HankoXml

Class: HankoXml::Xades::LongTermCheck Private

Inherits:
Object
  • Object
show all
Defined in:
lib/hanko_xml/xades/long_term.rb

Overview

This class is part of a private API. You should avoid using this class if possible, as it may be removed or be changed in the future.

Validates the signing certificate chain at the time of the earliest verified SignatureTimeStamp, with the embedded revocation data (#168).

The chain itself has already been built and verified at that time by Verifier (store:, StoreContext with time=). Here, each certificate below the trust anchor needs revocation evidence that:

  • verifies: an OCSP response through OpenSSL::OCSP::BasicResponse#verify (the responder's signature, its chain to the same anchor, and its authorization for that certificate), with the responder's chain then checked at the response's producedAt; or a CRL signed by the certificate's issuer (CRL#verify), an issuer allowed to sign CRLs;
  • is fresh: issued (thisUpdate) no earlier than the validation time minus grace, and not in the future;
  • does not show the certificate revoked at or before the validation time. Revoked later is accepted: the timestamp proves the signature existed before.

Evidence that does not verify or is stale is not used; a certificate left without usable evidence fails, and so does any usable evidence of an earlier revocation (fail closed, S-23).

Constant Summary collapse

CRL_SIGN_BIT =

This constant is part of a private API. You should avoid using this constant if possible, as it may be removed or be changed in the future. 

6

Instance Method Summary collapse

Constructor Details

#initialize(grace:, clock_skew:) ⇒ LongTermCheck

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Returns a new instance of LongTermCheck.



105
106
107
108
 
# File 'lib/hanko_xml/xades/long_term.rb', line 105

def initialize(grace:, clock_skew:)
  @grace = grace
  @clock_skew = clock_skew
end

Instance Method Details

#verify(time:, chain:, values:) ⇒ LongTermValidation

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Returns:

Raises:



112
113
114
115
116
117
118
119
 
# File 'lib/hanko_xml/xades/long_term.rb', line 112

def verify(time:, chain:, values:)
  @time = time
  @anchor = chain.last
  @pool = (chain + values.certificates).uniq(&:to_der)
  @values = values
  revocation = chain.each_cons(2).with_index.map { |(certificate, issuer), i| status(certificate, issuer, i) }
  LongTermValidation.new(time: time, certificate_chain: chain.freeze, revocation: revocation.freeze)
end