_list
DER_Encoder & encode_list(const std::vector< T > &values)
Definition: der_enc.h:75
Botan::BigInt
Definition: bigint.h:22
Botan::X509_CA::make_cert
static X509_Certificate make_cert(PK_Signer *signer, RandomNumberGenerator &rng, const AlgorithmIdentifier &sig_algo, const MemoryRegion< byte > &pub_key, const X509_Time &not_before, const X509_Time &not_after, const X509_DN &issuer_dn, const X509_DN &subject_dn, const Extensions &extensions)
Definition: x509_ca.cpp:90
Botan::X509_CA::~X509_CA
~X509_CA()
Definition: x509_ca.cpp:41
Botan::X509_CA::X509_CA
X509_CA(const X509_Certificate &ca_certificate, const Private_Key &key, const std::string &hash_fn)
Definition: x509_ca.cpp:28
Botan::RandomNumberGenerator
Definition: rng.h:20
Botan::Private_Key
Definition: pk_keys.h:86
Botan::Public_Key::algorithm_identifier
virtual AlgorithmIdentifier algorithm_identifier() const =0
Botan::X509_CRL::crl_number
u32bit crl_number() const
Definition: x509_crl.cpp:126
Botan::PKCS10_Request::subject_alt_name
AlternativeName subject_alt_name() const
Definition: pkcs10.cpp:157
Botan::X509_CA::ca_certificate
X509_Certificate ca_certificate() const
Definition: x509_ca.cpp:210
Botan::Signature_Format
Signature_Format
Definition: pubkey.h:24
Botan::Cert_Extension::Subject_Alternative_Name
Definition: x509_ext.h:218
Botan::Public_Key::algo_name
virtual std::string algo_name() const =0
Botan::Extensions
Definition: x509_ext.h:66
Botan::Invalid_Argument
std::invalid_argument Invalid_Argument
Definition: exceptn.h:20
Botan::AlgorithmIdentifier::parameters
SecureVector< byte > parameters
Definition: alg_id.h:36
Botan::Cert_Extension::Extended_Key_Usage
Definition: x509_ext.h:242
Botan::Cert_Extension::Subject_Key_ID
Definition: x509_ext.h:144
Botan::DER_Encoder::end_cons
DER_Encoder & end_cons()
Definition: der_enc.cpp:145
Botan::Cert_Extension::Basic_Constraints
Definition: x509_ext.h:95
Botan::X509_CA::update_crl
X509_CRL update_crl(const X509_CRL &last_crl, const std::vector< CRL_Entry > &new_entries, RandomNumberGenerator &rng, u32bit next_update=0) const
Definition: x509_ca.cpp:149
Botan::X509_Certificate::is_CA_cert
bool is_CA_cert() const
Definition: x509cert.cpp:205
Botan::Extensions::add
void add(Certificate_Extension *extn, bool critical=false)
Definition: x509_ext.cpp:77
Botan::u64bit
unsigned long long u64bit
Definition: types.h:49
Botan::DER_Encoder
Definition: der_enc.h:22
Botan::CRL_SIGN
Definition: pubkey_enums.h:26
Botan::X509_Certificate
Definition: x509cert.h:23
Botan::X509::find_constraints
Key_Constraints find_constraints(const Public_Key &pub_key, Key_Constraints limits)
Definition: x509_key.cpp:113
Botan::OIDS::lookup
std::string lookup(const OID &oid)
Definition: oids.cpp:31
Botan::X509_CRL::get_revoked
std::vector< CRL_Entry > get_revoked() const
Definition: x509_crl.cpp:102
Botan::PKCS10_Request::is_CA
bool is_CA() const
Definition: pkcs10.cpp:186
Botan::PKCS10_Request::constraints
Key_Constraints constraints() const
Definition: pkcs10.cpp:165
Botan::AlgorithmIdentifier::oid
OID oid
Definition: alg_id.h:35
Botan::X509_DN
Definition: x509_dn.h:21
Botan::SEQUENCE
Definition: asn1_int.h:35
Botan::PKCS10_Request
Definition: pkcs10.h:22
Botan::MemoryRegion< byte >
Botan
Definition: algo_base.h:14
Botan::Algorithm::name
virtual std::string name() const =0
Botan::X509_Object::make_signed
static MemoryVector< byte > make_signed(class PK_Signer *signer, RandomNumberGenerator &rng, const AlgorithmIdentifier &alg_id, const MemoryRegion< byte > &tbs)
Definition: x509_obj.cpp:204
Botan::IEEE_1363
Definition: pubkey.h:24
Botan::HashFunction
Definition: hash.h:20
Botan::Cert_Extension::CRL_Number
Definition: x509_ext.h:291
Botan::PEM_Code::encode
std::string encode(const byte der[], size_t length, const std::string &label, size_t width)
Definition: pem.cpp:19
Botan::PKCS10_Request::raw_public_key
MemoryVector< byte > raw_public_key() const
Definition: pkcs10.cpp:139
Botan::DataSource_Memory
Definition: data_src.h:94
Botan::PKCS10_Request::path_limit
u32bit path_limit() const
Definition: pkcs10.cpp:194
Botan::timespec_to_u32bit
u32bit timespec_to_u32bit(const std::string &timespec)
Definition: parsing.cpp:65
Botan::AlgorithmIdentifier
Definition: alg_id.h:20
Botan::DER_Encoder::start_cons
DER_Encoder & start_cons(ASN1_Tag type_tag, ASN1_Tag class_tag=UNIVERSAL)
Definition: der_enc.cpp:135
Botan::DER_SEQUENCE
Definition: pubkey.h:24
Botan::Cert_Extension::Authority_Key_ID
Definition: x509_ext.h:168
Botan::retrieve_hash
const HashFunction * retrieve_hash(const std::string &algo_spec)
Definition: lookup.h:55
Botan::X509_CRL
Definition: x509_crl.h:20
Botan::PKCS10_Request::subject_dn
X509_DN subject_dn() const
Definition: pkcs10.cpp:131
Botan::Public_Key::max_input_bits
virtual size_t max_input_bits() const =0
Botan::PKCS10_Request::subject_public_key
Public_Key * subject_public_key() const
Definition: pkcs10.cpp:148
Botan::PK_Signer
Definition: pubkey.h:123
Botan::X509_CA::sign_request
X509_Certificate sign_request(const PKCS10_Request &req, RandomNumberGenerator &rng, const X509_Time &not_before, const X509_Time &not_after)
Definition: x509_ca.cpp:49
Botan::Algorithm_Not_Found
Definition: exceptn.h:109
Botan::Key_Constraints
Key_Constraints
Definition: pubkey_enums.h:18
Botan::X509_CA::new_crl
X509_CRL new_crl(RandomNumberGenerator &rng, u32bit next_update=0) const
Definition: x509_ca.cpp:139
Botan::system_time
u64bit system_time()
Definition: time.cpp:73
Botan::Buffered_Computation::output_length
virtual size_t output_length() const =0
Botan::X509_Time
Definition: asn1_obj.h:41
Botan::u32bit
unsigned int u32bit
Definition: types.h:32
Botan::KEY_CERT_SIGN
Definition: pubkey_enums.h:25
Botan::Public_Key::message_parts
virtual size_t message_parts() const
Definition: pk_keys.h:50
Botan::choose_sig_format
PK_Signer * choose_sig_format(const Private_Key &key, const std::string &hash_fn, AlgorithmIdentifier &sig_algo)
Definition: x509_ca.cpp:218
Botan::PKCS10_Request::ex_constraints
std::vector< OID > ex_constraints() const
Definition: pkcs10.cpp:173