Botan 2.1.0 Crypto and TLS for C++11

- Main Page
- Namespaces
- Classes
- Files

- Namespace List
- Namespace Members

Functions
Botan::X509 Namespace Reference

## Functions
std::vector< uint8_t > | BER_encode (const Public_Key &key)
Public_Key * | copy_key (const Public_Key &key)
PKCS10_Request | create_cert_req (const X509_Cert_Options &opts, const Private_Key &key, const std::string &hash_fn, RandomNumberGenerator &rng)
X509_Certificate | create_self_signed_cert (const X509_Cert_Options &opts, const Private_Key &key, const std::string &hash_fn, RandomNumberGenerator &rng)
Public_Key * | load_key (DataSource &source)
Public_Key * | load_key (const std::vector< uint8_t > &mem)
std::string | PEM_encode (const Public_Key &key)

## Detailed Description

This namespace contains functions for handling X.509 public keys

## Function Documentation

BOTAN_DLL std::vector< uint8_t > Botan::X509::BER_encode | ( | const Public_Key & | key | ) |

BER encode a key

Parameters

  key | the public key to encode

Returns
  BER encoding of this key

Definition at line 19 of file x509_key.cpp.

References Botan::Public_Key::subject_public_key().

Referenced by botan_privkey_export_pubkey(), botan_pubkey_export(), create_cert_req(), and create_self_signed_cert().

20 {
21 // keeping it around for compat
22 return key.subject_public_key();
23 }

BOTAN_DLL Public_Key * Botan::X509::copy_key | ( | const Public_Key & | key | ) |

Copy a key.

Parameters

  key | the public key to copy

Returns
  new public key object

Definition at line 98 of file x509_key.cpp.

References load_key(), and PEM_encode().

99 {
100 DataSource_Memory source(PEM_encode(key));
101 return X509::load_key(source);
102 }
Botan::X509::load_key
Public_Key * load_key(const std::vector< uint8_t > &mem)
Definition: x509_key.cpp:89
Botan::X509::PEM_encode
std::string PEM_encode(const Public_Key &key)
Definition: x509_key.cpp:28

BOTAN_DLL PKCS10_Request Botan::X509::create_cert_req | ( | const X509_Cert_Options & | opts,
|  | const Private_Key & | key,
|  | const std::string & | hash_fn,
|  | RandomNumberGenerator & | rng
| ) |  |

Create a PKCS#10 certificate request.

Parameters

  opts | the options defining the request to create
  key | the key used to sign this request
  rng | the rng to use
  hash_fn | the hash function to use

Returns
  newly created PKCS#10 request

Definition at line 96 of file x509self.cpp.

References Botan::Extensions::add(), BER_encode(), Botan::X509_Cert_Options::challenge, Botan::choose_sig_format(), Botan::X509_Cert_Options::constraints, Botan::CRL_SIGN, Botan::DIRECTORY_STRING, Botan::DER_Encoder::encode(), Botan::PEM_Code::encode(), Botan::DER_Encoder::end_cons(), Botan::DER_Encoder::end_explicit(), Botan::X509_Cert_Options::ex_constraints, Botan::X509_Cert_Options::extensions, Botan::DER_Encoder::get_contents(), Botan::X509_Cert_Options::is_CA, Botan::KEY_CERT_SIGN, Botan::X509_Object::make_signed(), Botan::NO_CONSTRAINTS, Botan::X509_Cert_Options::path_limit, Botan::DER_Encoder::raw_bytes(), Botan::SEQUENCE, Botan::DER_Encoder::start_cons(), Botan::DER_Encoder::start_explicit(), and Botan::verify_cert_constraints_valid_for_key_type().

100 {
101 AlgorithmIdentifier sig_algo;
102 X509_DN subject_dn;
103 AlternativeName subject_alt;
104
105 std::vector<uint8_t> pub_key = X509::BER_encode(key);
106 std::unique_ptr<PK_Signer> signer(choose_sig_format(key, rng, hash_fn, sig_algo));
107 load_info(opts, subject_dn, subject_alt);
108
109 const size_t PKCS10_VERSION = 0;
110
111 Key_Constraints constraints;
112 if(opts.is_CA)
113 {
114 constraints = Key_Constraints(KEY_CERT_SIGN | CRL_SIGN);
115 }
116 else
117 {
118 verify_cert_constraints_valid_for_key_type(key, opts.constraints);
119 constraints = opts.constraints;
120 }
121
122 Extensions extensions = opts.extensions;
123
124 extensions.add(
125 new Cert_Extension::Basic_Constraints(opts.is_CA, opts.path_limit));
126
127 if(constraints != NO_CONSTRAINTS)
128 {
129 extensions.add(
130 new Cert_Extension::Key_Usage(constraints));
131 }
132 extensions.add(
133 new Cert_Extension::Extended_Key_Usage(opts.ex_constraints));
134 extensions.add(
135 new Cert_Extension::Subject_Alternative_Name(subject_alt));
136
137 DER_Encoder tbs_req;
138
139 tbs_req.start_cons(SEQUENCE)
140 .encode(PKCS10_VERSION)
141 .encode(subject_dn)
142 .raw_bytes(pub_key)
143 .start_explicit(0);
144
145 if(!opts.challenge.empty())
146 {
147 ASN1_String challenge(opts.challenge, DIRECTORY_STRING);
148
149 tbs_req.encode(
150 Attribute("PKCS9.ChallengePassword",
151 DER_Encoder().encode(challenge).get_contents_unlocked()
152 )
153 );
154 }
155
156 tbs_req.encode(
157 Attribute("PKCS9.ExtensionRequest",
158 DER_Encoder()
159 .start_cons(SEQUENCE)
160 .encode(extensions)
161 .end_cons()
162 .get_contents_unlocked()
163 )
164 )
165 .end_explicit()
166 .end_cons();
167
168 const std::vector<uint8_t> req =
169 X509_Object::make_signed(signer.get(), rng, sig_algo,
170 tbs_req.get_contents());
171
172 return PKCS10_Request(req);
173 }
CRL_SIGN
Definition: ffi.h:934
Botan::PEM_Code::encode
std::string encode(const uint8_t der[], size_t length, const std::string &label, size_t width)
Definition: pem.cpp:43
KEY_CERT_SIGN
Definition: ffi.h:933
Botan::PKCS8::BER_encode
secure_vector< uint8_t > BER_encode(const Private_Key &key)
Definition: pkcs8.cpp:130
Botan::verify_cert_constraints_valid_for_key_type
void verify_cert_constraints_valid_for_key_type(const Public_Key &pub_key, Key_Constraints constraints)
Definition: key_constraint.cpp:69
NO_CONSTRAINTS
Definition: ffi.h:927
Botan::SEQUENCE
Definition: asn1_obj.h:39
Botan::DIRECTORY_STRING
Definition: asn1_obj.h:55
Botan::choose_sig_format
PK_Signer * choose_sig_format(const Private_Key &key, RandomNumberGenerator &rng, const std::string &hash_fn, AlgorithmIdentifier &sig_algo)
Definition: x509_ca.cpp:228
Botan::PKCS11::Attribute
CK_ATTRIBUTE Attribute
Definition: p11.h:845
Botan::Key_Constraints
Key_Constraints
Definition: key_constraint.h:21

BOTAN_DLL X509_Certificate Botan::X509::create_self_signed_cert | ( | const X509_Cert_Options & | opts,
|  | const Private_Key & | key,
|  | const std::string & | hash_fn,
|  | RandomNumberGenerator & | rng
| ) |  |

Create a self-signed X.509 certificate.

Parameters

  opts | the options defining the certificate to create
  key | the private key used for signing, i.e. the key associated with this self-signed certificate
  hash_fn | the hash function to use
  rng | the rng to use

Returns
  newly created self-signed certificate

Definition at line 44 of file x509self.cpp.

References Botan::Extensions::add(), BER_encode(), Botan::choose_sig_format(), Botan::X509_Cert_Options::constraints, Botan::CRL_SIGN, Botan::X509_Cert_Options::end, Botan::X509_Cert_Options::ex_constraints, Botan::X509_Cert_Options::extensions, Botan::X509_Cert_Options::is_CA, Botan::KEY_CERT_SIGN, Botan::X509_CA::make_cert(), Botan::NO_CONSTRAINTS, Botan::X509_Cert_Options::path_limit, Botan::X509_Cert_Options::start, and Botan::verify_cert_constraints_valid_for_key_type().

48 {
49 AlgorithmIdentifier sig_algo;
50 X509_DN subject_dn;
51 AlternativeName subject_alt;
52
53 std::vector<uint8_t> pub_key = X509::BER_encode(key);
54 std::unique_ptr<PK_Signer> signer(choose_sig_format(key, rng, hash_fn, sig_algo));
55 load_info(opts, subject_dn, subject_alt);
56
57 Key_Constraints constraints;
58 if(opts.is_CA)
59 {
60 constraints = Key_Constraints(KEY_CERT_SIGN | CRL_SIGN);
61 }
62 else
63 {
64 verify_cert_constraints_valid_for_key_type(key, opts.constraints);
65 constraints = opts.constraints;
66 }
67
68 Extensions extensions = opts.extensions;
69
70 extensions.add(
71 new Cert_Extension::Basic_Constraints(opts.is_CA, opts.path_limit),
72 true);
73
74 if(constraints != NO_CONSTRAINTS)
75 {
76 extensions.add(new Cert_Extension::Key_Usage(constraints), true);
77 }
78
79 extensions.add(new Cert_Extension::Subject_Key_ID(pub_key));
80
81 extensions.add(
82 new Cert_Extension::Subject_Alternative_Name(subject_alt));
83
84 extensions.add(
85 new Cert_Extension::Extended_Key_Usage(opts.ex_constraints));
86
87 return X509_CA::make_cert(signer.get(), rng, sig_algo, pub_key,
88 opts.start, opts.end,
89 subject_dn, subject_dn,
90 extensions);
91 }
CRL_SIGN
Definition: ffi.h:934
KEY_CERT_SIGN
Definition: ffi.h:933
Botan::PKCS8::BER_encode
secure_vector< uint8_t > BER_encode(const Private_Key &key)
Definition: pkcs8.cpp:130
Botan::verify_cert_constraints_valid_for_key_type
void verify_cert_constraints_valid_for_key_type(const Public_Key &pub_key, Key_Constraints constraints)
Definition: key_constraint.cpp:69
NO_CONSTRAINTS
Definition: ffi.h:927
Botan::choose_sig_format
PK_Signer * choose_sig_format(const Private_Key &key, RandomNumberGenerator &rng, const std::string &hash_fn, AlgorithmIdentifier &sig_algo)
Definition: x509_ca.cpp:228
Botan::Key_Constraints
Key_Constraints
Definition: key_constraint.h:21

BOTAN_DLL Public_Key * Botan::X509::load_key | ( | DataSource & | source | ) |

Create a public key from a data source.

Parameters

  source | the source providing the DER or PEM encoded key

Returns
  new public key object

Definition at line 37 of file x509_key.cpp.

References Botan::BIT_STRING, Botan::BER_Decoder::decode(), Botan::PEM_Code::decode_check_label(), Botan::BER_Decoder::end_cons(), Botan::load_public_key(), Botan::PEM_Code::matches(), Botan::ASN1::maybe_BER(), Botan::SEQUENCE, Botan::BER_Decoder::start_cons(), and Botan::Exception::what().

Referenced by botan_privkey_export_pubkey(), botan_pubkey_load(), copy_key(), load_key(), Botan::PKCS10_Request::subject_public_key(), and Botan::X509_Certificate::subject_public_key().

38 {
39 try {
40 AlgorithmIdentifier alg_id;
41 std::vector<uint8_t> key_bits;
42
43 if(ASN1::maybe_BER(source) && !PEM_Code::matches(source))
44 {
45 BER_Decoder(source)
46 .start_cons(SEQUENCE)
47 .decode(alg_id)
48 .decode(key_bits, BIT_STRING)
49 .end_cons();
50 }
51 else
52 {
53 DataSource_Memory ber(
54 PEM_Code::decode_check_label(source, "PUBLIC KEY")
55 );
56
57 BER_Decoder(ber)
58 .start_cons(SEQUENCE)
59 .decode(alg_id)
60 .decode(key_bits, BIT_STRING)
61 .end_cons();
62 }
63
64 if(key_bits.empty())
65 throw Decoding_Error("X.509 public key decoding failed");
66
67 return load_public_key(alg_id, key_bits).release();
68 }
69 catch(Decoding_Error& e)
70 {
71 throw Decoding_Error("X.509 public key decoding failed: " + std::string(e.what()));
72 }
73 }
Botan::ASN1::maybe_BER
bool maybe_BER(DataSource &source)
Definition: asn1_obj.cpp:55
Botan::load_public_key
std::unique_ptr< Public_Key > load_public_key(const AlgorithmIdentifier &alg_id, const std::vector< uint8_t > &key_bits)
Definition: pk_algs.cpp:62
Botan::SEQUENCE
Definition: asn1_obj.h:39
Botan::PEM_Code::matches
bool matches(DataSource &source, const std::string &extra, size_t search_range)
Definition: pem.cpp:140
Botan::PEM_Code::decode_check_label
secure_vector< uint8_t > decode_check_label(DataSource &source, const std::string &label_want)
Definition: pem.cpp:54
Botan::BIT_STRING
Definition: asn1_obj.h:34

BOTAN_DLL Public_Key * Botan::X509::load_key | ( | const std::vector< uint8_t > & | enc | ) |

Create a public key from a memory region.

Parameters

  enc | the memory region containing the DER or PEM encoded key

Returns
  new public key object

Definition at line 89 of file x509_key.cpp.

References load_key().

90 {
91 DataSource_Memory source(mem);
92 return X509::load_key(source);
93 }
Botan::X509::load_key
Public_Key * load_key(const std::vector< uint8_t > &mem)
Definition: x509_key.cpp:89

BOTAN_DLL std::string Botan::X509::PEM_encode | ( | const Public_Key & | key | ) |

PEM encode a public key into a string.

Parameters

  key | the key to encode

Returns
  PEM encoded key

Definition at line 28 of file x509_key.cpp.

References Botan::PEM_Code::encode(), and Botan::Public_Key::subject_public_key().

Referenced by botan_pubkey_export(), copy_key(), and Botan::X509_Certificate::to_string().

29 {
30 return PEM_Code::encode(key.subject_public_key(),
31 "PUBLIC KEY");
32 }
Botan::PEM_Code::encode
std::string encode(const uint8_t der[], size_t length, const std::string &label, size_t width)
Definition: pem.cpp:43