java.lang.Object
net.i2p.data.DataStructureImpl
net.i2p.data.KeysAndCert
net.i2p.data.Destination
net.i2p.data.VerifiedDestination
- All Implemented Interfaces:
Serializable, DataStructure
Extend Destination with methods to verify its Certificate. The router does not check Certificates, it doesn't care. Apps however (particularly addressbook) may wish to enforce various cert content, format, and policies. This class is written such that apps may extend it to create their own policies.
- See Also:
Field Summary
FieldsModifier and TypeFieldDescriptionstatic final intDefaults for Signed Certs.static final intLength of a signed certificate including the signer hash.Fields inherited from class KeysAndCert
_certificate, _paddingBlocks, _publicKey, _signingKeyModifier and TypeFieldDescriptionprotected CertificateCertificate specifying key types and metadata.protected intIf compressed, the padding size / 32, else 0.protected PublicKeyPublic encryption key.protected SigningPublicKeyPublic signing key.Constructor Summary
ConstructorsConstructorDescriptionCreates a new VerifiedDestination with default values.Alternative constructor which takes a base64 string representation.Create from an existing Dest.Method Summary
Public MethodsModifier and TypeMethodDescriptiontoString()Returns a string representation including verification status.booleanverifyCert(boolean allowNone) Verify the certificate.protected booleanSigned Certs are signed by a 3rd-party Destination.protected booleanReject all unknown certs.Methods inherited from class Destination
clearCache, create, equals, hashCode, size, toBase32, toBase64, writeBytesModifier and TypeMethodDescriptionstatic voidClear the cache.static Destinationcreate(InputStream in) Pull from cache or return new.booleanCompares this Destination for equality with another object.inthashCode()Hash code of this destination.intsize()Serialized size of this destination.toBase32()For convenience.toBase64()Cache it.intwriteBytes(byte[] target, int offset) Deprecated, used only by Packet.java in streaming.Methods inherited from class KeysAndCert
calculateHash, combinePadding, getCertificate, getEncType, getHash, getPadding, getPublicKey, getSigningPublicKey, getSigType, isCompressible, readBytes, setCertificate, setPadding, setPublicKey, setSigningPublicKey, writeBytes, writePaddingBytesModifier and TypeMethodDescriptionThrows IllegalStateException if keys and cert are not initialized, as of 0.9.12.protected static byte[]combinePadding(byte[] pad1, byte[] pad2) Combines two padding arrays.Certificate for this identity.Encryption type from the certificate.getHash()Throws IllegalStateException if keys and cert are not initialized, as of 0.9.12.byte[]Padding bytes for key alignment.Valid for RouterIdentities.Signing public key for this identity.Signature type from the certificate.booleanIs there compressible padding?voidreadBytes(InputStream in) Reads the keys and certificate from an input stream.voidsetCertificate(Certificate cert) Certificate to set.voidsetPadding(byte[] padding) Padding bytes to set.voidsetPublicKey(PublicKey key) Public key to set.voidSigning public key to set.voidwriteBytes(OutputStream out) Writes the keys and certificate to an output stream.protected intwritePaddingBytes(byte[] target, int off) ForDestination.writeBytes().Methods inherited from class DataStructureImpl
fromBase64, fromByteArray, read, toByteArrayModifier and TypeMethodDescriptionvoidfromBase64(String data) Load the structure from the provided base64 string.voidfromByteArray(byte[] data) Loads structure from the data providedprotected intread(InputStream in, byte[] target) Repeated reads until buffer is full or IOException is thrown.byte[]Convert the structure to a byte array.
Field Details
CERTIFICATE_LENGTH_SIGNED
public static final int CERTIFICATE_LENGTH_SIGNEDDefaults for Signed Certs.CERTIFICATE_LENGTH_SIGNED_WITH_HASH
public static final int CERTIFICATE_LENGTH_SIGNED_WITH_HASHLength of a signed certificate including the signer hash.
Constructor Details
VerifiedDestination
public VerifiedDestination()Creates a new VerifiedDestination with default values.VerifiedDestination
Alternative constructor which takes a base64 string representation.- Parameters:
s- a Base64 representation of the destination, as (eg) is used in hosts.txt- Throws:
DataFormatException- if the string does not decode to a full-length destination
VerifiedDestination
Create from an existing Dest.- Parameters:
d- must be non-null- Throws:
DataFormatException- if the source destination's base64 form cannot be parsed
Method Details
verifyCert
public boolean verifyCert(boolean allowNone) Verify the certificate.- Parameters:
allowNone- If true, allow a NULL or HIDDEN certificate.- Returns:
- true if the certificate is valid
verifySignedCert
protected boolean verifySignedCert()Signed Certs are signed by a 3rd-party Destination. They can be used for a second-level domain, for example, to sign the Destination for a third-level domain. Or for a central authority to approve a destination.We define a Signed Certificate as follows: - length: Either 44 or 72 bytes - contents: 1: a 44 byte Signature 2 (optional): a 32 byte Hash of the signing Destination This can be a hint to the verification process to help find the identity and keys of the signing Destination. Data which is signed: The first 384 bytes of the Destination (i.e. the Public Key and Signing Public Key, WITHOUT the Certificate)
It is not appropriate to enforce a particular delegation scheme here. The application will need to apply additional steps to select an appropriate signing Destination and verify the signature.
See
PrivateKeyFile.verifySignature(Destination)for sample verification code.- Returns:
- true if the signed certificate payload length is valid
verifyUnknownCert
protected boolean verifyUnknownCert()Reject all unknown certs.- Returns:
- false always
toString
Returns a string representation including verification status.- Overrides:
toStringin classKeysAndCert