com.rsa.certj.cert.extensions

Class AuthorityKeyID

java.lang.Object
  |
  +--com.rsa.certj.cert.extensions.X509V3Extension
        |
        +--com.rsa.certj.cert.extensions.AuthorityKeyID

All Implemented Interfaces:

CertExtension, Cloneable, CRLExtension, Serializable

public class AuthorityKeyID

extends X509V3Extension

implements Cloneable, Serializable, CertExtension, CRLExtension

This class holds, encodes, and decodes the AuthorityKeyID extension. It provides a means of identifying the public key corresponding to the private key used to sign a certificate or CRL. This extension is used when an issuer has multiple signing keys (either due to multiple concurrent key pairs or due to change over). The identification is based on either the key identifier (the subject key identifier in the issuer’s certificate, or the subject key identifier in the CRL signer’s certificate) or on the issuer name and serial number.

If used in certificates, the keyIdentifier field of the authorityKeyIdentifier extension must be included in all certificates generated by conforming CAs to facilitate chain building. There is one exception; when a CA distributes its public key in the form of a self-signed certificate, the authority key identifier may be omitted. In this case, the subject and authority key identifiers are identical. The value of the keyIdentifier field should be derived from the public key used to verify the certificate’s signature or by a method that generates unique values.

If used in CRLs, conforming CAs that issue CRLs are required to include and use the authority key identifier.

The ASN.1 definition is as follows:

 authorityKeyIdentifier EXTENSION ::= {
 	SYNTAX		AuthorityKeyIdentifier
	IDENTIFIED BY 	id-ce-authorityKeyIdentifier }

 AuthorityKeyIdentifier ::= SEQUENCE {
    keyIdentifier		      [0] KeyIdentifier	      OPTIONAL,
	authorityCertIssuer	      [1] GeneralNames	      OPTIONAL,
	authorityCertSerialNumber     [2] CertificateSerialNumber   OPTIONAL }

Copyright © RSA Security Inc., 1999-2001. All rights reserved.

See Also

Serialized Form

Fields inherited from class com.rsa.certj.cert.extensions.X509V3Extension

ARCHIVE_CUTOFF, ARCHIVE_CUTOFF_OID, AUTHORITY_INFO_ACCESS, AUTHORITY_INFO_OID, AUTHORITY_KEY_ID, BASIC_CONSTRAINTS, BIO_INFO, BIO_INFO_OID, CERT_POLICIES, CERTIFICATE_ISSUER, CRL_DISTRIBUTION_POINTS, CRL_NUMBER, CRL_REFERENCE, CRL_REFERENCE_OID, DELTA_CRL_INDICATOR, EXTENDED_KEY_USAGE, HOLD_INSTRUCTION_CODE, INHIBIT_ANY_POLICY, INVALIDITY_DATE, ISSUER_ALT_NAME, ISSUING_DISTRIBUTION_POINT, KEY_USAGE, NAME_CONSTRAINTS, NETSCAPE_BASE_URL, NETSCAPE_BASE_URL_OID, NETSCAPE_CA_POLICY_URL, NETSCAPE_CA_POLICY_URL_OID, NETSCAPE_CA_REVOCATION_URL, NETSCAPE_CA_REVOCATION_URL_OID, NETSCAPE_CERT_RENEWAL_URL, NETSCAPE_CERT_RENEWAL_URL_OID, NETSCAPE_CERT_TYPE, NETSCAPE_CERT_TYPE_OID, NETSCAPE_COMMENT, NETSCAPE_COMMENT_OID, NETSCAPE_REVOCATION_URL, NETSCAPE_REVOCATION_URL_OID, NETSCAPE_SSL_SERVER_NAME, NETSCAPE_SSL_SERVER_NAME_OID, NON_STANDARD_EXTENSION, OCSP_ACCEPTABLE_RESPONSES, OCSP_ACCEPTABLE_RESPONSES_OID, OCSP_NOCHECK, OCSP_NOCHECK_OID, OCSP_NONCE, OCSP_NONCE_OID, OCSP_SERVICE_LOCATOR, OCSP_SERVICE_LOCATOR_OID, POLICY_CONSTRAINTS, POLICY_MAPPINGS, PRIVATE_KEY_USAGE_PERIOD, QC_STATEMENTS, QC_STATEMENTS_OID, REASON_CODE, SUBJECT_ALT_NAME, SUBJECT_DIRECTORY_ATTRIBUTES, SUBJECT_KEY_ID, VERISIGN_CZAG, VERISIGN_CZAG_OID, VERISIGN_FIDELITY_ID, VERISIGN_FIDELITY_ID_OID, VERISIGN_JURISDICTION_HASH, VERISIGN_JURISDICTION_HASH_OID, VERISIGN_NETSCAPE_INBOX_V1, VERISIGN_NETSCAPE_INBOX_V1_OID, VERISIGN_NETSCAPE_INBOX_V2, VERISIGN_NETSCAPE_INBOX_V2_OID, VERISIGN_NON_VERIFIED, VERISIGN_NON_VERIFIED_OID, VERISIGN_SERIAL_NUMBER, VERISIGN_SERIAL_NUMBER_OID, VERISIGN_TOKEN_TYPE, VERISIGN_TOKEN_TYPE_OID

Constructor Summary

AuthorityKeyID()

Constructs an empty AuthorityKeyID object.

AuthorityKeyID(GeneralNames authorityCertIssuer, byte[] serialNumber, int numberOffset, int numberLen, byte[] keyID, int keyOffset, int keyLen, boolean criticality)

Constructs an AuthorityKeyID object containing the values given.

Method Summary

Object	clone() Overrides the default clone method to get a deeper clone.
void	decodeValue(byte[] valueBER, int offset) Decode the value.
int	derEncodeValue(byte[] encoding, int offset) Place the encoding of the value into encoding, beginning at offset.
int	derEncodeValueInit() Initialize for encoding the value.
GeneralNames	getAuthorityCertIssuer() Gets the authority certificate issuer from this extension.
byte[]	getKeyID() Gets the key ID.
byte[]	getSerialNumber() Gets the authority certificate serial number from this extension.
void	setAuthorityCertIssuer(GeneralNames issuer) Sets the authorityCertIssuer value of this object.
void	setKeyID(byte[] keyID, int offset, int len) Sets the key ID value of this object to keyID.
void	setSerialNumber(byte[] number, int offset, int len) Sets the authorityCertSerialNumber value of this object.

Methods inherited from class com.rsa.certj.cert.extensions.X509V3Extension

extend, getCriticality, getDEREncoding, getDERLen, getExtensionType, getExtensionTypeString, getInstance, getNextBEROffset, isExtensionType, setCriticality, setEncoding, setSpecialOID, setStandardOID

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

AuthorityKeyID

public AuthorityKeyID()

Constructs an empty AuthorityKeyID object.

AuthorityKeyID

public AuthorityKeyID(GeneralNames authorityCertIssuer,
                      byte[] serialNumber,
                      int numberOffset,
                      int numberLen,
                      byte[] keyID,
                      int keyOffset,
                      int keyLen,
                      boolean criticality)

Constructs an AuthorityKeyID object containing the values given. An authority key is identified by using both the certificate issuer name and the certificate serial number.

Parameters

	authorityCertIssuer		The certificate issuer name.
	serialNumber		The certificate serial number, authorityCertSerialNumber.
	numberOffset		The offset into serialNumber where the value begins.
	numberLen		The length of the serial number.
	keyID		The key ID value.
	keyOffset		The offset into keyID where the value begins.
	keyLen		The length of the key ID.
	criticality		The user-specified criticality.

Method Detail

decodeValue

public void decodeValue(byte[] valueBER,
                        int offset)
                 throws CertificateException

Decode the value. The input is the BER encoding that was wrapped in the OCTET STRING.

Overrides

decodeValue in class X509V3Extension

Parameters

	valueBER		The BER encoding of the extension's value.
	offset		The offset into valueBER where the encoding actually begins.

Throws

CertificateException - If the encoding is invalid for this extension.

setKeyID

public void setKeyID(byte[] keyID,
                     int offset,
                     int len)

Sets the key ID value of this object to keyID. If this object already possesses a key ID, this method will replace it with the given value.

Parameters

	keyID		The key ID value.
	offset		The offset into keyID where the value actually begins.
	len		The length of the key ID.

setAuthorityCertIssuer

public void setAuthorityCertIssuer(GeneralNames issuer)

Sets the authorityCertIssuer value of this object. If this object already has an authorityCertIssuer value, this method will replace it with the given value.

Parameters

issuer

A GeneralNames object that contains the authority certificate issuer name.

setSerialNumber

public void setSerialNumber(byte[] number,
                            int offset,
                            int len)

Sets the authorityCertSerialNumber value of this object. If this object already has an authorityCertSerialNumber value, this method will replace it with the given value.

Parameters

	number		The authority certificate serial number.
	offset		The offset into number where the value begins.
	len		The length of the serial number in the number array.

getKeyID

public byte[] getKeyID()

Gets the key ID. If this object does not have an ID, this method returns null.

Returns

A new byte array containing the key ID.

getAuthorityCertIssuer

public GeneralNames getAuthorityCertIssuer()

Gets the authority certificate issuer from this extension.

Returns

The authority certificate issuer.

getSerialNumber

public byte[] getSerialNumber()

Gets the authority certificate serial number from this extension.

Returns

The authority certificate serial number.

derEncodeValueInit

public int derEncodeValueInit()

Initialize for encoding the value.

Overrides

derEncodeValueInit in class X509V3Extension

Returns

How many bytes the encoding will be.

derEncodeValue

public int derEncodeValue(byte[] encoding,
                          int offset)

Place the encoding of the value into encoding, beginning at offset. This is the actual contents that are wrapped in the OCTET STRING (not the surrounding OCTET STRING tag and length).

Overrides

derEncodeValue in class X509V3Extension

Parameters

	encoding		The byte array into which the result will be placed.
	offset		The offest into encoding where the writing is to begin.

Returns

The number of bytes actually placed into encoding.

clone

public Object clone()
             throws CloneNotSupportedException

Overrides the default clone method to get a deeper clone.

Overrides

clone in class X509V3Extension

Returns

A new AuthorityKeyID object, a copy of this object.

Throws

CloneNotSupportedException - If the cloning operation is not successful.