Package com.ongres.scram.common.util

Class TlsServerEndpoint

java.lang.Object
com.ongres.scram.common.util.TlsServerEndpoint
public final class TlsServerEndpoint extends Object
Utilitiy for extracting the "tls-server-end-point" channel binding data.

  • Field Details

    • TLS_SERVER_END_POINT

      public static final String TLS_SERVER_END_POINT
      The "tls-server-end-point" Channel Binding Type.
      See Also:

    • OID_TO_DIGEST

      private static final Map<String,String> OID_TO_DIGEST
      A static mapping of universally standard signature OIDs to their underlying digest algorithms. This guarantees resolution even if the JCE provider fails to provide a friendly string name.

  • Constructor Details

    • TlsServerEndpoint

      private TlsServerEndpoint()

  • Method Details

    • getDigestAlgorithm

      private static MessageDigest getDigestAlgorithm(X509Certificate serverCert) throws NoSuchAlgorithmException
      Get the digest algorithm that would be used for a given signature algorithm name.

      The TLS server's certificate bytes need to be hashed with SHA-256 if its signature algorithm is MD5 or SHA-1 as per RFC 5929 (https://tools.ietf.org/html/rfc5929#section-4.1). If something else is used, the same hash as the signature algorithm is used.

      Parameters:
      serverCert - the TLS server's peer certificate
      Returns:
      the MessageDigest algorithm
      Throws:
      NoSuchAlgorithmException - if the signature algorithm is unrecognized or unmapped
      See Also:

    • getChannelBindingData

      @Deprecated public static byte[] getChannelBindingData(X509Certificate serverCert) throws CertificateEncodingException
      Deprecated.
      this method silently swallows NoSuchAlgorithmException and returns an empty array. It is replaced by getChannelBindingHash(X509Certificate) and will be removed in a future release.
      The hash of the TLS server's certificate [RFC5280] as it appears, octet for octet, in the server's Certificate message.
      Parameters:
      serverCert - the TLS server's peer certificate
      Returns:
      the hash of the TLS server's peer certificate
      Throws:
      CertificateEncodingException - if an encoding error occurs.

    • getChannelBindingHash

      public static byte[] getChannelBindingHash(X509Certificate serverCert) throws CertificateEncodingException, NoSuchAlgorithmException
      Computes the hash of the TLS server's certificate [RFC5280] as it appears, octet for octet, in the server's Certificate message, for use as "tls-server-end-point" channel binding.

      The TLS server's certificate bytes need to be hashed with SHA-256 if its signature algorithm is MD5 or SHA-1 as per RFC 5929 Section 4.1. If another algorithm is used, the same hash function as the signature algorithm is applied. Unsupported or unmapped signature structures throw a NoSuchAlgorithmException.

      Parameters:
      serverCert - the TLS server's peer certificate
      Returns:
      the hash of the TLS server's peer certificate
      Throws:
      CertificateEncodingException - if an encoding error occurs
      NoSuchAlgorithmException - if the required digest algorithm cannot be determined or is unsupported by the underlying security provider