.TH SPKI 2.SH NAMESPKI: Cert, Hash, Key, Name, Seqel, Signature, Subject, Toplev, Valid \- simple public key infrastructure.SH SYNOPSIS.EXinclude "bufio.m";include "sexprs.m";include "keyring.m";include "spki.m";spki := load SPKI SPKI->PATH; Hash: adt {    alg:    string;    hash:   array of byte;     sexp:   fn(h: self ref Hash): ref Sexprs->Sexp;    text:   fn(h: self ref Hash): string;    eq:     fn(h1: self ref Hash, h2: ref Hash): int;}; Key: adt {    pk:     ref Keyring->PK;    # either pk/sk or hash might be nil    sk:     ref Keyring->SK;    nbits:  int;    halg:   string;             # basic signature hash algorithm    henc:   string;             # pre-signature encoding    hash:   list of ref Hash;     hashed:  fn(k: self ref Key, alg: string): array of byte;    hashexp: fn(k: self ref Key, alg: string): ref Hash;    public:  fn(k: self ref Key): ref Key;    sigalg:  fn(k: self ref Key): string;    text:    fn(k: self ref Key): string;    sexp:    fn(k: self ref Key): ref Sexprs->Sexp;    eq:      fn(k1: self ref Key, k2: ref Key): int;}; Name: adt {    principal:  ref Key;    names:  list of string;     isprincipal: fn(n: self ref Name): int;    local:    fn(n: self ref Name): ref Name;    islocal:  fn(n: self ref Name): int;    isprefix: fn(n1: self ref Name, n2: ref Name): int;    text:     fn(n: self ref Name): string;    sexp:     fn(n: self ref Name): ref Sexprs->Sexp;    eq:       fn(n1: self ref Name, n2: ref Name): int;}; Cert: adt {    e:        ref Sexprs->Sexp;   # S-expression, if originally parsed    issuer:   ref Name;    subject:  ref Subject;    valid:    ref Valid;    pick {    A or KH or O => # auth, keyholder or object        delegate:   int;        tag:        ref Sexprs->Sexp;    N =>    # name    }     text:     fn(c: self ref Cert): string;    sexp:     fn(c: self ref Cert): ref Sexprs->Sexp;}; Subject: adt {    pick{    P =>        key:    ref Key;    N =>        name:   ref Name;    O =>        hash:   ref Hash;    KH =>        holder: ref Name;    T =>        k, n:   int;        subs:   cyclic list of ref Subject;    }     eq:     fn(s1: self ref Subject, s2: ref Subject): int;    principal:  fn(s: self ref Subject): ref Key;    text:   fn(s: self ref Subject): string;    sexp:   fn(s: self ref Subject): ref Sexprs->Sexp;}; Signature: adt {    hash:   ref Hash;    key:    ref Key;    # find by hash if necessary    sa:     string;     # alg[-[encoding-]hash    sig:    list of (string, array of byte);     algs:   fn(s: self ref Signature): (string, string, string);    sexp:   fn(s: self ref Signature): ref Sexprs->Sexp;    text:   fn(s: self ref Signature): string;}; Seqel: adt {    pick{    C =>        c: ref Cert;    K =>        k: ref Key;    O =>        op: string;        args: list of ref Sexprs->Sexp;    S =>        sig: ref Signature;    E =>        exp:    ref Sexprs->Sexp;    }     sexp:   fn(se: self ref Seqeql): ref Sexprs->Sexp;    text:   fn(se: self ref Seqel): string;}; Valid: adt {    notbefore:  string;    notafter:   string;     intersect:  fn(a: self Valid, b: Valid): (int, Valid);    text:   fn(a: self Valid): string;    sexp:   fn(a: self Valid): ref Sexprs->Sexp;}; Toplev: adt {    pick {    C =>        v:  ref Cert;    Sig =>        v:  ref Signature;    K =>        v:  ref Key;    Seq =>        v:  list of ref Seqel;    }     sexp:   fn(t: self ref Toplev): ref Sexprs->Sexp;    text:   fn(t: self ref Toplev): string;}; init:   fn();date2epoch: fn(s: string): int; # YYYY-MM-DD_HH:MM:SSepoch2date: fn(t: int): string;time2secs:  fn(s: string): int; # HH:MM:SSsecs2time:  fn(t: int): string;sigalgs:    fn(spec: string): (string, string, string); # parse structuresparse:      fn(s: ref Sexprs->Sexp): (ref Toplev, string);parseseq:   fn(s: ref Sexprs->Sexp): list of ref Seqel;parsecert:  fn(s: ref Sexprs->Sexp): ref Cert;parsesig:   fn(s: ref Sexprs->Sexp): ref Signature;parsename:  fn(s: ref Sexprs->Sexp): ref Name;parsekey:   fn(s: ref Sexprs->Sexp): ref Key;parsehash:  fn(s: ref Sexprs->Sexp): ref Hash;parsecompound:  fn(s: ref Sexprs->Sexp): ref Name;parsevalid: fn(s: ref Sexprs->Sexp): ref Valid; # signature checkingchecksig:   fn(c: ref Cert, sig: ref Signature): string;sig2icert:  fn(sig: ref Signature, signer: string, exp: int): ref Keyring->Certificate; # signature makingsigncert:   fn(c: ref Cert, sigalg: string, key: ref Key):                 (ref Signature, string);signbytes:  fn(a: array of byte, sigalg: string, key: ref Key):                 (ref Signature, string); # tagsmaketag:    fn(e: ref Sexprs->Sexp): ref Sexprs->Sexp;tagintersect:  fn(t1: ref Sexprs->Sexp, t2: ref Sexprs->Sexp):                 ref Sexprs->Sexp;tagimplies: fn(t1: ref Sexprs->Sexp, t2: ref Sexprs->Sexp): int; # hash canonical s-expressionhashbytes:  fn(a: array of byte, alg: string): array of byte;hashexp:    fn(e: ref Sexprs->Sexp, alg: string): array of byte;.EE.SH DESCRIPTION.B SPKIprovides data types and operations to help build implementations of the Simple Public Key Infrastructure(SPKI).It provides types for hash values, public and private keys, local and extended names,principals and compound principles, certificates, validity periods, signatures, and proof sequences.It also provides operations on authorisation tags.Externally, SPKI represents all such things as particular forms of S-expression, internally represented using.B Sexprs->Sexpfrom.IR sexprs (2)..PP.B Initmust be called before invoking any other operation of the module..PPMost types defined here provide several common operations:.TP.IB t1 .eq( t2 )Return true iff values.I t1and.I t2are equal..TP.IB t .sexp()Return an S-expression.I srepresenting the value of.IR t .Subsequently, the.B Sexpoperation.IR s .pack()will yield an array of bytes containing the value.I tin SPKI's canonical S-expression form..TP.IB t .text()Return a textual representation of the value.IR t ;it is often just the textual representation of the corresponding S-expression..PP.B Hashis the internal representation of hash values,containing analgorithm name.B algand then the.B hashitself as an array of bytes.SPKI entities such as the public key of a principal or a signed certificate are often represented by the hashvalues of their corresponding S-expressions, where the hash value is later used as a compact way to referto the original entity.For example, a.B <principal>is either a.B <public-key>or a.BR <hash-of-key> ,where the latter refers to some instance of the former.Current hash algorithms are \f5"sha1"\fP and \f5"md5\fP.A.B Hashvalue can be created from an S-expression representing a SPKI.B <hash>elementby.BR parsehash .It returns nil if the S-expression was ill-formed..PP.B Keyrepresents public and private keys,with an optional associated pre-hash encoding.BR henc ,the hash algorithm.B halgto be used when signing, and an optional list ofcurrently known hashes of the public component of the key itself.SPKI identifies principals and public keys, thus each instance of a principalin the other data structures is represented by a.B Keygiving the corresponding public key, or its hash, or both.Currently the public and private (secret) key values have types defined by.IR keyring-intro (2).A.B Keyvalue can be created from an S-expression representing a SPKI.B <public-key>element by.BR parsekey .It returns nil if the S-expression was ill-formed.For a given.B Key.IR k :.TP.IB k .ishash()Returns true if.I kis just a hash of a key, with no public or private components..TP.IB k .public()Returns the public key for.IR k ,which is simply.I kif it is already a public key, but if itis a private key, then a new key is returnedthat has only public components..B Publicreturns a nil value if.I kis just a hash of a key value..TP.IB k .sigalg()Returns the SPKI signature algorithm for the key..TP.IB k .hashed( alg )Return an array of bytes giving the hash of the Key.I kusing algorithm.IR alg .It returns nil if.IB k .ishash()is true, and.I khas no associated hash value for.IR alg ..TP.IB k .hashexp( alg )Similar to.BR hashed ,but returns a.B Hashvalue instead of the raw data..PP.B Namerepresents both local and extended names, and simple principals consisting of just a key.The field.B principalgives the key that defines the name space in which the list of names is interpreted.For simple principles, the list of.B namesis nil.A local name has exactly one name in the list.Two parsing functions convert to.B Namefrom S-expressions..B Parsenameparses a SPKI.B <name>element:.BI (name[.I principal].I name\&....BR ),where.I principal is either a.B <public-key>or a.B <hash>element..B Parsecompoundaccepts either a.B <name>element as above, or a.B <public-key>or its.BR <hash> .Both functions return nil if the S-expression is ill-formed..PP.B Subjectrepresents the subjects of SPKI name and authorisation certificates.It has several variants in a.B pickadt, with suitable fields for each variant:.TP.B Subject.PA simple principal: a.BR key ..TP.B Subject.NA group of principals or a delayed binding to a principal: a.BR name ..TP.B Subject.OThe.B hashof an object..TP.B Subject.KHA keyholder certificate, that says something about a key's.B holder(represented by a.BR Name )..TP.B Subject.TA.I thresholdsubject, used only in authorisation certificates.The.I nsubsidiary subjects are listed in.BR subs ;of those, at least.I kmust sign a request for it to be authorised..TP.B Subjectprovides the common operations.BR eq ,.B sexpand.BR text ,and a further operation:.TP.IB s .principal()If.I sis a simple principal or a name, return the.B Keydefining the principal, if known; return nil otherwise..PPSubjects appear only as a subsidiary item in certificates and do not have a parsing function..PP.B Certrepresents SPKI certificates.There are four variants, represented by a pick adt:.B Cert.A(authorisation);.B Cert.KH(keyholder);.B Cert.O(object); and.B Cert.N(name).The following fields and operations are common to all variants:.TP.B eoriginal S-expression (if created by.BR parsecert )to allow hashes and signatures to be computed on the SPKI canonical form of the certificate.TP.B issuerThe simple principal (represented as a name) that issued an authorisation, keyholder or object certificate,or the.B <issuer-name>of a name certificate (allowing both local and extended names not just simple principals)..TP.B subjectThe.B Subjectof the certificate.Name certificates may not have threshold subjects..TP.B validOptional restriction on the certificate's validity(see.B Validfor details)..PPName certificates have only the fields above; the others have several more fields:.TP.BdelegateTrue iff the certificate carries delegation rights (ie,.B (propagate)in the S-expression representation)..TP.B tagAn S-expression that expresses the authority granted by the certificate.The expression.B "(tag (*))"means `all permissions'..PPA.B Certvaluecan be created from an S-expression representing a SPKI.B <cert>element by.BR parsecert .It returns nil if the expression was ill-formed..PPSPKI.B tagexpressions, represented internally by.B Sexprs->Sexprtrees, form a partial order,including the pattern operations.BR (*) ,.BR "(* set " ....BR ),.BR "(* prefix " ....BR ),.BR "(* range " ....BR ),and as an extension,.BR "(* suffix " ....BR ).Given two tag expressions.I t1and.IR t2 ,.I tagintersectreturns a tag expression representing.I t1∩.IR t2 ;.B tagimpliesreturns true iff tag.I t1implies tag.IR t2 :(\fIt1\fP∩\fIt2\fP)=\fIt2\fP.Both functions work correctly when.I t1and

Lines 1–500 of 601. Load more