libjava/java/security/cert/X509CRL.java

   1 /* X509CRL.java --- X.509 Certificate Revocation List
   2    Copyright (C) 1999 Free Software Foundation, Inc.
   3
   4 This file is part of GNU Classpath.
   5
   6 GNU Classpath is free software; you can redistribute it and/or modify
   7 it under the terms of the GNU General Public License as published by
   8 the Free Software Foundation; either version 2, or (at your option)
   9 any later version.
  10
  11 GNU Classpath is distributed in the hope that it will be useful, but
  12 WITHOUT ANY WARRANTY; without even the implied warranty of
  13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14 General Public License for more details.
  15
  16 You should have received a copy of the GNU General Public License
  17 along with GNU Classpath; see the file COPYING.  If not, write to the
  18 Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
  19 02111-1307 USA.
  20
  21 Linking this library statically or dynamically with other modules is
  22 making a combined work based on this library.  Thus, the terms and
  23 conditions of the GNU General Public License cover the whole
  24 combination.
  25
  26 As a special exception, the copyright holders of this library give you
  27 permission to link this library with independent modules to produce an
  28 executable, regardless of the license terms of these independent
  29 modules, and to copy and distribute the resulting executable under
  30 terms of your choice, provided that you also meet, for each linked
  31 independent module, the terms and conditions of the license of that
  32 module.  An independent module is a module which is not derived from
  33 or based on this library.  If you modify this library, you may extend
  34 this exception to your version of the library, but you are not
  35 obligated to do so.  If you do not wish to do so, delete this
  36 exception statement from your version. */
  37
  38
  39 package java.security.cert;
  40 import java.math.BigInteger;
  41 import java.security.Principal;
  42 import java.security.PublicKey;
  43 import java.security.NoSuchAlgorithmException;
  44 import java.security.InvalidKeyException;
  45 import java.security.NoSuchProviderException;
  46 import java.security.SignatureException;
  47 import java.util.Date;
  48 import java.util.Set;
  49
  50 /**
  51    The X509CRL class is the abstract class used to manage
  52    X.509 Certificate Revocation Lists. The CRL is a list of
  53    time stamped entries which indicate which lists have been
  54    revoked. The list is signed by a Certificate Authority (CA)
  55    and made publically available in a repository.
  56
  57    Each revoked certificate in the CRL is identified by its
  58    certificate serial number. When a piece of code uses a
  59    certificate, the certificates validity is checked by
  60    validating its signature and determing that it is not
  61    only a recently acquired CRL. The recently aquired CRL
  62    is depends on the local policy in affect. The CA issues
  63    a new CRL periodically and entries are removed as the
  64    certificate expiration date is reached
  65
  66
  67    A description of the X.509 v2 CRL follows below from rfc2459.
  68
  69    "The X.509 v2 CRL syntax is as follows.  For signature calculation,
  70    the data that is to be signed is ASN.1 DER encoded.  ASN.1 DER
  71    encoding is a tag, length, value encoding system for each element.
  72
  73            CertificateList  ::=  SEQUENCE  {
  74                 tbsCertList          TBSCertList,
  75                 signatureAlgorithm   AlgorithmIdentifier,
  76                 signatureValue       BIT STRING  }
  77
  78            TBSCertList  ::=  SEQUENCE  {
  79                 version                 Version OPTIONAL,
  80                                      -- if present, shall be v2
  81                 signature               AlgorithmIdentifier,
  82                 issuer                  Name,
  83                 thisUpdate              Time,
  84                 nextUpdate              Time OPTIONAL,
  85                 revokedCertificates     SEQUENCE OF SEQUENCE  {
  86                      userCertificate         CertificateSerialNumber,
  87                      revocationDate          Time,
  88                      crlEntryExtensions      Extensions OPTIONAL
  89                                                    -- if present, shall be v2
  90                                           }  OPTIONAL,
  91                 crlExtensions           [0]  EXPLICIT Extensions OPTIONAL
  92                                                    -- if present, shall be v2
  93                                           }"
  94
  95         @author Mark Benvenuto
  96
  97         @since JDK 1.2
  98 */
  99 public abstract class X509CRL extends CRL implements X509Extension
 100 {
 101
 102   /**
 103      Constructs a new X509CRL.
 104   */
 105   protected X509CRL()
 106   {
 107     super("X.509");
 108   }
 109
 110   /**
 111      Compares this X509CRL to other. It checks if the
 112      object if instanceOf X509CRL and then checks if
 113      the encoded form matches.
 114
 115      @param other An Object to test for equality
 116
 117      @return true if equal, false otherwise
 118   */
 119   public boolean equals(Object other)
 120   {
 121     if( other instanceof X509CRL ) {
 122       try {
 123         X509CRL x = (X509CRL) other;
 124         if( getEncoded().length != x.getEncoded().length )
 125           return false;
 126
 127         byte b1[] = getEncoded();
 128         byte b2[] = x.getEncoded();
 129
 130         for( int i = 0; i < b1.length; i++ )
 131           if( b1[i] != b2[i] )
 132             return false;
 133
 134       } catch( CRLException crle ) {
 135         return false;
 136       }
 137       return true;
 138     }
 139     return false;
 140   }
 141
 142   /**
 143      Returns a hash code for this X509CRL in its encoded
 144      form.
 145
 146      @return A hash code of this class
 147   */
 148   public int hashCode()
 149   {
 150     return super.hashCode();
 151   }
 152
 153   /**
 154      Gets the DER ASN.1 encoded format for this X.509 CRL.
 155
 156      @return byte array containg encoded form
 157
 158      @throws CRLException if an error occurs
 159   */
 160   public abstract byte[] getEncoded() throws CRLException;
 161
 162   /**
 163      Verifies that this CRL was properly signed with the
 164      PublicKey that corresponds to its private key.
 165
 166      @param key PublicKey to verify with
 167
 168      @throws CRLException encoding error
 169      @throws NoSuchAlgorithmException unsupported algorithm
 170      @throws InvalidKeyException incorrect key
 171      @throws NoSuchProviderException no provider
 172      @throws SignatureException signature error
 173   */
 174   public abstract void verify(PublicKey key)
 175     throws CRLException,
 176     NoSuchAlgorithmException,
 177     InvalidKeyException,
 178     NoSuchProviderException,
 179     SignatureException;
 180
 181   /**
 182      Verifies that this CRL was properly signed with the
 183      PublicKey that corresponds to its private key and uses
 184      the signature engine provided by the provider.
 185
 186      @param key PublicKey to verify with
 187      @param sigProvider Provider to use for signature algorithm
 188
 189      @throws CRLException encoding error
 190      @throws NoSuchAlgorithmException unsupported algorithm
 191      @throws InvalidKeyException incorrect key
 192      @throws NoSuchProviderException incorrect provider
 193      @throws SignatureException signature error
 194   */
 195   public abstract void verify(PublicKey key,
 196                               String sigProvider)
 197     throws CRLException,
 198     NoSuchAlgorithmException,
 199     InvalidKeyException,
 200     NoSuchProviderException,
 201     SignatureException;
 202
 203   /**
 204      Gets the version of this CRL.
 205
 206      The ASN.1 encoding is:
 207
 208      version                 Version OPTIONAL,
 209      -- if present, shall be v2
 210
 211      Version  ::=  INTEGER  {  v1(0), v2(1), v3(2)  }
 212
 213      Consult rfc2459 for more information.
 214
 215      @return the version number, Ex: 1 or 2
 216   */
 217   public abstract int getVersion();
 218
 219   /**
 220      Returns the issuer (issuer distinguished name) of the CRL.
 221      The issuer is the entity who signed and issued the
 222      Certificate Revocation List.
 223
 224      The ASN.1 DER encoding is:
 225
 226      issuer                  Name,
 227
 228      Name ::= CHOICE {
 229      RDNSequence }
 230
 231      RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
 232
 233      RelativeDistinguishedName ::=
 234      SET OF AttributeTypeAndValue
 235
 236      AttributeTypeAndValue ::= SEQUENCE {
 237      type     AttributeType,
 238      value    AttributeValue }
 239
 240      AttributeType ::= OBJECT IDENTIFIER
 241
 242      AttributeValue ::= ANY DEFINED BY AttributeType
 243
 244      DirectoryString ::= CHOICE {
 245      teletexString           TeletexString (SIZE (1..MAX)),
 246      printableString         PrintableString (SIZE (1..MAX)),
 247      universalString         UniversalString (SIZE (1..MAX)),
 248      utf8String              UTF8String (SIZE (1.. MAX)),
 249      bmpString               BMPString (SIZE (1..MAX)) }
 250
 251      Consult rfc2459 for more information.
 252
 253      @return the issuer in the Principal class
 254   */
 255   public abstract Principal getIssuerDN();
 256
 257   /**
 258      Returns the thisUpdate date of the CRL.
 259
 260      The ASN.1 DER encoding is:
 261
 262      thisUpdate              Time,
 263
 264      Time ::= CHOICE {
 265      utcTime        UTCTime,
 266      generalTime    GeneralizedTime }
 267
 268      Consult rfc2459 for more information.
 269
 270      @return the thisUpdate date
 271   */
 272   public abstract Date getThisUpdate();
 273
 274   /*
 275     Gets the nextUpdate field
 276
 277     The ASN.1 DER encoding is:
 278
 279     nextUpdate              Time OPTIONAL,
 280
 281     Time ::= CHOICE {
 282     utcTime        UTCTime,
 283     generalTime    GeneralizedTime }
 284
 285     Consult rfc2459 for more information.
 286
 287     @return the nextUpdate date
 288   */
 289   public abstract Date getNextUpdate();
 290
 291   /**
 292      Gets the requeste dX509Entry for the specified
 293      certificate serial number.
 294
 295      @return a X509CRLEntry representing the X.509 CRL entry
 296   */
 297   public abstract X509CRLEntry getRevokedCertificate(BigInteger serialNumber);
 298
 299   /**
 300      Returns a Set of revoked certificates.
 301
 302      @return a set of revoked certificates.
 303   */
 304   public abstract Set getRevokedCertificates();
 305
 306   /**
 307      Returns the DER ASN.1 encoded tbsCertList which is
 308      the basic information of the list and associated certificates
 309      in the encoded state. See top for more information.
 310
 311      The ASN.1 DER encoding is:
 312
 313      tbsCertList          TBSCertList,
 314
 315      Consult rfc2459 for more information.
 316
 317      @return byte array representing tbsCertList
 318   */
 319   public abstract byte[] getTBSCertList() throws CRLException;
 320
 321
 322   /**
 323      Returns the signature for the CRL.
 324
 325      The ASN.1 DER encoding is:
 326
 327      signatureValue       BIT STRING
 328
 329      Consult rfc2459 for more information.
 330   */
 331   public abstract byte[] getSignature();
 332
 333   /**
 334      Returns the signature algorithm used to sign the CRL.
 335      An examples is "SHA-1/DSA".
 336
 337      The ASN.1 DER encoding is:
 338
 339      signatureAlgorithm   AlgorithmIdentifier,
 340
 341      AlgorithmIdentifier  ::=  SEQUENCE  {
 342      algorithm               OBJECT IDENTIFIER,
 343      parameters              ANY DEFINED BY algorithm OPTIONAL  }
 344
 345      Consult rfc2459 for more information.
 346
 347      The algorithm name is determined from the OID.
 348
 349      @return a string with the signature algorithm name
 350   */
 351   public abstract String getSigAlgName();
 352
 353   /**
 354      Returns the OID for the signature algorithm used.
 355      Example "1.2.840.10040.4.3" is return for SHA-1 with DSA.\
 356
 357      The ASN.1 DER encoding for the example is:
 358
 359      id-dsa-with-sha1 ID  ::=  {
 360      iso(1) member-body(2) us(840) x9-57 (10040)
 361      x9cm(4) 3 }
 362
 363      Consult rfc2459 for more information.
 364
 365      @return a string containing the OID.
 366   */
 367   public abstract String getSigAlgOID();
 368
 369   /**
 370      Returns the AlgorithmParameters in the encoded form
 371      for the signature algorithm used.
 372
 373      If access to the parameters is need, create an
 374      instance of AlgorithmParameters.
 375
 376      @return byte array containing algorithm parameters, null
 377      if no parameters are present in CRL
 378   */
 379   public abstract byte[] getSigAlgParams();
 380
 381 }