Back to index...

	/*
	* Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	*
	* This code is free software; you can redistribute it and/or modify it
	* under the terms of the GNU General Public License version 2 only, as
	* published by the Free Software Foundation. Oracle designates this
	* particular file as subject to the "Classpath" exception as provided
	* by Oracle in the LICENSE file that accompanied this code.
	*
	* This code is distributed in the hope that it will be useful, but WITHOUT
	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	* version 2 for more details (a copy is included in the LICENSE file that
	* accompanied this code).
	*
	* You should have received a copy of the GNU General Public License version
	* 2 along with this work; if not, write to the Free Software Foundation,
	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	*
	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	* or visit www.oracle.com if you need additional information or have any
	* questions.
	*/

	package sun.security.provider.certpath;

	import java.io.IOException;
	import java.util.Objects;
	import java.security.SecureRandom;

	import sun.security.x509.Extension;
	import sun.security.x509.PKIXExtensions;
	import sun.security.util.Debug;
	import sun.security.util.DerValue;

	/**
	* Represent the OCSP Nonce Extension.
	* This extension, if present, provides a nonce value in OCSP requests
	* and responses. This will cryptographically bind requests and responses
	* and help to prevent replay attacks (see RFC 6960, section 4.4.1).
	*
	* @see Extension
	*/
	public final class OCSPNonceExtension extends Extension {

	/**
	* Attribute name.
	*/
	private static final String EXTENSION_NAME = "OCSPNonce";
	private byte[] nonceData = null;

	/**
	* Create an {@code OCSPNonceExtension} by providing the nonce length.
	* The criticality is set to false, and the OID for the extension will
	* be the value defined by "id-pkix-ocsp-nonce" from RFC 6960.
	*
	* @param length the number of random bytes composing the nonce
	*
	* @throws IOException if any errors happen during encoding of the
	* extension.
	* @throws IllegalArgumentException if length is not a positive integer.
	*/
	public OCSPNonceExtension(int length) throws IOException {
	this(false, length);
	}

	/**
	* Create an {@code OCSPNonceExtension} by providing the nonce length and
	* criticality setting. The OID for the extension will
	* be the value defined by "id-pkix-ocsp-nonce" from RFC 6960.
	*
	* @param isCritical a boolean flag indicating whether the criticality bit
	* is set for this extension
	* @param length the number of random bytes composing the nonce
	*
	* @throws IOException if any errors happen during encoding of the
	* extension.
	* @throws IllegalArgumentException if length is not a positive integer.
	*/
	public OCSPNonceExtension(boolean isCritical, int length)
	throws IOException {
	this.extensionId = PKIXExtensions.OCSPNonce_Id;
	this.critical = isCritical;

	if (length > 0) {
	SecureRandom rng = new SecureRandom();
	this.nonceData = new byte[length];
	rng.nextBytes(nonceData);
	this.extensionValue = new DerValue(DerValue.tag_OctetString,
	nonceData).toByteArray();
	} else {
	throw new IllegalArgumentException(
	"Length must be a positive integer");
	}
	}

	/**
	* Create an {@code OCSPNonceExtension} by providing a nonce value.
	* The criticality is set to false, and the OID for the extension will
	* be the value defined by "id-pkix-ocsp-nonce" from RFC 6960.
	*
	* @param incomingNonce The nonce data to be set for the extension. This
	* must be a non-null array of at least one byte long.
	*
	* @throws IOException if any errors happen during encoding of the
	* extension.
	* @throws IllegalArgumentException if the incomingNonce length is not a
	* positive integer.
	* @throws NullPointerException if the incomingNonce is null.
	*/
	public OCSPNonceExtension(byte[] incomingNonce) throws IOException {
	this(false, incomingNonce);
	}

	/**
	* Create an {@code OCSPNonceExtension} by providing a nonce value and
	* criticality setting. The OID for the extension will
	* be the value defined by "id-pkix-ocsp-nonce" from RFC 6960.
	*
	* @param isCritical a boolean flag indicating whether the criticality bit
	* is set for this extension
	* @param incomingNonce The nonce data to be set for the extension. This
	* must be a non-null array of at least one byte long.
	*
	* @throws IOException if any errors happen during encoding of the
	* extension.
	* @throws IllegalArgumentException if the incomingNonce length is not a
	* positive integer.
	* @throws NullPointerException if the incomingNonce is null.
	*/
	public OCSPNonceExtension(boolean isCritical, byte[] incomingNonce)
	throws IOException {
	this.extensionId = PKIXExtensions.OCSPNonce_Id;
	this.critical = isCritical;

	Objects.requireNonNull(incomingNonce, "Nonce data must be non-null");
	if (incomingNonce.length > 0) {
	this.nonceData = incomingNonce.clone();
	this.extensionValue = new DerValue(DerValue.tag_OctetString,
	nonceData).toByteArray();
	} else {
	throw new IllegalArgumentException(
	"Nonce data must be at least 1 byte in length");
	}
	}

	/**
	* Return the nonce bytes themselves, without any DER encoding.
	*
	* @return A copy of the underlying nonce bytes
	*/
	public byte[] getNonceValue() {
	return nonceData.clone();
	}

	/**
	* Returns a printable representation of the {@code OCSPNonceExtension}.
	*
	* @return a string representation of the extension.
	*/
	@Override
	public String toString() {
	StringBuilder sb = new StringBuilder();
	sb.append(super.toString()).append(EXTENSION_NAME).append(": ");
	sb.append((nonceData == null) ? "" : Debug.toString(nonceData));
	sb.append("\n");
	return sb.toString();
	}

	/**
	* Return the name of the extension as a {@code String}
	*
	* @return the name of the extension
	*/
	public String getName() {
	return EXTENSION_NAME;
	}
	}

Back to index...