Class CmpProtectedMessage

java.lang.Object
zeroecho.pkix.cmp.CmpProtectedMessage
public final class CmpProtectedMessage extends Object
Immutable bounded CMP request with exact canonical protected bytes. Parsing grants no authentication; only a successful verification creates CmpProtectedMessage.Verified. A verified proof still grants no certificate trust, ownership or RA authority. The server must apply those policies separately before any durable mutation.

Supports singular ir/cr/kur, rr, caCerts genm, pollReq and certConf requests under CMP versions 2 and 3. Signature protection supports RSA 2048..8192 with SHA-256/384/512 and named P-256/P-384/P-521 ECDSA with those digests. PSS, explicit EC and alternative protection modes are rejected without fallback.

Parsing and owned memory are O(N), bounded by one MiB and 64 ASN.1 levels. PBM work is O(I + N), for configured bounded iterations I; no secret is retained. Instances are thread-safe; callers exclusively own every returned byte array.

  • Field Details

    • MAXIMUM_MESSAGE_BYTES

      public static final int MAXIMUM_MESSAGE_BYTES
      Maximum complete incoming message size.
      See Also:

    • MAXIMUM_EXTRA_CERTIFICATES

      public static final int MAXIMUM_EXTRA_CERTIFICATES
      Maximum supported request certificate candidates.
      See Also:

  • Method Details

    • parse

      public static CmpProtectedMessage parse(byte[] der)
      Parses exactly one canonical DER request and the closed supported grammar. Unknown fields, multiple requests, missing protection and trailing data fail.
      Parameters:
      der - bounded caller-owned message, defensively copied
      Returns:
      immutable unauthenticated message
      Throws:
      IllegalArgumentException - if the message is malformed or unsupported

    • encoded

      public byte[] encoded()
      Returns a defensive copy of the complete canonical request.
      Returns:
      a defensive copy of the complete canonical request

    • bodyType

      public int bodyType()
      Returns the CMP body tag.
      Returns:
      the CMP body tag

    • requestId

      public BigInteger requestId()
      Returns the bounded request ID, or zero for requests without a CertReqId.
      Returns:
      the bounded request ID, or zero for requests without a CertReqId

    • certificationRequest

      public Optional<byte[]> certificationRequest()
      Returns the exact original CertReqMsg, when this is an enrollment request.
      Returns:
      the exact original CertReqMsg, when this is an enrollment request

    • revokedCertificate

      public Optional<CrmfRequest.CertificateReference> revokedCertificate()
      Returns the immutable revocation reference, when this is rr.
      Returns:
      the immutable revocation reference, when this is rr

    • revocationReason

      public int revocationReason()
      Returns the requested permanent revocation reason, or unspecified zero.
      Returns:
      the requested permanent revocation reason, or unspecified zero

    • confirmationHash

      public Optional<byte[]> confirmationHash()
      Returns a defensive confirmation hash, when this is certConf.
      Returns:
      a defensive confirmation hash, when this is certConf

    • confirmationHashAlgorithm

      public Optional<String> confirmationHashAlgorithm()
      Returns the explicit RFC 9480 confirmation hash name, present only in version-three certConf.
      Returns:
      the explicit RFC 9480 confirmation hash name, present only in version-three certConf

    • confirmationAccepted

      public boolean confirmationAccepted()
      Returns whether a certConf accepts rather than rejects the certificate.
      Returns:
      whether a certConf accepts rather than rejects the certificate

    • requestsImplicitConfirmation

      public boolean requestsImplicitConfirmation()
      Returns whether this enrollment explicitly requested implicit confirmation.
      Returns:
      whether this enrollment explicitly requested implicit confirmation

    • isPbm

      public boolean isPbm()
      Returns whether the declared protection mode is standard PBM; not proof validity.
      Returns:
      whether the declared protection mode is standard PBM; not proof validity

    • transactionId

      public byte[] transactionId()
      Returns a defensive transaction identifier.
      Returns:
      a defensive transaction identifier

    • senderNonce

      public byte[] senderNonce()
      Returns a defensive sender nonce.
      Returns:
      a defensive sender nonce

    • recipientNonce

      public Optional<byte[]> recipientNonce()
      Returns the optional defensive recipient nonce.
      Returns:
      the optional defensive recipient nonce

    • senderKid

      public Optional<byte[]> senderKid()
      Returns the optional defensive sender key identifier.
      Returns:
      the optional defensive sender key identifier

    • recipientKid

      public Optional<byte[]> recipientKid()
      Returns the optional defensive recipient key identifier for exact credential selection.
      Returns:
      the optional defensive recipient key identifier for exact credential selection

    • sender

      public X500Principal sender()
      Returns the sender's immutable distinguished name.
      Returns:
      the sender's immutable distinguished name

    • recipient

      public X500Principal recipient()
      Returns the recipient's immutable distinguished name.
      Returns:
      the recipient's immutable distinguished name

    • messageTime

      public Optional<Instant> messageTime()
      Returns the optional sender time; the server applies its freshness policy.
      Returns:
      the optional sender time; the server applies its freshness policy

    • extraCertificates

      public List<byte[]> extraCertificates()
      Returns untrusted certificate candidates; these are outside the protected bytes.
      Returns:
      immutable list of defensive certificate DER arrays

    • certificateKeyId

      public static byte[] certificateKeyId(X509Certificate certificate)
      Returns the exact certificate key identifier used by signature protection. A present subjectKeyIdentifier extension takes precedence and must contain one through 128 bytes. If absent, SHA-256 of the exact encoded SPKI is used. This identifier is only a routing constraint, never a trust assertion.
      Parameters:
      certificate - selected certificate
      Returns:
      caller-owned key identifier
      Throws:
      IllegalArgumentException - if the extension or public key is malformed

    • certificateConfirmationHash

      public static byte[] certificateConfirmationHash(byte[] certificateDer)
      Computes the CMP certificate-confirmation hash using the hash component of a supported RSA or ECDSA certificate signature. RSA-PSS uses its explicit digest parameters. This operation does not verify certificate trust.
      Parameters:
      certificateDer - exact issued DER certificate, at most one MiB
      Returns:
      defensive SHA-256, SHA-384 or SHA-512 digest
      Throws:
      IllegalArgumentException - if the certificate or digest selection is unsupported

    • certificateConfirmationHash

      public static byte[] certificateConfirmationHash(byte[] certificateDer, Optional<String> explicitDigest)
      Hashes an exact certificate for confirmation. RSA, ECDSA and RSA-PSS use their signature digest and any explicit choice must agree. Supported signatures without an encoded digest require an explicit SHA-256, SHA-384 or SHA-512 choice from a version-three certConf message. This operation does not establish certificate trust or protocol authentication.
      Parameters:
      certificateDer - exact DER certificate, at most one MiB
      explicitDigest - validated confirmation hash name, if supplied
      Returns:
      digest of the complete original certificate DER
      Throws:
      IllegalArgumentException - for malformed, inconsistent or unsupported input

    • verifySignature

      public CmpProtectedMessage.Verified verifySignature(X509Certificate certificate)
      Verifies the exact protected bytes using one explicitly selected certificate. Checks its key strength and algorithm grammar; trust, usage, validity, sender binding and authority remain the caller's responsibility.
      Parameters:
      certificate - externally selected candidate, never an implicit trust anchor
      Returns:
      unforgeable proof token for this exact message
      Throws:
      IllegalArgumentException - if mode, algorithm or signature is invalid

    • verifyPbm

      public CmpProtectedMessage.Verified verifyPbm(CmpPbmPolicy policy, byte[] secret, CancellationSignal cancellation)
      Verifies binary-secret PBM after validating all work and algorithm bounds. Secret bytes are never interpreted as characters or retained by the token.
      Parameters:
      policy - explicit configured bounds
      secret - caller-owned 32..128 bytes, copied and never modified
      cancellation - cooperative signal checked during iterative derivation
      Returns:
      proof token for this exact message
      Throws:
      IllegalArgumentException - if bounds, mode, protection or cancellation fail

    • toString

      public String toString()
      Returns a redacted diagnostic representation.
      Overrides:
      toString in class Object
      Returns:
      a redacted diagnostic representation