From 6624296abee89ba30b68c247a627687085e2b0b8 Mon Sep 17 00:00:00 2001 From: Cyrus <24922493+cyrus-dev@users.noreply.github.com> Date: Thu, 13 Dec 2018 09:30:10 -0500 Subject: [PATCH] [#43] Additional certificate fields to display * This change adds in additional information about the certificate, which include the public key and signature algoritms and their sizes, the key usage and extended key usage, the certificate version number for EK and CA certs and the issuer section expanded with Auth Key Id and Auth Info Access. * Made some fixes to the platform class print out. Needs to print out string representation of the value. * Additional changes for the certificate details page. Going over the spec determining what should be shown and what should be hidden if no information is specified. * This change adds in additional information about the certificate, which include the public key and signature algoritms and their sizes, the key usage and extended key usage, the certificate version number for EK and CA certs and the issuer section expanded with Auth Key Id and Auth Info Access. Made some fixes to the platform class print out. Needs to print out string representation of the value. Additional changes for the certificate details page. Going over the spec determining what should be shown and what should be hidden if no information is specified. Small updates to code commits and statements * Stashing changes. * Correcting some unit test fail instances. The PC Test fails because the tested cert is not updated to new (constantly changing) specs. Not just on the value but also on the value type. * Fixing git merge meta data. * Updates to include the Authority Key information as a set rather than just one item. Using a bouncy castle defined class. * Reversed the type of variable the public key value returns so that the unit test for it doesn't have to change. The type wasn't important, it was a convenience decision. * Adding changes based on review comments from @apldev3. * Made changes based on github review comments. * Additional changes for github comments * Updated the code for the public key size on CA and EK certificates. There was a previous issue with 4 additional bytes being included in the size. * Some more changes for Github comments --- .../util/CertificateStringMapBuilder.java | 40 +- .../WEB-INF/jsp/certificate-details.jsp | 374 +++++++++++----- .../src/main/webapp/common/common.js | 10 + .../data/persist/certificate/Certificate.java | 406 ++++++++++++++++++ .../CertificateAuthorityCredential.java | 25 +- .../certificate/PlatformCredential.java | 29 +- .../attributes/ComponentIdentifier.java | 36 +- .../certificate/PlatformCredentialTest.java | 4 +- 8 files changed, 810 insertions(+), 114 deletions(-) diff --git a/HIRS_AttestationCAPortal/src/main/java/hirs/attestationca/portal/util/CertificateStringMapBuilder.java b/HIRS_AttestationCAPortal/src/main/java/hirs/attestationca/portal/util/CertificateStringMapBuilder.java index c7b4c2ae..d2a19139 100644 --- a/HIRS_AttestationCAPortal/src/main/java/hirs/attestationca/portal/util/CertificateStringMapBuilder.java +++ b/HIRS_AttestationCAPortal/src/main/java/hirs/attestationca/portal/util/CertificateStringMapBuilder.java @@ -4,6 +4,7 @@ import org.apache.logging.log4j.LogManager; import org.apache.logging.log4j.Logger; import java.io.IOException; +import java.math.BigInteger; import java.util.Arrays; import java.util.HashMap; import java.util.Set; @@ -44,9 +45,15 @@ public final class CertificateStringMapBuilder { data.put("issuer", certificate.getIssuer()); //Serial number in hex value data.put("serialNumber", Long.toHexString(certificate.getSerialNumber().longValue())); + if (!certificate.getAuthoritySerialNumber().equals(BigInteger.ZERO)) { + data.put("authSerialNumber", Long.toHexString(certificate + .getAuthoritySerialNumber().longValue())); + } data.put("beginValidity", certificate.getBeginValidity().toString()); data.put("endValidity", certificate.getEndValidity().toString()); data.put("signature", Arrays.toString(certificate.getSignature())); + data.put("signatureSize", Integer.toString(certificate.getSignature().length + * Certificate.MIN_ATTR_CERT_LENGTH)); if (certificate.getSubject() != null) { data.put("subject", certificate.getSubject()); @@ -56,9 +63,27 @@ public final class CertificateStringMapBuilder { data.put("isSelfSigned", "false"); } + data.put("authKeyId", certificate.getAuthKeyId()); + data.put("crlPoints", certificate.getCrlPoints()); + data.put("signatureAlgorithm", certificate.getSignatureAlgorithm()); if (certificate.getEncodedPublicKey() != null) { data.put("encodedPublicKey", Arrays.toString(certificate.getEncodedPublicKey())); + data.put("publicKeyAlgorithm", certificate.getPublicKeyAlgorithm()); + } + + if (certificate.getPublicKeyModulusHexValue() != null) { + data.put("publicKeyValue", certificate.getPublicKeyModulusHexValue()); + data.put("publicKeySize", String.valueOf(certificate.getPublicKeySize())); + } + + if (certificate.getKeyUsage() != null) { + data.put("keyUsage", certificate.getKeyUsage()); + } + + if (certificate.getExtendedKeyUsage() != null + && !certificate.getExtendedKeyUsage().isEmpty()) { + data.put("extendedKeyUsage", certificate.getExtendedKeyUsage()); } //Get issuer ID if not self signed @@ -69,7 +94,7 @@ public final class CertificateStringMapBuilder { data.put("missingChainIssuer", missingCert.getIssuer()); } //Find all certificates that could be the issuer certificate based on subject name - for (Certificate issuerCert:CertificateAuthorityCredential + for (Certificate issuerCert : CertificateAuthorityCredential .select(certificateManager) .bySubject(certificate.getIssuer()) .getCertificates()) { @@ -179,6 +204,11 @@ public final class CertificateStringMapBuilder { data.putAll(getGeneralCertificateInfo(certificate, certificateManager)); data.put("subjectKeyIdentifier", Arrays.toString(certificate.getSubjectKeyIdentifier())); + //x509 credential version + data.put("x509Version", Integer.toString(certificate + .getX509CredentialVersion())); + data.put("authInfoAccess", certificate.getAuthInfoAccess()); + data.put("credentialType", certificate.getCredentialType()); } else { LOGGER.error(notFoundMessage); } @@ -202,12 +232,16 @@ public final class CertificateStringMapBuilder { if (certificate != null) { data.putAll(getGeneralCertificateInfo(certificate, certificateManager)); // Set extra fields - data.put("credentialType", certificate.getCredentialType()); data.put("manufacturer", certificate.getManufacturer()); data.put("model", certificate.getModel()); data.put("version", certificate.getVersion()); data.put("policyReference", certificate.getPolicyReference()); - data.put("revocationLocator", certificate.getRevocationLocator()); + data.put("crlPoints", certificate.getCrlPoints()); + data.put("authInfoAccess", certificate.getAuthInfoAccess()); + data.put("credentialType", certificate.getCredentialType()); + //x509 credential version + data.put("x509Version", Integer.toString(certificate + .getX509CredentialVersion())); // Add hashmap with TPM information if available if (certificate.getTpmSpecification() != null) { data.putAll( diff --git a/HIRS_AttestationCAPortal/src/main/webapp/WEB-INF/jsp/certificate-details.jsp b/HIRS_AttestationCAPortal/src/main/webapp/WEB-INF/jsp/certificate-details.jsp index 237b715d..d0c69da7 100644 --- a/HIRS_AttestationCAPortal/src/main/webapp/WEB-INF/jsp/certificate-details.jsp +++ b/HIRS_AttestationCAPortal/src/main/webapp/WEB-INF/jsp/certificate-details.jsp @@ -51,27 +51,44 @@
Issuer
- - - - ${initialData.issuer} - - - - ${initialData.issuer} - - +
Distinguished Name:  + + + + ${initialData.issuer} + + + + ${initialData.issuer} + + + +
+
Authority Key Identifier:  + +
+ +
Authority Info Access:  + ${initialData.authInfoAccess} + +
+ + +
Authority Serial Number:  + +
+ - + + title="All certificates in the chain were found.">
-
Signature
-
-
+
Signature
+
+
+
+ +
+ +
+
+
+ +
+ +
+
+
+
Public Key
-
+
+
+
+
+ +
+ +
+
+
+ +
+ +
+
+
+
+
X509 Credential Version
+
${initialData.x509Version} (v${initialData.x509Version + 1})
+
+
+
Credential Type
+
${initialData.credentialType}
+
+ + +
+
Subject Key Identifier
+
+
+ + + +
+
Revocation Locator
+ +
+
-
Subject Key Identifier
-
+
Key Usage
+ + +
${initialData.keyUsage}
+ + +
Not Specified
+ +
+ + +
+
Extended Key Usage
+
${initialData.extendedKeyUsage}
+
+ +
-
Credential Type
-
${initialData.credentialType}
-
-
-
Manufacturer
-
${initialData.manufacturer}
-
-
-
Model
-
${initialData.model}
-
-
-
Version
-
${initialData.version}
+
TPM
+
+
Manufacturer: ${initialData.manufacturer}
+
Model: ${initialData.model}
+
Version: ${initialData.version}
+
Serial NR: 
+
Policy Reference
-
${initialData.policyReference}
+
+ + + ${initialData.policyReference} + + + Not Specified + + +
+ +
+
Revocation Locator
+ +
+
-
Revocation Locator
-
${initialData.revocationLocator}
+
Key Usage
+ + +
${initialData.keyUsage}
+ + +
Not Specified
+ +
+ + +
+
Extended Key Usage
+
${initialData.extendedKeyUsage}
+
+ +
-
TPM Specification
+
+ + + +
-
Family: ${initialData.TPMSpecificationFamily}
-
Level: ${initialData.TPMSpecificationLevel}
-
Revision: ${initialData.TPMSpecificationRevision}
+
-
TPM Security Assertion
+
+ + + +
-
Version: ${initialData.TPMSecurityAssertionsVersion}
-
Field Upgradeable: ${initialData.TPMSecurityAssertionsFieldUpgradeable}
-
ek Generation Type: ${initialData.TPMSecurityAssertionsEkGenType}
-
ek Generation Location: ${initialData.TPMSecurityAssertionsEkGenLoc}
-
ek Certificate Generation Location: ${initialData.TPMSecurityAssertionsEkCertGenLoc}
+
-
-
X509 Credential Version
-
${initialData.x509Version} (v${initialData.x509Version + 1})
-
-
-
Credential Type
-
${initialData.credentialType}
-
Certification Practice Statement URI
- @@ -183,9 +334,10 @@
Holder
-
${initialData.holderIssuer}
+
EK Certificate: ${initialData.holderIssuer}
 -
+
+
EK Identifier:  @@ -195,24 +347,22 @@ -
${initialData.holderSerialNumber}
+ ${initialData.holderSerialNumber} -
+
+
-
Manufacturer
-
${initialData.manufacturer}
-
-
-
Model
-
${initialData.model}
-
-
-
Version
-
${initialData.version}
-
+
TPM
+
+
Manufacturer: ${initialData.manufacturer}
+
Model: ${initialData.model}
+
Version: ${initialData.version}
+
Serial NR: 
+
+
@@ -260,12 +410,12 @@

-
+
Version: @@ -346,7 +496,7 @@
Target Hash Value: ${ccinfo.getTargetUri().getHashValue()} -
+
@@ -362,12 +512,12 @@

-
+
Version: @@ -398,12 +548,12 @@

-
+
@@ -444,12 +594,12 @@

-
+
@@ -495,12 +645,12 @@

-
+
@@ -526,12 +676,12 @@

-
+