Class ScepCodec

java.lang.Object
zeroecho.pkix.scep.ScepCodec
public final class ScepCodec extends Object
BouncyCastle-backed codec for SCEP (RFC 8894) CMS message encoding and decoding.

All operations in this class use BouncyCastle CMS directly; no BouncyCastle types are exposed in the method signatures so that callers in other modules do not need a requires org.bouncycastle.* clause.

Since:
1.0

  • Field Details

    • MSG_PKCS_REQ

      public static final int MSG_PKCS_REQ
      SCEP messageType value for PKCSReq.
      See Also:

    • MSG_CERT_REP

      public static final int MSG_CERT_REP
      SCEP messageType value for CertRep.
      See Also:

    • MSG_GET_CERT_INITIAL

      public static final int MSG_GET_CERT_INITIAL
      SCEP messageType value for GetCertInitial.
      See Also:

    • MSG_GET_CERT

      public static final int MSG_GET_CERT
      SCEP messageType value for GetCert.
      See Also:

    • MSG_GET_CRL

      public static final int MSG_GET_CRL
      SCEP messageType value for GetCRL.
      See Also:

    • STATUS_SUCCESS

      public static final String STATUS_SUCCESS
      pkiStatus value for success.
      See Also:

    • STATUS_FAILURE

      public static final String STATUS_FAILURE
      pkiStatus value for failure.
      See Also:

    • STATUS_PENDING

      public static final String STATUS_PENDING
      pkiStatus value for pending.
      See Also:

    • FAIL_BAD_REQUEST

      public static final String FAIL_BAD_REQUEST
      failInfo value for badRequest (challenge password mismatch).
      See Also:

    • FAIL_BAD_CERT_ID

      public static final String FAIL_BAD_CERT_ID
      failInfo value for badCertId (certificate not found).
      See Also:

    • MAXIMUM_REQUEST_BYTES

      public static final int MAXIMUM_REQUEST_BYTES
      Maximum accepted encoded request size, before CMS parsing or decryption.
      See Also:

  • Method Details

    • verifyRequest

      public static ScepCodec.VerifiedRequest verifyRequest(byte[] cmsDer) throws ScepCodecException
      Verifies a bounded CMS request before any private-key decryption. Requires one signer and one matching certificate, SHA-256/RSA, authenticated id-data content, and strictly typed singular SCEP attributes. Certificate possession is proven; identity authorization is the caller's job.
      Parameters:
      cmsDer - complete encoded CMS message
      Returns:
      authenticated outer envelope
      Throws:
      ScepCodecException - for malformed or unsupported messages or invalid signatures

    • decryptRequest

      public static ScepPkiMessage decryptRequest(ScepCodec.VerifiedRequest request, X509Certificate raCertificate, PrivateKey raPrivateKey) throws ScepCodecException
      Decrypts an already verified request using one exact provisioned RA recipient. Requires AES-128-CBC, RSA key transport, and exactly one matching recipient; there is no trial decryption or fallback to another credential.
      Parameters:
      request - authenticated envelope
      raCertificate - exact provisioned recipient certificate
      raPrivateKey - matching private key borrowed under its custody lease
      Returns:
      verified attributes and independently owned plaintext request
      Throws:
      ScepCodecException - for an invalid envelope, recipient or decryption

    • requireIssuerAndSubject

      public static void requireIssuerAndSubject(byte[] encoded, X500Principal issuer, X500Principal subject) throws ScepCodecException
      Validates an IssuerAndSubject poll against the frozen issuer and original CSR.
      Parameters:
      encoded - exact decrypted poll
      issuer - frozen issuing CA subject
      subject - original CSR subject
      Throws:
      ScepCodecException - if either name differs or the encoding is malformed

    • extractChallengePassword

      public static String extractChallengePassword(byte[] csrDer) throws ScepCodecException
      Extracts the PKCS#9 challengePassword attribute string from a DER-encoded PKCS#10 CSR. Returns null if the attribute is absent.
      Parameters:
      csrDer - DER-encoded PKCS#10 CSR
      Returns:
      challengePassword string, or null if absent
      Throws:
      ScepCodecException - if the CSR cannot be parsed

    • buildCertRepSuccess

      public static byte[] buildCertRepSuccess(String transactionId, byte[] recipientNonce, byte[] issuedCertDer, X509Certificate requesterCert, X509Certificate raCert, PrivateKey raKey) throws ScepCodecException
      Builds a SCEP CertRep SUCCESS response signed by the RA.

      The inner content is a CMS EnvelopedData wrapping a degenerate SignedData containing the issued certificate, encrypted for the requester's certificate (from the original PKCSReq message).

      Parameters:
      transactionId - SCEP transaction identifier from the request
      recipientNonce - senderNonce from the request (becomes recipientNonce in response)
      issuedCertDer - DER-encoded issued certificate
      requesterCert - requester's certificate (for encrypting the response)
      raCert - RA signing certificate
      raKey - RA private key for signing
      Returns:
      DER-encoded CMS SignedData CertRep
      Throws:
      ScepCodecException - if encoding fails

    • buildCertRepFailure

      public static byte[] buildCertRepFailure(String transactionId, byte[] recipientNonce, String failInfo, X509Certificate raCert, PrivateKey raKey) throws ScepCodecException
      Builds a SCEP CertRep FAILURE response signed by the RA.
      Parameters:
      transactionId - SCEP transaction identifier from the request
      recipientNonce - senderNonce from the request
      failInfo - SCEP failInfo value string (e.g., "2" for badRequest)
      raCert - RA signing certificate
      raKey - RA private key for signing
      Returns:
      DER-encoded CMS SignedData CertRep
      Throws:
      ScepCodecException - if encoding fails

    • buildCertRepPending

      public static byte[] buildCertRepPending(String transactionId, byte[] recipientNonce, X509Certificate raCert, PrivateKey raKey) throws ScepCodecException
      Builds a SCEP CertRep PENDING response signed by the RA.
      Parameters:
      transactionId - SCEP transaction identifier from the request
      recipientNonce - senderNonce from the request
      raCert - RA signing certificate
      raKey - RA private key for signing
      Returns:
      DER-encoded CMS SignedData CertRep
      Throws:
      ScepCodecException - if encoding fails

    • buildDegenerateCertsCms

      public static byte[] buildDegenerateCertsCms(List<byte[]> certsDer) throws ScepCodecException
      Builds a degenerate CMS certs-only SignedData from the given DER-encoded certificates. Used for GetCACert and GetCACertChain responses.
      Parameters:
      certsDer - list of DER-encoded certificates in presentation order
      Returns:
      DER-encoded CMS ContentInfo wrapping SignedData
      Throws:
      ScepCodecException - if encoding fails