001: package org.bouncycastle.tsp.test;
002:
003: import java.math.BigInteger;
004: import java.security.KeyPair;
005: import java.security.PrivateKey;
006: import java.security.cert.CertStore;
007: import java.security.cert.CollectionCertStoreParameters;
008: import java.security.cert.X509Certificate;
009: import java.util.ArrayList;
010: import java.util.Collection;
011: import java.util.Date;
012: import java.util.HashSet;
013: import java.util.List;
014:
015: import junit.framework.TestCase;
016:
017: import org.bouncycastle.asn1.cmp.PKIFailureInfo;
018: import org.bouncycastle.asn1.cms.AttributeTable;
019: import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
020: import org.bouncycastle.tsp.GenTimeAccuracy;
021: import org.bouncycastle.tsp.TSPAlgorithms;
022: import org.bouncycastle.tsp.TSPValidationException;
023: import org.bouncycastle.tsp.TimeStampRequest;
024: import org.bouncycastle.tsp.TimeStampRequestGenerator;
025: import org.bouncycastle.tsp.TimeStampResponse;
026: import org.bouncycastle.tsp.TimeStampResponseGenerator;
027: import org.bouncycastle.tsp.TimeStampToken;
028: import org.bouncycastle.tsp.TimeStampTokenGenerator;
029: import org.bouncycastle.tsp.TimeStampTokenInfo;
030: import org.bouncycastle.util.Arrays;
031:
032: public class TSPTest extends TestCase {
033: public void testGeneral() throws Exception {
034: String signDN = "O=Bouncy Castle, C=AU";
035: KeyPair signKP = TSPTestUtil.makeKeyPair();
036: X509Certificate signCert = TSPTestUtil.makeCACertificate(
037: signKP, signDN, signKP, signDN);
038:
039: String origDN = "CN=Eric H. Echidna, E=eric@bouncycastle.org, O=Bouncy Castle, C=AU";
040: KeyPair origKP = TSPTestUtil.makeKeyPair();
041: X509Certificate origCert = TSPTestUtil.makeCertificate(origKP,
042: origDN, signKP, signDN);
043:
044: List certList = new ArrayList();
045: certList.add(origCert);
046: certList.add(signCert);
047:
048: CertStore certs = CertStore.getInstance("Collection",
049: new CollectionCertStoreParameters(certList), "BC");
050:
051: basicTest(origKP.getPrivate(), origCert, certs);
052: responseValidationTest(origKP.getPrivate(), origCert, certs);
053: incorrectHashTest(origKP.getPrivate(), origCert, certs);
054: badAlgorithmTest(origKP.getPrivate(), origCert, certs);
055: badPolicyTest(origKP.getPrivate(), origCert, certs);
056: tokenEncodingTest(origKP.getPrivate(), origCert, certs);
057: certReqTest(origKP.getPrivate(), origCert, certs);
058: testAccuracyZeroCerts(origKP.getPrivate(), origCert, certs);
059: testAccuracyWithCertsAndOrdering(origKP.getPrivate(), origCert,
060: certs);
061: testNoNonse(origKP.getPrivate(), origCert, certs);
062: }
063:
064: private void basicTest(PrivateKey privateKey, X509Certificate cert,
065: CertStore certs) throws Exception {
066: TimeStampTokenGenerator tsTokenGen = new TimeStampTokenGenerator(
067: privateKey, cert, TSPAlgorithms.SHA1, "1.2");
068:
069: tsTokenGen.setCertificatesAndCRLs(certs);
070:
071: TimeStampRequestGenerator reqGen = new TimeStampRequestGenerator();
072: TimeStampRequest request = reqGen.generate(TSPAlgorithms.SHA1,
073: new byte[20], BigInteger.valueOf(100));
074:
075: TimeStampResponseGenerator tsRespGen = new TimeStampResponseGenerator(
076: tsTokenGen, TSPAlgorithms.ALLOWED);
077:
078: TimeStampResponse tsResp = tsRespGen.generate(request,
079: new BigInteger("23"), new Date(), "BC");
080:
081: tsResp = new TimeStampResponse(tsResp.getEncoded());
082:
083: TimeStampToken tsToken = tsResp.getTimeStampToken();
084:
085: tsToken.validate(cert, "BC");
086:
087: AttributeTable table = tsToken.getSignedAttributes();
088:
089: assertNotNull("no signingCertificate attribute found", table
090: .get(PKCSObjectIdentifiers.id_aa_signingCertificate));
091: }
092:
093: private void responseValidationTest(PrivateKey privateKey,
094: X509Certificate cert, CertStore certs) throws Exception {
095: TimeStampTokenGenerator tsTokenGen = new TimeStampTokenGenerator(
096: privateKey, cert, TSPAlgorithms.MD5, "1.2");
097:
098: tsTokenGen.setCertificatesAndCRLs(certs);
099:
100: TimeStampRequestGenerator reqGen = new TimeStampRequestGenerator();
101: TimeStampRequest request = reqGen.generate(TSPAlgorithms.SHA1,
102: new byte[20], BigInteger.valueOf(100));
103:
104: TimeStampResponseGenerator tsRespGen = new TimeStampResponseGenerator(
105: tsTokenGen, TSPAlgorithms.ALLOWED);
106:
107: TimeStampResponse tsResp = tsRespGen.generate(request,
108: new BigInteger("23"), new Date(), "BC");
109:
110: tsResp = new TimeStampResponse(tsResp.getEncoded());
111:
112: TimeStampToken tsToken = tsResp.getTimeStampToken();
113:
114: tsToken.validate(cert, "BC");
115:
116: //
117: // check validation
118: //
119: tsResp.validate(request);
120:
121: try {
122: request = reqGen.generate(TSPAlgorithms.SHA1, new byte[20],
123: BigInteger.valueOf(101));
124:
125: tsResp.validate(request);
126:
127: fail("response validation failed on invalid nonce.");
128: } catch (TSPValidationException e) {
129: // ignore
130: }
131:
132: try {
133: request = reqGen.generate(TSPAlgorithms.SHA1, new byte[22],
134: BigInteger.valueOf(100));
135:
136: tsResp.validate(request);
137:
138: fail("response validation failed on wrong digest.");
139: } catch (TSPValidationException e) {
140: // ignore
141: }
142:
143: try {
144: request = reqGen.generate(TSPAlgorithms.MD5, new byte[20],
145: BigInteger.valueOf(100));
146:
147: tsResp.validate(request);
148:
149: fail("response validation failed on wrong digest.");
150: } catch (TSPValidationException e) {
151: // ignore
152: }
153: }
154:
155: private void incorrectHashTest(PrivateKey privateKey,
156: X509Certificate cert, CertStore certs) throws Exception {
157: TimeStampTokenGenerator tsTokenGen = new TimeStampTokenGenerator(
158: privateKey, cert, TSPAlgorithms.SHA1, "1.2");
159:
160: tsTokenGen.setCertificatesAndCRLs(certs);
161:
162: TimeStampRequestGenerator reqGen = new TimeStampRequestGenerator();
163: TimeStampRequest request = reqGen.generate(TSPAlgorithms.SHA1,
164: new byte[16]);
165:
166: TimeStampResponseGenerator tsRespGen = new TimeStampResponseGenerator(
167: tsTokenGen, TSPAlgorithms.ALLOWED);
168:
169: TimeStampResponse tsResp = tsRespGen.generate(request,
170: new BigInteger("23"), new Date(), "BC");
171:
172: tsResp = new TimeStampResponse(tsResp.getEncoded());
173:
174: TimeStampToken tsToken = tsResp.getTimeStampToken();
175:
176: if (tsToken != null) {
177: fail("incorrectHash - token not null.");
178: }
179:
180: PKIFailureInfo failInfo = tsResp.getFailInfo();
181:
182: if (failInfo == null) {
183: fail("incorrectHash - failInfo set to null.");
184: }
185:
186: if (failInfo.intValue() != PKIFailureInfo.badDataFormat) {
187: fail("incorrectHash - wrong failure info returned.");
188: }
189: }
190:
191: private void badAlgorithmTest(PrivateKey privateKey,
192: X509Certificate cert, CertStore certs) throws Exception {
193: TimeStampTokenGenerator tsTokenGen = new TimeStampTokenGenerator(
194: privateKey, cert, TSPAlgorithms.SHA1, "1.2");
195:
196: tsTokenGen.setCertificatesAndCRLs(certs);
197:
198: TimeStampRequestGenerator reqGen = new TimeStampRequestGenerator();
199: TimeStampRequest request = reqGen.generate("1.2.3.4.5",
200: new byte[20]);
201:
202: TimeStampResponseGenerator tsRespGen = new TimeStampResponseGenerator(
203: tsTokenGen, TSPAlgorithms.ALLOWED);
204:
205: TimeStampResponse tsResp = tsRespGen.generate(request,
206: new BigInteger("23"), new Date(), "BC");
207:
208: tsResp = new TimeStampResponse(tsResp.getEncoded());
209:
210: TimeStampToken tsToken = tsResp.getTimeStampToken();
211:
212: if (tsToken != null) {
213: fail("badAlgorithm - token not null.");
214: }
215:
216: PKIFailureInfo failInfo = tsResp.getFailInfo();
217:
218: if (failInfo == null) {
219: fail("badAlgorithm - failInfo set to null.");
220: }
221:
222: if (failInfo.intValue() != PKIFailureInfo.badAlg) {
223: fail("badAlgorithm - wrong failure info returned.");
224: }
225: }
226:
227: private void badPolicyTest(PrivateKey privateKey,
228: X509Certificate cert, CertStore certs) throws Exception {
229: TimeStampTokenGenerator tsTokenGen = new TimeStampTokenGenerator(
230: privateKey, cert, TSPAlgorithms.SHA1, "1.2");
231:
232: tsTokenGen.setCertificatesAndCRLs(certs);
233:
234: TimeStampRequestGenerator reqGen = new TimeStampRequestGenerator();
235:
236: reqGen.setReqPolicy("1.1");
237:
238: TimeStampRequest request = reqGen.generate(TSPAlgorithms.SHA1,
239: new byte[20]);
240:
241: TimeStampResponseGenerator tsRespGen = new TimeStampResponseGenerator(
242: tsTokenGen, TSPAlgorithms.ALLOWED, new HashSet());
243:
244: TimeStampResponse tsResp = tsRespGen.generate(request,
245: new BigInteger("23"), new Date(), "BC");
246:
247: tsResp = new TimeStampResponse(tsResp.getEncoded());
248:
249: TimeStampToken tsToken = tsResp.getTimeStampToken();
250:
251: if (tsToken != null) {
252: fail("badPolicy - token not null.");
253: }
254:
255: PKIFailureInfo failInfo = tsResp.getFailInfo();
256:
257: if (failInfo == null) {
258: fail("badPolicy - failInfo set to null.");
259: }
260:
261: if (failInfo.intValue() != PKIFailureInfo.unacceptedPolicy) {
262: fail("badPolicy - wrong failure info returned.");
263: }
264: }
265:
266: private void certReqTest(PrivateKey privateKey,
267: X509Certificate cert, CertStore certs) throws Exception {
268: TimeStampTokenGenerator tsTokenGen = new TimeStampTokenGenerator(
269: privateKey, cert, TSPAlgorithms.MD5, "1.2");
270:
271: tsTokenGen.setCertificatesAndCRLs(certs);
272:
273: TimeStampRequestGenerator reqGen = new TimeStampRequestGenerator();
274:
275: //
276: // request with certReq false
277: //
278: reqGen.setCertReq(false);
279:
280: TimeStampRequest request = reqGen.generate(TSPAlgorithms.SHA1,
281: new byte[20], BigInteger.valueOf(100));
282:
283: TimeStampResponseGenerator tsRespGen = new TimeStampResponseGenerator(
284: tsTokenGen, TSPAlgorithms.ALLOWED);
285:
286: TimeStampResponse tsResp = tsRespGen.generate(request,
287: new BigInteger("23"), new Date(), "BC");
288:
289: tsResp = new TimeStampResponse(tsResp.getEncoded());
290:
291: TimeStampToken tsToken = tsResp.getTimeStampToken();
292:
293: assertNull(tsToken.getTimeStampInfo().getGenTimeAccuracy()); // check for abscence of accuracy
294:
295: assertEquals("1.2", tsToken.getTimeStampInfo().getPolicy());
296:
297: try {
298: tsToken.validate(cert, "BC");
299: } catch (TSPValidationException e) {
300: fail("certReq(false) verification of token failed.");
301: }
302:
303: CertStore respCerts = tsToken.getCertificatesAndCRLs(
304: "Collection", "BC");
305:
306: Collection certsColl = respCerts.getCertificates(null);
307:
308: if (!certsColl.isEmpty()) {
309: fail("certReq(false) found certificates in response.");
310: }
311: }
312:
313: private void tokenEncodingTest(PrivateKey privateKey,
314: X509Certificate cert, CertStore certs) throws Exception {
315: TimeStampTokenGenerator tsTokenGen = new TimeStampTokenGenerator(
316: privateKey, cert, TSPAlgorithms.SHA1, "1.2.3.4.5.6");
317:
318: tsTokenGen.setCertificatesAndCRLs(certs);
319:
320: TimeStampRequestGenerator reqGen = new TimeStampRequestGenerator();
321: TimeStampRequest request = reqGen.generate(TSPAlgorithms.SHA1,
322: new byte[20], BigInteger.valueOf(100));
323: TimeStampResponseGenerator tsRespGen = new TimeStampResponseGenerator(
324: tsTokenGen, TSPAlgorithms.ALLOWED);
325: TimeStampResponse tsResp = tsRespGen.generate(request,
326: new BigInteger("23"), new Date(), "BC");
327:
328: tsResp = new TimeStampResponse(tsResp.getEncoded());
329:
330: TimeStampResponse tsResponse = new TimeStampResponse(tsResp
331: .getEncoded());
332:
333: if (!Arrays.areEqual(tsResponse.getEncoded(), tsResp
334: .getEncoded())
335: || !Arrays.areEqual(tsResponse.getTimeStampToken()
336: .getEncoded(), tsResp.getTimeStampToken()
337: .getEncoded())) {
338: fail();
339: }
340: }
341:
342: private void testAccuracyZeroCerts(PrivateKey privateKey,
343: X509Certificate cert, CertStore certs) throws Exception {
344: TimeStampTokenGenerator tsTokenGen = new TimeStampTokenGenerator(
345: privateKey, cert, TSPAlgorithms.MD5, "1.2");
346:
347: tsTokenGen.setCertificatesAndCRLs(certs);
348:
349: tsTokenGen.setAccuracySeconds(1);
350: tsTokenGen.setAccuracyMillis(2);
351: tsTokenGen.setAccuracyMicros(3);
352:
353: TimeStampRequestGenerator reqGen = new TimeStampRequestGenerator();
354: TimeStampRequest request = reqGen.generate(TSPAlgorithms.SHA1,
355: new byte[20], BigInteger.valueOf(100));
356:
357: TimeStampResponseGenerator tsRespGen = new TimeStampResponseGenerator(
358: tsTokenGen, TSPAlgorithms.ALLOWED);
359:
360: TimeStampResponse tsResp = tsRespGen.generate(request,
361: new BigInteger("23"), new Date(), "BC");
362:
363: tsResp = new TimeStampResponse(tsResp.getEncoded());
364:
365: TimeStampToken tsToken = tsResp.getTimeStampToken();
366:
367: tsToken.validate(cert, "BC");
368:
369: //
370: // check validation
371: //
372: tsResp.validate(request);
373:
374: //
375: // check tstInfo
376: //
377: TimeStampTokenInfo tstInfo = tsToken.getTimeStampInfo();
378:
379: //
380: // check accuracy
381: //
382: GenTimeAccuracy accuracy = tstInfo.getGenTimeAccuracy();
383:
384: assertEquals(1, accuracy.getSeconds());
385: assertEquals(2, accuracy.getMillis());
386: assertEquals(3, accuracy.getMicros());
387:
388: assertEquals(new BigInteger("23"), tstInfo.getSerialNumber());
389:
390: assertEquals("1.2", tstInfo.getPolicy());
391:
392: //
393: // test certReq
394: //
395: CertStore store = tsToken.getCertificatesAndCRLs("Collection",
396: "BC");
397:
398: Collection certificates = store.getCertificates(null);
399:
400: assertEquals(0, certificates.size());
401: }
402:
403: private void testAccuracyWithCertsAndOrdering(
404: PrivateKey privateKey, X509Certificate cert, CertStore certs)
405: throws Exception {
406: TimeStampTokenGenerator tsTokenGen = new TimeStampTokenGenerator(
407: privateKey, cert, TSPAlgorithms.MD5, "1.2.3");
408:
409: tsTokenGen.setCertificatesAndCRLs(certs);
410:
411: tsTokenGen.setAccuracySeconds(3);
412: tsTokenGen.setAccuracyMillis(1);
413: tsTokenGen.setAccuracyMicros(2);
414:
415: tsTokenGen.setOrdering(true);
416:
417: TimeStampRequestGenerator reqGen = new TimeStampRequestGenerator();
418:
419: reqGen.setCertReq(true);
420:
421: TimeStampRequest request = reqGen.generate(TSPAlgorithms.SHA1,
422: new byte[20], BigInteger.valueOf(100));
423:
424: assertTrue(request.getCertReq());
425:
426: TimeStampResponseGenerator tsRespGen = new TimeStampResponseGenerator(
427: tsTokenGen, TSPAlgorithms.ALLOWED);
428:
429: TimeStampResponse tsResp = tsRespGen.generate(request,
430: new BigInteger("23"), new Date(), "BC");
431:
432: tsResp = new TimeStampResponse(tsResp.getEncoded());
433:
434: TimeStampToken tsToken = tsResp.getTimeStampToken();
435:
436: tsToken.validate(cert, "BC");
437:
438: //
439: // check validation
440: //
441: tsResp.validate(request);
442:
443: //
444: // check tstInfo
445: //
446: TimeStampTokenInfo tstInfo = tsToken.getTimeStampInfo();
447:
448: //
449: // check accuracy
450: //
451: GenTimeAccuracy accuracy = tstInfo.getGenTimeAccuracy();
452:
453: assertEquals(3, accuracy.getSeconds());
454: assertEquals(1, accuracy.getMillis());
455: assertEquals(2, accuracy.getMicros());
456:
457: assertEquals(new BigInteger("23"), tstInfo.getSerialNumber());
458:
459: assertEquals("1.2.3", tstInfo.getPolicy());
460:
461: assertEquals(true, tstInfo.isOrdered());
462:
463: assertEquals(tstInfo.getNonce(), BigInteger.valueOf(100));
464:
465: //
466: // test certReq
467: //
468: CertStore store = tsToken.getCertificatesAndCRLs("Collection",
469: "BC");
470:
471: Collection certificates = store.getCertificates(null);
472:
473: assertEquals(2, certificates.size());
474: }
475:
476: private void testNoNonse(PrivateKey privateKey,
477: X509Certificate cert, CertStore certs) throws Exception {
478: TimeStampTokenGenerator tsTokenGen = new TimeStampTokenGenerator(
479: privateKey, cert, TSPAlgorithms.MD5, "1.2.3");
480:
481: tsTokenGen.setCertificatesAndCRLs(certs);
482:
483: TimeStampRequestGenerator reqGen = new TimeStampRequestGenerator();
484: TimeStampRequest request = reqGen.generate(TSPAlgorithms.SHA1,
485: new byte[20]);
486:
487: assertFalse(request.getCertReq());
488:
489: TimeStampResponseGenerator tsRespGen = new TimeStampResponseGenerator(
490: tsTokenGen, TSPAlgorithms.ALLOWED);
491:
492: TimeStampResponse tsResp = tsRespGen.generate(request,
493: new BigInteger("24"), new Date(), "BC");
494:
495: tsResp = new TimeStampResponse(tsResp.getEncoded());
496:
497: TimeStampToken tsToken = tsResp.getTimeStampToken();
498:
499: tsToken.validate(cert, "BC");
500:
501: //
502: // check validation
503: //
504: tsResp.validate(request);
505:
506: //
507: // check tstInfo
508: //
509: TimeStampTokenInfo tstInfo = tsToken.getTimeStampInfo();
510:
511: //
512: // check accuracy
513: //
514: GenTimeAccuracy accuracy = tstInfo.getGenTimeAccuracy();
515:
516: assertNull(accuracy);
517:
518: assertEquals(new BigInteger("24"), tstInfo.getSerialNumber());
519:
520: assertEquals("1.2.3", tstInfo.getPolicy());
521:
522: assertEquals(false, tstInfo.isOrdered());
523:
524: assertNull(tstInfo.getNonce());
525:
526: //
527: // test certReq
528: //
529: CertStore store = tsToken.getCertificatesAndCRLs("Collection",
530: "BC");
531:
532: Collection certificates = store.getCertificates(null);
533:
534: assertEquals(0, certificates.size());
535: }
536: }
|