sop / x509

lib/X509/AttributeCertificate/Attributes.php

Indentation +196 added lines, -196 removed lines

@@ -26,200 +26,200 @@
  */
 class Attributes implements \Countable, \IteratorAggregate
 {
-    use AttributeContainer;
-    
-    /**
-     * Mapping from OID to attribute value class name.
-     *
-     * @internal
-     *
-     * @var array
-     */
-    const MAP_OID_TO_CLASS = array(
-        /* @formatter:off */
-        AccessIdentityAttributeValue::OID => AccessIdentityAttributeValue::class,
-        AuthenticationInfoAttributeValue::OID => AuthenticationInfoAttributeValue::class,
-        ChargingIdentityAttributeValue::OID => ChargingIdentityAttributeValue::class,
-        GroupAttributeValue::OID => GroupAttributeValue::class,
-        AttributeType::OID_ROLE => RoleAttributeValue::class
-        /* @formatter:on */
-    );
-    
-    /**
-     * Constructor.
-     *
-     * @param Attribute[] $attribs
-     */
-    public function __construct(Attribute ...$attribs)
-    {
-        $this->_attributes = $attribs;
-    }
-    
-    /**
-     * Initialize from attribute values.
-     *
-     * @param AttributeValue[] $values
-     * @return self
-     */
-    public static function fromAttributeValues(AttributeValue ...$values): self
-    {
-        $attribs = array_map(
-            function (AttributeValue $value) {
-                return $value->toAttribute();
-            }, $values);
-        return new self(...$attribs);
-    }
-    
-    /**
-     * Initialize from ASN.1.
-     *
-     * @param Sequence $seq
-     * @return self
-     */
-    public static function fromASN1(Sequence $seq): self
-    {
-        $attribs = array_map(
-            function (UnspecifiedType $el) {
-                return Attribute::fromASN1($el->asSequence());
-            }, $seq->elements());
-        // cast attributes
-        $attribs = array_map(
-            function (Attribute $attr) {
-                $oid = $attr->oid();
-                if (array_key_exists($oid, self::MAP_OID_TO_CLASS)) {
-                    $cls = self::MAP_OID_TO_CLASS[$oid];
-                    $attr = $attr->castValues($cls);
-                }
-                return $attr;
-            }, $attribs);
-        return new self(...$attribs);
-    }
-    
-    /**
-     * Check whether 'Access Identity' attribute is present.
-     *
-     * @return bool
-     */
-    public function hasAccessIdentity(): bool
-    {
-        return $this->has(AccessIdentityAttributeValue::OID);
-    }
-    
-    /**
-     * Get the first 'Access Identity' attribute value.
-     *
-     * @return AccessIdentityAttributeValue
-     */
-    public function accessIdentity(): AccessIdentityAttributeValue
-    {
-        return $this->firstOf(AccessIdentityAttributeValue::OID)->first();
-    }
-    
-    /**
-     * Check whether 'Service Authentication Information' attribute is present.
-     *
-     * @return bool
-     */
-    public function hasAuthenticationInformation(): bool
-    {
-        return $this->has(AuthenticationInfoAttributeValue::OID);
-    }
-    
-    /**
-     * Get the first 'Service Authentication Information' attribute value.
-     *
-     * @return AuthenticationInfoAttributeValue
-     */
-    public function authenticationInformation(): AuthenticationInfoAttributeValue
-    {
-        return $this->firstOf(AuthenticationInfoAttributeValue::OID)->first();
-    }
-    
-    /**
-     * Check whether 'Charging Identity' attribute is present.
-     *
-     * @return bool
-     */
-    public function hasChargingIdentity(): bool
-    {
-        return $this->has(ChargingIdentityAttributeValue::OID);
-    }
-    
-    /**
-     * Get the first 'Charging Identity' attribute value.
-     *
-     * @return ChargingIdentityAttributeValue
-     */
-    public function chargingIdentity(): ChargingIdentityAttributeValue
-    {
-        return $this->firstOf(ChargingIdentityAttributeValue::OID)->first();
-    }
-    
-    /**
-     * Check whether 'Group' attribute is present.
-     *
-     * @return bool
-     */
-    public function hasGroup(): bool
-    {
-        return $this->has(GroupAttributeValue::OID);
-    }
-    
-    /**
-     * Get the first 'Group' attribute value.
-     *
-     * @return GroupAttributeValue
-     */
-    public function group(): GroupAttributeValue
-    {
-        return $this->firstOf(GroupAttributeValue::OID)->first();
-    }
-    
-    /**
-     * Check whether 'Role' attribute is present.
-     *
-     * @return bool
-     */
-    public function hasRole(): bool
-    {
-        return $this->has(AttributeType::OID_ROLE);
-    }
-    
-    /**
-     * Get the first 'Role' attribute value.
-     *
-     * @return RoleAttributeValue
-     */
-    public function role(): RoleAttributeValue
-    {
-        return $this->firstOf(AttributeType::OID_ROLE)->first();
-    }
-    
-    /**
-     * Get all 'Role' attribute values.
-     *
-     * @return RoleAttributeValue[]
-     */
-    public function roles(): array
-    {
-        return array_merge(array(),
-            ...array_map(
-                function (Attribute $attr) {
-                    return $attr->values();
-                }, $this->allOf(AttributeType::OID_ROLE)));
-    }
-    
-    /**
-     * Generate ASN.1 structure.
-     *
-     * @return Sequence
-     */
-    public function toASN1(): Sequence
-    {
-        $elements = array_map(
-            function (Attribute $attr) {
-                return $attr->toASN1();
-            }, array_values($this->_attributes));
-        return new Sequence(...$elements);
-    }
+	use AttributeContainer;
+    
+	/**
+	 * Mapping from OID to attribute value class name.
+	 *
+	 * @internal
+	 *
+	 * @var array
+	 */
+	const MAP_OID_TO_CLASS = array(
+		/* @formatter:off */
+		AccessIdentityAttributeValue::OID => AccessIdentityAttributeValue::class,
+		AuthenticationInfoAttributeValue::OID => AuthenticationInfoAttributeValue::class,
+		ChargingIdentityAttributeValue::OID => ChargingIdentityAttributeValue::class,
+		GroupAttributeValue::OID => GroupAttributeValue::class,
+		AttributeType::OID_ROLE => RoleAttributeValue::class
+		/* @formatter:on */
+	);
+    
+	/**
+	 * Constructor.
+	 *
+	 * @param Attribute[] $attribs
+	 */
+	public function __construct(Attribute ...$attribs)
+	{
+		$this->_attributes = $attribs;
+	}
+    
+	/**
+	 * Initialize from attribute values.
+	 *
+	 * @param AttributeValue[] $values
+	 * @return self
+	 */
+	public static function fromAttributeValues(AttributeValue ...$values): self
+	{
+		$attribs = array_map(
+			function (AttributeValue $value) {
+				return $value->toAttribute();
+			}, $values);
+		return new self(...$attribs);
+	}
+    
+	/**
+	 * Initialize from ASN.1.
+	 *
+	 * @param Sequence $seq
+	 * @return self
+	 */
+	public static function fromASN1(Sequence $seq): self
+	{
+		$attribs = array_map(
+			function (UnspecifiedType $el) {
+				return Attribute::fromASN1($el->asSequence());
+			}, $seq->elements());
+		// cast attributes
+		$attribs = array_map(
+			function (Attribute $attr) {
+				$oid = $attr->oid();
+				if (array_key_exists($oid, self::MAP_OID_TO_CLASS)) {
+					$cls = self::MAP_OID_TO_CLASS[$oid];
+					$attr = $attr->castValues($cls);
+				}
+				return $attr;
+			}, $attribs);
+		return new self(...$attribs);
+	}
+    
+	/**
+	 * Check whether 'Access Identity' attribute is present.
+	 *
+	 * @return bool
+	 */
+	public function hasAccessIdentity(): bool
+	{
+		return $this->has(AccessIdentityAttributeValue::OID);
+	}
+    
+	/**
+	 * Get the first 'Access Identity' attribute value.
+	 *
+	 * @return AccessIdentityAttributeValue
+	 */
+	public function accessIdentity(): AccessIdentityAttributeValue
+	{
+		return $this->firstOf(AccessIdentityAttributeValue::OID)->first();
+	}
+    
+	/**
+	 * Check whether 'Service Authentication Information' attribute is present.
+	 *
+	 * @return bool
+	 */
+	public function hasAuthenticationInformation(): bool
+	{
+		return $this->has(AuthenticationInfoAttributeValue::OID);
+	}
+    
+	/**
+	 * Get the first 'Service Authentication Information' attribute value.
+	 *
+	 * @return AuthenticationInfoAttributeValue
+	 */
+	public function authenticationInformation(): AuthenticationInfoAttributeValue
+	{
+		return $this->firstOf(AuthenticationInfoAttributeValue::OID)->first();
+	}
+    
+	/**
+	 * Check whether 'Charging Identity' attribute is present.
+	 *
+	 * @return bool
+	 */
+	public function hasChargingIdentity(): bool
+	{
+		return $this->has(ChargingIdentityAttributeValue::OID);
+	}
+    
+	/**
+	 * Get the first 'Charging Identity' attribute value.
+	 *
+	 * @return ChargingIdentityAttributeValue
+	 */
+	public function chargingIdentity(): ChargingIdentityAttributeValue
+	{
+		return $this->firstOf(ChargingIdentityAttributeValue::OID)->first();
+	}
+    
+	/**
+	 * Check whether 'Group' attribute is present.
+	 *
+	 * @return bool
+	 */
+	public function hasGroup(): bool
+	{
+		return $this->has(GroupAttributeValue::OID);
+	}
+    
+	/**
+	 * Get the first 'Group' attribute value.
+	 *
+	 * @return GroupAttributeValue
+	 */
+	public function group(): GroupAttributeValue
+	{
+		return $this->firstOf(GroupAttributeValue::OID)->first();
+	}
+    
+	/**
+	 * Check whether 'Role' attribute is present.
+	 *
+	 * @return bool
+	 */
+	public function hasRole(): bool
+	{
+		return $this->has(AttributeType::OID_ROLE);
+	}
+    
+	/**
+	 * Get the first 'Role' attribute value.
+	 *
+	 * @return RoleAttributeValue
+	 */
+	public function role(): RoleAttributeValue
+	{
+		return $this->firstOf(AttributeType::OID_ROLE)->first();
+	}
+    
+	/**
+	 * Get all 'Role' attribute values.
+	 *
+	 * @return RoleAttributeValue[]
+	 */
+	public function roles(): array
+	{
+		return array_merge(array(),
+			...array_map(
+				function (Attribute $attr) {
+					return $attr->values();
+				}, $this->allOf(AttributeType::OID_ROLE)));
+	}
+    
+	/**
+	 * Generate ASN.1 structure.
+	 *
+	 * @return Sequence
+	 */
+	public function toASN1(): Sequence
+	{
+		$elements = array_map(
+			function (Attribute $attr) {
+				return $attr->toASN1();
+			}, array_values($this->_attributes));
+		return new Sequence(...$elements);
+	}
 }

Spacing +5 added lines, -5 removed lines

@@ -64,7 +64,7 @@ 
     public static function fromAttributeValues(AttributeValue ...$values): self
     {
         $attribs = array_map(
-            function (AttributeValue $value) {
+            function(AttributeValue $value) {
                 return $value->toAttribute();
             }, $values);
         return new self(...$attribs);
@@ -79,12 +79,12 @@ 
     public static function fromASN1(Sequence $seq): self
     {
         $attribs = array_map(
-            function (UnspecifiedType $el) {
+            function(UnspecifiedType $el) {
                 return Attribute::fromASN1($el->asSequence());
             }, $seq->elements());
         // cast attributes
         $attribs = array_map(
-            function (Attribute $attr) {
+            function(Attribute $attr) {
                 $oid = $attr->oid();
                 if (array_key_exists($oid, self::MAP_OID_TO_CLASS)) {
                     $cls = self::MAP_OID_TO_CLASS[$oid];
@@ -204,7 +204,7 @@ 
     {
         return array_merge(array(),
             ...array_map(
-                function (Attribute $attr) {
+                function(Attribute $attr) {
                     return $attr->values();
                 }, $this->allOf(AttributeType::OID_ROLE)));
     }
@@ -217,7 +217,7 @@ 
     public function toASN1(): Sequence
     {
         $elements = array_map(
-            function (Attribute $attr) {
+            function(Attribute $attr) {
                 return $attr->toASN1();
             }, array_values($this->_attributes));
         return new Sequence(...$elements);

lib/X509/AttributeCertificate/IssuerSerial.php

Indentation +156 added lines, -156 removed lines

@@ -19,172 +19,172 @@
  */
 class IssuerSerial
 {
-    /**
-     * Issuer name.
-     *
-     * @var GeneralNames $_issuer
-     */
-    protected $_issuer;
+	/**
+	 * Issuer name.
+	 *
+	 * @var GeneralNames $_issuer
+	 */
+	protected $_issuer;
     
-    /**
-     * Serial number.
-     *
-     * @var string $_serial
-     */
-    protected $_serial;
+	/**
+	 * Serial number.
+	 *
+	 * @var string $_serial
+	 */
+	protected $_serial;
     
-    /**
-     * Issuer unique ID.
-     *
-     * @var UniqueIdentifier|null $_issuerUID
-     */
-    protected $_issuerUID;
+	/**
+	 * Issuer unique ID.
+	 *
+	 * @var UniqueIdentifier|null $_issuerUID
+	 */
+	protected $_issuerUID;
     
-    /**
-     * Constructor.
-     *
-     * @param GeneralNames $issuer
-     * @param string|int $serial
-     * @param UniqueIdentifier|null $uid
-     */
-    public function __construct(GeneralNames $issuer, $serial,
-        UniqueIdentifier $uid = null)
-    {
-        $this->_issuer = $issuer;
-        $this->_serial = strval($serial);
-        $this->_issuerUID = $uid;
-    }
+	/**
+	 * Constructor.
+	 *
+	 * @param GeneralNames $issuer
+	 * @param string|int $serial
+	 * @param UniqueIdentifier|null $uid
+	 */
+	public function __construct(GeneralNames $issuer, $serial,
+		UniqueIdentifier $uid = null)
+	{
+		$this->_issuer = $issuer;
+		$this->_serial = strval($serial);
+		$this->_issuerUID = $uid;
+	}
     
-    /**
-     * Initialize from ASN.1.
-     *
-     * @param Sequence $seq
-     * @return self
-     */
-    public static function fromASN1(Sequence $seq): self
-    {
-        $issuer = GeneralNames::fromASN1($seq->at(0)->asSequence());
-        $serial = $seq->at(1)
-            ->asInteger()
-            ->number();
-        $uid = null;
-        if ($seq->has(2, Element::TYPE_BIT_STRING)) {
-            $uid = UniqueIdentifier::fromASN1($seq->at(2)->asBitString());
-        }
-        return new self($issuer, $serial, $uid);
-    }
+	/**
+	 * Initialize from ASN.1.
+	 *
+	 * @param Sequence $seq
+	 * @return self
+	 */
+	public static function fromASN1(Sequence $seq): self
+	{
+		$issuer = GeneralNames::fromASN1($seq->at(0)->asSequence());
+		$serial = $seq->at(1)
+			->asInteger()
+			->number();
+		$uid = null;
+		if ($seq->has(2, Element::TYPE_BIT_STRING)) {
+			$uid = UniqueIdentifier::fromASN1($seq->at(2)->asBitString());
+		}
+		return new self($issuer, $serial, $uid);
+	}
     
-    /**
-     * Initialize from a public key certificate.
-     *
-     * @param Certificate $cert
-     * @return self
-     */
-    public static function fromPKC(Certificate $cert)
-    {
-        $tbsCert = $cert->tbsCertificate();
-        $issuer = new GeneralNames(new DirectoryName($tbsCert->issuer()));
-        $serial = $tbsCert->serialNumber();
-        $uid = $tbsCert->hasIssuerUniqueID() ? $tbsCert->issuerUniqueID() : null;
-        return new self($issuer, $serial, $uid);
-    }
+	/**
+	 * Initialize from a public key certificate.
+	 *
+	 * @param Certificate $cert
+	 * @return self
+	 */
+	public static function fromPKC(Certificate $cert)
+	{
+		$tbsCert = $cert->tbsCertificate();
+		$issuer = new GeneralNames(new DirectoryName($tbsCert->issuer()));
+		$serial = $tbsCert->serialNumber();
+		$uid = $tbsCert->hasIssuerUniqueID() ? $tbsCert->issuerUniqueID() : null;
+		return new self($issuer, $serial, $uid);
+	}
     
-    /**
-     * Get issuer name.
-     *
-     * @return GeneralNames
-     */
-    public function issuer(): GeneralNames
-    {
-        return $this->_issuer;
-    }
+	/**
+	 * Get issuer name.
+	 *
+	 * @return GeneralNames
+	 */
+	public function issuer(): GeneralNames
+	{
+		return $this->_issuer;
+	}
     
-    /**
-     * Get serial number.
-     *
-     * @return string
-     */
-    public function serial(): string
-    {
-        return $this->_serial;
-    }
+	/**
+	 * Get serial number.
+	 *
+	 * @return string
+	 */
+	public function serial(): string
+	{
+		return $this->_serial;
+	}
     
-    /**
-     * Check whether issuer unique identifier is present.
-     *
-     * @return bool
-     */
-    public function hasIssuerUID(): bool
-    {
-        return isset($this->_issuerUID);
-    }
+	/**
+	 * Check whether issuer unique identifier is present.
+	 *
+	 * @return bool
+	 */
+	public function hasIssuerUID(): bool
+	{
+		return isset($this->_issuerUID);
+	}
     
-    /**
-     * Get issuer unique identifier.
-     *
-     * @throws \LogicException
-     * @return UniqueIdentifier
-     */
-    public function issuerUID(): UniqueIdentifier
-    {
-        if (!$this->hasIssuerUID()) {
-            throw new \LogicException("issuerUID not set.");
-        }
-        return $this->_issuerUID;
-    }
+	/**
+	 * Get issuer unique identifier.
+	 *
+	 * @throws \LogicException
+	 * @return UniqueIdentifier
+	 */
+	public function issuerUID(): UniqueIdentifier
+	{
+		if (!$this->hasIssuerUID()) {
+			throw new \LogicException("issuerUID not set.");
+		}
+		return $this->_issuerUID;
+	}
     
-    /**
-     * Generate ASN.1 structure.
-     *
-     * @return Sequence
-     */
-    public function toASN1(): Sequence
-    {
-        $elements = array($this->_issuer->toASN1(), new Integer($this->_serial));
-        if (isset($this->_issuerUID)) {
-            $elements[] = $this->_issuerUID->toASN1();
-        }
-        return new Sequence(...$elements);
-    }
+	/**
+	 * Generate ASN.1 structure.
+	 *
+	 * @return Sequence
+	 */
+	public function toASN1(): Sequence
+	{
+		$elements = array($this->_issuer->toASN1(), new Integer($this->_serial));
+		if (isset($this->_issuerUID)) {
+			$elements[] = $this->_issuerUID->toASN1();
+		}
+		return new Sequence(...$elements);
+	}
     
-    /**
-     * Check whether this IssuerSerial identifies given certificate.
-     *
-     * @param Certificate $cert
-     * @return boolean
-     */
-    public function identifiesPKC(Certificate $cert): bool
-    {
-        $tbs = $cert->tbsCertificate();
-        if (!$tbs->issuer()->equals($this->_issuer->firstDN())) {
-            return false;
-        }
-        if (strval($tbs->serialNumber()) != strval($this->_serial)) {
-            return false;
-        }
-        if ($this->_issuerUID && !$this->_checkUniqueID($cert)) {
-            return false;
-        }
-        return true;
-    }
+	/**
+	 * Check whether this IssuerSerial identifies given certificate.
+	 *
+	 * @param Certificate $cert
+	 * @return boolean
+	 */
+	public function identifiesPKC(Certificate $cert): bool
+	{
+		$tbs = $cert->tbsCertificate();
+		if (!$tbs->issuer()->equals($this->_issuer->firstDN())) {
+			return false;
+		}
+		if (strval($tbs->serialNumber()) != strval($this->_serial)) {
+			return false;
+		}
+		if ($this->_issuerUID && !$this->_checkUniqueID($cert)) {
+			return false;
+		}
+		return true;
+	}
     
-    /**
-     * Check whether issuerUID matches given certificate.
-     *
-     * @param Certificate $cert
-     * @return boolean
-     */
-    private function _checkUniqueID(Certificate $cert): bool
-    {
-        if (!$cert->tbsCertificate()->hasIssuerUniqueID()) {
-            return false;
-        }
-        $uid = $cert->tbsCertificate()
-            ->issuerUniqueID()
-            ->string();
-        if ($this->_issuerUID->string() != $uid) {
-            return false;
-        }
-        return true;
-    }
+	/**
+	 * Check whether issuerUID matches given certificate.
+	 *
+	 * @param Certificate $cert
+	 * @return boolean
+	 */
+	private function _checkUniqueID(Certificate $cert): bool
+	{
+		if (!$cert->tbsCertificate()->hasIssuerUniqueID()) {
+			return false;
+		}
+		$uid = $cert->tbsCertificate()
+			->issuerUniqueID()
+			->string();
+		if ($this->_issuerUID->string() != $uid) {
+			return false;
+		}
+		return true;
+	}
 }

lib/X509/AttributeCertificate/Validation/ACValidationConfig.php

Indentation +98 added lines, -98 removed lines

@@ -12,112 +12,112 @@
  */
 class ACValidationConfig
 {
-    /**
-     * Certification path of the AC holder.
-     *
-     * @var CertificationPath
-     */
-    protected $_holderPath;
+	/**
+	 * Certification path of the AC holder.
+	 *
+	 * @var CertificationPath
+	 */
+	protected $_holderPath;
     
-    /**
-     * Certification path of the AC issuer.
-     *
-     * @var CertificationPath
-     */
-    protected $_issuerPath;
+	/**
+	 * Certification path of the AC issuer.
+	 *
+	 * @var CertificationPath
+	 */
+	protected $_issuerPath;
     
-    /**
-     * Evaluation reference time.
-     *
-     * @var \DateTimeImmutable
-     */
-    protected $_evalTime;
+	/**
+	 * Evaluation reference time.
+	 *
+	 * @var \DateTimeImmutable
+	 */
+	protected $_evalTime;
     
-    /**
-     * Permitted targets.
-     *
-     * @var Target[]
-     */
-    protected $_targets;
+	/**
+	 * Permitted targets.
+	 *
+	 * @var Target[]
+	 */
+	protected $_targets;
     
-    /**
-     * Constructor.
-     *
-     * @param CertificationPath $holder_path Certification path of the AC holder
-     * @param CertificationPath $issuer_path Certification path of the AC issuer
-     */
-    public function __construct(CertificationPath $holder_path,
-        CertificationPath $issuer_path)
-    {
-        $this->_holderPath = $holder_path;
-        $this->_issuerPath = $issuer_path;
-        $this->_evalTime = new \DateTimeImmutable();
-        $this->_targets = array();
-    }
+	/**
+	 * Constructor.
+	 *
+	 * @param CertificationPath $holder_path Certification path of the AC holder
+	 * @param CertificationPath $issuer_path Certification path of the AC issuer
+	 */
+	public function __construct(CertificationPath $holder_path,
+		CertificationPath $issuer_path)
+	{
+		$this->_holderPath = $holder_path;
+		$this->_issuerPath = $issuer_path;
+		$this->_evalTime = new \DateTimeImmutable();
+		$this->_targets = array();
+	}
     
-    /**
-     * Get certification path of the AC's holder.
-     *
-     * @return CertificationPath
-     */
-    public function holderPath(): CertificationPath
-    {
-        return $this->_holderPath;
-    }
+	/**
+	 * Get certification path of the AC's holder.
+	 *
+	 * @return CertificationPath
+	 */
+	public function holderPath(): CertificationPath
+	{
+		return $this->_holderPath;
+	}
     
-    /**
-     * Get certification path of the AC's issuer.
-     *
-     * @return CertificationPath
-     */
-    public function issuerPath(): CertificationPath
-    {
-        return $this->_issuerPath;
-    }
+	/**
+	 * Get certification path of the AC's issuer.
+	 *
+	 * @return CertificationPath
+	 */
+	public function issuerPath(): CertificationPath
+	{
+		return $this->_issuerPath;
+	}
     
-    /**
-     * Get self with given evaluation reference time.
-     *
-     * @param \DateTimeImmutable $dt
-     * @return self
-     */
-    public function withEvaluationTime(\DateTimeImmutable $dt): self
-    {
-        $obj = clone $this;
-        $obj->_evalTime = $dt;
-        return $obj;
-    }
+	/**
+	 * Get self with given evaluation reference time.
+	 *
+	 * @param \DateTimeImmutable $dt
+	 * @return self
+	 */
+	public function withEvaluationTime(\DateTimeImmutable $dt): self
+	{
+		$obj = clone $this;
+		$obj->_evalTime = $dt;
+		return $obj;
+	}
     
-    /**
-     * Get the evaluation reference time.
-     *
-     * @return \DateTimeImmutable
-     */
-    public function evaluationTime(): \DateTimeImmutable
-    {
-        return $this->_evalTime;
-    }
+	/**
+	 * Get the evaluation reference time.
+	 *
+	 * @return \DateTimeImmutable
+	 */
+	public function evaluationTime(): \DateTimeImmutable
+	{
+		return $this->_evalTime;
+	}
     
-    /**
-     * Get self with permitted targets.
-     *
-     * @param Target ...$targets
-     * @return self
-     */
-    public function withTargets(Target ...$targets): self
-    {
-        $obj = clone $this;
-        $obj->_targets = $targets;
-        return $obj;
-    }
+	/**
+	 * Get self with permitted targets.
+	 *
+	 * @param Target ...$targets
+	 * @return self
+	 */
+	public function withTargets(Target ...$targets): self
+	{
+		$obj = clone $this;
+		$obj->_targets = $targets;
+		return $obj;
+	}
     
-    /**
-     * Get array of permitted targets
-     *
-     * @return Target[]
-     */
-    public function targets(): array
-    {
-        return $this->_targets;
-    }
+	/**
+	 * Get array of permitted targets
+	 *
+	 * @return Target[]
+	 */
+	public function targets(): array
+	{
+		return $this->_targets;
+	}
 }

lib/X509/AttributeCertificate/Validation/ACValidator.php

Indentation +164 added lines, -164 removed lines

@@ -21,178 +21,178 @@
  */
 class ACValidator
 {
-    /**
-     * Attribute certificate.
-     *
-     * @var AttributeCertificate
-     */
-    protected $_ac;
+	/**
+	 * Attribute certificate.
+	 *
+	 * @var AttributeCertificate
+	 */
+	protected $_ac;
     
-    /**
-     * Validation configuration.
-     *
-     * @var ACValidationConfig
-     */
-    protected $_config;
+	/**
+	 * Validation configuration.
+	 *
+	 * @var ACValidationConfig
+	 */
+	protected $_config;
     
-    /**
-     * Crypto engine.
-     *
-     * @var Crypto
-     */
-    protected $_crypto;
+	/**
+	 * Crypto engine.
+	 *
+	 * @var Crypto
+	 */
+	protected $_crypto;
     
-    /**
-     * Constructor.
-     *
-     * @param AttributeCertificate $ac Attribute certificate to validate
-     * @param ACValidationConfig $config Validation configuration
-     * @param Crypto|null $crypto Crypto engine, use default if not set
-     */
-    public function __construct(AttributeCertificate $ac,
-        ACValidationConfig $config, Crypto $crypto = null)
-    {
-        $this->_ac = $ac;
-        $this->_config = $config;
-        $this->_crypto = $crypto ?: Crypto::getDefault();
-    }
+	/**
+	 * Constructor.
+	 *
+	 * @param AttributeCertificate $ac Attribute certificate to validate
+	 * @param ACValidationConfig $config Validation configuration
+	 * @param Crypto|null $crypto Crypto engine, use default if not set
+	 */
+	public function __construct(AttributeCertificate $ac,
+		ACValidationConfig $config, Crypto $crypto = null)
+	{
+		$this->_ac = $ac;
+		$this->_config = $config;
+		$this->_crypto = $crypto ?: Crypto::getDefault();
+	}
     
-    /**
-     * Validate attribute certificate.
-     *
-     * @throws ACValidationException If validation fails
-     * @return AttributeCertificate Validated AC
-     */
-    public function validate(): AttributeCertificate
-    {
-        $this->_validateHolder();
-        $issuer = $this->_verifyIssuer();
-        $this->_validateIssuerProfile($issuer);
-        $this->_validateTime();
-        $this->_validateTargeting();
-        return $this->_ac;
-    }
+	/**
+	 * Validate attribute certificate.
+	 *
+	 * @throws ACValidationException If validation fails
+	 * @return AttributeCertificate Validated AC
+	 */
+	public function validate(): AttributeCertificate
+	{
+		$this->_validateHolder();
+		$issuer = $this->_verifyIssuer();
+		$this->_validateIssuerProfile($issuer);
+		$this->_validateTime();
+		$this->_validateTargeting();
+		return $this->_ac;
+	}
     
-    /**
-     * Validate AC holder's certification.
-     *
-     * @throws ACValidationException
-     * @return Certificate Certificate of the AC's holder
-     */
-    private function _validateHolder(): Certificate
-    {
-        $path = $this->_config->holderPath();
-        $config = PathValidationConfig::defaultConfig()->withMaxLength(
-            count($path))->withDateTime($this->_config->evaluationTime());
-        try {
-            $holder = $path->validate($config, $this->_crypto)->certificate();
-        } catch (PathValidationException $e) {
-            throw new ACValidationException(
-                "Failed to validate holder PKC's certification path.", 0, $e);
-        }
-        if (!$this->_ac->isHeldBy($holder)) {
-            throw new ACValidationException("Name mismatch of AC's holder PKC.");
-        }
-        return $holder;
-    }
+	/**
+	 * Validate AC holder's certification.
+	 *
+	 * @throws ACValidationException
+	 * @return Certificate Certificate of the AC's holder
+	 */
+	private function _validateHolder(): Certificate
+	{
+		$path = $this->_config->holderPath();
+		$config = PathValidationConfig::defaultConfig()->withMaxLength(
+			count($path))->withDateTime($this->_config->evaluationTime());
+		try {
+			$holder = $path->validate($config, $this->_crypto)->certificate();
+		} catch (PathValidationException $e) {
+			throw new ACValidationException(
+				"Failed to validate holder PKC's certification path.", 0, $e);
+		}
+		if (!$this->_ac->isHeldBy($holder)) {
+			throw new ACValidationException("Name mismatch of AC's holder PKC.");
+		}
+		return $holder;
+	}
     
-    /**
-     * Verify AC's signature and issuer's certification.
-     *
-     * @throws ACValidationException
-     * @return Certificate Certificate of the AC's issuer
-     */
-    private function _verifyIssuer(): Certificate
-    {
-        $path = $this->_config->issuerPath();
-        $config = PathValidationConfig::defaultConfig()->withMaxLength(
-            count($path))->withDateTime($this->_config->evaluationTime());
-        try {
-            $issuer = $path->validate($config, $this->_crypto)->certificate();
-        } catch (PathValidationException $e) {
-            throw new ACValidationException(
-                "Failed to validate issuer PKC's certification path.", 0, $e);
-        }
-        if (!$this->_ac->isIssuedBy($issuer)) {
-            throw new ACValidationException("Name mismatch of AC's issuer PKC.");
-        }
-        $pubkey_info = $issuer->tbsCertificate()->subjectPublicKeyInfo();
-        if (!$this->_ac->verify($pubkey_info, $this->_crypto)) {
-            throw new ACValidationException("Failed to verify signature.");
-        }
-        return $issuer;
-    }
+	/**
+	 * Verify AC's signature and issuer's certification.
+	 *
+	 * @throws ACValidationException
+	 * @return Certificate Certificate of the AC's issuer
+	 */
+	private function _verifyIssuer(): Certificate
+	{
+		$path = $this->_config->issuerPath();
+		$config = PathValidationConfig::defaultConfig()->withMaxLength(
+			count($path))->withDateTime($this->_config->evaluationTime());
+		try {
+			$issuer = $path->validate($config, $this->_crypto)->certificate();
+		} catch (PathValidationException $e) {
+			throw new ACValidationException(
+				"Failed to validate issuer PKC's certification path.", 0, $e);
+		}
+		if (!$this->_ac->isIssuedBy($issuer)) {
+			throw new ACValidationException("Name mismatch of AC's issuer PKC.");
+		}
+		$pubkey_info = $issuer->tbsCertificate()->subjectPublicKeyInfo();
+		if (!$this->_ac->verify($pubkey_info, $this->_crypto)) {
+			throw new ACValidationException("Failed to verify signature.");
+		}
+		return $issuer;
+	}
     
-    /**
-     * Validate AC issuer's profile.
-     *
-     * @link https://tools.ietf.org/html/rfc5755#section-4.5
-     * @param Certificate $cert
-     * @throws ACValidationException
-     */
-    private function _validateIssuerProfile(Certificate $cert)
-    {
-        $exts = $cert->tbsCertificate()->extensions();
-        if ($exts->hasKeyUsage() && !$exts->keyUsage()->isDigitalSignature()) {
-            throw new ACValidationException(
-                "Issuer PKC's Key Usage extension doesn't permit" .
-                     " verification of digital signatures.");
-        }
-        if ($exts->hasBasicConstraints() && $exts->basicConstraints()->isCA()) {
-            throw new ACValidationException("Issuer PKC must not be a CA.");
-        }
-    }
+	/**
+	 * Validate AC issuer's profile.
+	 *
+	 * @link https://tools.ietf.org/html/rfc5755#section-4.5
+	 * @param Certificate $cert
+	 * @throws ACValidationException
+	 */
+	private function _validateIssuerProfile(Certificate $cert)
+	{
+		$exts = $cert->tbsCertificate()->extensions();
+		if ($exts->hasKeyUsage() && !$exts->keyUsage()->isDigitalSignature()) {
+			throw new ACValidationException(
+				"Issuer PKC's Key Usage extension doesn't permit" .
+					 " verification of digital signatures.");
+		}
+		if ($exts->hasBasicConstraints() && $exts->basicConstraints()->isCA()) {
+			throw new ACValidationException("Issuer PKC must not be a CA.");
+		}
+	}
     
-    /**
-     * Validate AC's validity period.
-     *
-     * @throws ACValidationException
-     */
-    private function _validateTime()
-    {
-        $t = $this->_config->evaluationTime();
-        $validity = $this->_ac->acinfo()->validityPeriod();
-        if ($validity->notBeforeTime()->diff($t)->invert) {
-            throw new ACValidationException("Validity period has not started.");
-        }
-        if ($t->diff($validity->notAfterTime())->invert) {
-            throw new ACValidationException("Attribute certificate has expired.");
-        }
-    }
+	/**
+	 * Validate AC's validity period.
+	 *
+	 * @throws ACValidationException
+	 */
+	private function _validateTime()
+	{
+		$t = $this->_config->evaluationTime();
+		$validity = $this->_ac->acinfo()->validityPeriod();
+		if ($validity->notBeforeTime()->diff($t)->invert) {
+			throw new ACValidationException("Validity period has not started.");
+		}
+		if ($t->diff($validity->notAfterTime())->invert) {
+			throw new ACValidationException("Attribute certificate has expired.");
+		}
+	}
     
-    /**
-     * Validate AC's target information.
-     *
-     * @throws ACValidationException
-     */
-    private function _validateTargeting()
-    {
-        $exts = $this->_ac->acinfo()->extensions();
-        // if target information extension is not present
-        if (!$exts->has(Extension::OID_TARGET_INFORMATION)) {
-            return;
-        }
-        $ext = $exts->get(Extension::OID_TARGET_INFORMATION);
-        if ($ext instanceof TargetInformationExtension &&
-             !$this->_hasMatchingTarget($ext->targets())) {
-            throw new ACValidationException(
-                "Attribute certificate doesn't have a matching target.");
-        }
-    }
+	/**
+	 * Validate AC's target information.
+	 *
+	 * @throws ACValidationException
+	 */
+	private function _validateTargeting()
+	{
+		$exts = $this->_ac->acinfo()->extensions();
+		// if target information extension is not present
+		if (!$exts->has(Extension::OID_TARGET_INFORMATION)) {
+			return;
+		}
+		$ext = $exts->get(Extension::OID_TARGET_INFORMATION);
+		if ($ext instanceof TargetInformationExtension &&
+			 !$this->_hasMatchingTarget($ext->targets())) {
+			throw new ACValidationException(
+				"Attribute certificate doesn't have a matching target.");
+		}
+	}
     
-    /**
-     * Check whether validation configuration has matching targets.
-     *
-     * @param Targets $targets Set of eligible targets
-     * @return boolean
-     */
-    private function _hasMatchingTarget(Targets $targets): bool
-    {
-        foreach ($this->_config->targets() as $target) {
-            if ($targets->hasTarget($target)) {
-                return true;
-            }
-        }
-        return false;
-    }
+	/**
+	 * Check whether validation configuration has matching targets.
+	 *
+	 * @param Targets $targets Set of eligible targets
+	 * @return boolean
+	 */
+	private function _hasMatchingTarget(Targets $targets): bool
+	{
+		foreach ($this->_config->targets() as $target) {
+			if ($targets->hasTarget($target)) {
+				return true;
+			}
+		}
+		return false;
+	}
 }

lib/X509/AttributeCertificate/AttCertValidityPeriod.php

Indentation +82 added lines, -82 removed lines

@@ -15,94 +15,94 @@
  */
 class AttCertValidityPeriod
 {
-    use DateTimeHelper;
+	use DateTimeHelper;
     
-    /**
-     * Not before time.
-     *
-     * @var \DateTimeImmutable
-     */
-    protected $_notBeforeTime;
+	/**
+	 * Not before time.
+	 *
+	 * @var \DateTimeImmutable
+	 */
+	protected $_notBeforeTime;
     
-    /**
-     * Not after time.
-     *
-     * @var \DateTimeImmutable
-     */
-    protected $_notAfterTime;
+	/**
+	 * Not after time.
+	 *
+	 * @var \DateTimeImmutable
+	 */
+	protected $_notAfterTime;
     
-    /**
-     * Constructor.
-     *
-     * @param \DateTimeImmutable $nb
-     * @param \DateTimeImmutable $na
-     */
-    public function __construct(\DateTimeImmutable $nb, \DateTimeImmutable $na)
-    {
-        $this->_notBeforeTime = $nb;
-        $this->_notAfterTime = $na;
-    }
+	/**
+	 * Constructor.
+	 *
+	 * @param \DateTimeImmutable $nb
+	 * @param \DateTimeImmutable $na
+	 */
+	public function __construct(\DateTimeImmutable $nb, \DateTimeImmutable $na)
+	{
+		$this->_notBeforeTime = $nb;
+		$this->_notAfterTime = $na;
+	}
     
-    /**
-     * Initialize from ASN.1.
-     *
-     * @param Sequence $seq
-     * @return self
-     */
-    public static function fromASN1(Sequence $seq): self
-    {
-        $nb = $seq->at(0)
-            ->asGeneralizedTime()
-            ->dateTime();
-        $na = $seq->at(1)
-            ->asGeneralizedTime()
-            ->dateTime();
-        return new self($nb, $na);
-    }
+	/**
+	 * Initialize from ASN.1.
+	 *
+	 * @param Sequence $seq
+	 * @return self
+	 */
+	public static function fromASN1(Sequence $seq): self
+	{
+		$nb = $seq->at(0)
+			->asGeneralizedTime()
+			->dateTime();
+		$na = $seq->at(1)
+			->asGeneralizedTime()
+			->dateTime();
+		return new self($nb, $na);
+	}
     
-    /**
-     * Initialize from date strings.
-     *
-     * @param string|null $nb_date Not before date
-     * @param string|null $na_date Not after date
-     * @param string|null $tz Timezone string
-     * @return self
-     */
-    public static function fromStrings($nb_date, $na_date, $tz = null): self
-    {
-        $nb = self::_createDateTime($nb_date, $tz);
-        $na = self::_createDateTime($na_date, $tz);
-        return new self($nb, $na);
-    }
+	/**
+	 * Initialize from date strings.
+	 *
+	 * @param string|null $nb_date Not before date
+	 * @param string|null $na_date Not after date
+	 * @param string|null $tz Timezone string
+	 * @return self
+	 */
+	public static function fromStrings($nb_date, $na_date, $tz = null): self
+	{
+		$nb = self::_createDateTime($nb_date, $tz);
+		$na = self::_createDateTime($na_date, $tz);
+		return new self($nb, $na);
+	}
     
-    /**
-     * Get not before time.
-     *
-     * @return \DateTimeImmutable
-     */
-    public function notBeforeTime(): \DateTimeImmutable
-    {
-        return $this->_notBeforeTime;
-    }
+	/**
+	 * Get not before time.
+	 *
+	 * @return \DateTimeImmutable
+	 */
+	public function notBeforeTime(): \DateTimeImmutable
+	{
+		return $this->_notBeforeTime;
+	}
     
-    /**
-     * Get not after time.
-     *
-     * @return \DateTimeImmutable
-     */
-    public function notAfterTime(): \DateTimeImmutable
-    {
-        return $this->_notAfterTime;
-    }
+	/**
+	 * Get not after time.
+	 *
+	 * @return \DateTimeImmutable
+	 */
+	public function notAfterTime(): \DateTimeImmutable
+	{
+		return $this->_notAfterTime;
+	}
     
-    /**
-     * Generate ASN.1 structure.
-     *
-     * @return Sequence
-     */
-    public function toASN1(): Sequence
-    {
-        return new Sequence(new GeneralizedTime($this->_notBeforeTime),
-            new GeneralizedTime($this->_notAfterTime));
-    }
+	/**
+	 * Generate ASN.1 structure.
+	 *
+	 * @return Sequence
+	 */
+	public function toASN1(): Sequence
+	{
+		return new Sequence(new GeneralizedTime($this->_notBeforeTime),
+			new GeneralizedTime($this->_notAfterTime));
+	}
 }

lib/X509/AttributeCertificate/AttributeCertificate.php

Indentation +199 added lines, -199 removed lines

@@ -20,203 +20,203 @@
  */
 class AttributeCertificate
 {
-    /**
-     * Attribute certificate info.
-     *
-     * @var AttributeCertificateInfo $_acinfo
-     */
-    protected $_acinfo;
-    
-    /**
-     * Signature algorithm identifier.
-     *
-     * @var SignatureAlgorithmIdentifier $_signatureAlgorithm
-     */
-    protected $_signatureAlgorithm;
-    
-    /**
-     * Signature value.
-     *
-     * @var Signature $_signatureValue
-     */
-    protected $_signatureValue;
-    
-    /**
-     * Constructor.
-     *
-     * @param AttributeCertificateInfo $acinfo
-     * @param SignatureAlgorithmIdentifier $algo
-     * @param Signature $signature
-     */
-    public function __construct(AttributeCertificateInfo $acinfo,
-        SignatureAlgorithmIdentifier $algo, Signature $signature)
-    {
-        $this->_acinfo = $acinfo;
-        $this->_signatureAlgorithm = $algo;
-        $this->_signatureValue = $signature;
-    }
-    
-    /**
-     * Initialize from ASN.1.
-     *
-     * @param Sequence $seq
-     * @return self
-     */
-    public static function fromASN1(Sequence $seq): self
-    {
-        $acinfo = AttributeCertificateInfo::fromASN1($seq->at(0)->asSequence());
-        $algo = AlgorithmIdentifier::fromASN1($seq->at(1)->asSequence());
-        if (!$algo instanceof SignatureAlgorithmIdentifier) {
-            throw new \UnexpectedValueException(
-                "Unsupported signature algorithm " . $algo->oid() . ".");
-        }
-        $signature = Signature::fromSignatureData(
-            $seq->at(2)
-                ->asBitString()
-                ->string(), $algo);
-        return new self($acinfo, $algo, $signature);
-    }
-    
-    /**
-     * Initialize from DER data.
-     *
-     * @param string $data
-     * @return self
-     */
-    public static function fromDER(string $data): self
-    {
-        return self::fromASN1(Sequence::fromDER($data));
-    }
-    
-    /**
-     * Initialize from PEM.
-     *
-     * @param PEM $pem
-     * @throws \UnexpectedValueException
-     * @return self
-     */
-    public static function fromPEM(PEM $pem): self
-    {
-        if ($pem->type() !== PEM::TYPE_ATTRIBUTE_CERTIFICATE) {
-            throw new \UnexpectedValueException("Invalid PEM type.");
-        }
-        return self::fromDER($pem->data());
-    }
-    
-    /**
-     * Get attribute certificate info.
-     *
-     * @return AttributeCertificateInfo
-     */
-    public function acinfo(): AttributeCertificateInfo
-    {
-        return $this->_acinfo;
-    }
-    
-    /**
-     * Get signature algorithm identifier.
-     *
-     * @return SignatureAlgorithmIdentifier
-     */
-    public function signatureAlgorithm(): SignatureAlgorithmIdentifier
-    {
-        return $this->_signatureAlgorithm;
-    }
-    
-    /**
-     * Get signature value.
-     *
-     * @return Signature
-     */
-    public function signatureValue(): Signature
-    {
-        return $this->_signatureValue;
-    }
-    
-    /**
-     * Get ASN.1 structure.
-     *
-     * @return Sequence
-     */
-    public function toASN1(): Sequence
-    {
-        return new Sequence($this->_acinfo->toASN1(),
-            $this->_signatureAlgorithm->toASN1(),
-            $this->_signatureValue->bitString());
-    }
-    
-    /**
-     * Get attribute certificate as a DER.
-     *
-     * @return string
-     */
-    public function toDER(): string
-    {
-        return $this->toASN1()->toDER();
-    }
-    
-    /**
-     * Get attribute certificate as a PEM.
-     *
-     * @return PEM
-     */
-    public function toPEM(): PEM
-    {
-        return new PEM(PEM::TYPE_ATTRIBUTE_CERTIFICATE, $this->toDER());
-    }
-    
-    /**
-     * Check whether attribute certificate is issued to the subject identified
-     * by given public key certificate.
-     *
-     * @param Certificate $cert Certificate
-     * @return boolean
-     */
-    public function isHeldBy(Certificate $cert): bool
-    {
-        if (!$this->_acinfo->holder()->identifiesPKC($cert)) {
-            return false;
-        }
-        return true;
-    }
-    
-    /**
-     * Check whether attribute certificate is issued by given public key
-     * certificate.
-     *
-     * @param Certificate $cert Certificate
-     * @return boolean
-     */
-    public function isIssuedBy(Certificate $cert): bool
-    {
-        if (!$this->_acinfo->issuer()->identifiesPKC($cert)) {
-            return false;
-        }
-        return true;
-    }
-    
-    /**
-     * Verify signature.
-     *
-     * @param PublicKeyInfo $pubkey_info Signer's public key
-     * @param Crypto|null $crypto Crypto engine, use default if not set
-     * @return bool
-     */
-    public function verify(PublicKeyInfo $pubkey_info, Crypto $crypto = null): bool
-    {
-        $crypto = $crypto ?: Crypto::getDefault();
-        $data = $this->_acinfo->toASN1()->toDER();
-        return $crypto->verify($data, $this->_signatureValue, $pubkey_info,
-            $this->_signatureAlgorithm);
-    }
-    
-    /**
-     * Get attribute certificate as a PEM formatted string.
-     *
-     * @return string
-     */
-    public function __toString()
-    {
-        return $this->toPEM()->string();
-    }
+	/**
+	 * Attribute certificate info.
+	 *
+	 * @var AttributeCertificateInfo $_acinfo
+	 */
+	protected $_acinfo;
+    
+	/**
+	 * Signature algorithm identifier.
+	 *
+	 * @var SignatureAlgorithmIdentifier $_signatureAlgorithm
+	 */
+	protected $_signatureAlgorithm;
+    
+	/**
+	 * Signature value.
+	 *
+	 * @var Signature $_signatureValue
+	 */
+	protected $_signatureValue;
+    
+	/**
+	 * Constructor.
+	 *
+	 * @param AttributeCertificateInfo $acinfo
+	 * @param SignatureAlgorithmIdentifier $algo
+	 * @param Signature $signature
+	 */
+	public function __construct(AttributeCertificateInfo $acinfo,
+		SignatureAlgorithmIdentifier $algo, Signature $signature)
+	{
+		$this->_acinfo = $acinfo;
+		$this->_signatureAlgorithm = $algo;
+		$this->_signatureValue = $signature;
+	}
+    
+	/**
+	 * Initialize from ASN.1.
+	 *
+	 * @param Sequence $seq
+	 * @return self
+	 */
+	public static function fromASN1(Sequence $seq): self
+	{
+		$acinfo = AttributeCertificateInfo::fromASN1($seq->at(0)->asSequence());
+		$algo = AlgorithmIdentifier::fromASN1($seq->at(1)->asSequence());
+		if (!$algo instanceof SignatureAlgorithmIdentifier) {
+			throw new \UnexpectedValueException(
+				"Unsupported signature algorithm " . $algo->oid() . ".");
+		}
+		$signature = Signature::fromSignatureData(
+			$seq->at(2)
+				->asBitString()
+				->string(), $algo);
+		return new self($acinfo, $algo, $signature);
+	}
+    
+	/**
+	 * Initialize from DER data.
+	 *
+	 * @param string $data
+	 * @return self
+	 */
+	public static function fromDER(string $data): self
+	{
+		return self::fromASN1(Sequence::fromDER($data));
+	}
+    
+	/**
+	 * Initialize from PEM.
+	 *
+	 * @param PEM $pem
+	 * @throws \UnexpectedValueException
+	 * @return self
+	 */
+	public static function fromPEM(PEM $pem): self
+	{
+		if ($pem->type() !== PEM::TYPE_ATTRIBUTE_CERTIFICATE) {
+			throw new \UnexpectedValueException("Invalid PEM type.");
+		}
+		return self::fromDER($pem->data());
+	}
+    
+	/**
+	 * Get attribute certificate info.
+	 *
+	 * @return AttributeCertificateInfo
+	 */
+	public function acinfo(): AttributeCertificateInfo
+	{
+		return $this->_acinfo;
+	}
+    
+	/**
+	 * Get signature algorithm identifier.
+	 *
+	 * @return SignatureAlgorithmIdentifier
+	 */
+	public function signatureAlgorithm(): SignatureAlgorithmIdentifier
+	{
+		return $this->_signatureAlgorithm;
+	}
+    
+	/**
+	 * Get signature value.
+	 *
+	 * @return Signature
+	 */
+	public function signatureValue(): Signature
+	{
+		return $this->_signatureValue;
+	}
+    
+	/**
+	 * Get ASN.1 structure.
+	 *
+	 * @return Sequence
+	 */
+	public function toASN1(): Sequence
+	{
+		return new Sequence($this->_acinfo->toASN1(),
+			$this->_signatureAlgorithm->toASN1(),
+			$this->_signatureValue->bitString());
+	}
+    
+	/**
+	 * Get attribute certificate as a DER.
+	 *
+	 * @return string
+	 */
+	public function toDER(): string
+	{
+		return $this->toASN1()->toDER();
+	}
+    
+	/**
+	 * Get attribute certificate as a PEM.
+	 *
+	 * @return PEM
+	 */
+	public function toPEM(): PEM
+	{
+		return new PEM(PEM::TYPE_ATTRIBUTE_CERTIFICATE, $this->toDER());
+	}
+    
+	/**
+	 * Check whether attribute certificate is issued to the subject identified
+	 * by given public key certificate.
+	 *
+	 * @param Certificate $cert Certificate
+	 * @return boolean
+	 */
+	public function isHeldBy(Certificate $cert): bool
+	{
+		if (!$this->_acinfo->holder()->identifiesPKC($cert)) {
+			return false;
+		}
+		return true;
+	}
+    
+	/**
+	 * Check whether attribute certificate is issued by given public key
+	 * certificate.
+	 *
+	 * @param Certificate $cert Certificate
+	 * @return boolean
+	 */
+	public function isIssuedBy(Certificate $cert): bool
+	{
+		if (!$this->_acinfo->issuer()->identifiesPKC($cert)) {
+			return false;
+		}
+		return true;
+	}
+    
+	/**
+	 * Verify signature.
+	 *
+	 * @param PublicKeyInfo $pubkey_info Signer's public key
+	 * @param Crypto|null $crypto Crypto engine, use default if not set
+	 * @return bool
+	 */
+	public function verify(PublicKeyInfo $pubkey_info, Crypto $crypto = null): bool
+	{
+		$crypto = $crypto ?: Crypto::getDefault();
+		$data = $this->_acinfo->toASN1()->toDER();
+		return $crypto->verify($data, $this->_signatureValue, $pubkey_info,
+			$this->_signatureAlgorithm);
+	}
+    
+	/**
+	 * Get attribute certificate as a PEM formatted string.
+	 *
+	 * @return string
+	 */
+	public function __toString()
+	{
+		return $this->toPEM()->string();
+	}
 }