All Packages  Class Hierarchy  This Package  Previous  Next  Index

Class semper.certificate.CertificateMan

java.lang.Object
   |
   +----semper.certificate.CertificateMan

public class CertificateMan

extends Object

implements ComPointConstants

_certificateMenu

CertificateMan()

buildPrefs()

This method builds the preferences needed by the certificate block.

checkCertificate(Certificate)

Check whether the Certificate is ok.

chooseCertificates(CertificateContext, CertificateContext, SituationDescription, ComPoint, Vector)

Method answering request from peer for selecting pseudonym and certificates in transaction.

chooseCertificates(CertificateContext, CertificateContext, SituationDescription, Vector)

Method answering request from peer for selecting pseudonym and certificates in transaction.

chooseMyCertificates(CertificateContext, SituationDescription, Vector)

Method for choosing certificates for myself in the non-interactive negotiation.

choosePeerCertificates(CertificateContext, SituationDescription, Vector)

Method for choosing certificates for peer in the non-interactive negotiation.

computeFingerprint(CryptoKeyInfo, HashingAlgorithm)

Computes a fingerprint of a public key.

defaultCAHost()

Returns default CAHost.

defaultCAName()

Returns default CA name.

ensureInit()

This method ensures that the static variables are initialised correctly.

fillOutTemplate(Template, String, CryptoKeyInfo)

Fill out the template.

getAcceptPolicy()

Method for getting the AcceptPolicy of the user

getCAInformation()

Method for listing information in a String about the currently added CAs

getCertificate(Certificate, boolean)

Retrieve the certificate(s) which are like the certificate given as an argument.

getCertificate(CertificateId)

Get a certificate matching a given certId

getCertificateRequest(ComPointAddress, Vector, long, Certificate)

After registration I can get certificates from a CA that accepts my registration.

getIdentityBag()

Method for getting the Identity Bag of the user

getInitialisedModules()

Method for getting the initialised modules

getLocalCertificates(Certificate)

getLocalCertificates retrieves a selection of local certificates (from the local archive).

getPeerBag()

Method for getting the Peer Bag of the user

getTD()

Method for getting the TrustDomain of the user

getTrustedPK(ComPointAddress, String, String, Vector)

Get the trusted public Key of the CA.

hexFilter(byte[])

Helper functions

init()

Initialises the Certification Manager.

initialiseModule(String, String)

Initialise module.

installRegistration(Template)

Store registration form in Archive under special access name.

isInitialised()

Tells whether CertificateMan is initialised.

registerModule(String)

Register new module with the manager.

removeCertificate(Certificate)

Remove the given users Certificate from Archive and from the list of identities of the user .

removeReceivedCertificate(Certificate)

Remove the given users Certificate from Archive and from the list of identities of the user .

requestChoice(CertificateContext, CertificateContext, SituationDescription, ComPoint, Vector)

Method requesting certificates from the peer choosing own certificates matching as requested from the peer.

requestChoice(CertificateContext, CertificateContext, SituationDescription, String, Vector)

Method requesting certificates from the peer choosing own certificates matching as requested from the peer.

retrieveCertificate(Object, TypeField, boolean)

Retrieve a list of certificates.

retrieveCertificate(String, Object, TypeField, boolean)

Retrieve a list of certificates.

retrieveRegistration(String, long)

Retrieve registration form from Archive under.

retrieveTrustedPK(String, String)

Retrieve the installed trusted public Key of the CA.

sendFilledTemplate(ComPointAddress, Vector, Template, CryptoKeyInfo)

Send the filled-out template, returned by fillinTemplate.

sendTemplateRequest(String, String, ComPointAddress, Vector)

Send the initial request during the Registration phase to the server indicating to server that I want a registration Template for the RA (which currently is co-located at CA).

setAcceptPolicy(AcceptPolicy)

Method for setting the AcceptPolicy

setTD(TrustDomain)

Method for setting the TrustDomain of the user

showFingerprint(String, String, CryptoKeyInfo, HashingAlgorithm)

Shows a fingerprint of a public key on the TINGUIN.

showFingerprint(String, String, HashingAlgorithm)

Shows a fingerprint of the public key of a CA on the TINGUIN.

storeCertificate(Certificate)

Store certificate in Archive.

storeReceivedCertificate(Certificate)

Store certificate in Archive.

unRegisterModule(String, String)

Undoes registration of module.

 public static ApplicationsMenu _certificateMenu

 public CertificateMan()

 public static boolean isInitialised()

Tells whether CertificateMan is initialised. The CertificateMan is initialised when CertificateMan.init() has been sucessfully executed.

Returns:

true if CertificateMan.init() has been executed, false otherwise.

 public static String defaultCAHost()

Returns default CAHost. First tries to read if from configuration and if this gives no result "blankenbach.darmstadt.gmd.de" is returned.

Returns:

default CAHost

 public static String defaultCAName()

Returns default CA name. First tries to read if from configuration and if this gives no result "GMD_SemperCA" is returned.

Returns:

name of default CA

 public static void buildPrefs()

This method builds the preferences needed by the certificate block. Currently three actions are supported. The user can see a list of registered modules, decide when a certificate should be verified onlien and an interface for adding a CA is provided.

 public static void init() throws CertificateManException, RuntimeException

Initialises the Certification Manager. The initialisation reads two settings from the configuration. First it reads "semper.certificate.isServer" to determine if CA-functinality is required, where "0" means no, "1" means "yes" (if this is not set, it is interpreted as "0". Next the user name is set by reading "semper.configuration.username". If this is not present, the user name is read from the system.

Throws: CertificateManException

if a requested module could not be loaded or initialised

 public static void ensureInit()

This method ensures that the static variables are initialised correctly. Should be called just after init.

 public static void registerModule(String name) throws CertificateManException

Register new module with the manager. If the module is already registered nothing happens.

Parameters:

name - is the name of the module to be registered

Throws: CertificateManException

if the module is not installed

 public static void unRegisterModule(String moduleName,
                                     String caName)

Undoes registration of module.

Parameters:

moduleName - is the name of the module to be unregistered.

caName - is the name of the CA.

 public static String getCAInformation()

Method for listing information in a String about the currently added CAs

Returns:

the registered information is added to doc

 public static void initialiseModule(String modName,
                                     String caName) throws CertificateManException

Initialise module. Makes instances of the named module and provides adds a link to the object implementing RCModuleInterface to the table of initialised modules.

Parameters:

modName - is the name of the module (the module must be implemented in classes moduleName+RCModule/Certificate/Registration/Template.

caName - is the name of the CA for which the module should be initialised.

Throws: CertificateManException

if the initialisation fails.

 public static CryptoKeyInfo getTrustedPK(ComPointAddress srvAddr,
                                          String module,
                                          String caName,
                                          Vector options) throws CertificateManException

Get the trusted public Key of the CA. This call results in the CA sending the public key using sendTrustedPK. The parameter must contain the name of the CA as the host name.

Parameters:

srvAddr: - ComPointAddress of the CA-server.

module - is the name of the module

caName - is the name of the CA

options - can be used to give options to be used in communication

Returns:

s trustedPK: CA's public key. If the key could not be retrieved null is returned.

Throws: CertificateException

if the module could not get the key

Throws: ModuleNotFoundException

if no module mathcing the input parameters coud be found. get the key from CA.

 public static String computeFingerprint(CryptoKeyInfo trustedPK,
                                         HashingAlgorithm hashAlg) throws CertificateManException

Computes a fingerprint of a public key. The fingerprint is the hashvalue computed using the given hashfunction and cnverted to a hexadecimal String.

Parameters:

trustedPK - is the public key for which a fingerpring should be computed

hashAlg - is ths hashing algorithm to be used for generating the fingerprint. If 0 the default function for the CA is used.

Returns:

true if the user accepted the fingerprint of the key

Throws: CertificateManException

if, for some reason, the fingerprint could not be displayed

 public static boolean showFingerprint(String module,
                                       String caDN,
                                       CryptoKeyInfo trustedPK,
                                       HashingAlgorithm hashAlg) throws CertificateManException

Shows a fingerprint of a public key on the TINGUIN. This function allows the user to compare his local copy of the trusted public key with other published copies (e.g., with copies shown at the CA's home page). The fingerprint is computed using computeFingerprint. If no key is given as parameter and no key has been installed for the CA this method shows a message with no fingerpring on the TINGUIN (this may be changed later)

Parameters:

module - is the name of the module for which the key should be used

caDN - is the distinguished name of the CA

trustedPK - is the public key for which a fingerpring should be shown (if this is null a fingerprint of the installed public key of the CA will be shown)

hashAlg - is ths hashing algorithm to be used for generating the fingerprint. If 0 the default function for the CA is used.

Returns:

true if the user accepted the fingerprint of the key

Throws: CertificateManException

if, for some reason, the fingerprint could not be displayed

See Also:

computeFingerprint

 public static boolean showFingerprint(String moduleName,
                                       String caDN,
                                       HashingAlgorithm hashAlg) throws CertificateManException

Shows a fingerprint of the public key of a CA on the TINGUIN. This function allows the user to compare his local copy of the trusted public key with other published copies (e.g., with copies shown at the CA's home page). The fingerprint is computed using computeFingerprint. If no public key for the CA has been installed an empty string will be depicted as fingerprint.

Parameters:

moduleName - is the name of the module

caName - is the name of the CA

hashAlg - is the hashing algorithm to be used for generating the fingerprint. If 0 the default function for the CA is used.

Returns:

true if the user accepted the fingerprint of the key

Throws: CertificateManException

if, for some reason, the fingerprint could not be displayed

See Also:

computeFingerprint

 public static CryptoKeyInfo retrieveTrustedPK(String moduleName,
                                               String caName) throws CertificateManException

Retrieve the installed trusted public Key of the CA.

Parameters:

moduleName - is the name of the module

caName: - Distinguished name of CA.

Returns:

s CryptoKeyInfo pkey, which represents the CA's public Key.

Throws: CertificateManException

if the pkey of that CA hasn't been installed before (via installTrustedPK).

 public static Template sendTemplateRequest(String module,
                                            String caName,
                                            ComPointAddress serverAddress,
                                            Vector options) throws CertificateManException

Send the initial request during the Registration phase to the server indicating to server that I want a registration Template for the RA (which currently is co-located at CA). The RA/CA answers this using sendTemplate. The Template (or registration form) received from the CA contains a serial number, which is later used in registration and certificates.

Parameters:

module - is the name of the module

caName - is the name of the CA

serverAddress - is the ComPointAddress of the RA-server at which I want to be registrated.

options: - option-Vector used in openInitiatorChannel.

Returns:

s ComPoint from which to receive the Template via getTemplate().

Throws: ModuleNotFoundException

if the manager hasn't initialised the named module.

Throws: CertificateException

if there was an error in module

 public static void fillOutTemplate(Template templ,
                                    String doc,
                                    CryptoKeyInfo pkey) throws CertificateManException

Fill out the template. This method allows a user to fill out the information requested during registration through the TINGUIN.

Parameters:

templ - is the Template to be filled out

doc - contains a description defined by the RA of the registration form

pkey - The public Key, that should be used in the Registration and later on in the certificate.

Returns:

s filled-in template.

Throws: CertificateManException

if the user did not fill out the template

 public static boolean sendFilledTemplate(ComPointAddress srvAddr,
                                          Vector options,
                                          Template templ,
                                          CryptoKeyInfo secrKey) throws CertificateManException

Send the filled-out template, returned by fillinTemplate. As part of this the client must send a signature using the secret key corresponding to the public key to be registered. Based on the information the RA sends back a designated name to the user. The user must use this in future communications with the CA. The client also uses this DN when storing the template in Archive.

Parameters:

srvAddr: - ComPointAddress of the RA-server.

options: - Vector of options to be used in openInitiatorChannel.

Template: - Filled-in Template returned by fillinTemplate.

secrKey: - Secret Key belonging to the Public key sent in the Certificate. This is used to create a Signature of the Template.

Returns:

s Boolean indicating whether server received Template or not.

Throws: CertificateManException

if an error happened in the communication.

See Also:

getFilledTemplate

 public static void installRegistration(Template templ) throws CertificateManException

Store registration form in Archive under special access name. This service has to be called in order to be able to retrieve the filled out template later.

Parameters:

reg: - the filled out template that shall be installed.

Throws: CertificateManException

if the Archive can't process the request.

See Also:

retrieveRegistration

 public static Template retrieveRegistration(String caName,
                                             long serialNo) throws CertificateManException

Retrieve registration form from Archive under. This service can be used to retrieve registration forms previously stored using installRegistration.

Returns:

the filled out template that shall be installed.

Throws: CertificateManException

if the Archive can't process the request.

See Also:

installRegistration

 public static RegistrationStatus getCertificateRequest(ComPointAddress caAddr,
                                                        Vector options,
                                                        long serialNo,
                                                        Certificate certificate) throws CertificateManException

After registration I can get certificates from a CA that accepts my registration. This services can be used to get a certificate from a CA (either my own or that another party). If the certificate is not issued a status message is returned. The received certificate is stored locally.

Parameters:

caAddress: - ComPointAddress of the CA-server.

options - my contain additional options for the module

serialNo - of the certificate

certificate - contains the certificate returned from the CA (may be null)

Returns:

A message object giving the status of the registration

Throws: ModuleNotFoundException

if the module could not be found

Throws: CertificateManException

if an error happened during the communication.

 public static void storeCertificate(Certificate cert) throws CertificateManException

Store certificate in Archive. Stores the users own certificates in the Archive and adds it to the bag of identities for the user..

Parameters:

cert: - Certificate to be stored.

Throws: CertificateManException

if store fails.

 public static void storeReceivedCertificate(Certificate cert) throws CertificateManException

Store certificate in Archive. Stores received certificates in the Archive and adds it to the bag of received identities.

Parameters:

cert: - Certificate to be stored (if null, nothing is done).

Throws: CertificateManException

if store fails.

 public static void removeCertificate(Certificate cert) throws CertificateManException

Remove the given users Certificate from Archive and from the list of identities of the user .

Parameters:

the - installed certificate.

Throws: CertificateManException

if an error happened while trying to remove the Certificate.

 public static void removeReceivedCertificate(Certificate cert) throws CertificateManException

Remove the given users Certificate from Archive and from the list of identities of the user .

Parameters:

the - installed certificate.

Throws: CertificateManException

if an error happened while trying to remove the Certificate.

 public static Vector getLocalCertificates(Certificate partialCert)

getLocalCertificates retrieves a selection of local certificates (from the local archive). A partial Certificate, containing null or 0 for un identified fields and correct values for the other fields is used as search criteria.

Parameters:

partialCert - is the Certificate containing search criteria.

Returns:

s a Vector of certificates from the archive matching the search criteria.

 public static Vector getCertificate(Certificate partialCert,
                                     boolean localOnly) throws CertificateManException

Retrieve the certificate(s) which are like the certificate given as an argument. In this certificate all fields which I know something about should be set via cert.setUserDN(), cert.setSerialNo() etc. An example hereof can be found in Test/TClient.java (at the bottom of this file). If no CA name is given all CAs initialised for the particular module are tried.

Parameters:

partialCert: - Certificate generated from an empty Certificate, and only with the fields set, which I know something about.

Returns:

s Vector of all the Certificates matching this partial certificate.

Throws: CertificateManException

if an error happened during the communication.

 public static Vector retrieveCertificate(Object partID,
                                          TypeField type,
                                          boolean localOnly) throws CertificateManException

Retrieve a list of certificates. This is supposed to be a more user-friendly version of getCertificates. In order to use it, one must specify a (partial) string defining one of the String-components of a certificate. All registered modules are tried (if a CA name is given as parameter, only modules initialised for that CA, though). The format is: String[*], ie either "thomasj" or "thomasj*" are for instance acceptable strings. The first one will look for a specific String, whereas the second one will look for Strings starting with "thomasj". The second parameter determines which field to set (only one field can be set with this option). the possible fields are: CertificateConstants.CADN_FIELD (ca's name) CertificateConstants.USERDN_FIELD (users name) CertificateConstants.KEYID_FIELD (keyID of the public key)

Parameters:

partID - Object identifying certificate (A string if a CADN or USERDN is given. If a KEYID is given this is an AccessName.

type - fieldtype as shown above.

localOnly - search local certificates only (in Archive).

Returns:

s a vector of certificates matching the (partial) String.

Throws: CertificateManException

if an error happens during the communication or if the Type Field was wrong.

 public static Vector retrieveCertificate(String moduleName,
                                          Object partID,
                                          TypeField type,
                                          boolean localOnly) throws CertificateManException

Retrieve a list of certificates. This is supposed to be a more user-friendly version of getCertificates. In order to use it, one must specify a (partial) string defining one of the String-components of a certificate. The format is: String[*], ie either "thomasj" or "thomasj*" are for instance acceptable strings. The first one will look for a specific String, whereas the second one will look for Strings starting with "thomasj". The second parameter determines which field to set (only one field can be set with this option). the possible fields are: CertificateConstants.CADN_FIELD (ca's name) CertificateConstants.USERDN_FIELD (users name) CertificateConstants.KEYID_FIELD (keyID of the public key)

Parameters:

moduleName - is the name of the module to be tried (if null all registered modules are tried)

partID - Object identifying certificate (A string if a CADN or USERDN is given. If a KEYID is given this is an AccessName.

type - fieldtype as shown above.

localOnly - search local certificates only (in Archive).

Returns:

s a vector of certificates matching the (partial) String.

Throws: CertificateManException

if an error happens during the communication or if the Type Field was wrong.

 public static Certificate getCertificate(CertificateId certId)

Get a certificate matching a given certId

Parameters:

certId - identifies the certificate

Returns:

certificate matching certId (null if none are found)

 public static boolean checkCertificate(Certificate cert) throws CertificateManException

Check whether the Certificate is ok. Later versions will use the preferences to decide whether the CA should be asked during verification. This checks, whether: a) Signature is ok. b) UserDN is ok. c) CADN is ok. d) serialNr is ok. e) scope is ok. f) notValidBefore date is ok. g) notValidAfter date is ok. h) status is ok.

Parameters:

Certificate - cert, that the CA sent.

Returns:

s true if ok, otherwise throws a CertificateManException.

Throws: CertificateManException

if an error happened during the communication.

 public static void requestChoice(CertificateContext myContext,
                                  CertificateContext yourContext,
                                  SituationDescription situation,
                                  String yourAddress,
                                  Vector options) throws CertificateManException

Method requesting certificates from the peer choosing own certificates matching as requested from the peer.

Parameters:

myContext - must specify which types of certificates are needed from myself. After negotiation the chosen certificates are returned in the context.

yourContext - must specify which types of certificates are needed from you. After negotiation the chosen certificates are returned in the context.

yourAddress - contains your address.

options - is a placeholder which can be used to specify options for the negotiation. In the present version just use null.

Throws: CertificateManException

if the negotiation does not provide the required certificates

See Also:

chooseCertificates

 public static void chooseCertificates(CertificateContext myContext,
                                       CertificateContext yourContext,
                                       SituationDescription situation,
                                       Vector options) throws CertificateManException

Method answering request from peer for selecting pseudonym and certificates in transaction. It uses the port registered for the Certificate manager.

Parameters:

myContext - must specify which types of certificates are needed from myself. After negotiation the chosen certificates are returned in the context.

yourContext - must specify which types of certificates are needed from you. After negotiation the chosen certificates are returned in the context.

options - is a placeholder which can be used to specify options for the negotiation. In the present version just use null.

Throws: CertificateManException

if the negotiation does not provide the required certificates

See Also:

requestChoice

 public static void requestChoice(CertificateContext myContext,
                                  CertificateContext yourContext,
                                  SituationDescription situation,
                                  ComPoint cp,
                                  Vector options) throws CertificateManException

Method requesting certificates from the peer choosing own certificates matching as requested from the peer. If the policy in a context is null no restrictions are put on the selection of certificates. myContext describes which certificates are required as well as possible requirements on my own name and the name of the peer. Similarly, your context contains possible restrictions on the name of the peer and the name of the BA. If these requirements do not fit those of the peer negotiation of certificates fails.

Parameters:

myContext - must specify which types of certificates are needed from myself. After negotiation the chosen certificates are returned in the context.

yourContext - must specify which types of certificates are needed from you. After negotiation the chosen certificates are returned in the context.

cp - is the ComPoint to be used for communication with peer

options - is a placeholder which can be used to specify options for the negotiation. In the present version just use null.

Throws: CertificateManException

if the negotiation does not provide the required certificates

See Also:

chooseCertificates

 public static void chooseCertificates(CertificateContext myContext,
                                       CertificateContext yourContext,
                                       SituationDescription situation,
                                       ComPoint cp,
                                       Vector options) throws CertificateManException

Method answering request from peer for selecting pseudonym and certificates in transaction. myContext describes which certificates are required as well as possible requirements on my own name and the name of the peer. Similarly, your context contains possible restrictions on the name of the peer and the name of the BA. If these requirements do not fit those of the peer negotiation of certificates fails.

Parameters:

myContext - must specify which types of certificates are needed from myself. After negotiation the chosen certificates are returned in the context.

yourContext - must specify which types of certificates are needed from you. After negotiation the chosen certificates are returned in the context.

cp - is the ComPoint to use

options - is a placeholder which can be used to specify options for the negotiation. In the present version just use null.

Throws: CertificateManException

if the negotiation does not provide the required certificates

See Also:

requestChoice

 public static void chooseMyCertificates(CertificateContext myContext,
                                         SituationDescription situation,
                                         Vector options) throws CertificateManException

Method for choosing certificates for myself in the non-interactive negotiation. myContext describes which certificates are required as well as possible requirements. If these requirements are not satisfied, or satisfied partly the status of myContext is properly set.

Parameters:

myContext - must specify which types of certificates are needed from myself. After negotiation the chosen certificates are returned in the context.

situation - specifies the pseudonym, as well as the policy the certificate should have.

options - is a placeholder which can be used to specify options for the negotiation. In the present version just use null.

Throws: CertificateManException

if the negotiation does not provide the required certificates

 public static void choosePeerCertificates(CertificateContext yourContext,
                                           SituationDescription situation,
                                           Vector options) throws CertificateManException

Method for choosing certificates for peer in the non-interactive negotiation. yourContext describes which certificates are required as well as possible requirements. If these requirements are not satisfied, or satisfied partly the status of yourContext is properly set.

Parameters:

yourContext - must specify which types of certificates are needed for peer. After negotiation the chosen certificates are returned in the context.

situation - specifies the pseudonym, as well as the policy the received certificate should have.

options - is a placeholder which can be used to specify options for the negotiation. In the present version just use null.

Throws: CertificateManException

if the negotiation does not provide the required certificates

 public static CertBag getIdentityBag()

Method for getting the Identity Bag of the user

 public static CertBag getPeerBag()

Method for getting the Peer Bag of the user

 public static TrustDomain getTD()

Method for getting the TrustDomain of the user

 public static AcceptPolicy getAcceptPolicy()

Method for getting the AcceptPolicy of the user

 public static ModuleInformation getInitialisedModules()

Method for getting the initialised modules

 public static void setAcceptPolicy(AcceptPolicy acceptPolicy)

Method for setting the AcceptPolicy

 public static void setTD(TrustDomain trustDomain)

Method for setting the TrustDomain of the user

 public static String hexFilter(byte bytes[])

Helper functions

All Packages  Class Hierarchy  This Package  Previous  Next  Index