* SubjectPublicKeyInfo ::= SEQUENCE {
* algorithm AlgorithmIdentifier,
* subjectPublicKey BIT STRING
* }
*
* AlgorithmIdentifier ::= SEQUENCE {
* algorithm OBJECT IDENTIFIER,
* parameters ANY DEFINED BY algorithm OPTIONAL
* }
*
* DssParams ::= SEQUENCE {
* p INTEGER,
* q INTEGER,
* g INTEGER
* }
*
* * Note that RFC-3280 (page 79) implies that some certificates MAY have an * absent, or NULL, parameters field in their AlgorithmIdentifier element, * implying that those parameters MUST be inherited from another * certificate. This implementation, encodes a NULL element as the DER * value of the parameters field when such is the case. *
* The subjectPublicKey field, which is a BIT STRING, contains the * DER-encoded form of the DSA public key as an INTEGER. * *
* DSAPublicKey ::= INTEGER -- public key, Y ** * @param key the {@link PublicKey} instance to encode. MUST be an instance of * {@link DSSPublicKey}. * @return the ASN.1 representation of the SubjectPublicKeyInfo in an * X.509 certificate. * @throw InvalidParameterException if
key is not an instance
* of {@link DSSPublicKey} or if an exception occurs during the
* marshalling process.
*/
public byte[] encodePublicKey(PublicKey key)
{
if (! (key instanceof DSSPublicKey))
throw new InvalidParameterException("key");
DERValue derOID = new DERValue(DER.OBJECT_IDENTIFIER, DSA_ALG_OID);
DSSPublicKey dssKey = (DSSPublicKey) key;
DERValue derParams;
if (dssKey.hasInheritedParameters())
derParams = new DERValue(DER.NULL, null);
else
{
BigInteger p = dssKey.getParams().getP();
BigInteger q = dssKey.getParams().getQ();
BigInteger g = dssKey.getParams().getG();
DERValue derP = new DERValue(DER.INTEGER, p);
DERValue derQ = new DERValue(DER.INTEGER, q);
DERValue derG = new DERValue(DER.INTEGER, g);
ArrayList params = new ArrayList(3);
params.add(derP);
params.add(derQ);
params.add(derG);
derParams = new DERValue(DER.CONSTRUCTED | DER.SEQUENCE, params);
}
ArrayList algorithmID = new ArrayList(2);
algorithmID.add(derOID);
algorithmID.add(derParams);
DERValue derAlgorithmID = new DERValue(DER.CONSTRUCTED | DER.SEQUENCE,
algorithmID);
BigInteger y = dssKey.getY();
DERValue derDSAPublicKey = new DERValue(DER.INTEGER, y);
byte[] yBytes = derDSAPublicKey.getEncoded();
DERValue derSPK = new DERValue(DER.BIT_STRING, new BitString(yBytes));
ArrayList spki = new ArrayList(2);
spki.add(derAlgorithmID);
spki.add(derSPK);
DERValue derSPKI = new DERValue(DER.CONSTRUCTED | DER.SEQUENCE, spki);
byte[] result;
ByteArrayOutputStream baos = new ByteArrayOutputStream();
try
{
DERWriter.write(baos, derSPKI);
result = baos.toByteArray();
}
catch (IOException x)
{
InvalidParameterException e = new InvalidParameterException(x.getMessage());
e.initCause(x);
throw e;
}
return result;
}
/**
* @throws InvalidParameterException ALWAYS.
*/
public byte[] encodePrivateKey(PrivateKey key)
{
throw new InvalidParameterException("Wrong format for private keys");
}
/**
* @param input the byte array to unmarshall into a valid DSS
* {@link PublicKey} instance. MUST NOT be null.
* @return a new instance of a {@link DSSPublicKey} decoded from the
* SubjectPublicKeyInfo material in an X.509 certificate.
* @throw InvalidParameterException if an exception occurs during the
* unmarshalling process.
*/
public PublicKey decodePublicKey(byte[] input)
{
if (input == null)
throw new InvalidParameterException("Input bytes MUST NOT be null");
BigInteger p = null;
BigInteger g = null;
BigInteger q = null;
BigInteger y;
DERReader der = new DERReader(input);
try
{
DERValue derSPKI = der.read();
DerUtil.checkIsConstructed(derSPKI, "Wrong SubjectPublicKeyInfo field");
DERValue derAlgorithmID = der.read();
DerUtil.checkIsConstructed(derAlgorithmID, "Wrong AlgorithmIdentifier field");
DERValue derOID = der.read();
if (! (derOID.getValue() instanceof OID))
throw new InvalidParameterException("Wrong Algorithm field");
OID algOID = (OID) derOID.getValue();
if (! algOID.equals(DSA_ALG_OID))
throw new InvalidParameterException("Unexpected OID: " + algOID);
DERValue val = der.read();
// RFC-3280, page 79 states: "If the subjectPublicKeyInfo field of the
// certificate contains an algorithm field with null parameters or
// parameters are omitted, compare the certificate subjectPublicKey
// algorithm to the working_public_key_algorithm. If the certificate
// subjectPublicKey algorithm and the working_public_key_algorithm are
// different, set the working_public_key_parameters to null."
// in other words, the parameters field of an AlgorithmIdentifier
// element MAY NOT be present at all, or if present MAY be NULL!
// the Mauve test ValidDSAParameterInheritenceTest5, in
// gnu.testlet.java.security.cert.pkix.pkits, is/was failing because
// of this.
if (val.getTag() == DER.NULL)
val = der.read();
else if (val.isConstructed())
{
val = der.read();
DerUtil.checkIsBigInteger(val, "Wrong P field");
p = (BigInteger) val.getValue();
val = der.read();
DerUtil.checkIsBigInteger(val, "Wrong Q field");
q = (BigInteger) val.getValue();
val = der.read();
DerUtil.checkIsBigInteger(val, "Wrong G field");
g = (BigInteger) val.getValue();
val = der.read();
}
if (! (val.getValue() instanceof BitString))
throw new InvalidParameterException("Wrong SubjectPublicKey field");
byte[] yBytes = ((BitString) val.getValue()).toByteArray();
DERReader dsaPub = new DERReader(yBytes);
val = dsaPub.read();
DerUtil.checkIsBigInteger(val, "Wrong Y field");
y = (BigInteger) val.getValue();
}
catch (IOException x)
{
InvalidParameterException e = new InvalidParameterException(x.getMessage());
e.initCause(x);
throw e;
}
return new DSSPublicKey(Registry.X509_ENCODING_ID, p, q, g, y);
}
/**
* @throws InvalidParameterException ALWAYS.
*/
public PrivateKey decodePrivateKey(byte[] input)
{
throw new InvalidParameterException("Wrong format for private keys");
}
}