Inspection of "Add AC example" - sop/x509 - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Push — master ( 91afec...2569ae )

by Joni

created 2017-11-27 12:42 UTC

Status

Indentation +166 added lines, -166 removed lines patch added patch discarded remove patch

@@ -20,181 +20,181 @@
 block discarded – undo
  */
 class AuthorityKeyIdentifierExtension extends Extension
 {
-    /**
-     * Key identifier.
-     *
-     * @var string|null $_keyIdentifier
-     */
-    protected $_keyIdentifier;
+	/**
+	 * Key identifier.
+	 *
+	 * @var string|null $_keyIdentifier
+	 */
+	protected $_keyIdentifier;
     
-    /**
-     * Issuer name.
-     *
-     * @var GeneralNames|null $_authorityCertIssuer
-     */
-    protected $_authorityCertIssuer;
+	/**
+	 * Issuer name.
+	 *
+	 * @var GeneralNames|null $_authorityCertIssuer
+	 */
+	protected $_authorityCertIssuer;
     
-    /**
-     * Issuer serial number.
-     *
-     * @var string|null $_authorityCertSerialNumber
-     */
-    protected $_authorityCertSerialNumber;
+	/**
+	 * Issuer serial number.
+	 *
+	 * @var string|null $_authorityCertSerialNumber
+	 */
+	protected $_authorityCertSerialNumber;
     
-    /**
-     * Constructor.
-     *
-     * @param bool $critical Conforming CA's must mark as non-critical (false)
-     * @param string|null $keyIdentifier
-     * @param GeneralNames|null $issuer
-     * @param string|null $serial
-     */
-    public function __construct(bool $critical, $keyIdentifier,
-        GeneralNames $issuer = null, $serial = null)
-    {
-        parent::__construct(self::OID_AUTHORITY_KEY_IDENTIFIER, $critical);
-        $this->_keyIdentifier = $keyIdentifier;
-        $this->_authorityCertIssuer = $issuer;
-        $this->_authorityCertSerialNumber = isset($serial) ? strval($serial) : null;
-    }
+	/**
+	 * Constructor.
+	 *
+	 * @param bool $critical Conforming CA's must mark as non-critical (false)
+	 * @param string|null $keyIdentifier
+	 * @param GeneralNames|null $issuer
+	 * @param string|null $serial
+	 */
+	public function __construct(bool $critical, $keyIdentifier,
+		GeneralNames $issuer = null, $serial = null)
+	{
+		parent::__construct(self::OID_AUTHORITY_KEY_IDENTIFIER, $critical);
+		$this->_keyIdentifier = $keyIdentifier;
+		$this->_authorityCertIssuer = $issuer;
+		$this->_authorityCertSerialNumber = isset($serial) ? strval($serial) : null;
+	}
     
-    /**
-     * Create from public key info.
-     *
-     * @param PublicKeyInfo $pki
-     * @return AuthorityKeyIdentifierExtension
-     */
-    public static function fromPublicKeyInfo(PublicKeyInfo $pki)
-    {
-        return new self(false, $pki->keyIdentifier());
-    }
+	/**
+	 * Create from public key info.
+	 *
+	 * @param PublicKeyInfo $pki
+	 * @return AuthorityKeyIdentifierExtension
+	 */
+	public static function fromPublicKeyInfo(PublicKeyInfo $pki)
+	{
+		return new self(false, $pki->keyIdentifier());
+	}
     
-    /**
-     *
-     * {@inheritdoc}
-     * @return self
-     */
-    protected static function _fromDER(string $data, bool $critical): self
-    {
-        $seq = UnspecifiedType::fromDER($data)->asSequence();
-        $keyIdentifier = null;
-        $issuer = null;
-        $serial = null;
-        if ($seq->hasTagged(0)) {
-            $keyIdentifier = $seq->getTagged(0)
-                ->asImplicit(Element::TYPE_OCTET_STRING)
-                ->asOctetString()
-                ->string();
-        }
-        if ($seq->hasTagged(1) || $seq->hasTagged(2)) {
-            if (!$seq->hasTagged(1) || !$seq->hasTagged(2)) {
-                throw new \UnexpectedValueException(
-                    "AuthorityKeyIdentifier must have both" .
-                         " authorityCertIssuer and authorityCertSerialNumber" .
-                         " present or both absent.");
-            }
-            $issuer = GeneralNames::fromASN1(
-                $seq->getTagged(1)
-                    ->asImplicit(Element::TYPE_SEQUENCE)
-                    ->asSequence());
-            $serial = $seq->getTagged(2)
-                ->asImplicit(Element::TYPE_INTEGER)
-                ->asInteger()
-                ->number();
-        }
-        return new self($critical, $keyIdentifier, $issuer, $serial);
-    }
+	/**
+	 *
+	 * {@inheritdoc}
+	 * @return self
+	 */
+	protected static function _fromDER(string $data, bool $critical): self
+	{
+		$seq = UnspecifiedType::fromDER($data)->asSequence();
+		$keyIdentifier = null;
+		$issuer = null;
+		$serial = null;
+		if ($seq->hasTagged(0)) {
+			$keyIdentifier = $seq->getTagged(0)
+				->asImplicit(Element::TYPE_OCTET_STRING)
+				->asOctetString()
+				->string();
+		}
+		if ($seq->hasTagged(1) || $seq->hasTagged(2)) {
+			if (!$seq->hasTagged(1) || !$seq->hasTagged(2)) {
+				throw new \UnexpectedValueException(
+					"AuthorityKeyIdentifier must have both" .
+						 " authorityCertIssuer and authorityCertSerialNumber" .
+						 " present or both absent.");
+			}
+			$issuer = GeneralNames::fromASN1(
+				$seq->getTagged(1)
+					->asImplicit(Element::TYPE_SEQUENCE)
+					->asSequence());
+			$serial = $seq->getTagged(2)
+				->asImplicit(Element::TYPE_INTEGER)
+				->asInteger()
+				->number();
+		}
+		return new self($critical, $keyIdentifier, $issuer, $serial);
+	}
     
-    /**
-     * Whether key identifier is present.
-     *
-     * @return bool
-     */
-    public function hasKeyIdentifier(): bool
-    {
-        return isset($this->_keyIdentifier);
-    }
+	/**
+	 * Whether key identifier is present.
+	 *
+	 * @return bool
+	 */
+	public function hasKeyIdentifier(): bool
+	{
+		return isset($this->_keyIdentifier);
+	}
     
-    /**
-     * Get key identifier.
-     *
-     * @throws \LogicException
-     * @return string
-     */
-    public function keyIdentifier(): string
-    {
-        if (!$this->hasKeyIdentifier()) {
-            throw new \LogicException("keyIdentifier not set.");
-        }
-        return $this->_keyIdentifier;
-    }
+	/**
+	 * Get key identifier.
+	 *
+	 * @throws \LogicException
+	 * @return string
+	 */
+	public function keyIdentifier(): string
+	{
+		if (!$this->hasKeyIdentifier()) {
+			throw new \LogicException("keyIdentifier not set.");
+		}
+		return $this->_keyIdentifier;
+	}
     
-    /**
-     * Whether issuer is present.
-     *
-     * @return bool
-     */
-    public function hasIssuer(): bool
-    {
-        return isset($this->_authorityCertIssuer);
-    }
+	/**
+	 * Whether issuer is present.
+	 *
+	 * @return bool
+	 */
+	public function hasIssuer(): bool
+	{
+		return isset($this->_authorityCertIssuer);
+	}
     
-    /**
-     * Get issuer.
-     *
-     * @throws \LogicException
-     * @return GeneralNames
-     */
-    public function issuer(): GeneralNames
-    {
-        if (!$this->hasIssuer()) {
-            throw new \LogicException("authorityCertIssuer not set.");
-        }
-        return $this->_authorityCertIssuer;
-    }
+	/**
+	 * Get issuer.
+	 *
+	 * @throws \LogicException
+	 * @return GeneralNames
+	 */
+	public function issuer(): GeneralNames
+	{
+		if (!$this->hasIssuer()) {
+			throw new \LogicException("authorityCertIssuer not set.");
+		}
+		return $this->_authorityCertIssuer;
+	}
     
-    /**
-     * Get serial number.
-     *
-     * @throws \LogicException
-     * @return string Base 10 integer string
-     */
-    public function serial(): string
-    {
-        // both issuer and serial must be present or both absent
-        if (!$this->hasIssuer()) {
-            throw new \LogicException("authorityCertSerialNumber not set.");
-        }
-        return $this->_authorityCertSerialNumber;
-    }
+	/**
+	 * Get serial number.
+	 *
+	 * @throws \LogicException
+	 * @return string Base 10 integer string
+	 */
+	public function serial(): string
+	{
+		// both issuer and serial must be present or both absent
+		if (!$this->hasIssuer()) {
+			throw new \LogicException("authorityCertSerialNumber not set.");
+		}
+		return $this->_authorityCertSerialNumber;
+	}
     
-    /**
-     *
-     * {@inheritdoc}
-     * @return Sequence
-     */
-    protected function _valueASN1(): Sequence
-    {
-        $elements = array();
-        if (isset($this->_keyIdentifier)) {
-            $elements[] = new ImplicitlyTaggedType(0,
-                new OctetString($this->_keyIdentifier));
-        }
-        // if either issuer or serial is set, both must be set
-        if (isset($this->_authorityCertIssuer) ||
-             isset($this->_authorityCertSerialNumber)) {
-            if (!isset($this->_authorityCertIssuer,
-                $this->_authorityCertSerialNumber)) {
-                throw new \LogicException(
-                    "AuthorityKeyIdentifier must have both" .
-                     " authorityCertIssuer and authorityCertSerialNumber" .
-                     " present or both absent.");
-            }
-            $elements[] = new ImplicitlyTaggedType(1,
-                $this->_authorityCertIssuer->toASN1());
-            $elements[] = new ImplicitlyTaggedType(2,
-                new Integer($this->_authorityCertSerialNumber));
-        }
-        return new Sequence(...$elements);
-    }
+	/**
+	 *
+	 * {@inheritdoc}
+	 * @return Sequence
+	 */
+	protected function _valueASN1(): Sequence
+	{
+		$elements = array();
+		if (isset($this->_keyIdentifier)) {
+			$elements[] = new ImplicitlyTaggedType(0,
+				new OctetString($this->_keyIdentifier));
+		}
+		// if either issuer or serial is set, both must be set
+		if (isset($this->_authorityCertIssuer) ||
+			 isset($this->_authorityCertSerialNumber)) {
+			if (!isset($this->_authorityCertIssuer,
+				$this->_authorityCertSerialNumber)) {
+				throw new \LogicException(
+					"AuthorityKeyIdentifier must have both" .
+					 " authorityCertIssuer and authorityCertSerialNumber" .
+					 " present or both absent.");
+			}
+			$elements[] = new ImplicitlyTaggedType(1,
+				$this->_authorityCertIssuer->toASN1());
+			$elements[] = new ImplicitlyTaggedType(2,
+				new Integer($this->_authorityCertSerialNumber));
+		}
+		return new Sequence(...$elements);
+	}
 }

Please login to merge, or discard this patch.

examples/ac-example.php 1 patch

Indentation +68 added lines, -68 removed lines patch added patch discarded remove patch

@@ -36,106 +36,106 @@  discard block
 block discarded – undo
 
 // CA private key
 openssl_pkey_export(
-    openssl_pkey_new(
-        ["private_key_type" => OPENSSL_KEYTYPE_RSA,
-            "private_key_bits" => 2048]), $pkey);
+	openssl_pkey_new(
+		["private_key_type" => OPENSSL_KEYTYPE_RSA,
+			"private_key_bits" => 2048]), $pkey);
 $ca_private_key = PrivateKeyInfo::fromPEM(PEM::fromString($pkey));
 // Issuer private key
 openssl_pkey_export(
-    openssl_pkey_new(
-        ["private_key_type" => OPENSSL_KEYTYPE_RSA,
-            "private_key_bits" => 2048]), $pkey);
+	openssl_pkey_new(
+		["private_key_type" => OPENSSL_KEYTYPE_RSA,
+			"private_key_bits" => 2048]), $pkey);
 $issuer_private_key = PrivateKeyInfo::fromPEM(PEM::fromString($pkey));
 // Holder private key
 openssl_pkey_export(
-    openssl_pkey_new(
-        ["private_key_type" => OPENSSL_KEYTYPE_RSA,
-            "private_key_bits" => 2048]), $pkey);
+	openssl_pkey_new(
+		["private_key_type" => OPENSSL_KEYTYPE_RSA,
+			"private_key_bits" => 2048]), $pkey);
 $holder_private_key = PrivateKeyInfo::fromPEM(PEM::fromString($pkey));
 
 // create trust anchor certificate (self signed)
 $tbs_cert = new TBSCertificate(
-    Name::fromString("cn=CA"),
-    $ca_private_key->publicKeyInfo(),
-    Name::fromString("cn=CA"),
-    Validity::fromStrings("now", "now + 1 year"));
+	Name::fromString("cn=CA"),
+	$ca_private_key->publicKeyInfo(),
+	Name::fromString("cn=CA"),
+	Validity::fromStrings("now", "now + 1 year"));
 $tbs_cert = $tbs_cert->withRandomSerialNumber()
-    ->withAdditionalExtensions(
-        new BasicConstraintsExtension(true, true),
-        new SubjectKeyIdentifierExtension(false, 
-            $ca_private_key->publicKeyInfo()->keyIdentifier()),
-        new KeyUsageExtension(true,
-            KeyUsageExtension::DIGITAL_SIGNATURE | 
-            KeyUsageExtension::KEY_CERT_SIGN));
+	->withAdditionalExtensions(
+		new BasicConstraintsExtension(true, true),
+		new SubjectKeyIdentifierExtension(false, 
+			$ca_private_key->publicKeyInfo()->keyIdentifier()),
+		new KeyUsageExtension(true,
+			KeyUsageExtension::DIGITAL_SIGNATURE | 
+			KeyUsageExtension::KEY_CERT_SIGN));
 $algo = SignatureAlgorithmIdentifierFactory::algoForAsymmetricCrypto(
-    $ca_private_key->algorithmIdentifier(),
-    new SHA256AlgorithmIdentifier());
+	$ca_private_key->algorithmIdentifier(),
+	new SHA256AlgorithmIdentifier());
 $ca_cert = $tbs_cert->sign($algo, $ca_private_key);
 
 // create AC issuer certificate
 $tbs_cert = new TBSCertificate(
-    Name::fromString("cn=Issuer"), 
-    $issuer_private_key->publicKeyInfo(), 
-    new Name(),
-    Validity::fromStrings("now", "now + 6 months"));
+	Name::fromString("cn=Issuer"), 
+	$issuer_private_key->publicKeyInfo(), 
+	new Name(),
+	Validity::fromStrings("now", "now + 6 months"));
 $tbs_cert = $tbs_cert->withIssuerCertificate($ca_cert)
-    ->withRandomSerialNumber()
-    ->withAdditionalExtensions(
-        // issuer must not be a CA
-        new BasicConstraintsExtension(true, false),
-        new KeyUsageExtension(true,
-            KeyUsageExtension::DIGITAL_SIGNATURE |
-             KeyUsageExtension::KEY_ENCIPHERMENT));
+	->withRandomSerialNumber()
+	->withAdditionalExtensions(
+		// issuer must not be a CA
+		new BasicConstraintsExtension(true, false),
+		new KeyUsageExtension(true,
+			KeyUsageExtension::DIGITAL_SIGNATURE |
+			 KeyUsageExtension::KEY_ENCIPHERMENT));
 $algo = SignatureAlgorithmIdentifierFactory::algoForAsymmetricCrypto(
-    $ca_private_key->algorithmIdentifier(),
-    new SHA256AlgorithmIdentifier());
+	$ca_private_key->algorithmIdentifier(),
+	new SHA256AlgorithmIdentifier());
 $issuer_cert = $tbs_cert->sign($algo, $ca_private_key);
 
 // create AC holder certificate
 $tbs_cert = new TBSCertificate(
-    Name::fromString("cn=Holder, gn=John, sn=Doe"), 
-    $holder_private_key->publicKeyInfo(), 
-    new Name(),
-    Validity::fromStrings("now", "now + 6 months"));
+	Name::fromString("cn=Holder, gn=John, sn=Doe"), 
+	$holder_private_key->publicKeyInfo(), 
+	new Name(),
+	Validity::fromStrings("now", "now + 6 months"));
 $tbs_cert = $tbs_cert->withIssuerCertificate($ca_cert)
-    ->withRandomSerialNumber()
-    ->withAdditionalExtensions(
-        new BasicConstraintsExtension(true, false),
-        new KeyUsageExtension(true,
-            KeyUsageExtension::DIGITAL_SIGNATURE |
-             KeyUsageExtension::KEY_ENCIPHERMENT));
+	->withRandomSerialNumber()
+	->withAdditionalExtensions(
+		new BasicConstraintsExtension(true, false),
+		new KeyUsageExtension(true,
+			KeyUsageExtension::DIGITAL_SIGNATURE |
+			 KeyUsageExtension::KEY_ENCIPHERMENT));
 $algo = SignatureAlgorithmIdentifierFactory::algoForAsymmetricCrypto(
-    $ca_private_key->algorithmIdentifier(),
-    new SHA256AlgorithmIdentifier());
+	$ca_private_key->algorithmIdentifier(),
+	new SHA256AlgorithmIdentifier());
 $holder_cert = $tbs_cert->sign($algo, $ca_private_key);
 
 // named authority that grants the attributes
 $authority = new GeneralNames(
-    new UniformResourceIdentifier("uri:trusted_authority"));
+	new UniformResourceIdentifier("uri:trusted_authority"));
 // role attribute
 $attribs = new Attributes(
-    Attribute::fromAttributeValues(
-        RoleAttributeValue::fromString("role-name", $authority)));
+	Attribute::fromAttributeValues(
+		RoleAttributeValue::fromString("role-name", $authority)));
 $aci = new AttributeCertificateInfo(
-    // holder is identified by the holder's public key certificate
-    new Holder(IssuerSerial::fromPKC($holder_cert)),
-    AttCertIssuer::fromPKC($issuer_cert),
-    AttCertValidityPeriod::fromStrings("now - 1 hour", "now + 3 months"),
-    $attribs);
+	// holder is identified by the holder's public key certificate
+	new Holder(IssuerSerial::fromPKC($holder_cert)),
+	AttCertIssuer::fromPKC($issuer_cert),
+	AttCertValidityPeriod::fromStrings("now - 1 hour", "now + 3 months"),
+	$attribs);
 $aci = $aci->withRandomSerialNumber()
-    ->withAdditionalExtensions(
-        // named target identifier
-        TargetInformationExtension::fromTargets(
-            new TargetName(
-                new UniformResourceIdentifier("uri:target_identifier"))),
-        // key identifier of the AC issuer
-        new AuthorityKeyIdentifierExtension(false,
-            $issuer_cert->tbsCertificate()
-                ->subjectPublicKeyInfo()
-                ->keyIdentifier()));
+	->withAdditionalExtensions(
+		// named target identifier
+		TargetInformationExtension::fromTargets(
+			new TargetName(
+				new UniformResourceIdentifier("uri:target_identifier"))),
+		// key identifier of the AC issuer
+		new AuthorityKeyIdentifierExtension(false,
+			$issuer_cert->tbsCertificate()
+				->subjectPublicKeyInfo()
+				->keyIdentifier()));
 $algo = SignatureAlgorithmIdentifierFactory::algoForAsymmetricCrypto(
-    $issuer_private_key->algorithmIdentifier(),
-    new SHA256AlgorithmIdentifier());
+	$issuer_private_key->algorithmIdentifier(),
+	new SHA256AlgorithmIdentifier());
 $ac = $aci->sign($algo, $issuer_private_key);
 
 // validate AC
@@ -147,7 +147,7 @@  discard block
 block discarded – undo
 $validator_config = $validator_config->withTargets($target);
 $validator = new ACValidator($ac, $validator_config);
 if ($validator->validate()) {
-    fprintf(STDERR, "AC validation succeeded.\n");
+	fprintf(STDERR, "AC validation succeeded.\n");
 }
 
 fprintf(STDERR, "Root certificate:\n");

Please login to merge, or discard this patch.

GitHub Access Token became invalid

Push — master ( 91afec...2569ae )

Status

Category

Indentation +166 added lines, -166 removed lines patch added patch discarded remove patch

Indentation +68 added lines, -68 removed lines patch added patch discarded remove patch

		@@ -20,181 +20,181 @@
		block discarded – undo
20	20	*/
21	21	class AuthorityKeyIdentifierExtension extends Extension
22	22	{
23		- /**
24		- * Key identifier.
25		- *
26		- * @var string\|null $_keyIdentifier
27		- */
28		- protected $_keyIdentifier;
	23	+ /**
	24	+ * Key identifier.
	25	+ *
	26	+ * @var string\|null $_keyIdentifier
	27	+ */
	28	+ protected $_keyIdentifier;
29	29
30		- /**
31		- * Issuer name.
32		- *
33		- * @var GeneralNames\|null $_authorityCertIssuer
34		- */
35		- protected $_authorityCertIssuer;
	30	+ /**
	31	+ * Issuer name.
	32	+ *
	33	+ * @var GeneralNames\|null $_authorityCertIssuer
	34	+ */
	35	+ protected $_authorityCertIssuer;
36	36
37		- /**
38		- * Issuer serial number.
39		- *
40		- * @var string\|null $_authorityCertSerialNumber
41		- */
42		- protected $_authorityCertSerialNumber;
	37	+ /**
	38	+ * Issuer serial number.
	39	+ *
	40	+ * @var string\|null $_authorityCertSerialNumber
	41	+ */
	42	+ protected $_authorityCertSerialNumber;
43	43
44		- /**
45		- * Constructor.
46		- *
47		- * @param bool $critical Conforming CA's must mark as non-critical (false)
48		- * @param string\|null $keyIdentifier
49		- * @param GeneralNames\|null $issuer
50		- * @param string\|null $serial
51		- */
52		- public function __construct(bool $critical, $keyIdentifier,
53		- GeneralNames $issuer = null, $serial = null)
54		- {
55		- parent::__construct(self::OID_AUTHORITY_KEY_IDENTIFIER, $critical);
56		- $this->_keyIdentifier = $keyIdentifier;
57		- $this->_authorityCertIssuer = $issuer;
58		- $this->_authorityCertSerialNumber = isset($serial) ? strval($serial) : null;
59		- }
	44	+ /**
	45	+ * Constructor.
	46	+ *
	47	+ * @param bool $critical Conforming CA's must mark as non-critical (false)
	48	+ * @param string\|null $keyIdentifier
	49	+ * @param GeneralNames\|null $issuer
	50	+ * @param string\|null $serial
	51	+ */
	52	+ public function __construct(bool $critical, $keyIdentifier,
	53	+ GeneralNames $issuer = null, $serial = null)
	54	+ {
	55	+ parent::__construct(self::OID_AUTHORITY_KEY_IDENTIFIER, $critical);
	56	+ $this->_keyIdentifier = $keyIdentifier;
	57	+ $this->_authorityCertIssuer = $issuer;
	58	+ $this->_authorityCertSerialNumber = isset($serial) ? strval($serial) : null;
	59	+ }
60	60
61		- /**
62		- * Create from public key info.
63		- *
64		- * @param PublicKeyInfo $pki
65		- * @return AuthorityKeyIdentifierExtension
66		- */
67		- public static function fromPublicKeyInfo(PublicKeyInfo $pki)
68		- {
69		- return new self(false, $pki->keyIdentifier());
70		- }
	61	+ /**
	62	+ * Create from public key info.
	63	+ *
	64	+ * @param PublicKeyInfo $pki
	65	+ * @return AuthorityKeyIdentifierExtension
	66	+ */
	67	+ public static function fromPublicKeyInfo(PublicKeyInfo $pki)
	68	+ {
	69	+ return new self(false, $pki->keyIdentifier());
	70	+ }
71	71
72		- /**
73		- *
74		- * {@inheritdoc}
75		- * @return self
76		- */
77		- protected static function _fromDER(string $data, bool $critical): self
78		- {
79		- $seq = UnspecifiedType::fromDER($data)->asSequence();
80		- $keyIdentifier = null;
81		- $issuer = null;
82		- $serial = null;
83		- if ($seq->hasTagged(0)) {
84		- $keyIdentifier = $seq->getTagged(0)
85		- ->asImplicit(Element::TYPE_OCTET_STRING)
86		- ->asOctetString()
87		- ->string();
88		- }
89		- if ($seq->hasTagged(1) \|\| $seq->hasTagged(2)) {
90		- if (!$seq->hasTagged(1) \|\| !$seq->hasTagged(2)) {
91		- throw new \UnexpectedValueException(
92		- "AuthorityKeyIdentifier must have both" .
93		- " authorityCertIssuer and authorityCertSerialNumber" .
94		- " present or both absent.");
95		- }
96		- $issuer = GeneralNames::fromASN1(
97		- $seq->getTagged(1)
98		- ->asImplicit(Element::TYPE_SEQUENCE)
99		- ->asSequence());
100		- $serial = $seq->getTagged(2)
101		- ->asImplicit(Element::TYPE_INTEGER)
102		- ->asInteger()
103		- ->number();
104		- }
105		- return new self($critical, $keyIdentifier, $issuer, $serial);
106		- }
	72	+ /**
	73	+ *
	74	+ * {@inheritdoc}
	75	+ * @return self
	76	+ */
	77	+ protected static function _fromDER(string $data, bool $critical): self
	78	+ {
	79	+ $seq = UnspecifiedType::fromDER($data)->asSequence();
	80	+ $keyIdentifier = null;
	81	+ $issuer = null;
	82	+ $serial = null;
	83	+ if ($seq->hasTagged(0)) {
	84	+ $keyIdentifier = $seq->getTagged(0)
	85	+ ->asImplicit(Element::TYPE_OCTET_STRING)
	86	+ ->asOctetString()
	87	+ ->string();
	88	+ }
	89	+ if ($seq->hasTagged(1) \|\| $seq->hasTagged(2)) {
	90	+ if (!$seq->hasTagged(1) \|\| !$seq->hasTagged(2)) {
	91	+ throw new \UnexpectedValueException(
	92	+ "AuthorityKeyIdentifier must have both" .
	93	+ " authorityCertIssuer and authorityCertSerialNumber" .
	94	+ " present or both absent.");
	95	+ }
	96	+ $issuer = GeneralNames::fromASN1(
	97	+ $seq->getTagged(1)
	98	+ ->asImplicit(Element::TYPE_SEQUENCE)
	99	+ ->asSequence());
	100	+ $serial = $seq->getTagged(2)
	101	+ ->asImplicit(Element::TYPE_INTEGER)
	102	+ ->asInteger()
	103	+ ->number();
	104	+ }
	105	+ return new self($critical, $keyIdentifier, $issuer, $serial);
	106	+ }
107	107
108		- /**
109		- * Whether key identifier is present.
110		- *
111		- * @return bool
112		- */
113		- public function hasKeyIdentifier(): bool
114		- {
115		- return isset($this->_keyIdentifier);
116		- }
	108	+ /**
	109	+ * Whether key identifier is present.
	110	+ *
	111	+ * @return bool
	112	+ */
	113	+ public function hasKeyIdentifier(): bool
	114	+ {
	115	+ return isset($this->_keyIdentifier);
	116	+ }
117	117
118		- /**
119		- * Get key identifier.
120		- *
121		- * @throws \LogicException
122		- * @return string
123		- */
124		- public function keyIdentifier(): string
125		- {
126		- if (!$this->hasKeyIdentifier()) {
127		- throw new \LogicException("keyIdentifier not set.");
128		- }
129		- return $this->_keyIdentifier;
130		- }
	118	+ /**
	119	+ * Get key identifier.
	120	+ *
	121	+ * @throws \LogicException
	122	+ * @return string
	123	+ */
	124	+ public function keyIdentifier(): string
	125	+ {
	126	+ if (!$this->hasKeyIdentifier()) {
	127	+ throw new \LogicException("keyIdentifier not set.");
	128	+ }
	129	+ return $this->_keyIdentifier;
	130	+ }
131	131
132		- /**
133		- * Whether issuer is present.
134		- *
135		- * @return bool
136		- */
137		- public function hasIssuer(): bool
138		- {
139		- return isset($this->_authorityCertIssuer);
140		- }
	132	+ /**
	133	+ * Whether issuer is present.
	134	+ *
	135	+ * @return bool
	136	+ */
	137	+ public function hasIssuer(): bool
	138	+ {
	139	+ return isset($this->_authorityCertIssuer);
	140	+ }
141	141
142		- /**
143		- * Get issuer.
144		- *
145		- * @throws \LogicException
146		- * @return GeneralNames
147		- */
148		- public function issuer(): GeneralNames
149		- {
150		- if (!$this->hasIssuer()) {
151		- throw new \LogicException("authorityCertIssuer not set.");
152		- }
153		- return $this->_authorityCertIssuer;
154		- }
	142	+ /**
	143	+ * Get issuer.
	144	+ *
	145	+ * @throws \LogicException
	146	+ * @return GeneralNames
	147	+ */
	148	+ public function issuer(): GeneralNames
	149	+ {
	150	+ if (!$this->hasIssuer()) {
	151	+ throw new \LogicException("authorityCertIssuer not set.");
	152	+ }
	153	+ return $this->_authorityCertIssuer;
	154	+ }
155	155
156		- /**
157		- * Get serial number.
158		- *
159		- * @throws \LogicException
160		- * @return string Base 10 integer string
161		- */
162		- public function serial(): string
163		- {
164		- // both issuer and serial must be present or both absent
165		- if (!$this->hasIssuer()) {
166		- throw new \LogicException("authorityCertSerialNumber not set.");
167		- }
168		- return $this->_authorityCertSerialNumber;
169		- }
	156	+ /**
	157	+ * Get serial number.
	158	+ *
	159	+ * @throws \LogicException
	160	+ * @return string Base 10 integer string
	161	+ */
	162	+ public function serial(): string
	163	+ {
	164	+ // both issuer and serial must be present or both absent
	165	+ if (!$this->hasIssuer()) {
	166	+ throw new \LogicException("authorityCertSerialNumber not set.");
	167	+ }
	168	+ return $this->_authorityCertSerialNumber;
	169	+ }
170	170
171		- /**
172		- *
173		- * {@inheritdoc}
174		- * @return Sequence
175		- */
176		- protected function _valueASN1(): Sequence
177		- {
178		- $elements = array();
179		- if (isset($this->_keyIdentifier)) {
180		- $elements[] = new ImplicitlyTaggedType(0,
181		- new OctetString($this->_keyIdentifier));
182		- }
183		- // if either issuer or serial is set, both must be set
184		- if (isset($this->_authorityCertIssuer) \|\|
185		- isset($this->_authorityCertSerialNumber)) {
186		- if (!isset($this->_authorityCertIssuer,
187		- $this->_authorityCertSerialNumber)) {
188		- throw new \LogicException(
189		- "AuthorityKeyIdentifier must have both" .
190		- " authorityCertIssuer and authorityCertSerialNumber" .
191		- " present or both absent.");
192		- }
193		- $elements[] = new ImplicitlyTaggedType(1,
194		- $this->_authorityCertIssuer->toASN1());
195		- $elements[] = new ImplicitlyTaggedType(2,
196		- new Integer($this->_authorityCertSerialNumber));
197		- }
198		- return new Sequence(...$elements);
199		- }
	171	+ /**
	172	+ *
	173	+ * {@inheritdoc}
	174	+ * @return Sequence
	175	+ */
	176	+ protected function _valueASN1(): Sequence
	177	+ {
	178	+ $elements = array();
	179	+ if (isset($this->_keyIdentifier)) {
	180	+ $elements[] = new ImplicitlyTaggedType(0,
	181	+ new OctetString($this->_keyIdentifier));
	182	+ }
	183	+ // if either issuer or serial is set, both must be set
	184	+ if (isset($this->_authorityCertIssuer) \|\|
	185	+ isset($this->_authorityCertSerialNumber)) {
	186	+ if (!isset($this->_authorityCertIssuer,
	187	+ $this->_authorityCertSerialNumber)) {
	188	+ throw new \LogicException(
	189	+ "AuthorityKeyIdentifier must have both" .
	190	+ " authorityCertIssuer and authorityCertSerialNumber" .
	191	+ " present or both absent.");
	192	+ }
	193	+ $elements[] = new ImplicitlyTaggedType(1,
	194	+ $this->_authorityCertIssuer->toASN1());
	195	+ $elements[] = new ImplicitlyTaggedType(2,
	196	+ new Integer($this->_authorityCertSerialNumber));
	197	+ }
	198	+ return new Sequence(...$elements);
	199	+ }
200	200	}

		@@ -36,106 +36,106 @@ discard block
		block discarded – undo
36	36
37	37	// CA private key
38	38	openssl_pkey_export(
39		- openssl_pkey_new(
40		- ["private_key_type" => OPENSSL_KEYTYPE_RSA,
41		- "private_key_bits" => 2048]), $pkey);
	39	+ openssl_pkey_new(
	40	+ ["private_key_type" => OPENSSL_KEYTYPE_RSA,
	41	+ "private_key_bits" => 2048]), $pkey);
42	42	$ca_private_key = PrivateKeyInfo::fromPEM(PEM::fromString($pkey));
43	43	// Issuer private key
44	44	openssl_pkey_export(
45		- openssl_pkey_new(
46		- ["private_key_type" => OPENSSL_KEYTYPE_RSA,
47		- "private_key_bits" => 2048]), $pkey);
	45	+ openssl_pkey_new(
	46	+ ["private_key_type" => OPENSSL_KEYTYPE_RSA,
	47	+ "private_key_bits" => 2048]), $pkey);
48	48	$issuer_private_key = PrivateKeyInfo::fromPEM(PEM::fromString($pkey));
49	49	// Holder private key
50	50	openssl_pkey_export(
51		- openssl_pkey_new(
52		- ["private_key_type" => OPENSSL_KEYTYPE_RSA,
53		- "private_key_bits" => 2048]), $pkey);
	51	+ openssl_pkey_new(
	52	+ ["private_key_type" => OPENSSL_KEYTYPE_RSA,
	53	+ "private_key_bits" => 2048]), $pkey);
54	54	$holder_private_key = PrivateKeyInfo::fromPEM(PEM::fromString($pkey));
55	55
56	56	// create trust anchor certificate (self signed)
57	57	$tbs_cert = new TBSCertificate(
58		- Name::fromString("cn=CA"),
59		- $ca_private_key->publicKeyInfo(),
60		- Name::fromString("cn=CA"),
61		- Validity::fromStrings("now", "now + 1 year"));
	58	+ Name::fromString("cn=CA"),
	59	+ $ca_private_key->publicKeyInfo(),
	60	+ Name::fromString("cn=CA"),
	61	+ Validity::fromStrings("now", "now + 1 year"));
62	62	$tbs_cert = $tbs_cert->withRandomSerialNumber()
63		- ->withAdditionalExtensions(
64		- new BasicConstraintsExtension(true, true),
65		- new SubjectKeyIdentifierExtension(false,
66		- $ca_private_key->publicKeyInfo()->keyIdentifier()),
67		- new KeyUsageExtension(true,
68		- KeyUsageExtension::DIGITAL_SIGNATURE \|
69		- KeyUsageExtension::KEY_CERT_SIGN));
	63	+ ->withAdditionalExtensions(
	64	+ new BasicConstraintsExtension(true, true),
	65	+ new SubjectKeyIdentifierExtension(false,
	66	+ $ca_private_key->publicKeyInfo()->keyIdentifier()),
	67	+ new KeyUsageExtension(true,
	68	+ KeyUsageExtension::DIGITAL_SIGNATURE \|
	69	+ KeyUsageExtension::KEY_CERT_SIGN));
70	70	$algo = SignatureAlgorithmIdentifierFactory::algoForAsymmetricCrypto(
71		- $ca_private_key->algorithmIdentifier(),
72		- new SHA256AlgorithmIdentifier());
	71	+ $ca_private_key->algorithmIdentifier(),
	72	+ new SHA256AlgorithmIdentifier());
73	73	$ca_cert = $tbs_cert->sign($algo, $ca_private_key);
74	74
75	75	// create AC issuer certificate
76	76	$tbs_cert = new TBSCertificate(
77		- Name::fromString("cn=Issuer"),
78		- $issuer_private_key->publicKeyInfo(),
79		- new Name(),
80		- Validity::fromStrings("now", "now + 6 months"));
	77	+ Name::fromString("cn=Issuer"),
	78	+ $issuer_private_key->publicKeyInfo(),
	79	+ new Name(),
	80	+ Validity::fromStrings("now", "now + 6 months"));
81	81	$tbs_cert = $tbs_cert->withIssuerCertificate($ca_cert)
82		- ->withRandomSerialNumber()
83		- ->withAdditionalExtensions(
84		- // issuer must not be a CA
85		- new BasicConstraintsExtension(true, false),
86		- new KeyUsageExtension(true,
87		- KeyUsageExtension::DIGITAL_SIGNATURE \|
88		- KeyUsageExtension::KEY_ENCIPHERMENT));
	82	+ ->withRandomSerialNumber()
	83	+ ->withAdditionalExtensions(
	84	+ // issuer must not be a CA
	85	+ new BasicConstraintsExtension(true, false),
	86	+ new KeyUsageExtension(true,
	87	+ KeyUsageExtension::DIGITAL_SIGNATURE \|
	88	+ KeyUsageExtension::KEY_ENCIPHERMENT));
89	89	$algo = SignatureAlgorithmIdentifierFactory::algoForAsymmetricCrypto(
90		- $ca_private_key->algorithmIdentifier(),
91		- new SHA256AlgorithmIdentifier());
	90	+ $ca_private_key->algorithmIdentifier(),
	91	+ new SHA256AlgorithmIdentifier());
92	92	$issuer_cert = $tbs_cert->sign($algo, $ca_private_key);
93	93
94	94	// create AC holder certificate
95	95	$tbs_cert = new TBSCertificate(
96		- Name::fromString("cn=Holder, gn=John, sn=Doe"),
97		- $holder_private_key->publicKeyInfo(),
98		- new Name(),
99		- Validity::fromStrings("now", "now + 6 months"));
	96	+ Name::fromString("cn=Holder, gn=John, sn=Doe"),
	97	+ $holder_private_key->publicKeyInfo(),
	98	+ new Name(),
	99	+ Validity::fromStrings("now", "now + 6 months"));
100	100	$tbs_cert = $tbs_cert->withIssuerCertificate($ca_cert)
101		- ->withRandomSerialNumber()
102		- ->withAdditionalExtensions(
103		- new BasicConstraintsExtension(true, false),
104		- new KeyUsageExtension(true,
105		- KeyUsageExtension::DIGITAL_SIGNATURE \|
106		- KeyUsageExtension::KEY_ENCIPHERMENT));
	101	+ ->withRandomSerialNumber()
	102	+ ->withAdditionalExtensions(
	103	+ new BasicConstraintsExtension(true, false),
	104	+ new KeyUsageExtension(true,
	105	+ KeyUsageExtension::DIGITAL_SIGNATURE \|
	106	+ KeyUsageExtension::KEY_ENCIPHERMENT));
107	107	$algo = SignatureAlgorithmIdentifierFactory::algoForAsymmetricCrypto(
108		- $ca_private_key->algorithmIdentifier(),
109		- new SHA256AlgorithmIdentifier());
	108	+ $ca_private_key->algorithmIdentifier(),
	109	+ new SHA256AlgorithmIdentifier());
110	110	$holder_cert = $tbs_cert->sign($algo, $ca_private_key);
111	111
112	112	// named authority that grants the attributes
113	113	$authority = new GeneralNames(
114		- new UniformResourceIdentifier("uri:trusted_authority"));
	114	+ new UniformResourceIdentifier("uri:trusted_authority"));
115	115	// role attribute
116	116	$attribs = new Attributes(
117		- Attribute::fromAttributeValues(
118		- RoleAttributeValue::fromString("role-name", $authority)));
	117	+ Attribute::fromAttributeValues(
	118	+ RoleAttributeValue::fromString("role-name", $authority)));
119	119	$aci = new AttributeCertificateInfo(
120		- // holder is identified by the holder's public key certificate
121		- new Holder(IssuerSerial::fromPKC($holder_cert)),
122		- AttCertIssuer::fromPKC($issuer_cert),
123		- AttCertValidityPeriod::fromStrings("now - 1 hour", "now + 3 months"),
124		- $attribs);
	120	+ // holder is identified by the holder's public key certificate
	121	+ new Holder(IssuerSerial::fromPKC($holder_cert)),
	122	+ AttCertIssuer::fromPKC($issuer_cert),
	123	+ AttCertValidityPeriod::fromStrings("now - 1 hour", "now + 3 months"),
	124	+ $attribs);
125	125	$aci = $aci->withRandomSerialNumber()
126		- ->withAdditionalExtensions(
127		- // named target identifier
128		- TargetInformationExtension::fromTargets(
129		- new TargetName(
130		- new UniformResourceIdentifier("uri:target_identifier"))),
131		- // key identifier of the AC issuer
132		- new AuthorityKeyIdentifierExtension(false,
133		- $issuer_cert->tbsCertificate()
134		- ->subjectPublicKeyInfo()
135		- ->keyIdentifier()));
	126	+ ->withAdditionalExtensions(
	127	+ // named target identifier
	128	+ TargetInformationExtension::fromTargets(
	129	+ new TargetName(
	130	+ new UniformResourceIdentifier("uri:target_identifier"))),
	131	+ // key identifier of the AC issuer
	132	+ new AuthorityKeyIdentifierExtension(false,
	133	+ $issuer_cert->tbsCertificate()
	134	+ ->subjectPublicKeyInfo()
	135	+ ->keyIdentifier()));
136	136	$algo = SignatureAlgorithmIdentifierFactory::algoForAsymmetricCrypto(
137		- $issuer_private_key->algorithmIdentifier(),
138		- new SHA256AlgorithmIdentifier());
	137	+ $issuer_private_key->algorithmIdentifier(),
	138	+ new SHA256AlgorithmIdentifier());
139	139	$ac = $aci->sign($algo, $issuer_private_key);
140	140
141	141	// validate AC
		@@ -147,7 +147,7 @@ discard block
		block discarded – undo
147	147	$validator_config = $validator_config->withTargets($target);
148	148	$validator = new ACValidator($ac, $validator_config);
149	149	if ($validator->validate()) {
150		- fprintf(STDERR, "AC validation succeeded.\n");
	150	+ fprintf(STDERR, "AC validation succeeded.\n");
151	151	}
152	152
153	153	fprintf(STDERR, "Root certificate:\n");

sop / x509

GitHub Access Token became invalid

Push — master ( 91afec...2569ae )

Status

Category

Indentation +166 added lines, -166 removed lines patch added patch discarded remove patch

Indentation +68 added lines, -68 removed lines patch added patch discarded remove patch