iaik.x509.attr
Class AttributeCertificate

java.lang.Object
  |
  +--java.security.cert.Certificate
        |
        +--iaik.x509.attr.AttributeCertificate

All Implemented Interfaces:

ASN1Type, Serializable, X509Extension

public class AttributeCertificate

extends Certificate

implements ASN1Type, Serializable, X509Extension

This class represents an attribute certificate, as specified by the PKIX Internet Attribute Certificate Profile for Authorization.

Attribute Certificates (see RFC 3281) do not contain a public key, rather they bind some kind of property to some entity:

 An attribute certificate (AC) may contain attributes that specify group 
 membership, role, security clearance, or other authorization information
 associated with the AC holder. 
 
 A public key certificate (PKC) can be considered to be like a passport: it
 identifies the holder, tends to last for a long time, and should not
 be trivial to obtain. An AC is more like an entry visa: it is
 typically issued by a different authority and does not last for as
 long a time. As acquiring an entry visa typically requires
 presenting a passport, getting a visa can be a simpler process.
 
 Authorization information may be placed in a PKC extension or placed
 in a separate attribute certificate (AC). The placement of
 authorization information in PKCs is usually undesirable for two
 reasons. First, authorization information often does not have the
 same lifetime as the binding of the identity and the public key.
 When authorization information is placed in a PKC extension, the
 general result is the shortening of the PKC useful lifetime. Second,
 the PKC issuer is not usually authoritative for the authorization
 information. This results in additional steps for the PKC issuer to
 obtain authorization information from the authoritative source.
 
 For these reasons, it is often better to separate authorization
 information from the PKC. Yet, authorization information also needs
 to be bound to an identity. An AC provides this binding; it is
 simply a digitally signed (or certified) identity and set of
 attributes.
 
 An AC may be used with various security services, including access
 control, data origin authentication, and non-repudiation.
 
 PKCs can provide an identity to access control decision functions.
 However, in many contexts the identity is not the criterion that is
 used for access control decisions, rather the role or group-
 membership of the accessor is the criterion used. Such access
 control schemes are called role-based access control.
 
 When making an access control decision based on an AC, an access
 control decision function may need to ensure that the appropriate AC
 holder is the entity that has requested access. One way in which the
 linkage between the request or identity and the AC can be achieved
 is the inclusion of a reference to a PKC within the AC and the use
 of the private key corresponding to the PKC for authentication
 within the access request.
 

The PKIX attribute certificate format is defined as an ASN.1 SEQUENCE structure containing the following components:

 AttributeCertificate ::= SEQUENCE {
   acinfo               AttributeCertificateInfo,
   signatureAlgorithm   AlgorithmIdentifier,
   signatureValue       BIT STRING
 }
 

where signatureAlgorithm identifies the signature algorithm used by the issuer for computing the digital signature upon the ASN.1 DER encoded AttributeCertificateInfo structure, which itself is expressed as ASN.1 SEQUENCE structure specifying holder and issuer of the AC, signature algorithm (the same as specified in Certificate above), version and serial numbers, validity period, attributes and optionally unique identifier of the issuer and certificate extensions:

 AttributeCertificateInfo ::= SEQUENCE {
   version                 AttCertVersion -- version is v2,
   holder                  Holder,
   issuer                  AttCertIssuer,
   signature               AlgorithmIdentifier,
   serialNumber            CertificateSerialNumber,
   attrCertValidityPeriod  AttCertValidityPeriod,
   attributes              SEQUENCE OF Attribute,
   issuerUniqueID          UniqueIdentifier OPTIONAL,
   extensions              Extensions OPTIONAL
 }
 

where:

 AttCertVersion  ::=  INTEGER { v2(1) }
 

 Holder ::= SEQUENCE {
      baseCertificateID   [0] IssuerSerial OPTIONAL,
                          -- the issuer and serial number of
                          -- the holder's Public Key Certificate
      entityName          [1] GeneralNames OPTIONAL,
                          -- the name of the claimant or role
      objectDigestInfo    [2] ObjectDigestInfo OPTIONAL
                          -- used to directly authenticate the holder,
                          -- for example, an executable
 }
 

 AttCertIssuer ::= CHOICE {
      v1Form   GeneralNames,  -- MUST NOT be used in this
                              -- profile
      v2Form   [0] V2Form     -- v2 only
 

 V2Form ::= SEQUENCE {
   issuerName            GeneralNames  OPTIONAL,
   baseCertificateID     [0] IssuerSerial  OPTIONAL,
   objectDigestInfo      [1] ObjectDigestInfo  OPTIONAL
           -- issuerName MUST be present in this profile
           -- baseCertificateID and objectDigestInfo MUST NOT
           -- be present in this profile
 }
 

 AlgorithmIdentifier  ::=  SEQUENCE  {
   algorithm               OBJECT IDENTIFIER,
   parameters              ANY DEFINED BY algorithm OPTIONAL  }
 

 CertificateSerialNumber  ::=  INTEGER
 

 AttCertValidityPeriod ::= SEQUENCE {
   notBeforeTime  GeneralizedTime,
   notAfter       GeneralizedTime }
 

 Attribute ::= SEQUENCE {
   type      AttributeType,
   values    SET OF AttributeValue
     -- at least one value is required }
 

 AttributeType ::= OBJECT IDENTIFIER
 

 AttributeValue ::= ANY DEFINED BY AttributeType
 

 UniqueIdentifier  ::=  BIT STRING
 

 Extensions  ::=  SEQUENCE SIZE (1..MAX) OF Extension
 

 Extension  ::=  SEQUENCE  {
   extnID      OBJECT IDENTIFIER,
   critical    BOOLEAN DEFAULT FALSE,
   extnValue   OCTET STRING  }
 

For a detailled description of the several fields refer to RFC 3281)

For each value extists a set<Value> and a get<Value> method.

After creating a new attribute certificate by means of the default constructor, setting AC holder and AC issuer, setting validity period and serial number, and adding any attribute and extension to be included, finally the certificate can be signed with the private key of the issuer.

The AttributeCertificate(byte[]) and AttributeCertificate(InputStream) constructors may be used for parsing an AttributeCertificate from its DER encoding.

The Internet Attribute Certificate Profile for Authorization ( RFC 3281) only specified attribute certificate with version number v2 (1). However, this class is also able to parse v1 (0) attribute certificates according to the ITU X.509-1997 specification.

Version:

File Revision 22

See Also:

X509Extensions, V3Extension, UnknownExtension, Holder, AttCertIssuer, Attribute, Serialized Form

Inner classes inherited from class java.security.cert.Certificate

Certificate.CertificateRep

Constructor Summary

AttributeCertificate()
Default constructor for creating a new empty attribute certificate.

AttributeCertificate(byte[] array)
Creates an AttributeCertificate form a PEM or DER byte array.

AttributeCertificate(InputStream is)
Creates an AttributeCertificate from an input stream.

Method Summary

void	addAttribute(Attribute attribute) Adds one Atribute to this attribute certificate.
void	addExtension(V3Extension e) Adds the given X509v3 extension.
void	checkValidity() Checks if this attribute certificate currently is valid.
void	checkValidity(Date date) Checks if this attribute certificate would be valid at the given date value.
int	countExtensions() Returns the number of extensions included into this certificate.
void	decode(ASN1Object obj) Creates an AttributeCertificate from an ASN1Object.
void	decode(InputStream is) Decodes an AttributeCertificate from an inputstream.
byte[]	getAcInfo() Returns the DER encoded AttributeCertificateInfo ASN.1 data structure of this attribute certificate.
Attribute	getAttribute(ObjectID type) Gets all the Atributes matching to a specific type (object identifier).
Enumeration	getAttributes() Gets the Atributes of this CertificateRequest.
Set	getCriticalExtensionOIDs() Returns a Set of the OID strings identifying the extension(s) that are marked CRITICAL in this attribute certificate.
byte[]	getEncoded() Returns this attribute certificate as DER encoded ASN.1 data structure
V3Extension	getExtension(ObjectID oid) Returns a specific extension, identified by its object identifier.
byte[]	getExtensionValue(String oid) Returns a byte array representing the DER encoding of the extension value identified by the passed-in OID string.
byte[]	getFingerprint() Returns the fingerprint of this certificate.
byte[]	getFingerprint(String digestAlgorithm) Returns the fingerprint of this certificate calculated with the given hash algorithm.
byte[]	getFingerprintSHA() Get the SHA fingerprint of this attribute certificate.
Holder	getHolder() Returns the Holder of this attribute certificate.
AttCertIssuer	getIssuer() Returns the Issuer of this attribute certificate.
boolean[]	getIssuerUniqueID() Returns the issuer unique identifier of this certificate, or null if no IssuerUniqueID is specified by this certificate.
Set	getNonCriticalExtensionOIDs() Returns a Set of the OID strings for the extension(s) marked NON-CRITICAL in this attribute certificate.
Date	getNotAfterTime() Returns the notAfterTime value of this certificate.
Date	getNotBeforeTime() Returns the notBeforeTime value of this certificate.
PublicKey	getPublicKey() Returns null!!!!
BigInteger	getSerialNumber() Returns the serial number of this certificate as BigInteger.
String	getSigAlgName() Returns the name of the signature algorithm used by the issuer for signing this certificate.
String	getSigAlgOID() Returns the OID of the signature algorithm used by the issuer for signing this certificate.
byte[]	getSigAlgParams() Returns the algorithm parameters associated with the signature algorithm used by the issuer for signing this certificate.
byte[]	getSignature() Returns the signature value of this certificate.
AlgorithmID	getSignatureAlgorithm() Returns the signature algorithm of this certificate.
int	getVersion() Returns the version number of this certificate as int.
boolean	hasExtensions() Checks, if there are any extensions included into this certificate.
boolean	hasUnsupportedCriticalExtension() Returns true if there are unsupported critical extensions.
Enumeration	listExtensions() Returns an enumeration of all extensions included in this attribute certificate.
void	removeAllAttributes() Removes all attributes included.
void	removeAllExtensions() Removes all extensions from this attribute certificate.
Attribute	removeAttribute(ObjectID type) Removes the attribute of the given type, if present.
boolean	removeExtension(ObjectID oid) Removes the extension specified by its object identifier.
void	setAttributes(Attribute[] attributes) Sets the Atributes of this Attribute certificate.
void	setHolder(Holder holder) Sets the Holder of this attribute certificate.
void	setIssuer(AttCertIssuer issuer) Sets the issuer of this attribute certificate.
void	setIssuerUniqueID(boolean[] id) Sets the issuer unique ID for this certificate.
void	setNotAfterTime(Date validNotAfter) Sets the notAfterTime value of this certificate.
void	setNotBeforeTime(Date validNotBefore) Sets the notBeforeTime value of this atttribute certificate.
void	setSerialNumber(BigInteger serialNumber) Sets the serial number of this certificate.
void	setSignature(byte[] signatureValue) Sets the signature value of this attribute certificate.
void	setSignatureAlgorithm(AlgorithmID signatureAlg) Sets the signature algorithm to be used for signing.
void	sign(AlgorithmID signatureAlg, PrivateKey issuerPK) Signs the attribute certificate with the private key of the issuer.
void	sign(AlgorithmID signatureAlg, PrivateKey issuerPK, String provider) Signs the attribute certificate with the private key of the issuer.
ASN1Object	toASN1Object() Returns this attribute certificate as an ASN1Object.
byte[]	toByteArray() Returns this attribute certificate as DER encoded ASN.1 data structure.
String	toString() Returns a string that represents the contents of the certificate.
String	toString(boolean detailed) Returns a string that represents the contents of the certificate.
void	verify(DSAPublicKey key, DSAParameterSpec dsaParams) Uses the given public DSA key and DSA parameters to verify this certificate.
void	verify(PublicKey key) Verifies a certificate using the given public key.
void	verify(PublicKey key, String sigProvider) Uses the given public key to verify a certificate based on a signature algorithm supplied by the specified provider.
void	writeTo(OutputStream os) Writes this attribute certificate DER encoded to the given output stream.

Methods inherited from class java.security.cert.Certificate

equals, getType, hashCode, writeReplace

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Constructor Detail

AttributeCertificate

public AttributeCertificate()

Default constructor for creating a new empty attribute certificate.

Any value may be set using the corrseponding set<Value> method. According to the Internet Attribute Certificate Profile for Authorization presented in RFC 3281) the version number is set to 2 indicating a Version 2 attribute certificate. Note that this is not the default version number (1).

AttributeCertificate

public AttributeCertificate(InputStream is)
                     throws IOException,
                            CertificateException

Creates an AttributeCertificate from an input stream.

The supplied attribute certificate can be in PEM or DER format. This constructor reads and decodes an AttributeCertificate that may have been previously written (encoded) by calling method writeTo(OutputStream).

For instance:

 InputStream fis = new FileInputStream("cert.der");
 AttributeCertificate cert = new AttributeCertificate(fis);
 fis.close();
 

Parameters:

is - InputStream from which to create the certificate

Throws:

IOException - if the certificate cannot not be read

CertificateException - if the certificate cannot be parsed

AttributeCertificate

public AttributeCertificate(byte[] array)
                     throws CertificateException

Creates an AttributeCertificate form a PEM or DER byte array.

This constructor may be used for parsing an already exisiting AttributeCertifcate ASN.1 object, supplied as DER encoded byte array, which may have been created by calling the toByteArray or the getEncoded method.

Parameters:

array - the byte array containing the DER encoded certificate

Throws:

CertificateException - if the format of the cert is wrong

Method Detail

decode

public void decode(ASN1Object obj)
            throws CodingException

Creates an AttributeCertificate from an ASN1Object.

The given ASN1Object represents an already existing AttributeCertificate which may have been created by calling the toASN1Object method.

Specified by:

decode in interface ASN1Type

Parameters:

obj - the attribute certificate as ASN1Object

Throws:

CodingException - if there is a problem when parsing the certificate

decode

public void decode(InputStream is)
            throws IOException,
                   CertificateException

Decodes an AttributeCertificate from an inputstream. The given InputStream supplies the certificate in DER or PEM encoded format. This method internally is called when creating a AttributeCertificate from an InputStream.

Parameters:

is - the InputStream from where the encoded certificate shall be read

Throws:

IOException - if an I/O error occurs

CertificateException - if the certificate cannot be parsed

sign

public void sign(AlgorithmID signatureAlg,
                 PrivateKey issuerPK)
          throws CertificateException,
                 InvalidKeyException,
                 NoSuchAlgorithmException

Signs the attribute certificate with the private key of the issuer.

Parameters:

signatureAlg - the AlgorithmID of the signature algorithm

issuerPK - the private key of the issuer

Throws:

CertificateException - if the certificate could not be signed

InvalidKeyException - if the format of the key is wrong

NoSuchAlgorithmException - if there is no implementation for the specified algorithm

sign

public void sign(AlgorithmID signatureAlg,
                 PrivateKey issuerPK,
                 String provider)
          throws CertificateException,
                 InvalidKeyException,
                 NoSuchAlgorithmException

Signs the attribute certificate with the private key of the issuer.

Parameters:

signatureAlg - the AlgorithmID of the signature algorithm

issuerPK - the private key of the issuer

Throws:

CertificateException - if the certificate could not be signed

InvalidKeyException - if the format of the key is wrong

NoSuchAlgorithmException - if there is no implementation for the specified algorithm

setSignature

public void setSignature(byte[] signatureValue)
                  throws CertificateException

Sets the signature value of this attribute certificate.

This method provides an alternative to method sign when it is required to set the signature value from outside (e.g. calculated by means of a smartcard):

 AttributeCertificate cert = ...;
 ...
 // set issuer, holder, attributes, ...
 ...
 // set the signature algorithm to be used for signing
 cert.setSignatureAlgorithm(AlgorithmID.sha1WithRSAEncryption);
 // get the to-be-signed value
 byte[] acInfo = cert.getAcInfo();
 // now calculate the signature over the attribute certificate info
 byte[] signatureValue = calculateSignature(acInfo);
 // and set the signatureValue
 cert.setSignature(signatureValue);
 // encode the certificate
 byte[] encodedCert = cert.getEncoded();
 

Parameters:

signatureValue - the signature calculated outside

Throws:

CertificateException - if the certificate could not be signed

checkValidity

public void checkValidity(Date date)
                   throws CertificateExpiredException,
                          CertificateNotYetValidException

Checks if this attribute certificate would be valid at the given date value.

Attribute certificates have a limited period of validity prescribed by the notBeforeTime and notAfterTime values. This method just checks if the given date/time value lies between notBeforeTime and notAfterTime and throws an exception if this does not come true.

Throws:

CertificateExpiredException - if the certificate alreay has expired or the notAfterTime value yet has not been set

CertificateNotYetValidException - if the certificate yet is not valid or the notBeforeTime value yet has not been set

See Also:

checkValidity(java.util.Date)

checkValidity

public void checkValidity()
                   throws CertificateExpiredException,
                          CertificateNotYetValidException

Checks if this attribute certificate currently is valid. Certificates have a limited period of validity prescribed by the notBeforeTime and notAfterTime values:

 AttCertValidityPeriod ::= SEQUENCE {
    notBeforeTime      GeneralizedTime,
    notAfterTime       GeneralizedTime }
 

The notBeforeTime and notAfterTime time values can be set by using the setNotBeforeTime and setNotAfterTime methods.

This checkValidity method only calls checkValidity(Date) with the current date to check if it lies between the two time values specified by notBeforeTime and notAfterTime.

Throws:

CertificateExpiredException - if the certificate already has expired

CertificateNotYetValidException - if the certificate is yet not valid

See Also:

GeneralizedTime

getEncoded

public byte[] getEncoded()
                  throws CertificateEncodingException

Returns this attribute certificate as DER encoded ASN.1 data structure

Overrides:

getEncoded in class Certificate

Returns:

a byte array holding the DER encoded attribute certificate ASN.1 data structure

Throws:

CertificateEncodingException - if the certificate cannot be encoded correctly

getVersion

public int getVersion()

Returns the version number of this certificate as int. The version number may specify a v1 or v2 attribute certificate.

ASN.1 definition:

 AttCertVersion  ::=  INTEGER  {  v1(0), v2(1) }
 

Returns:

version number of the certificate as int, 1 for a v1 cert, 2 for a v2 cert

getSerialNumber

public BigInteger getSerialNumber()

Returns the serial number of this certificate as BigInteger. Attribute certificates are labelled with positive serial numbers by the issuing certification authority for unequivocally identifying them:

ASN.1 definition:

 CertificateSerialNumber  ::=  INTEGER
 

Returns:

the serial number of this certificate as BigInteger

getIssuer

public AttCertIssuer getIssuer()

Returns the Issuer of this attribute certificate.

The issuer of an attribute certificate either may be represented as V1Form or as V2Form:

 AttCertIssuer ::= CHOICE {
   v1Form   GeneralNames,  -- MUST NOT be used in this
                           -- profile
   v2Form   [0] V2Form     -- v2 only
 }
 

Attribute certifcates conforming to the Internet Attribute Certificate Profile for Authorization presented in RFC 3281 are not allowed to use the V1Form choice for representing the issuer, theay should use the V2Form :

 V2Form ::= SEQUENCE {
   issuerName            GeneralNames  OPTIONAL,
   baseCertificateID     [0] IssuerSerial  OPTIONAL,
   objectDigestInfo      [1] ObjectDigestInfo  OPTIONAL
           -- issuerName MUST be present in this profile
           -- baseCertificateID and objectDigestInfo MUST NOT
 
 ACs conforming to this profile MUST use the v2Form choice, which MUST
 contain one and only one GeneralName in the issuerName, which MUST
 contain a non-empty distinguished name in the directoryName field.
 This means that all AC issuers MUST have non-empty distinguished
 names.  ACs conforming to this profile MUST omit the
 baseCertificateID and objectDigestInfo fields.

 Part of the reason for the use of the v2Form containing only an
 issuerName is that it means that the AC issuer does not have to know
 which PKC the AC verifier will use for it (the AC issuer).  Using the
 baseCertificateID field to reference the AC issuer would mean that
 the AC verifier would have to trust the PKC that the AC issuer chose
 (for itself) at AC creation time.
 

Use class Name for creating a V2Form attCertIssuer holding a directoryName to be set as the issuer of an AttributeCertificate:

 Name issuerName = ...;
 V2Form v2Form = new V2Form(issuerName);
 attributeCertificate.setIssuer(v2Form);
 

Returns:

the issuer of this certificate

See Also:

AttCertIssuer, V1Form, V2Form

getHolder

public Holder getHolder()

Returns the Holder of this attribute certificate.

The Attribute certifcates conforming to the Internet Attribute Certificate Profile for Authorization presented in RFC 3281 specifies the Holder type for identifying the entity to which the AttributeCertificate belongs:

 Holder ::= SEQUENCE {
   baseCertificateID   [0] IssuerSerial OPTIONAL,
                       -- the issuer and serial number of
                       -- the holder's Public Key Certificate
   entityName          [1] GeneralNames OPTIONAL,
                       -- the name of the claimant or role
   objectDigestInfo    [2] ObjectDigestInfo OPTIONAL
                       -- used to directly authenticate the holder,
                       -- for example, an executable
 }
 

For any environment where the AC is passed in an authenticated message or session and where the authentication is based on the use of an X.509 public key certificate, the holder should be identified by means of a baseCertificateID pointing to the right X.509 public key certificate by issuer name and issuer-specific serial number, e.g.:

 X509Certificate baseCert = ...;
 IssuerSerial baseCertificateID = new IssuerSerial(baseCert);
 Holder holder = new Holder();
 holder.setBaseCertificateID(baseCertificateID);
 attributeCertificate.setHolder(holder);
 

If the holder field uses the entityName option and the underlying authentication is based on a PKC, then the entityName MUST be the same as the PKC subject field or one of the values of the PKC subjectAltName field extension (if present), e.g.:

 X509Certificate cert = ...;
 Name subject = (Name)cert.getSubjectDN();
 GeneralName subjectName = new GeneralName(GeneralName.directoryName, subject);
 GeneralNames entityName = new GeneralNames(subjectName);
 Holder holder = new Holder();
 holder.setEntityName(entityName);
 attributeCertificate.setHolder(holder);
 

The ObjectDigestInfo component may be used for linking the AC to an object by placing a hash of that object into the holder field of the AC. For example, this allows production of ACs that are linked to public keys rather than names (see RFC 3281 for more information):

 // the public key to which to link the AC:
 PublicKey publicKey = ...;
 // the digest algorithm to use
 AlgorithmID digestAlgorithm = ...;
 ObjectDigestInfo odi = new ObjectDigestInfo(publicKey, digestAlgorithm);
 Holder holder = new Holder();
 holder.setObjectDigestInfo(odi);
 attributeCertificate.setHolder(holder);
 

Returns:

the holder of this attribute certificate

See Also:

Holder, IssuerSerial, ObjectDigestInfo, GeneralNames

getPublicKey

public PublicKey getPublicKey()

Returns null!!!!

Attention!!! This method anytime returns null since a Attribute Certificate does not contain a public key. This method only is included because inherited from java.security.cert.Certificate which is the highest JCA "cerrificate level" and extended by this class to incorporate attribute certificates into the JCA certificate management.

Overrides:

getPublicKey in class Certificate

Returns:

null

getNotBeforeTime

public Date getNotBeforeTime()

Returns the notBeforeTime value of this certificate.

The notBeforeTime value denotes the date on which the certificate becomes valid and can be set using the setNotBeforeTime method.

Returns:

the date on which this certificate becomes valid, or null if the notBefore date has yet not been set

See Also:

checkValidity(java.util.Date)

getNotAfterTime

public Date getNotAfterTime()

Returns the notAfterTime value of this certificate.

The notAfterTime value denotes the date on which the certificate´s validity expires. The notAfterTime date can be set using the setNotAfterTime method.

Returns:

the date on which the certificate´s validity expires, or null if the notAfter date has yet not been set

See Also:

checkValidity(java.util.Date)

getAcInfo

public byte[] getAcInfo()
                 throws CertificateEncodingException

Returns the DER encoded AttributeCertificateInfo ASN.1 data structure of this attribute certificate.

 AttributeCertificateInfo ::= SEQUENCE {
    version              AttCertVersion DEFAULT v1,
    holder               Holder,
    issuer               AttCertIssuer,
    signature            AlgorithmIdentifier,
    serialNumber         CertificateSerialNumber,
    attrCertValidityPeriod   AttCertValidityPeriod,
    attributes           SEQUENCE OF Attribute,
    issuerUniqueID       UniqueIdentifier OPTIONAL,
    extensions           Extensions OPTIONAL
 }
 

Returns:

the inherent AttributeCertificateInfo as DER encoded ASN.1 structure

Throws:

CertificateEncodingException - if an encoding error occurs

setSignatureAlgorithm

public void setSignatureAlgorithm(AlgorithmID signatureAlg)

Sets the signature algorithm to be used for signing. This method only provides a way for setting the signature algorithm if an application wants to call getAcInfo before signing the cert. When using this fearure an application itsself is responsible to ensure that the signature algorithm specified by this method is equal to that supplied to the sign(AlgorithmID, PrivateKey) method when finally signing the certificate.

Parameters:

signatureAlg - the signature algorithm to be used for signing

getSignature

public byte[] getSignature()

Returns the signature value of this certificate. The signature is defined as an ASN.1 BIT STRING structure. This method returns the inherent signature value as byte array.

Returns:

the signature value as byte array

getSigAlgName

public String getSigAlgName()

Returns the name of the signature algorithm used by the issuer for signing this certificate.

Returns:

the name of the signature algorithm, e.g. "md5WithRSAEncryption", or null if the signature algorithm yet has not been set

getSigAlgOID

public String getSigAlgOID()

Returns the OID of the signature algorithm used by the issuer for signing this certificate. An object identifier consists of a sequence of integer components and is used for identifying, e.g. the signature algorithm used for this certificate. This method returns the OID in String representation, e.g. "1.2.840.113549.1.1.4"

Returns:

the OID of the signature algorithm as String representation, or null if the signature algorithm yet has not been set

See Also:

ObjectID, AlgorithmID

getSigAlgParams

public byte[] getSigAlgParams()

Returns the algorithm parameters associated with the signature algorithm used by the issuer for signing this certificate. The parameters are returned as DER encoded ASN.1 data structure.

Returns:

the signature algorithm parameters as DER encoded ASN.1 data structure, or null if there are no parameters used or the signature algorithm yet has been not set

getIssuerUniqueID

public boolean[] getIssuerUniqueID()

Returns the issuer unique identifier of this certificate, or null if no IssuerUniqueID is specified by this certificate.

An IssuerUniqueID only may be included if the attribute certificate is linked to a public key certificate (PKC) and this PKC contains the issuer unique id. In this case the issuer unique ids of PKC and corresponding AC have to be the same.

The issuer unique identifier is defined as ASN.1 BIT STRING structure:

 UniqueIdentifier  ::=  BIT STRING
 

This method scans the issuer unique identifier and returns it as an array of boolean values.

Returns:

the IssuerUniqueID of this certificate as array of booleans, or null if no issuer unique identifier is speciifed

verify

public void verify(PublicKey key,
                   String sigProvider)
            throws CertificateException,
                   NoSuchAlgorithmException,
                   InvalidKeyException,
                   NoSuchProviderException,
                   SignatureException

Uses the given public key to verify a certificate based on a signature algorithm supplied by the specified provider.

Overrides:

verify in class Certificate

Parameters:

key - the public key (of the issuer) to verify the cert

sigProvider - the name of the provider supplying the signature algorithm

Throws:

CertificateException - if an encoding error occurs

NoSuchAlgorithmException - if there is no implementation for the algorithm used to sign this cert

InvalidKeyException - if the format of the public key is wrong

NoSuchProviderException - if there is no such provider

SignatureException - if the signature does not verify

verify

public void verify(PublicKey key)
            throws CertificateException,
                   NoSuchAlgorithmException,
                   InvalidKeyException,
                   NoSuchProviderException,
                   SignatureException

Verifies a certificate using the given public key.

This method only calls verify(PublicKey, String) setting the provider name to null for relying on the default provider signature architecture.

Overrides:

verify in class Certificate

Parameters:

key - the public key of the issuer

Throws:

CertificateException - if an encoding error occurs

NoSuchAlgorithmException - if there is no implementation for the algorithm used to sign this cert

InvalidKeyException - if the format of the public key is wrong

NoSuchProviderException - if there is no default provider

SignatureException - if the signature does not verify

verify

public void verify(DSAPublicKey key,
                   DSAParameterSpec dsaParams)
            throws CertificateException,
                   NoSuchAlgorithmException,
                   InvalidKeyException,
                   NoSuchProviderException,
                   SignatureException

Uses the given public DSA key and DSA parameters to verify this certificate.

Attention! This method only may be used to verify a certificate that has been signed with the DSA algorithm and the public DSA key now used for verification does not contain the DSA parameters. Additionally this method only can be used with the IAIK provider.

Parameters:

key - the public DSA key (of the issuer) to verify the cert

dsaParams - the DSA parameters provided by other means

Throws:

CertificateException - if an encoding error occurs

NoSuchAlgorithmException - if there is no implementation for the algorithm used to sign this cert

InvalidKeyException - if the format of the public key is wrong

NoSuchProviderException - if there is no such provider

SignatureException - if the signature does not verify

toASN1Object

public ASN1Object toASN1Object()

Returns this attribute certificate as an ASN1Object.

Specified by:

toASN1Object in interface ASN1Type

Returns:

this attribute certificate as ASN1Object

toByteArray

public byte[] toByteArray()

Returns this attribute certificate as DER encoded ASN.1 data structure.

Returns:

this attribute certificate in a byte array in DER format

writeTo

public void writeTo(OutputStream os)
             throws IOException

Writes this attribute certificate DER encoded to the given output stream.

Parameters:

os - the output stream where the certifiacte shall be written to

Throws:

IOException - if an I/O error occurs

setSerialNumber

public void setSerialNumber(BigInteger serialNumber)

Sets the serial number of this certificate.

Parameters:

serialNumber - the serial number of the certificate as BigInteger

See Also:

getSerialNumber()

setIssuer

public void setIssuer(AttCertIssuer issuer)

Sets the issuer of this attribute certificate.

The issuer of an attribute certificate either may be represented as V1Form or as V2Form:

 AttCertIssuer ::= CHOICE {
   v1Form   GeneralNames,  -- MUST NOT be used in this
                           -- profile
   v2Form   [0] V2Form     -- v2 only
 }
 

Attribute certifcates conforming to the Internet Attribute Certificate Profile for Authorization presented in RFC 3281 are not allowed to use the V1Form choice for representing the issuer, theay should use the V2Form :

 V2Form ::= SEQUENCE {
   issuerName            GeneralNames  OPTIONAL,
   baseCertificateID     [0] IssuerSerial  OPTIONAL,
   objectDigestInfo      [1] ObjectDigestInfo  OPTIONAL
           -- issuerName MUST be present in this profile
           -- baseCertificateID and objectDigestInfo MUST NOT
 
 ACs conforming to this profile MUST use the v2Form choice, which MUST
 contain one and only one GeneralName in the issuerName, which MUST
 contain a non-empty distinguished name in the directoryName field.
 This means that all AC issuers MUST have non-empty distinguished
 names.  ACs conforming to this profile MUST omit the
 baseCertificateID and objectDigestInfo fields.

 Part of the reason for the use of the v2Form containing only an
 issuerName is that it means that the AC issuer does not have to know
 which PKC the AC verifier will use for it (the AC issuer).  Using the
 baseCertificateID field to reference the AC issuer would mean that
 the AC verifier would have to trust the PKC that the AC issuer chose
 (for itself) at AC creation time.
 

Use class Name for creating a V2Form attCertIssuer holding a directoryName to be set as the issuer of an AttributeCertificate:

 Name issuerName = ...;
 V2Form v2Form = new V2Form(issuerName);
 attributeCertificate.setIssuer(v2Form);
 

Returns:

the issuer of this attribute certificate

See Also:

getIssuer(), AttCertIssuer, V1Form, V2Form

setNotBeforeTime

public void setNotBeforeTime(Date validNotBefore)

Sets the notBeforeTime value of this atttribute certificate.

For instance:

 GregorianCalendar date = (GregorianCalendar)Calendar.getInstance();
 cert.setNotBeforeTime(date.getTime());
 

The certificate is not valid before this Date.

Parameters:

validNotBefore - Date when cert will become valid

See Also:

getNotBeforeTime()

setNotAfterTime

public void setNotAfterTime(Date validNotAfter)

Sets the notAfterTime value of this certificate.

For instance:

 GregorianCalendar date = (GregorianCalendar)Calendar.getInstance();
 date.add(Calendar.MONTH, 6);
 cert.setNotAfterTime(date.getTime());
 

The certificate will expire at this Date.

Parameters:

validNotAfter - Date on which the certificate will expire

See Also:

getNotAfterTime()

setHolder

public void setHolder(Holder holder)

Sets the Holder of this attribute certificate.

The Attribute certifcates conforming to the Internet Attribute Certificate Profile for Authorization presented in RFC 3281 specifies the Holder type for identifying the entity to which the AttributeCertificate belongs:

 Holder ::= SEQUENCE {
   baseCertificateID   [0] IssuerSerial OPTIONAL,
                       -- the issuer and serial number of
                       -- the holder's Public Key Certificate
   entityName          [1] GeneralNames OPTIONAL,
                       -- the name of the claimant or role
   objectDigestInfo    [2] ObjectDigestInfo OPTIONAL
                       -- used to directly authenticate the holder,
                       -- for example, an executable
 }
 

For any environment where the AC is passed in an authenticated message or session and where the authentication is based on the use of an X.509 public key certificate, the holder should be identified by means of a baseCertificateID pointing to the right X.509 public key certificate by issuer name and issuer-specific serial number, e.g.:

 X509Certificate baseCert = ...;
 IssuerSerial baseCertificateID = new IssuerSerial(baseCert);
 Holder holder = new Holder();
 holder.setBaseCertificateID(baseCertificateID);
 attributeCertificate.setHolder(holder);
 

If the holder field uses the entityName option and the underlying authentication is based on a PKC, then the entityName MUST be the same as the PKC subject field or one of the values of the PKC subjectAltName field extension (if present), e.g.:

 X509Certificate cert = ...;
 Name subject = (Name)cert.getSubjectDN();
 GeneralName subjectName = new GeneralName(GeneralName.directoryName, subject);
 GeneralNames entityName = new GeneralNames(subjectName);
 Holder holder = new Holder();
 holder.setEntityName(entityName);
 attributeCertificate.setHolder(holder);
 

The ObjectDigestInfo component may be used for linking the AC to an object by placing a hash of that object into the holder field of the AC. For example, this allows production of ACs that are linked to public keys rather than names (see RFC 3281 for more information):

 // the public key to which to link the AC:
 PublicKey publicKey = ...;
 // the digest algorithm to use
 AlgorithmID digestAlgorithm = ...;
 ObjectDigestInfo odi = new ObjectDigestInfo(publicKey, digestAlgorithm);
 Holder holder = new Holder();
 holder.setObjectDigestInfo(odi);
 attributeCertificate.setHolder(holder);
 

Parameters:

holder - the holder of this attribute certificate

See Also:

Holder, IssuerSerial, ObjectDigestInfo, GeneralNames

setIssuerUniqueID

public void setIssuerUniqueID(boolean[] id)

Sets the issuer unique ID for this certificate.

An IssuerUniqueID only may be included if the attribute certificate is linked to a public key certificate (PKC) and this PKC contains the issuer unique id. In this case the issuer unique ids of PKC and corresponding AC have to be the same.

The issuer unique identifier is defined as ASN.1 BIT STRING structure:

 UniqueIdentifier  ::=  BIT STRING
 

Parameters:

id - the unique identifier of the issuer as array of boolean values

See Also:

getIssuerUniqueID()

getSignatureAlgorithm

public AlgorithmID getSignatureAlgorithm()

Returns the signature algorithm of this certificate.

Returns:

the AlgorithmID of the signature algorithm used for signing this certificate

See Also:

AlgorithmID

getFingerprint

public byte[] getFingerprint()

Returns the fingerprint of this certificate. This is a MD5 hash of the DER encoded certificate.

Returns:

the fingerprint of the certificate

getFingerprint

public byte[] getFingerprint(String digestAlgorithm)
                      throws NoSuchAlgorithmException

Returns the fingerprint of this certificate calculated with the given hash algorithm.

Parameters:

digestAlgorithm - the digest algorithm to be used

Returns:

the fingerprint of the certificate

Throws:

NoSuchAlgorithmException - if the requested algorithm is not supported

getFingerprintSHA

public byte[] getFingerprintSHA()

Get the SHA fingerprint of this attribute certificate. The result is cached for subsequent calls.

Returns:

the SHA fingerprint

toString

public String toString()

Returns a string that represents the contents of the certificate.

Overrides:

toString in class Certificate

Returns:

the string representation

getCriticalExtensionOIDs

public Set getCriticalExtensionOIDs()

Returns a Set of the OID strings identifying the extension(s) that are marked CRITICAL in this attribute certificate. Extensions can be marked as being critical. If the certificate handling software cannot parse such an extension, the appertaining certifcate has to be rejected. Non-Critical extensions can be ignored, if they cannot be handled (i.e. of unknown state).

Specified by:

getCriticalExtensionOIDs in interface X509Extension

Returns:

a Set (or an empty Set if none are marked critical) of the extension OID strings for extensions that are marked critical. If there are no extensions present at all, then this method returns null

See Also:

getNonCriticalExtensionOIDs()

getNonCriticalExtensionOIDs

public Set getNonCriticalExtensionOIDs()

Returns a Set of the OID strings for the extension(s) marked NON-CRITICAL in this attribute certificate.

Specified by:

getNonCriticalExtensionOIDs in interface X509Extension

Returns:

a Set (or an empty Set if none are marked non-critical) of the extension OID strings for extensions that are marked non-critical. If there are no extensions present at all, then this method returns null.

See Also:

getCriticalExtensionOIDs()

getExtensionValue

public byte[] getExtensionValue(String oid)

Returns a byte array representing the DER encoding of the extension value identified by the passed-in OID string.

The oid string is represented by a set of positive whole numbers separated by periods, e.g. "2.5.29.55" for the ACTargeting extension.

In ASN.1, the Extensions field is defined as a SEQUENCE of Extension:

 Extensions  ::=  SEQUENCE SIZE (1..MAX) OF Extension
 

 Extension  ::=  SEQUENCE  {
   extnID      OBJECT IDENTIFIER,
   critical    BOOLEAN DEFAULT FALSE,
   extnValue   OCTET STRING  }
 

where critical specifies whether an extension has to be treated as being critical or not; the default value is FALSE. An extension can be identified by its object identifier, given in the extnID field. The value of the extension is represented as ASN.1 OCTET STRING data structure in the extnValue field. Only one instance of a particular extension may be present in a particular certificate.

The byte value returned by this method represents the DER encoding of the extnValue (OCTET_STRING) from above, and the value of this OCTET STRING represents the DER encoding of the specific extension´s ASN.1 representation itsself.

Attention: For compatibility reasons to the standard JCA certificate API this method has been changed to return the OCTET STRING value as described above. Prior versions of this class have returned the DER encoding of the specific extension´s ASN.1 representation itsself.

Specified by:

getExtensionValue in interface X509Extension

Parameters:

oid - the Object Identifier of the extension to be queried for

Returns:

the DER encoded ASN.1 representation of extension value or null if it is not present

addExtension

public void addExtension(V3Extension e)
                  throws X509ExtensionException

Adds the given X509v3 extension.

For reading back some extension, use the getExtension(ObjectID) method.

Parameters:

e - the X509v3 extension to add to the list of extensions

Throws:

X509ExtensionException - if an error occurs while DER encoding the extension

See Also:

V3Extension

removeExtension

public boolean removeExtension(ObjectID oid)

Removes the extension specified by its object identifier.

Parameters:

objectID - the object ID of the extension to remove

Returns:

true if the extension has been successfully removed, false otherwise

removeAllExtensions

public void removeAllExtensions()

Removes all extensions from this attribute certificate.

listExtensions

public Enumeration listExtensions()

Returns an enumeration of all extensions included in this attribute certificate.

The enumeration returned may contain unknown extensions (instances of UnknownExtension if there are any extensions included in this certificate, for which there exists no registered implementation, and it may contain error extensions (instances of ErrorExtension) indicating extensions which cannot be parsed properly because of some kind of error.

If any extension cannot be parsed properly, an ErrorExtension is created from it and written to the enumeration list returned by this method.

Returns:

an enumeration of the extensions, or null if there are no extensions present at all

hasExtensions

public boolean hasExtensions()

Checks, if there are any extensions included into this certificate.

Returns:

true if there are extensions, false if not

hasUnsupportedCriticalExtension

public boolean hasUnsupportedCriticalExtension()

Returns true if there are unsupported critical extensions.

Specified by:

hasUnsupportedCriticalExtension in interface X509Extension

Returns:

true, if there are unsupported critical extensions

countExtensions

public int countExtensions()

Returns the number of extensions included into this certificate.

Returns:

the number of extensions

getExtension

public V3Extension getExtension(ObjectID oid)
                         throws X509ExtensionInitException

Returns a specific extension, identified by its object identifier.

If the extension cannot be initialized for some reason, an X509ExtensionInitException is thrown. If the requested extension is an unknown extension, which is not supported by a registered implementation, this method creates and returns an UnknownExtension which may be queried for obtaining as much information as possible about the unknown extension.

Parameters:

objectID - the object ID of the extension

Returns:

the desired extension or null if the requested extension is not present

Throws:

X509ExtensionInitException - if the extension can not be initialized

addAttribute

public void addAttribute(Attribute attribute)

Adds one Atribute to this attribute certificate.

Since only one attribute per attribute type is allowed to be included in an attribute certificate this method replaces an already included attribute of same type with the given attribute.

Note that the attributes have to be set before the certificate is signed with the issuer´s private key!

Parameters:

attribute - the Attribute to add

setAttributes

public void setAttributes(Attribute[] attributes)

Sets the Atributes of this Attribute certificate. The given attributes have to be an array of iaik.asn1.structures.Attribute objects.
Note that the attributes have to be set before the certificate is signed with the issuer´s private key!

Parameters:

attributes - the Attributes to set

removeAllAttributes

public void removeAllAttributes()

Removes all attributes included.

removeAttribute

public Attribute removeAttribute(ObjectID type)

Removes the attribute of the given type, if present.

Parameters:

type - the type OID identifying the attribute in mind

Returns:

the attribute removed or null if no attribute has been removed because no attribute with the given type is present

getAttributes

public Enumeration getAttributes()

Gets the Atributes of this CertificateRequest. If no Attributes are included, null is returned. Otherwise the atributes are returned as an array of iaik.asn1.structures.Attribute objects:

 Attribute[] attributes = request.getAttributes();
 if (attributes != null) {
   for (int i = 0; i < attributes.length; i++) {
     Attribute attr = attributes[i];
     System.out.println(attr.getType());
     ASN1Object[] asn1Obj = attr.getValue();
     for (int j = 0; j < asn1Obj.length; j++) {
       System.out.println(asn1Obj[j].toString());
     }
   }
 }
 

Returns:

the attributes of this request as array of iaik.asn1.structures.Attribute, or null if there are no attributes included

getAttribute

public Attribute getAttribute(ObjectID type)

Gets all the Atributes matching to a specific type (object identifier). If no Attributes of given type are included, null is returned. Otherwise the matching atributes are returned as an array of iaik.asn1.structures.Attribute objects. The following sample queries if the challangePassword attribute is included:

 Attribute[] attributes = request.getAttributes(ObjectID.challengePassword);
 if (attributes != null) {
   //expected only one:
   Attribute attr = attributes[0];
   System.out.println(attr.getType());
   ASN1Object[] asn1Obj = attr.getValue();
   //again, only one expected:
   System.out.println(asn1Obj[0].getValue());
 }
 

Returns:

all the attributes of given type as array of iaik.asn1.structures.Attribute, or null if there are no attributes of the given type included

toString

public String toString(boolean detailed)

Returns a string that represents the contents of the certificate.

Parameters:

detailed - whether or not to give detailed information about the certificate.

Returns:

the string representation