Botan: Botan::X509 Namespace Reference

Botan 1.10.16

Functions
Botan::X509 Namespace Reference

## Functions
MemoryVector< byte > | BER_encode (const Public_Key &key)
Public_Key * | copy_key (const Public_Key &key)
PKCS10_Request | create_cert_req (const X509_Cert_Options &opts, const Private_Key &key, const std::string &hash_fn, RandomNumberGenerator &rng)
X509_Certificate | create_self_signed_cert (const X509_Cert_Options &opts, const Private_Key &key, const std::string &hash_fn, RandomNumberGenerator &rng)
void | encode (const Public_Key &key, Pipe &pipe, X509_Encoding encoding=PEM)
Key_Constraints | find_constraints (const Public_Key &pub_key, Key_Constraints limits)
Public_Key * | load_key (DataSource &source)
Public_Key * | load_key (const std::string &fsname)
Public_Key * | load_key (const MemoryRegion< byte > &mem)
std::string | PEM_encode (const Public_Key &key)

## Detailed Description

This namespace contains functions for handling X.509 public keys

## Function Documentation

## ◆ BER_encode()

BOTAN_DLL MemoryVector< byte > Botan::X509::BER_encode | ( | const Public_Key & | key | ) |

BER encode a key

Parameters

  key | the public key to encode

Returns
  BER encoding of this key

Definition at line 21 of file x509_key.cpp.

References Botan::Public_Key::algorithm_identifier(), Botan::BIT_STRING, Botan::DER_Encoder::encode(), encode(), Botan::SEQUENCE, Botan::DER_Encoder::start_cons(), and Botan::Public_Key::x509_subject_public_key().

Referenced by encode(), and PEM_encode().

22 {
23 return DER_Encoder()
24 .start_cons(SEQUENCE)
25 .encode(key.algorithm_identifier())
26 .encode(key.x509_subject_public_key(), BIT_STRING)
27 .end_cons()
28 .get_contents();
29 }
Botan::SEQUENCE
Definition: asn1_int.h:35
Botan::PEM_Code::encode
std::string encode(const byte der[], size_t length, const std::string &label, size_t width)
Definition: pem.cpp:19
Botan::BIT_STRING
Definition: asn1_int.h:30

## ◆ copy_key()

BOTAN_DLL Public_Key * Botan::X509::copy_key | ( | const Public_Key & | key | ) |

Copy a key.

Parameters

  key | the public key to copy

Returns
  new public key object

Definition at line 104 of file x509_key.cpp.

References load_key(), and PEM_encode().

105 {
106 DataSource_Memory source(PEM_encode(key));
107 return X509::load_key(source);
108 }
Botan::X509::load_key
Public_Key * load_key(const MemoryRegion< byte > &mem)
Definition: x509_key.cpp:95
Botan::X509::PEM_encode
std::string PEM_encode(const Public_Key &key)
Definition: x509_key.cpp:34

## ◆ create_cert_req()

BOTAN_DLL PKCS10_Request Botan::X509::create_cert_req | ( | const X509_Cert_Options & | opts,
|  | const Private_Key & | key,
|  | const std::string & | hash_fn,
|  | RandomNumberGenerator & | rng
| ) |  |

Create a PKCS#10 certificate request.

Parameters

  opts | the options defining the request to create
  key | the key used to sign this request
  rng | the rng to use
  hash_fn | the hash function to use

Returns
  newly created PKCS#10 request

Definition at line 91 of file x509self.cpp.

95 {
96 AlgorithmIdentifier sig_algo;
97 X509_DN subject_dn;
98 AlternativeName subject_alt;
99
100 opts.sanity_check();
101
102 MemoryVector<byte> pub_key = X509::BER_encode(key);
103 std::auto_ptr<PK_Signer> signer(choose_sig_format(key, hash_fn, sig_algo));
104 load_info(opts, subject_dn, subject_alt);
105
106 const size_t PKCS10_VERSION = 0;
107
108 Extensions extensions;
109
110 extensions.add(
111 new Cert_Extension::Basic_Constraints(opts.is_CA, opts.path_limit));
112 extensions.add(
113 new Cert_Extension::Key_Usage(
114 opts.is_CA ? Key_Constraints(KEY_CERT_SIGN | CRL_SIGN) :
115 find_constraints(key, opts.constraints)
116 )
117 );
118 extensions.add(
119 new Cert_Extension::Extended_Key_Usage(opts.ex_constraints));
120 extensions.add(
121 new Cert_Extension::Subject_Alternative_Name(subject_alt));
122
123 DER_Encoder tbs_req;
124
125 tbs_req.start_cons(SEQUENCE)
126 .encode(PKCS10_VERSION)
127 .encode(subject_dn)
128 .raw_bytes(pub_key)
129 .start_explicit(0);
130
131 if(opts.challenge != "")
132 {
133 ASN1_String challenge(opts.challenge, DIRECTORY_STRING);
134
135 tbs_req.encode(
136 Attribute("PKCS9.ChallengePassword",
137 DER_Encoder().encode(challenge).get_contents()
138 )
139 );
140 }
141
142 tbs_req.encode(
143 Attribute("PKCS9.ExtensionRequest",
144 DER_Encoder()
145 .start_cons(SEQUENCE)
146 .encode(extensions)
147 .end_cons()
148 .get_contents()
149 )
150 )
151 .end_explicit()
152 .end_cons();
153
154 DataSource_Memory source(
155 X509_Object::make_signed(signer.get(),
156 rng,
157 sig_algo,
158 tbs_req.get_contents())
159 );
160
161 return PKCS10_Request(source);
162 }
Botan::PKCS8::BER_encode
SecureVector< byte > BER_encode(const Private_Key &key)
Definition: pkcs8.cpp:134
Botan::CRL_SIGN
Definition: pubkey_enums.h:26
Botan::X509::find_constraints
Key_Constraints find_constraints(const Public_Key &pub_key, Key_Constraints limits)
Definition: x509_key.cpp:113
Botan::SEQUENCE
Definition: asn1_int.h:35
Botan::DIRECTORY_STRING
Definition: asn1_int.h:50
Botan::PEM_Code::encode
std::string encode(const byte der[], size_t length, const std::string &label, size_t width)
Definition: pem.cpp:19
Botan::Key_Constraints
Key_Constraints
Definition: pubkey_enums.h:18
Botan::KEY_CERT_SIGN
Definition: pubkey_enums.h:25
Botan::choose_sig_format
PK_Signer * choose_sig_format(const Private_Key &key, const std::string &hash_fn, AlgorithmIdentifier &sig_algo)
Definition: x509_ca.cpp:218

## ◆ create_self_signed_cert()

BOTAN_DLL X509_Certificate Botan::X509::create_self_signed_cert | ( | const X509_Cert_Options & | opts,
|  | const Private_Key & | key,
|  | const std::string & | hash_fn,
|  | RandomNumberGenerator & | rng
| ) |  |

Create a self-signed X.509 certificate.

Parameters

  opts | the options defining the certificate to create
  key | the private key used for signing, i.e. the key associated with this self-signed certificate
  hash_fn | the hash function to use
  rng | the rng to use

Returns
  newly created self-signed certificate

Definition at line 45 of file x509self.cpp.

49 {
50 AlgorithmIdentifier sig_algo;
51 X509_DN subject_dn;
52 AlternativeName subject_alt;
53
54 opts.sanity_check();
55
56 MemoryVector<byte> pub_key = X509::BER_encode(key);
57 std::auto_ptr<PK_Signer> signer(choose_sig_format(key, hash_fn, sig_algo));
58 load_info(opts, subject_dn, subject_alt);
59
60 Key_Constraints constraints;
61 if(opts.is_CA)
62 constraints = Key_Constraints(KEY_CERT_SIGN | CRL_SIGN);
63 else
64 constraints = find_constraints(key, opts.constraints);
65
66 Extensions extensions;
67
68 extensions.add(
69 new Cert_Extension::Basic_Constraints(opts.is_CA, opts.path_limit),
70 true);
71
72 extensions.add(new Cert_Extension::Key_Usage(constraints), true);
73
74 extensions.add(new Cert_Extension::Subject_Key_ID(pub_key));
75
76 extensions.add(
77 new Cert_Extension::Subject_Alternative_Name(subject_alt));
78
79 extensions.add(
80 new Cert_Extension::Extended_Key_Usage(opts.ex_constraints));
81
82 return X509_CA::make_cert(signer.get(), rng, sig_algo, pub_key,
83 opts.start, opts.end,
84 subject_dn, subject_dn,
85 extensions);
86 }
Botan::PKCS8::BER_encode
SecureVector< byte > BER_encode(const Private_Key &key)
Definition: pkcs8.cpp:134
Botan::CRL_SIGN
Definition: pubkey_enums.h:26
Botan::X509::find_constraints
Key_Constraints find_constraints(const Public_Key &pub_key, Key_Constraints limits)
Definition: x509_key.cpp:113
Botan::Key_Constraints
Key_Constraints
Definition: pubkey_enums.h:18
Botan::KEY_CERT_SIGN
Definition: pubkey_enums.h:25
Botan::choose_sig_format
PK_Signer * choose_sig_format(const Private_Key &key, const std::string &hash_fn, AlgorithmIdentifier &sig_algo)
Definition: x509_ca.cpp:218

## ◆ encode()

void Botan::X509::encode | ( | const Public_Key & | key,
|  | Pipe & | pipe,
|  | X509_Encoding | encoding = `PEM`
| ) |  |
| inline

Encode a key into a pipe.

Deprecated:
  Use PEM_encode or BER_encode instead

Parameters

  key | the public key to encode
  pipe | the pipe to feed the encoded key into
  encoding | the encoding type to use

Definition at line 87 of file x509_key.h.

References BER_encode(), and PEM_encode().

Referenced by BER_encode().

90 {
91 if(encoding == PEM)
92 pipe.write(X509::PEM_encode(key));
93 else
94 pipe.write(X509::BER_encode(key));
95 }
Botan::PKCS8::BER_encode
SecureVector< byte > BER_encode(const Private_Key &key)
Definition: pkcs8.cpp:134
Botan::PKCS8::PEM_encode
std::string PEM_encode(const Private_Key &key)
Definition: pkcs8.cpp:150
Botan::PEM
Definition: pubkey_enums.h:67

## ◆ find_constraints()

BOTAN_DLL Key_Constraints Botan::X509::find_constraints | ( | const Public_Key & | pub_key,
|  | Key_Constraints | limits
| ) |  |

Create the key constraints for a specific public key.

Parameters

  pub_key | the public key from which the basic set of constraints to be placed in the return value is derived
  limits | additional limits that will be incorporated into the return value

Returns
  combination of key type specific constraints and additional limits

Definition at line 113 of file x509_key.cpp.

References Botan::Public_Key::algo_name(), Botan::DATA_ENCIPHERMENT, Botan::DIGITAL_SIGNATURE, Botan::KEY_AGREEMENT, Botan::KEY_ENCIPHERMENT, and Botan::NON_REPUDIATION.

115 {
116 const std::string name = pub_key.algo_name();
117
118 size_t constraints = 0;
119
120 if(name == "DH" || name == "ECDH")
121 constraints |= KEY_AGREEMENT;
122
123 if(name == "RSA" || name == "ElGamal")
124 constraints |= KEY_ENCIPHERMENT | DATA_ENCIPHERMENT;
125
126 if(name == "RSA" || name == "RW" || name == "NR" ||
127 name == "DSA" || name == "ECDSA")
128 constraints |= DIGITAL_SIGNATURE | NON_REPUDIATION;
129
130 if(limits)
131 constraints &= limits;
132
133 return Key_Constraints(constraints);
134 }
Botan::DATA_ENCIPHERMENT
Definition: pubkey_enums.h:23
Botan::NON_REPUDIATION
Definition: pubkey_enums.h:21
Botan::KEY_ENCIPHERMENT
Definition: pubkey_enums.h:22
Botan::KEY_AGREEMENT
Definition: pubkey_enums.h:24
Botan::DIGITAL_SIGNATURE
Definition: pubkey_enums.h:20
Botan::Key_Constraints
Key_Constraints
Definition: pubkey_enums.h:18

## ◆ load_key() [1/3]

BOTAN_DLL Public_Key * Botan::X509::load_key | ( | DataSource & | source | ) |

Create a public key from a data source.

Parameters

  source | the source providing the DER or PEM encoded key

Returns
  new public key object

Definition at line 43 of file x509_key.cpp.

References Botan::BIT_STRING, Botan::BER_Decoder::decode(), Botan::PEM_Code::decode_check_label(), Botan::MemoryRegion< T >::empty(), Botan::BER_Decoder::end_cons(), Botan::make_public_key(), Botan::PEM_Code::matches(), Botan::ASN1::maybe_BER(), Botan::SEQUENCE, Botan::BER_Decoder::start_cons(), and Botan::BER_Decoder::verify_end().

Referenced by copy_key(), load_key(), Botan::PKCS10_Request::subject_public_key(), and Botan::X509_Certificate::subject_public_key().

44 {
45 try {
46 AlgorithmIdentifier alg_id;
47 MemoryVector<byte> key_bits;
48
49 if(ASN1::maybe_BER(source) && !PEM_Code::matches(source))
50 {
51 BER_Decoder(source)
52 .start_cons(SEQUENCE)
53 .decode(alg_id)
54 .decode(key_bits, BIT_STRING)
55 .verify_end()
56 .end_cons();
57 }
58 else
59 {
60 DataSource_Memory ber(
61 PEM_Code::decode_check_label(source, "PUBLIC KEY")
62 );
63
64 BER_Decoder(ber)
65 .start_cons(SEQUENCE)
66 .decode(alg_id)
67 .decode(key_bits, BIT_STRING)
68 .verify_end()
69 .end_cons();
70 }
71
72 if(key_bits.empty())
73 throw Decoding_Error("X.509 public key decoding failed");
74
75 return make_public_key(alg_id, key_bits);
76 }
77 catch(Decoding_Error)
78 {
79 throw Decoding_Error("X.509 public key decoding failed");
80 }
81 }
Botan::ASN1::maybe_BER
bool maybe_BER(DataSource &source)
Definition: asn1_int.cpp:55
Botan::SEQUENCE
Definition: asn1_int.h:35
Botan::PEM_Code::matches
bool matches(DataSource &source, const std::string &extra, size_t search_range)
Definition: pem.cpp:116
Botan::BIT_STRING
Definition: asn1_int.h:30
Botan::PEM_Code::decode_check_label
SecureVector< byte > decode_check_label(DataSource &source, const std::string &label_want)
Definition: pem.cpp:42
Botan::make_public_key
Public_Key * make_public_key(const AlgorithmIdentifier &alg_id, const MemoryRegion< byte > &key_bits)
Definition: pk_algs.cpp:49

## ◆ load_key() [2/3]

BOTAN_DLL Public_Key * Botan::X509::load_key | ( | const std::string & | filename | ) |

Create a public key from a file

Parameters

  filename | pathname to the file to load

Returns
  new public key object

Definition at line 86 of file x509_key.cpp.

References load_key().

87 {
88 DataSource_Stream source(fsname, true);
89 return X509::load_key(source);
90 }
Botan::X509::load_key
Public_Key * load_key(const MemoryRegion< byte > &mem)
Definition: x509_key.cpp:95

## ◆ load_key() [3/3]

BOTAN_DLL Public_Key * Botan::X509::load_key | ( | const MemoryRegion< byte > & | enc | ) |

Create a public key from a memory region.

Parameters

  enc | the memory region containing the DER or PEM encoded key

Returns
  new public key object

Definition at line 95 of file x509_key.cpp.

References load_key().

96 {
97 DataSource_Memory source(mem);
98 return X509::load_key(source);
99 }
Botan::X509::load_key
Public_Key * load_key(const MemoryRegion< byte > &mem)
Definition: x509_key.cpp:95

## ◆ PEM_encode()

BOTAN_DLL std::string Botan::X509::PEM_encode | ( | const Public_Key & | key | ) |

PEM encode a public key into a string.

Parameters

  key | the key to encode

Returns
  PEM encoded key

Definition at line 34 of file x509_key.cpp.

References BER_encode(), and Botan::PEM_Code::encode().

Referenced by copy_key(), encode(), and Botan::X509_Certificate::to_string().

35 {
36 return PEM_Code::encode(X509::BER_encode(key),
37 "PUBLIC KEY");
38 }
Botan::X509::BER_encode
MemoryVector< byte > BER_encode(const Public_Key &key)
Definition: x509_key.cpp:21
Botan::PEM_Code::encode
std::string encode(const byte der[], size_t length, const std::string &label, size_t width)
Definition: pem.cpp:19