Botan::X509 Namespace Reference

Functions
std::vector< uint8_t >	BER_encode (const Public_Key &key)
Public_Key *	copy_key (const Public_Key &key)
PKCS10_Request	create_cert_req (const X509_Cert_Options &opts, const Private_Key &key, const std::string &hash_fn, RandomNumberGenerator &rng)
X509_Certificate	create_self_signed_cert (const X509_Cert_Options &opts, const Private_Key &key, const std::string &hash_fn, RandomNumberGenerator &rng)
Public_Key *	load_key (const std::vector< uint8_t > &enc)
Public_Key *	load_key (DataSource &source)
std::string	PEM_encode (const Public_Key &key)

Detailed Description

This namespace contains functions for handling X.509 public keys

Function Documentation

BER_encode()

std::vector< uint8_t > Botan::X509::BER_encode ( const Public_Key &  key )

inline

BER encode a key

Parameters

key	the public key to encode

Returns

BER encoding of this key

Definition at line 28 of file x509_key.h.

   {
   return key.subject_public_key();
   }

References Botan::Public_Key::subject_public_key().

Referenced by botan_privkey_export_pubkey(), botan_pubkey_export(), and create_self_signed_cert().

copy_key()

Public_Key * Botan::X509::copy_key ( const Public_Key &  key )

inline

Copy a key.

Parameters

key	the public key to copy

Returns

new public key object

Definition at line 76 of file x509_key.h.

   {
   DataSource_Memory source(PEM_encode(key));
   return X509::load_key(source);
   }

References load_key(), and PEM_encode().

create_cert_req()

PKCS10_Request Botan::X509::create_cert_req	(	const X509_Cert_Options &	opts,
		const Private_Key &	key,
		const std::string &	hash_fn,
		RandomNumberGenerator &	rng
	)

Create a PKCS#10 certificate request.

Parameters

opts	the options defining the request to create
key	the key used to sign this request
rng	the rng to use
hash_fn	the hash function to use

Returns

newly created PKCS#10 request

Definition at line 110 of file x509self.cpp.

   {
   X509_DN subject_dn;
   AlternativeName subject_alt;
   load_info(opts, subject_dn, subject_alt);
 
   Key_Constraints constraints;
   if(opts.is_CA)
      {
      constraints = Key_Constraints(KEY_CERT_SIGN | CRL_SIGN);
      }
   else
      {
      verify_cert_constraints_valid_for_key_type(key, opts.constraints);
      constraints = opts.constraints;
      }
 
   Extensions extensions = opts.extensions;
 
   extensions.add_new(std::make_unique<Cert_Extension::Basic_Constraints>(opts.is_CA, opts.path_limit));
 
   if(constraints != NO_CONSTRAINTS)
      {
      extensions.add_new(std::make_unique<Cert_Extension::Key_Usage>(constraints));
      }
   extensions.add_new(std::make_unique<Cert_Extension::Extended_Key_Usage>(opts.ex_constraints));
   extensions.add_new(std::make_unique<Cert_Extension::Subject_Alternative_Name>(subject_alt));
 
   return PKCS10_Request::create(key,
                                 subject_dn,
                                 extensions,
                                 hash_fn,
                                 rng,
                                 opts.padding_scheme,
                                 opts.challenge);
   }

References Botan::Extensions::add_new(), Botan::X509_Cert_Options::challenge, Botan::X509_Cert_Options::constraints, Botan::PKCS10_Request::create(), Botan::CRL_SIGN, Botan::X509_Cert_Options::ex_constraints, Botan::X509_Cert_Options::extensions, Botan::X509_Cert_Options::is_CA, Botan::KEY_CERT_SIGN, Botan::NO_CONSTRAINTS, Botan::X509_Cert_Options::padding_scheme, Botan::X509_Cert_Options::path_limit, and Botan::verify_cert_constraints_valid_for_key_type().

create_self_signed_cert()

X509_Certificate Botan::X509::create_self_signed_cert	(	const X509_Cert_Options &	opts,
		const Private_Key &	key,
		const std::string &	hash_fn,
		RandomNumberGenerator &	rng
	)

Create a self-signed X.509 certificate.

Parameters

opts	the options defining the certificate to create
key	the private key used for signing, i.e. the key associated with this self-signed certificate
hash_fn	the hash function to use
rng	the rng to use

Returns

newly created self-signed certificate

Definition at line 51 of file x509self.cpp.

   {
   AlgorithmIdentifier sig_algo;
   X509_DN subject_dn;
   AlternativeName subject_alt;
 
   // for now, only the padding option is used
   std::map<std::string,std::string> sig_opts = { {"padding",opts.padding_scheme} };
 
   const std::vector<uint8_t> pub_key = X509::BER_encode(key);
   std::unique_ptr<PK_Signer> signer(choose_sig_format(key, sig_opts, rng, hash_fn, sig_algo));
   BOTAN_ASSERT_NOMSG(sig_algo.get_oid().has_value());
   load_info(opts, subject_dn, subject_alt);
 
   Extensions extensions = opts.extensions;
 
   Key_Constraints constraints;
   if(opts.is_CA)
      {
      constraints = Key_Constraints(KEY_CERT_SIGN | CRL_SIGN);
      }
   else
      {
      verify_cert_constraints_valid_for_key_type(key, opts.constraints);
      constraints = opts.constraints;
      }
 
   extensions.add_new(
      std::make_unique<Cert_Extension::Basic_Constraints>(opts.is_CA, opts.path_limit),
      true);
 
   if(constraints != NO_CONSTRAINTS)
      {
      extensions.add_new(std::make_unique<Cert_Extension::Key_Usage>(constraints), true);
      }
 
   std::unique_ptr<Cert_Extension::Subject_Key_ID> skid(std::make_unique<Cert_Extension::Subject_Key_ID>(pub_key, hash_fn));
 
   extensions.add_new(std::make_unique<Cert_Extension::Authority_Key_ID>(skid->get_key_id()));
   extensions.add_new(std::move(skid));
 
   extensions.add_new(
      std::make_unique<Cert_Extension::Subject_Alternative_Name>(subject_alt));
 
   extensions.add_new(
      std::make_unique<Cert_Extension::Extended_Key_Usage>(opts.ex_constraints));
 
   return X509_CA::make_cert(signer.get(), rng, sig_algo, pub_key,
                             opts.start, opts.end,
                             subject_dn, subject_dn,
                             extensions);
   }

References Botan::Extensions::add_new(), BER_encode(), BOTAN_ASSERT_NOMSG, Botan::choose_sig_format(), Botan::X509_Cert_Options::constraints, Botan::CRL_SIGN, Botan::X509_Cert_Options::end, Botan::X509_Cert_Options::ex_constraints, Botan::X509_Cert_Options::extensions, Botan::AlgorithmIdentifier::get_oid(), Botan::OID::has_value(), Botan::X509_Cert_Options::is_CA, Botan::KEY_CERT_SIGN, Botan::X509_CA::make_cert(), Botan::NO_CONSTRAINTS, Botan::X509_Cert_Options::padding_scheme, Botan::X509_Cert_Options::path_limit, Botan::X509_Cert_Options::start, and Botan::verify_cert_constraints_valid_for_key_type().

load_key() [1/2]

Public_Key * Botan::X509::load_key ( const std::vector< uint8_t > &  enc )

inline

Create a public key from a memory region.

Parameters

enc	the memory region containing the DER or PEM encoded key

Returns

new public key object

Definition at line 65 of file x509_key.h.

   {
   DataSource_Memory source(enc);
   return X509::load_key(source);
   }

References load_key().

load_key() [2/2]

Public_Key * Botan::X509::load_key

(

DataSource &

source

)

Create a public key from a data source.

Parameters

source

the source providing the DER or PEM encoded key

Returns

new public key object

Definition at line 29 of file x509_key.cpp.

   {
   try {
      AlgorithmIdentifier alg_id;
      std::vector<uint8_t> key_bits;
 
      if(ASN1::maybe_BER(source) && !PEM_Code::matches(source))
         {
         BER_Decoder(source)
            .start_sequence()
            .decode(alg_id)
            .decode(key_bits, ASN1_Type::BitString)
         .end_cons();
         }
      else
         {
         DataSource_Memory ber(
            PEM_Code::decode_check_label(source, "PUBLIC KEY")
            );
 
         BER_Decoder(ber)
            .start_sequence()
            .decode(alg_id)
            .decode(key_bits, ASN1_Type::BitString)
         .end_cons();
         }
 
      if(key_bits.empty())
         throw Decoding_Error("X.509 public key decoding");
 
      return load_public_key(alg_id, key_bits).release();
      }
   catch(Decoding_Error& e)
      {
      throw Decoding_Error("X.509 public key decoding", e);
      }
   }

References Botan::BitString, Botan::BER_Decoder::decode(), Botan::PEM_Code::decode_check_label(), Botan::BER_Decoder::end_cons(), Botan::load_public_key(), Botan::PEM_Code::matches(), Botan::ASN1::maybe_BER(), and Botan::BER_Decoder::start_sequence().

Referenced by botan_privkey_export_pubkey(), botan_pubkey_load(), copy_key(), load_key(), Botan::X509_Certificate::load_subject_public_key(), and Botan::PKCS10_Request::subject_public_key().

PEM_encode()

std::string Botan::X509::PEM_encode

(

const Public_Key &

key

)

PEM encode a public key into a string.

Parameters

key	the key to encode

Returns

PEM encoded key

Definition at line 20 of file x509_key.cpp.

   {
   return PEM_Code::encode(key.subject_public_key(),
                           "PUBLIC KEY");
   }

References Botan::PEM_Code::encode(), and Botan::Public_Key::subject_public_key().

Referenced by botan_pubkey_export(), copy_key(), and Botan::X509_Certificate::to_string().