org.apache.tsik.verifier
Class SimpleTrustVerifier

java.lang.Object
  org.apache.tsik.verifier.SimpleTrustVerifier

All Implemented Interfaces:

TrustVerifier

public class SimpleTrustVerifier

extends Object

implements TrustVerifier

A simple TrustVerifier implementation based on a collection of trusted public keys.

A key is trusted if it is in the trusted collection; a certificate chain is trusted if the public key of the leaf certificate is in the trusted collection.

When verifyTrust() is called, an exception is always thrown by this class. When verifyTrust(PublicKey,String) is called, the key name parameter is ignored by this class.

Constructor Summary

SimpleTrustVerifier(Collection keys)
Creates an SimpleTrustVerifier from a collection of certificates.

Method Summary

void	verifyTrust() Verifies that the absence of a key or certificate (e.g., an unsigned message) can be trusted.
void	verifyTrust(PublicKey key) Verifies that a public key is trusted.
void	verifyTrust(PublicKey key, String keyName) Verifies that a public key is trusted, also using an XML Signature key name.
void	verifyTrust(X509Certificate[] chain) Verifies that a certificate chain is trusted.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SimpleTrustVerifier

public SimpleTrustVerifier(Collection keys)

Creates an SimpleTrustVerifier from a collection of certificates.

Parameters:

keys - is the collection of PublicKey objects to trust. This collection is not copied by the constructor, so subsequent modifications to the collection will impact on the verifier.

Method Detail

verifyTrust

public void verifyTrust()
                 throws TrustVerificationException

Description copied from interface: TrustVerifier

Verifies that the absence of a key or certificate (e.g., an unsigned message) can be trusted. Returns silently if the message is trusted, or throws an exception if not.

Note that most TrustVerifier implementations will not consider the absence of a key or certificate to be trusted and these will always throw an exception when this method is called. This option is provided mainly for debugging purposes.

Specified by:

verifyTrust in interface TrustVerifier

Throws:

TrustVerificationException - if the absence of a key or certificate cannot be trusted.

verifyTrust

public void verifyTrust(PublicKey key)
                 throws TrustVerificationException

Description copied from interface: TrustVerifier

Verifies that a public key is trusted. Returns silently if the key is trusted, or throws an exception indicating the reason it is not.

Specified by:

verifyTrust in interface TrustVerifier

Parameters:

key - is the public key to check.

Throws:

TrustVerificationException - if the given key cannot be trusted, or if an error occurs while trying to determine trust.

verifyTrust

public void verifyTrust(PublicKey key,
                        String keyName)
                 throws TrustVerificationException

Description copied from interface: TrustVerifier

Verifies that a public key is trusted, also using an XML Signature key name. Returns silently if the key is trusted, or throws an exception indicating the reason it is not.

Note that some TrustVerifier implementations may ignore the keyName parameter and only verify the key. However, a key name should be specified when one is available since this allows certain verifiers to operate more reliably. For example, a public key value may not neccessary be globally unique and in this case the keyName can help to qualify it.

If the keyName is used by the verifier, it will also ensure that the specified key is indeed associated with that keyName.

Specified by:

verifyTrust in interface TrustVerifier

Parameters:

key - is the public key to check.

keyName - is the XML Signature key name of the key to check.

Throws:

TrustVerificationException - if the given key cannot be trusted, or if an error occurs while trying to determine trust.

verifyTrust

public void verifyTrust(X509Certificate[] chain)
                 throws TrustVerificationException

Description copied from interface: TrustVerifier

Verifies that a certificate chain is trusted. The chain must be presented in order from leaf entity toward root CA, such that for all i, 0 <= i < (chain.length - 1) implies chain[i].verify(chain[i+1].getPublicKey()) will succeed. Returns silently if the chain is trusted, or throws an exception indicating the reason if not.

Specified by:

verifyTrust in interface TrustVerifier

Parameters:

chain - is the certificate chain to check.

Throws:

TrustVerificationException - if the given chain cannot be trusted, or if an error occurs while trying to determine trust.