security/ct/BTVerifier.h

   1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
   3 /* This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 #ifndef BTVerifier_h
   8 #define BTVerifier_h
   9
  10 #include "BTTypes.h"
  11 #include "mozpkix/Input.h"
  12 #include "mozpkix/Result.h"
  13 #include "mozpkix/pkixder.h"
  14 #include "mozpkix/pkixtypes.h"
  15
  16 namespace mozilla {
  17 namespace ct {
  18
  19 // Given an encoded subject public key info, a digest algorithm, a public key
  20 // algorithm, and an encoded signed tree head (SignedTreeHeadV2 as defined in
  21 // RFC 6962-bis), decodes and verifies the STH. Currently only ECDSA keys are
  22 // supported. SHA-256 and SHA-512 are supported, but according to the
  23 // specification only SHA-256 should be supported at this time.
  24 pkix::Result DecodeAndVerifySignedTreeHead(
  25     pkix::Input signerSubjectPublicKeyInfo,
  26     pkix::DigestAlgorithm digestAlgorithm,
  27     pkix::der::PublicKeyAlgorithm publicKeyAlg, pkix::Input signedTreeHeadInput,
  28     SignedTreeHeadDataV2& signedTreeHead);
  29
  30 // Decodes an Inclusion Proof (InclusionProofDataV2 as defined in RFC
  31 // 6962-bis). This consumes the entirety of the input.
  32 pkix::Result DecodeInclusionProof(pkix::Input input,
  33                                   InclusionProofDataV2& output);
  34 // Given a decoded Inclusion Proof (InclusionProofDataV2 as per RFC 6962-bis),
  35 // the corresponding leaf data entry, and the expected root hash, returns
  36 // Success if the proof verifies correctly.
  37 // (https://tools.ietf.org/html/draft-ietf-trans-rfc6962-bis-28#section-2.1.3.2)
  38 pkix::Result VerifyInclusionProof(const InclusionProofDataV2& proof,
  39                                   pkix::Input leafEntry,
  40                                   pkix::Input expectedRootHash,
  41                                   pkix::DigestAlgorithm digestAlgorithm);
  42
  43 }  // namespace ct
  44 }  // namespace mozilla
  45
  46 #endif  // BTVerifier_h