/* * Copyright (c) 1996, 2002, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License version 2 only, as * published by the Free Software Foundation.  Oracle designates this * particular file as subject to the "Classpath" exception as provided * by Oracle in the LICENSE file that accompanied this code. * * This code is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License * version 2 for more details (a copy is included in the LICENSE file that * accompanied this code). * * You should have received a copy of the GNU General Public License version * 2 along with this work; if not, write to the Free Software Foundation, * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. * * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA * or visit www.oracle.com if you need additional information or have any * questions. */  package sun.security.pkcs; import java.io.ByteArrayOutputStream;import java.io.PrintStream;import java.io.IOException;import java.math.BigInteger; import java.security.cert.CertificateException;import java.security.NoSuchAlgorithmException;import java.security.InvalidKeyException;import java.security.Signature;import java.security.SignatureException;import java.security.PublicKey; import sun.misc.BASE64Encoder; import sun.security.util.*;import sun.security.x509.AlgorithmId;import sun.security.x509.X509Key;import sun.security.x509.X500Name; /** * A PKCS #10 certificate request is created and sent to a Certificate * Authority, which then creates an X.509 certificate and returns it to * the entity that requested it. A certificate request basically consists * of the subject's X.500 name, public key, and optionally some attributes, * signed using the corresponding private key. * * The ASN.1 syntax for a Certification Request is: * <pre> * CertificationRequest ::= SEQUENCE { *    certificationRequestInfo CertificationRequestInfo, *    signatureAlgorithm       SignatureAlgorithmIdentifier, *    signature                Signature *  } * * SignatureAlgorithmIdentifier ::= AlgorithmIdentifier * Signature ::= BIT STRING * * CertificationRequestInfo ::= SEQUENCE { *    version                 Version, *    subject                 Name, *    subjectPublicKeyInfo    SubjectPublicKeyInfo, *    attributes [0] IMPLICIT Attributes * } * Attributes ::= SET OF Attribute * </pre> * * @author David Brownell * @author Amit Kapoor * @author Hemma Prafullchandra */public class PKCS10 {    /**     * Constructs an unsigned PKCS #10 certificate request.  Before this     * request may be used, it must be encoded and signed.  Then it     * must be retrieved in some conventional format (e.g. string).     *     * @param publicKey the public key that should be placed     *          into the certificate generated by the CA.     */    public PKCS10(PublicKey publicKey) {        subjectPublicKeyInfo = publicKey;        attributeSet = new PKCS10Attributes();    }     /**     * Constructs an unsigned PKCS #10 certificate request.  Before this     * request may be used, it must be encoded and signed.  Then it     * must be retrieved in some conventional format (e.g. string).     *     * @param publicKey the public key that should be placed     *          into the certificate generated by the CA.     * @param attributes additonal set of PKCS10 attributes requested     *          for in the certificate.     */    public PKCS10(PublicKey publicKey, PKCS10Attributes attributes) {        subjectPublicKeyInfo = publicKey;        attributeSet = attributes;    }     /**     * Parses an encoded, signed PKCS #10 certificate request, verifying     * the request's signature as it does so.  This constructor would     * typically be used by a Certificate Authority, from which a new     * certificate would then be constructed.     *     * @param data the DER-encoded PKCS #10 request.     * @exception IOException for low level errors reading the data     * @exception SignatureException when the signature is invalid     * @exception NoSuchAlgorithmException when the signature     *  algorithm is not supported in this environment     */    public PKCS10(byte[] data)    throws IOException, SignatureException, NoSuchAlgorithmException {        DerInputStream  in;        DerValue[]      seq;        AlgorithmId     id;        byte[]          sigData;        Signature       sig;         encoded = data;         //        // Outer sequence:  request, signature algorithm, signature.        // Parse, and prepare to verify later.        //        in = new DerInputStream(data);        seq = in.getSequence(3);         if (seq.length != 3)            throw new IllegalArgumentException("not a PKCS #10 request");         data = seq[0].toByteArray();            // reusing this variable        id = AlgorithmId.parse(seq[1]);        sigData = seq[2].getBitString();         //        // Inner sequence:  version, name, key, attributes        //        BigInteger      serial;        DerValue        val;         serial = seq[0].data.getBigInteger();        if (!serial.equals(BigInteger.ZERO))            throw new IllegalArgumentException("not PKCS #10 v1");         subject = new X500Name(seq[0].data);        subjectPublicKeyInfo = X509Key.parse(seq[0].data.getDerValue());         // Cope with a somewhat common illegal PKCS #10 format        if (seq[0].data.available() != 0)            attributeSet = new PKCS10Attributes(seq[0].data);        else            attributeSet = new PKCS10Attributes();         if (seq[0].data.available() != 0)            throw new IllegalArgumentException("illegal PKCS #10 data");         //        // OK, we parsed it all ... validate the signature using the        // key and signature algorithm we found.        //        try {            sig = Signature.getInstance(id.getName());            sig.initVerify(subjectPublicKeyInfo);            sig.update(data);            if (!sig.verify(sigData))                throw new SignatureException("Invalid PKCS #10 signature");        } catch (InvalidKeyException e) {            throw new SignatureException("invalid key");        }    }     /**     * Create the signed certificate request.  This will later be     * retrieved in either string or binary format.     *     * @param subject identifies the signer (by X.500 name).     * @param signature private key and signing algorithm to use.     * @exception IOException on errors.     * @exception CertificateException on certificate handling errors.     * @exception SignatureException on signature handling errors.     */    public void encodeAndSign(X500Name subject, Signature signature)    throws CertificateException, IOException, SignatureException {        DerOutputStream out, scratch;        byte[]          certificateRequestInfo;        byte[]          sig;         if (encoded != null)            throw new SignatureException("request is already signed");         this.subject = subject;         /*         * Encode cert request info, wrap in a sequence for signing         */        scratch = new DerOutputStream();        scratch.putInteger(BigInteger.ZERO);            // PKCS #10 v1.0        subject.encode(scratch);                        // X.500 name        scratch.write(subjectPublicKeyInfo.getEncoded()); // public key        attributeSet.encode(scratch);         out = new DerOutputStream();        out.write(DerValue.tag_Sequence, scratch);      // wrap it!        certificateRequestInfo = out.toByteArray();        scratch = out;         /*         * Sign it ...         */        signature.update(certificateRequestInfo, 0,                certificateRequestInfo.length);        sig = signature.sign();         /*         * Build guts of SIGNED macro         */        AlgorithmId algId = null;        try {            algId = AlgorithmId.getAlgorithmId(signature.getAlgorithm());        } catch (NoSuchAlgorithmException nsae) {            throw new SignatureException(nsae);        }        algId.encode(scratch);     // sig algorithm        scratch.putBitString(sig);                      // sig         /*         * Wrap those guts in a sequence         */        out = new DerOutputStream();        out.write(DerValue.tag_Sequence, scratch);        encoded = out.toByteArray();    }     /**     * Returns the subject's name.     */    public X500Name getSubjectName() { return subject; }     /**     * Returns the subject's public key.     */    public PublicKey getSubjectPublicKeyInfo()        { return subjectPublicKeyInfo; }     /**     * Returns the additional attributes requested.     */    public PKCS10Attributes getAttributes()        { return attributeSet; }     /**     * Returns the encoded and signed certificate request as a     * DER-encoded byte array.     *     * @return the certificate request, or null if encodeAndSign()     *          has not yet been called.     */    public byte[] getEncoded() {        if (encoded != null)            return encoded.clone();        else            return null;    }     /**     * Prints an E-Mailable version of the certificate request on the print     * stream passed.  The format is a common base64 encoded one, supported     * by most Certificate Authorities because Netscape web servers have     * used this for some time.  Some certificate authorities expect some     * more information, in particular contact information for the web     * server administrator.     *     * @param out the print stream where the certificate request     *  will be printed.     * @exception IOException when an output operation failed     * @exception SignatureException when the certificate request was     *  not yet signed.     */    public void print(PrintStream out)    throws IOException, SignatureException {        if (encoded == null)            throw new SignatureException("Cert request was not signed");         BASE64Encoder   encoder = new BASE64Encoder();         out.println("-----BEGIN NEW CERTIFICATE REQUEST-----");        encoder.encodeBuffer(encoded, out);        out.println("-----END NEW CERTIFICATE REQUEST-----");    }     /**     * Provides a short description of this request.     */    public String toString() {        return "[PKCS #10 certificate request:\n"            + subjectPublicKeyInfo.toString()            + " subject: <" + subject + ">" + "\n"            + " attributes: " + attributeSet.toString()            + "\n]";    }     /**     * Compares this object for equality with the specified     * object. If the <code>other</code> object is an     * <code>instanceof</code> <code>PKCS10</code>, then     * its encoded form is retrieved and compared with the     * encoded form of this certificate request.     *     * @param other the object to test for equality with this object.     * @return true iff the encoded forms of the two certificate     * requests match, false otherwise.     */    public boolean equals(Object other) {        if (this == other)            return true;        if (!(other instanceof PKCS10))            return false;        if (encoded == null) // not signed yet            return false;        byte[] otherEncoded = ((PKCS10)other).getEncoded();        if (otherEncoded == null)            return false;         return java.util.Arrays.equals(encoded, otherEncoded);    }     /**     * Returns a hashcode value for this certificate request from its     * encoded form.     *     * @return the hashcode value.     */    public int hashCode() {        int     retval = 0;        if (encoded != null)            for (int i = 1; i < encoded.length; i++)             retval += encoded[i] * i;        return(retval);    }     private X500Name            subject;    private PublicKey           subjectPublicKeyInfo;    private PKCS10Attributes    attributeSet;    private byte[]              encoded;        // signed}