private bool IsParent(X509Certificate child, X509Certificate parent)
{
if (child.IssuerName != parent.SubjectName)
{
return(false);
}
if (parent.Version > 2 && !this.IsTrusted(parent))
{
X509Extension x509Extension = parent.Extensions["2.5.29.19"];
if (x509Extension != null)
{
BasicConstraintsExtension basicConstraintsExtension = new BasicConstraintsExtension(x509Extension);
if (!basicConstraintsExtension.CertificateAuthority)
{
this._status = X509ChainStatusFlags.InvalidBasicConstraints;
}
}
else
{
this._status = X509ChainStatusFlags.InvalidBasicConstraints;
}
}
if (!child.VerifySignature(parent.RSA))
{
this._status = X509ChainStatusFlags.NotSignatureValid;
return(false);
}
return(true);
}
private bool IsParent(X509Certificate child, X509Certificate parent)
{
if (child.IssuerName != parent.SubjectName)
{
return(false);
}
// parent MUST have the Basic Constraint CA=true (except for trusted roots)
// see why at http://www.microsoft.com/technet/security/bulletin/MS02-050.asp
if ((parent.Version > 2) && (!IsTrusted(parent)))
{
// TODO: we do not support pathLenConstraint
X509Extension ext = parent.Extensions ["2.5.29.19"];
if (ext != null)
{
BasicConstraintsExtension bc = new BasicConstraintsExtension(ext);
if (!bc.CertificateAuthority)
{
_status = X509ChainStatusFlags.InvalidBasicConstraints;
}
}
else
{
_status = X509ChainStatusFlags.InvalidBasicConstraints;
}
}
if (!child.VerifySignature(parent.RSA))
{
_status = X509ChainStatusFlags.NotSignatureValid;
return(false);
}
return(true);
}
private bool IsSignedWith(X509Certificate2 signed, AsymmetricAlgorithm pubkey)
{
if (pubkey == null)
{
return(false);
}
Mono.Security.X509.X509Certificate monoCertificate = signed.MonoCertificate;
return(monoCertificate.VerifySignature(pubkey));
}
private bool IsSignedWith(X509Certificate2 signed, AsymmetricAlgorithm pubkey)
{
if (pubkey == null)
{
return(false);
}
// Sadly X509Certificate2 doesn't expose the signature nor the tbs (to be signed) structure
MX.X509Certificate mx = signed.MonoCertificate;
return(mx.VerifySignature(pubkey));
}
/// <summary>True if this certificate is signed by a CA whose cetificate
/// we have, false otherwise.</summary>
public bool Verify(X509Certificate x509) {
MemBlock sn = MemBlock.Reference(x509.SerialNumber);
lock(_sync) {
if(!_cas.ContainsKey(sn)) {
throw new Exception("Unsupported CA!");
}
if(!x509.VerifySignature(_cas[sn].RSA)) {
throw new Exception("Unable to verify certificate, bad signature!");
}
}
foreach(ICertificateVerification icv in _certificate_verifiers) {
if(!icv.Verify(x509)) {
throw new Exception("Certificate not valid, reason unsure");
}
}
return true;
}
public void VerifyDSASignature_Bad ()
{
X509Certificate ca = new X509Certificate (DSACACert_crt);
X509Certificate signed = new X509Certificate (InvalidDSASignatureTest6EE_crt);
Assert.IsFalse (signed.VerifySignature (ca.DSA), "VerifySignature(dsa)");
}
public void VerifyDSASignature ()
{
X509Certificate ca = new X509Certificate (DSACACert_crt);
// note: the DSA signature has 41 bytes because part1 first byte would be
// negative (bad for ASN.1) so a 0x00 was prepended
X509Certificate signed = new X509Certificate (ValidDSASignaturesTest4EE_crt);
Assert.IsTrue (signed.VerifySignature (ca.DSA), "VerifySignature(dsa)");
}
public void InheritedDSAParameters ()
{
X509Certificate ca = new X509Certificate (DSACACert_crt);
X509Certificate subca = new X509Certificate (DSAParametersInheritedCACert_crt);
subca.KeyAlgorithmParameters = ca.KeyAlgorithmParameters;
Assert.AreEqual ("<DSAKeyValue><P>3+URPtrptm4Q1uqd4p06sEe9RADHVsjMbtAzhFZHNT32VMjjwq27unXzLzMMpvkx7Gfj5Zlt/CluqleIcjTijgCQ4KOsZI7A9jwdj7TISkgwXn+qnHYmC9sTczODl8DFs+Y39T7/FQ3UoS66Mfirh9gLzHeYQm6sk5jCvS57NAs=</P><Q>zwYE2P+L6wDp9lwHlnP9lmU6Lwc=</Q><G>zOF8sM6SX2PsOLtEut2SNLZevmV72HF3BJ3sZnw7BM6281L+D5JVAu9OEqtdmi4vblbzcOxq7ZsiuKgTywycFurBCo4hJkSlDPmg7GLgcDHMaPULhaRKG2559MH5Nlo4b07vhFPfZ/3M91lij5yczRCPXKQPnLcH7GDzvq9+OZg=</G><Y>Z4xH2gw2gWQ5+Bo3C/C71BP9Zz1AyJyS4TqJVLDyl6Vw0GQXpKd8qeknCWXfoKUc/ATaPt1ia/AM7YFXT10pyAhZGQxfjYjw/4y26HUBvhAKZN9Xe4tsVvBTzkOIuQmZCDyQrwHo2TJd7VYCz2DSATrjCiuekUH2x3zebJljAA4=</Y></DSAKeyValue>", subca.DSA.ToXmlString (false), "DSA");
Assert.IsTrue (subca.VerifySignature (ca.DSA), "CA signed SubCA");
X509Certificate ee = new X509Certificate (ValidDSAParameterInheritanceTest5EE_crt);
ee.KeyAlgorithmParameters = subca.KeyAlgorithmParameters;
Assert.AreEqual ("<DSAKeyValue><P>3+URPtrptm4Q1uqd4p06sEe9RADHVsjMbtAzhFZHNT32VMjjwq27unXzLzMMpvkx7Gfj5Zlt/CluqleIcjTijgCQ4KOsZI7A9jwdj7TISkgwXn+qnHYmC9sTczODl8DFs+Y39T7/FQ3UoS66Mfirh9gLzHeYQm6sk5jCvS57NAs=</P><Q>zwYE2P+L6wDp9lwHlnP9lmU6Lwc=</Q><G>zOF8sM6SX2PsOLtEut2SNLZevmV72HF3BJ3sZnw7BM6281L+D5JVAu9OEqtdmi4vblbzcOxq7ZsiuKgTywycFurBCo4hJkSlDPmg7GLgcDHMaPULhaRKG2559MH5Nlo4b07vhFPfZ/3M91lij5yczRCPXKQPnLcH7GDzvq9+OZg=</G><Y>zos22FxEQcfqmrDYlDlFs0m0bGa91p2w64m+flvQ2zMhgxtKkmrXdtKjyEvHm5V8S+QZ1zQGmhgd1rH937TFByrUbZvIrGcr5tglsmFe6+98S1AldWg1Gd4C4P5RfmwAqNrRPzTDyRMDX/YrS8kxXATG5ls4+FhuWJXXX/pu/E8=</Y></DSAKeyValue>", ee.DSA.ToXmlString (false), "DSA");
Assert.IsTrue (ee.VerifySignature (subca.DSA), "SubCA signed EE");
}
private bool IsParent (X509Certificate child, X509Certificate parent)
{
if (child.IssuerName != parent.SubjectName)
return false;
// parent MUST have the Basic Constraint CA=true (except for trusted roots)
// see why at http://www.microsoft.com/technet/security/bulletin/MS02-050.asp
if ((parent.Version > 2) && (!IsTrusted (parent))) {
// TODO: we do not support pathLenConstraint
X509Extension ext = parent.Extensions ["2.5.29.19"];
if (ext != null) {
BasicConstraintsExtension bc = new BasicConstraintsExtension (ext);
if (!bc.CertificateAuthority)
_status = X509ChainStatusFlags.InvalidBasicConstraints;
}
else
_status = X509ChainStatusFlags.InvalidBasicConstraints;
}
if (!child.VerifySignature (parent.RSA)) {
_status = X509ChainStatusFlags.NotSignatureValid;
return false;
}
return true;
}
/// <summary>True if this certificate is signed by a CA whose cetificate
/// we have, false otherwise.</summary>
public bool Verify(X509Certificate x509) {
MemBlock sn = MemBlock.Reference(x509.SerialNumber);
if(!_cas.ContainsKey(sn)) {
throw new Exception("Unsupported CA!");
}
if(!x509.VerifySignature(_cas[sn].RSA)) {
throw new Exception("Unable to verify certificate, bad signature!");
}
return true;
}
public void RipeMd160 ()
{
X509Certificate c = new X509Certificate (ripemd160_data);
Assert.AreEqual ("1.3.36.3.3.1.2", c.SignatureAlgorithm, "SignatureAlgorithm");
Assert.IsTrue (c.VerifySignature (c.RSA), "hash mapping");
Assert.IsTrue (c.IsSelfSigned, "IsSelfSigned");
}
public void Sha512 ()
{
X509Certificate c = new X509Certificate (sha512_data);
Assert.AreEqual ("1.2.840.113549.1.1.13", c.SignatureAlgorithm, "SignatureAlgorithm");
Assert.IsTrue (c.VerifySignature (c.RSA), "hash mapping");
Assert.IsTrue (c.IsSelfSigned, "IsSelfSigned");
}
public void Sha256 ()
{
X509Certificate c = new X509Certificate (sha256_data);
Assert.AreEqual ("1.2.840.113549.1.1.11", c.SignatureAlgorithm, "SignatureAlgorithm");
Assert.IsFalse (c.VerifySignature (c.RSA), "hash mapping");
}