From cb31c134e253c5f780c79b9e04ecef8023c27021 Mon Sep 17 00:00:00 2001 From: Kenji Urushima Date: Fri, 19 Feb 2021 21:29:10 +0900 Subject: [PATCH] 10.1.11 release --- ChangeLog.txt | 10 +- api/files.html | 2 +- api/symbols/global__.html | 58 +- api/symbols/src/nodeutil-1.0.js.html | 194 +- api/symbols/src/x509-1.1.js.html | 5810 +++++++++++++------------- bower.json | 2 +- jsrsasign-all-min.js | 4 +- jsrsasign-jwths-min.js | 2 +- jsrsasign-rsa-min.js | 2 +- min/x509-1.1.min.js | 2 +- npm/lib/jsrsasign-all-min.js | 4 +- npm/lib/jsrsasign-jwths-min.js | 2 +- npm/lib/jsrsasign-rsa-min.js | 2 +- npm/lib/jsrsasign.js | 4 +- npm/package.json | 2 +- src/x509-1.1.js | 16 +- 16 files changed, 3100 insertions(+), 3016 deletions(-) diff --git a/ChangeLog.txt b/ChangeLog.txt index 38f4bf3c..7df39af5 100755 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -1,9 +1,13 @@ ChangeLog for jsrsasign -TBD -* Changes from 10.1.10 to next release (2021-xx-xx) - - src/nodeutil.js +update X509.getVersion and add jsrsasign-util saveFileJSON +* Changes from 10.1.10 to 10.1.11 (2021-02-19) + - src/x509.js + - X509.getVersion supports other than + empty(DEFAULT =v1) and [0] {INTEGER 2} (=v3). + Thus version checking is relaxed. (#471) + - src/nodeutil.js (jsrsasign-util 1.0.4) - add saveFileUTF8 - saveFileJSON API document fix diff --git a/api/files.html b/api/files.html index c7fc55e4..9679213d 100644 --- a/api/files.html +++ b/api/files.html @@ -827,7 +827,7 @@

nodeutil-1.0.js

Version:
-
jsrsasign-util 1.0.1 nodeutil 1.0.1 (2020-Oct-23)
+
jsrsasign-util 1.0.3 nodeutil 1.0.2 (2021-Feb-15)
diff --git a/api/symbols/global__.html b/api/symbols/global__.html index d8b5b13d..0b8dc818 100644 --- a/api/symbols/global__.html +++ b/api/symbols/global__.html @@ -990,6 +990,16 @@

+ +   + +
saveFileUTF8(binFile, utf8String) +
+
save UTF-8 string to file +This function only works in Node.js.
+ + +   @@ -3625,7 +3635,7 @@ 

var rsu = require("jsrsasign-util");
-rsu.saveJSONC("aaa.jsonc", json);
+rsu.saveFileJSON("aaa.jsonc", json); @@ -3660,6 +3670,52 @@

+
+ + +
+ + + saveFileUTF8(binFile, utf8String) + +
+
+ save UTF-8 string to file +This function only works in Node.js. + +
+ Defined in: nodeutil-1.0.js. + + +
+ + + + +
+
Parameters:
+ +
+ {String} binFile + +
+
file name to save contents.
+ +
+ {String} utf8String + +
+
string contents to be saved.
+ +
+ + + + + + + +
diff --git a/api/symbols/src/nodeutil-1.0.js.html b/api/symbols/src/nodeutil-1.0.js.html index 080e37f7..79aba83d 100644 --- a/api/symbols/src/nodeutil-1.0.js.html +++ b/api/symbols/src/nodeutil-1.0.js.html @@ -5,12 +5,12 @@ .STRN {color: #393;} .REGX {color: #339;} .line {border-right: 1px dotted #666; color: #666; font-style: normal;} - 
  1 /* nodeutil-1.0.1 (c) 2015-2020 Kenji Urushima | kjur.github.com/jsrsasign/license
+	
  1 /* nodeutil-1.0.2 (c) 2015-2021 Kenji Urushima | kjur.github.com/jsrsasign/license
   2  */
   3 /*
   4  * nodeutil.js - Utilities for Node
   5  *
-  6  * Copyright (c) 2015-2020 Kenji Urushima (kenji.urushima@gmail.com)
+  6  * Copyright (c) 2015-2021 Kenji Urushima (kenji.urushima@gmail.com)
   7  *
   8  * This software is licensed under the terms of the MIT License.
   9  * https://kjur.github.io/jsrsasign/license/
@@ -23,7 +23,7 @@
  16  * @fileOverview
  17  * @name nodeutil-1.0.js
  18  * @author Kenji Urushima kenji.urushima@gmail.com
- 19  * @version jsrsasign-util 1.0.1 nodeutil 1.0.1 (2020-Oct-23)
+ 19  * @version jsrsasign-util 1.0.3 nodeutil 1.0.2 (2021-Feb-15)
  20  * @since jsrsasign 5.0.2
  21  * @license <a href="https://kjur.github.io/jsrsasign/license/">MIT License</a>
  22  */
@@ -77,98 +77,110 @@
  70 }
  71 
  72 /**
- 73  * save data represented by hexadecimal string to file
+ 73  * save UTF-8 string to file
  74  * @param {String} binFile file name to save contents.
- 75  * @param {String} hexString hexadecimal string to be saved.
+ 75  * @param {String} utf8String string contents to be saved.
  76  * @description
  77  * This function only works in Node.js.
  78  */
- 79 function saveFileBinByHex(binFile, hexString) {
- 80     var rawString = rs.hextorstr(hexString);
- 81     fs.writeFileSync(binFile, rawString, 'binary');
+ 79 function saveFileUTF8(binFile, utf8String) {
+ 80     var fs = require('fs');
+ 81     fs.writeFileSync(binFile, utf8String, 'utf8');
  82 }
  83 
  84 /**
- 85  * read JSON file and return its JSON object
- 86  * @param {String} JSON file name to be read
- 87  * @return {Object} JSON object or array of file contents
- 88  * @since jsrsasign-util 1.0.1 nodeutil 1.0.1
- 89  *
- 90  * @description
- 91  * This function only works in Node.js.
- 92  * @example
- 93  * var rsu = require("jsrsasign-util");
- 94  * rsu.readJSON("aaa.json") → JSON object
- 95  */
- 96 function readJSON(jsonFile) {
- 97     var jsonStr = fs.readFileSync(jsonFile, "utf8");
- 98     var json = JSON.parse(jsonStr);
- 99     return json;
-100 }
-101 
-102 /**
-103  * read JSONC file and return its JSON object
-104  * @param {String} JSONC file name to be read
-105  * @return {Object} JSON object or array of file contents
-106  * @since jsrsasign-util 1.0.1 nodeutil 1.0.1
-107  *
-108  * @description
-109  * This method read JSONC (i.e. JSON with comments) file
-110  * and returns JSON object.
-111  * This function only works in Node.js.
-112  * 
-113  * @example
-114  * var rsu = require("jsrsasign-util");
-115  * rsu.readJSONC("aaa.jsonc") → JSON object
-116  */
-117 function readJSONC(jsonFile) {
-118     var jsonStr = fs.readFileSync(jsonFile, "utf8");
-119     var json = JSONC.parse(jsonStr);
-120     return json;
-121 }
-122 
-123 /**
-124  * save JSON object as file
-125  * @param {Object} jsonFile output JSON file name
-126  * @param {Object} json JSON object to save
-127  * @since jsrsasign-util 1.0.1 nodeutil 1.0.1
-128  *
-129  * @description
-130  * This method saves JSON object as a file.
-131  * This function only works in Node.js.
-132  * 
-133  * @example
-134  * var rsu = require("jsrsasign-util");
-135  * rsu.saveJSONC("aaa.jsonc", json);
-136  */
-137 function saveFileJSON(jsonFile, json) {
-138     var s = JSON.stringify(json, null, "  ");
-139     saveFile(jsonFile, s);
-140 }
-141 
-142 /**
-143  * output JSON object to console
-144  * @param {Object} json JSON object to print out
-145  * @param {Object} prefix prefix string (OPTION)
-146  * @since jsrsasign-util 1.0.1 nodeutil 1.0.1
-147  *
-148  * @description
-149  * This method writes JSON object to console.
-150  * This function only works in Node.js.
-151  * 
-152  * @example
-153  * var rsu = require("jsrsasign-util");
-154  * var obj = {aaa: "bbb", "ccc": 123};
-155  * rsu.printJSON(obj, "obj = ") →
-156  * obj = {
-157  *   "aaa": "bbb",
-158  *   "ccc": 123
-159  * }
-160  */
-161 function printJSON(json, prefix) {
-162     var s = "";
-163     if (prefix != undefined) s = prefix;
-164     console.log(s + JSON.stringify(json, null, "  "));
-165 }
-166 
-167 

\ No newline at end of file
+ 85  * save data represented by hexadecimal string to file
+ 86  * @param {String} binFile file name to save contents.
+ 87  * @param {String} hexString hexadecimal string to be saved.
+ 88  * @description
+ 89  * This function only works in Node.js.
+ 90  */
+ 91 function saveFileBinByHex(binFile, hexString) {
+ 92     var rawString = rs.hextorstr(hexString);
+ 93     fs.writeFileSync(binFile, rawString, 'binary');
+ 94 }
+ 95 
+ 96 /**
+ 97  * read JSON file and return its JSON object
+ 98  * @param {String} JSON file name to be read
+ 99  * @return {Object} JSON object or array of file contents
+100  * @since jsrsasign-util 1.0.1 nodeutil 1.0.1
+101  *
+102  * @description
+103  * This function only works in Node.js.
+104  * @example
+105  * var rsu = require("jsrsasign-util");
+106  * rsu.readJSON("aaa.json") → JSON object
+107  */
+108 function readJSON(jsonFile) {
+109     var jsonStr = fs.readFileSync(jsonFile, "utf8");
+110     var json = JSON.parse(jsonStr);
+111     return json;
+112 }
+113 
+114 /**
+115  * read JSONC file and return its JSON object
+116  * @param {String} JSONC file name to be read
+117  * @return {Object} JSON object or array of file contents
+118  * @since jsrsasign-util 1.0.1 nodeutil 1.0.1
+119  *
+120  * @description
+121  * This method read JSONC (i.e. JSON with comments) file
+122  * and returns JSON object.
+123  * This function only works in Node.js.
+124  * 
+125  * @example
+126  * var rsu = require("jsrsasign-util");
+127  * rsu.readJSONC("aaa.jsonc") → JSON object
+128  */
+129 function readJSONC(jsonFile) {
+130     var jsonStr = fs.readFileSync(jsonFile, "utf8");
+131     var json = JSONC.parse(jsonStr);
+132     return json;
+133 }
+134 
+135 /**
+136  * save JSON object as file
+137  * @param {Object} jsonFile output JSON file name
+138  * @param {Object} json JSON object to save
+139  * @since jsrsasign-util 1.0.1 nodeutil 1.0.1
+140  *
+141  * @description
+142  * This method saves JSON object as a file.
+143  * This function only works in Node.js.
+144  * 
+145  * @example
+146  * var rsu = require("jsrsasign-util");
+147  * rsu.saveFileJSON("aaa.jsonc", json);
+148  */
+149 function saveFileJSON(jsonFile, json) {
+150     var s = JSON.stringify(json, null, "  ");
+151     saveFileUTF8(jsonFile, s);
+152 }
+153 
+154 /**
+155  * output JSON object to console
+156  * @param {Object} json JSON object to print out
+157  * @param {Object} prefix prefix string (OPTION)
+158  * @since jsrsasign-util 1.0.1 nodeutil 1.0.1
+159  *
+160  * @description
+161  * This method writes JSON object to console.
+162  * This function only works in Node.js.
+163  * 
+164  * @example
+165  * var rsu = require("jsrsasign-util");
+166  * var obj = {aaa: "bbb", "ccc": 123};
+167  * rsu.printJSON(obj, "obj = ") →
+168  * obj = {
+169  *   "aaa": "bbb",
+170  *   "ccc": 123
+171  * }
+172  */
+173 function printJSON(json, prefix) {
+174     var s = "";
+175     if (prefix != undefined) s = prefix;
+176     console.log(s + JSON.stringify(json, null, "  "));
+177 }
+178 
+179
\ No newline at end of file diff --git a/api/symbols/src/x509-1.1.js.html b/api/symbols/src/x509-1.1.js.html index 90bd5980..36759347 100644 --- a/api/symbols/src/x509-1.1.js.html +++ b/api/symbols/src/x509-1.1.js.html @@ -114,2924 +114,2930 @@ 107 _getIdxbyList = _ASN1HEX.getIdxbyList, 108 _getIdxbyListEx = _ASN1HEX.getIdxbyListEx, 109 _getVidx = _ASN1HEX.getVidx, -110 _oidname = _ASN1HEX.oidname, -111 _hextooidstr = _ASN1HEX.hextooidstr, -112 _X509 = X509, -113 _pemtohex = pemtohex, -114 _PSSNAME2ASN1TLV; -115 -116 try { -117 _PSSNAME2ASN1TLV = KJUR.asn1.x509.AlgorithmIdentifier.PSSNAME2ASN1TLV; -118 } catch (ex) {}; -119 this.HEX2STAG = {"0c": "utf8", "13": "prn", "16": "ia5", -120 "1a": "vis" , "1e": "bmp"}; -121 -122 this.hex = null; -123 this.version = 0; // version (1: X509v1, 3: X509v3, others: unspecified) -124 this.foffset = 0; // field index offset (-1: for X509v1, 0: for X509v3) -125 this.aExtInfo = null; -126 -127 // ===== get basic fields from hex ===================================== -128 -129 /** -130 * get format version (X.509v1 or v3 certificate)<br/> -131 * @name getVersion -132 * @memberOf X509# -133 * @function -134 * @return {Number} 1 for X509v1, 3 for X509v3, otherwise 0 -135 * @since jsrsasign 7.1.14 x509 1.1.13 -136 * @description -137 * This method returns a format version of X.509 certificate. -138 * It returns 1 for X.509v1 certificate and 3 for v3 certificate. -139 * Otherwise returns 0. -140 * This method will be automatically called in -141 * {@link X509#readCertPEM}. After then, you can use -142 * {@link X509.version} parameter. -143 * @example -144 * var x = new X509(); -145 * x.readCertPEM(sCertPEM); -146 * version = x.getVersion(); // 1 or 3 -147 * sn = x.getSerialNumberHex(); // return string like "01ad..." -148 */ -149 this.getVersion = function() { -150 if (this.hex === null || this.version !== 0) return this.version; -151 -152 // check if the first item of tbsCertificate "[0] { INTEGER 2 }" -153 if (_getTLVbyList(this.hex, 0, [0, 0]) !== -154 "a003020102") { -155 this.version = 1; -156 this.foffset = -1; -157 return 1; -158 } -159 -160 this.version = 3; -161 return 3; -162 }; -163 -164 /** -165 * get hexadecimal string of serialNumber field of certificate.<br/> -166 * @name getSerialNumberHex -167 * @memberOf X509# -168 * @function -169 * @return {String} hexadecimal string of certificate serial number -170 * @example -171 * var x = new X509(); -172 * x.readCertPEM(sCertPEM); -173 * var sn = x.getSerialNumberHex(); // return string like "01ad..." -174 */ -175 this.getSerialNumberHex = function() { -176 return _getVbyListEx(this.hex, 0, [0, 0], "02"); -177 }; -178 -179 /** -180 * get signature algorithm name in basic field -181 * @name getSignatureAlgorithmField -182 * @memberOf X509# -183 * @function -184 * @return {String} signature algorithm name (ex. SHA1withRSA, SHA256withECDSA, SHA512withRSAandMGF1) -185 * @since x509 1.1.8 -186 * @see X509#getAlgorithmIdentifierName -187 * @description -188 * This method will get a name of signature algorithm in -189 * basic field of certificate. -190 * <br/> -191 * NOTE: From jsrsasign 8.0.21, RSA-PSS certificate is also supported. -192 * For supported RSA-PSS algorithm name and PSS parameters, -193 * see {@link X509#getSignatureAlgorithmField}. -194 * @example -195 * var x = new X509(); -196 * x.readCertPEM(sCertPEM); -197 * algName = x.getSignatureAlgorithmField(); -198 */ -199 this.getSignatureAlgorithmField = function() { -200 var hTLV = _getTLVbyListEx(this.hex, 0, [0, 1]); -201 return this.getAlgorithmIdentifierName(hTLV); -202 }; -203 -204 /** -205 * get algorithm name name of AlgorithmIdentifier ASN.1 structure -206 * @name getAlgorithmIdentifierName -207 * @memberOf X509# -208 * @function -209 * @param {String} hTLV hexadecimal string of AlgorithmIdentifier -210 * @return {String} algorithm name (ex. SHA1withRSA, SHA256withECDSA, SHA512withRSAandMGF1, SHA1) -211 * @since jsrsasign 9.0.0 x509 2.0.0 -212 * @description -213 * This method will get a name of AlgorithmIdentifier. -214 * <br/> -215 * @example -216 * var x = new X509(); -217 * algName = x.getAlgorithmIdentifierName("30..."); -218 */ -219 this.getAlgorithmIdentifierName = function(hTLV) { -220 for (var key in _PSSNAME2ASN1TLV) { -221 if (hTLV === _PSSNAME2ASN1TLV[key]) { -222 return key; -223 } -224 } -225 return _oidname(_getVbyListEx(hTLV, 0, [0], "06")); -226 }; -227 -228 /** -229 * get JSON object of issuer field<br/> -230 * @name getIssuer -231 * @memberOf X509# -232 * @function -233 * @return {Array} JSON object of issuer field -234 * @since jsrsasign 9.0.0 x509 2.0.0 -235 * @see X509#getX500Name -236 * @description -237 * @example -238 * var x = new X509(sCertPEM); -239 * x.getIssuer() → -240 * { array: [[{type:'C',value:'JP',ds:'prn'}],...], -241 * str: "/C=JP/..." } -242 */ -243 this.getIssuer = function() { -244 return this.getX500Name(this.getIssuerHex()) -245 }; -246 -247 /** -248 * get hexadecimal string of issuer field TLV of certificate.<br/> -249 * @name getIssuerHex -250 * @memberOf X509# -251 * @function -252 * @return {String} hexadecial string of issuer DN ASN.1 -253 * @example -254 * var x = new X509(); -255 * x.readCertPEM(sCertPEM); -256 * var issuer = x.getIssuerHex(); // return string like "3013..." -257 */ -258 this.getIssuerHex = function() { -259 return _getTLVbyList(this.hex, 0, [0, 3 + this.foffset], "30"); -260 }; -261 -262 /** -263 * get string of issuer field of certificate.<br/> -264 * @name getIssuerString -265 * @memberOf X509# -266 * @function -267 * @return {String} issuer DN string -268 * @example -269 * var x = new X509(); -270 * x.readCertPEM(sCertPEM); -271 * var dn1 = x.getIssuerString(); // return string like "/C=US/O=TEST" -272 * var dn2 = KJUR.asn1.x509.X500Name.compatToLDAP(dn1); // returns "O=TEST, C=US" -273 */ -274 this.getIssuerString = function() { -275 return _X509.hex2dn(this.getIssuerHex()); -276 }; -277 -278 /** -279 * get JSON object of subject field<br/> -280 * @name getSubject -281 * @memberOf X509# -282 * @function -283 * @return {Array} JSON object of subject field -284 * @since jsrsasign 9.0.0 x509 2.0.0 -285 * @see X509#getX500Name -286 * @description -287 * @example -288 * var x = new X509(sCertPEM); -289 * x.getSubject() → -290 * { array: [[{type:'C',value:'JP',ds:'prn'}],...], -291 * str: "/C=JP/..." } -292 */ -293 this.getSubject = function() { -294 return this.getX500Name(this.getSubjectHex()); -295 }; -296 -297 /** -298 * get hexadecimal string of subject field of certificate.<br/> -299 * @name getSubjectHex -300 * @memberOf X509# -301 * @function -302 * @return {String} hexadecial string of subject DN ASN.1 -303 * @example -304 * var x = new X509(); -305 * x.readCertPEM(sCertPEM); -306 * var subject = x.getSubjectHex(); // return string like "3013..." -307 */ -308 this.getSubjectHex = function() { -309 return _getTLVbyList(this.hex, 0, [0, 5 + this.foffset], "30"); -310 }; -311 -312 /** -313 * get string of subject field of certificate.<br/> -314 * @name getSubjectString -315 * @memberOf X509# -316 * @function -317 * @return {String} subject DN string -318 * @example -319 * var x = new X509(); -320 * x.readCertPEM(sCertPEM); -321 * var dn1 = x.getSubjectString(); // return string like "/C=US/O=TEST" -322 * var dn2 = KJUR.asn1.x509.X500Name.compatToLDAP(dn1); // returns "O=TEST, C=US" -323 */ -324 this.getSubjectString = function() { -325 return _X509.hex2dn(this.getSubjectHex()); -326 }; -327 -328 /** -329 * get notBefore field string of certificate.<br/> -330 * @name getNotBefore -331 * @memberOf X509# -332 * @function -333 * @return {String} not before time value (ex. "151231235959Z") -334 * @example -335 * var x = new X509(); -336 * x.readCertPEM(sCertPEM); -337 * var notBefore = x.getNotBefore(); // return string like "151231235959Z" -338 */ -339 this.getNotBefore = function() { -340 var s = _getVbyList(this.hex, 0, [0, 4 + this.foffset, 0]); -341 s = s.replace(/(..)/g, "%$1"); -342 s = decodeURIComponent(s); -343 return s; -344 }; -345 -346 /** -347 * get notAfter field string of certificate.<br/> -348 * @name getNotAfter -349 * @memberOf X509# -350 * @function -351 * @return {String} not after time value (ex. "151231235959Z") -352 * @example -353 * var x = new X509(); -354 * x.readCertPEM(sCertPEM); -355 * var notAfter = x.getNotAfter(); // return string like "151231235959Z" -356 */ -357 this.getNotAfter = function() { -358 var s = _getVbyList(this.hex, 0, [0, 4 + this.foffset, 1]); -359 s = s.replace(/(..)/g, "%$1"); -360 s = decodeURIComponent(s); -361 return s; -362 }; -363 -364 /** -365 * get a hexadecimal string of subjectPublicKeyInfo field.<br/> -366 * @name getPublicKeyHex -367 * @memberOf X509# -368 * @function -369 * @return {String} ASN.1 SEQUENCE hexadecimal string of subjectPublicKeyInfo field -370 * @since jsrsasign 7.1.4 x509 1.1.13 -371 * @example -372 * x = new X509(); -373 * x.readCertPEM(sCertPEM); -374 * hSPKI = x.getPublicKeyHex(); // return string like "30820122..." -375 */ -376 this.getPublicKeyHex = function() { -377 return _ASN1HEX.getTLVbyList(this.hex, 0, [0, 6 + this.foffset], "30"); -378 }; -379 -380 /** -381 * get a string index of subjectPublicKeyInfo field for hexadecimal string certificate.<br/> -382 * @name getPublicKeyIdx -383 * @memberOf X509# -384 * @function -385 * @return {Number} string index of subjectPublicKeyInfo field for hexadecimal string certificate. -386 * @since jsrsasign 7.1.4 x509 1.1.13 -387 * @example -388 * x = new X509(); -389 * x.readCertPEM(sCertPEM); -390 * idx = x.getPublicKeyIdx(); // return string index in x.hex parameter -391 */ -392 this.getPublicKeyIdx = function() { -393 return _getIdxbyList(this.hex, 0, [0, 6 + this.foffset], "30"); -394 }; -395 -396 /** -397 * get a string index of contents of subjectPublicKeyInfo BITSTRING value from hexadecimal certificate<br/> -398 * @name getPublicKeyContentIdx -399 * @memberOf X509# -400 * @function -401 * @return {Integer} string index of key contents -402 * @since jsrsasign 8.0.0 x509 1.2.0 -403 * @example -404 * x = new X509(); -405 * x.readCertPEM(sCertPEM); -406 * idx = x.getPublicKeyContentIdx(); // return string index in x.hex parameter -407 */ -408 // NOTE: Without BITSTRING encapsulation. -409 this.getPublicKeyContentIdx = function() { -410 var idx = this.getPublicKeyIdx(); -411 return _getIdxbyList(this.hex, idx, [1, 0], "30"); -412 }; -413 -414 /** -415 * get a RSAKey/ECDSA/DSA public key object of subjectPublicKeyInfo field.<br/> -416 * @name getPublicKey -417 * @memberOf X509# -418 * @function -419 * @return {Object} RSAKey/ECDSA/DSA public key object of subjectPublicKeyInfo field -420 * @since jsrsasign 7.1.4 x509 1.1.13 -421 * @example -422 * x = new X509(); -423 * x.readCertPEM(sCertPEM); -424 * pubkey= x.getPublicKey(); -425 */ -426 this.getPublicKey = function() { -427 return KEYUTIL.getKey(this.getPublicKeyHex(), null, "pkcs8pub"); -428 }; -429 -430 /** -431 * get signature algorithm name from hexadecimal certificate data -432 * @name getSignatureAlgorithmName -433 * @memberOf X509# -434 * @function -435 * @return {String} signature algorithm name (ex. SHA1withRSA, SHA256withECDSA) -436 * @since jsrsasign 7.2.0 x509 1.1.14 -437 * @see X509#getAlgorithmIdentifierName -438 * @description -439 * This method will get signature algorithm name of certificate: -440 * @example -441 * var x = new X509(); -442 * x.readCertPEM(sCertPEM); -443 * x.getSignatureAlgorithmName() → "SHA256withRSA" -444 */ -445 this.getSignatureAlgorithmName = function() { -446 var hTLV = _getTLVbyList(this.hex, 0, [1], "30"); -447 return this.getAlgorithmIdentifierName(hTLV); -448 }; -449 -450 /** -451 * get signature value as hexadecimal string<br/> -452 * @name getSignatureValueHex -453 * @memberOf X509# -454 * @function -455 * @return {String} signature value hexadecimal string without BitString unused bits -456 * @since jsrsasign 7.2.0 x509 1.1.14 -457 * -458 * @description -459 * This method will get signature value of certificate: -460 * -461 * @example -462 * var x = new X509(); -463 * x.readCertPEM(sCertPEM); -464 * x.getSignatureValueHex() &rarr "8a4c47913..." -465 */ -466 this.getSignatureValueHex = function() { -467 return _getVbyList(this.hex, 0, [2], "03", true); -468 }; -469 -470 /** -471 * verifies signature value by public key<br/> -472 * @name verifySignature -473 * @memberOf X509# -474 * @function -475 * @param {Object} pubKey public key object -476 * @return {Boolean} true if signature value is valid otherwise false -477 * @since jsrsasign 7.2.0 x509 1.1.14 -478 * -479 * @description -480 * This method verifies signature value of hexadecimal string of -481 * X.509 certificate by specified public key object. -482 * The signature algorithm used to verify will refer -483 * signatureAlgorithm field. (See {@link X509#getSignatureAlgorithmField}) -484 * RSA-PSS signature algorithms (SHA{,256,384,512}withRSAandMGF1) -485 * are available. -486 * -487 * @example -488 * pubKey = KEYUTIL.getKey(pemPublicKey); // or certificate -489 * x = new X509(); -490 * x.readCertPEM(pemCert); -491 * x.verifySignature(pubKey) → true, false or raising exception -492 */ -493 this.verifySignature = function(pubKey) { -494 var algName = this.getSignatureAlgorithmField(); -495 var hSigVal = this.getSignatureValueHex(); -496 var hTbsCert = _getTLVbyList(this.hex, 0, [0], "30"); -497 -498 var sig = new KJUR.crypto.Signature({alg: algName}); -499 sig.init(pubKey); -500 sig.updateHex(hTbsCert); -501 return sig.verify(hSigVal); -502 }; -503 -504 // ===== parse extension ====================================== -505 /** -506 * set array of X.509v3 and CSR extesion information such as extension OID, criticality and value index. (DEPRECATED)<br/> -507 * @name parseExt -508 * @memberOf X509# -509 * @function -510 * @param {String} hCSR - PEM string of certificate signing requrest(CSR) (OPTION) -511 * @since jsrsasign 7.2.0 x509 1.1.14 -512 * @deprecated jsrsasign 9.1.1 x509 2.0.1 -513 * -514 * @description -515 * This method will set an array of X.509v3 extension information having -516 * following parameters: -517 * <ul> -518 * <li>oid - extension OID (ex. 2.5.29.19)</li> -519 * <li>critical - true or false</li> -520 * <li>vidx - string index for extension value</li> -521 * <br/> -522 * When you want to parse extensionRequest of CSR, -523 * argument 'hCSR' shall be specified. -524 * <br/> -525 * NOTE: CSR is supported from jsrsasign 8.0.20 x509 1.1.22. -526 * <br/> -527 * This method and X509.aExtInfo property -528 * have been *deprecated* since jsrsasign 9.1.1. -529 * All extension parser method such as X509.getExt* shall be -530 * call with argument "hExtV" and "critical" explicitly. -531 * -532 * @example -533 * x = new X509(); -534 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. -535 * -536 * x.aExtInfo → -537 * [ { oid: "2.5.29,19", critical: true, vidx: 2504 }, ... ] -538 * -539 * // to parse CSR -540 * X = new X509() -541 * x.parseExt("-----BEGIN CERTIFICATE REQUEST-----..."); +110 _getInt = _ASN1HEX.getInt, +111 _oidname = _ASN1HEX.oidname, +112 _hextooidstr = _ASN1HEX.hextooidstr, +113 _X509 = X509, +114 _pemtohex = pemtohex, +115 _PSSNAME2ASN1TLV; +116 +117 try { +118 _PSSNAME2ASN1TLV = KJUR.asn1.x509.AlgorithmIdentifier.PSSNAME2ASN1TLV; +119 } catch (ex) {}; +120 this.HEX2STAG = {"0c": "utf8", "13": "prn", "16": "ia5", +121 "1a": "vis" , "1e": "bmp"}; +122 +123 this.hex = null; +124 this.version = 0; // version (1: X509v1, 3: X509v3, others: unspecified) +125 this.foffset = 0; // field index offset (-1: for X509v1, 0: for X509v3) +126 this.aExtInfo = null; +127 +128 // ===== get basic fields from hex ===================================== +129 +130 /** +131 * get format version (X.509v1 or v3 certificate)<br/> +132 * @name getVersion +133 * @memberOf X509# +134 * @function +135 * @return {Number} 1 for X509v1, 3 for X509v3, otherwise 0 +136 * @since jsrsasign 7.1.14 x509 1.1.13 +137 * @description +138 * This method returns a format version of X.509 certificate. +139 * It returns 1 for X.509v1 certificate and 3 for v3 certificate. +140 * Otherwise returns 0. +141 * This method will be automatically called in +142 * {@link X509#readCertPEM}. After then, you can use +143 * {@link X509.version} parameter. +144 * @example +145 * var x = new X509(); +146 * x.readCertPEM(sCertPEM); +147 * version = x.getVersion(); // 1 or 3 +148 * sn = x.getSerialNumberHex(); // return string like "01ad..." +149 */ +150 this.getVersion = function() { +151 if (this.hex === null || this.version !== 0) return this.version; +152 +153 // check if the first item of tbsCertificate "[0] { INTEGER 2 }" +154 var hFirstObj = _getTLVbyList(this.hex, 0, [0, 0]); +155 if (hFirstObj.substr(0, 2) == "a0") { +156 var hVersionTLV = _getTLVbyList(hFirstObj, 0, [0]); +157 var iVersion = _getInt(hVersionTLV, 0); +158 if (iVersion < 0 || 2 < iVersion) { +159 throw new Error("malformed version field"); +160 } +161 this.version = iVersion + 1; +162 return this.version; +163 } else { +164 this.version = 1; +165 this.foffset = -1; +166 return 1; +167 } +168 }; +169 +170 /** +171 * get hexadecimal string of serialNumber field of certificate.<br/> +172 * @name getSerialNumberHex +173 * @memberOf X509# +174 * @function +175 * @return {String} hexadecimal string of certificate serial number +176 * @example +177 * var x = new X509(); +178 * x.readCertPEM(sCertPEM); +179 * var sn = x.getSerialNumberHex(); // return string like "01ad..." +180 */ +181 this.getSerialNumberHex = function() { +182 return _getVbyListEx(this.hex, 0, [0, 0], "02"); +183 }; +184 +185 /** +186 * get signature algorithm name in basic field +187 * @name getSignatureAlgorithmField +188 * @memberOf X509# +189 * @function +190 * @return {String} signature algorithm name (ex. SHA1withRSA, SHA256withECDSA, SHA512withRSAandMGF1) +191 * @since x509 1.1.8 +192 * @see X509#getAlgorithmIdentifierName +193 * @description +194 * This method will get a name of signature algorithm in +195 * basic field of certificate. +196 * <br/> +197 * NOTE: From jsrsasign 8.0.21, RSA-PSS certificate is also supported. +198 * For supported RSA-PSS algorithm name and PSS parameters, +199 * see {@link X509#getSignatureAlgorithmField}. +200 * @example +201 * var x = new X509(); +202 * x.readCertPEM(sCertPEM); +203 * algName = x.getSignatureAlgorithmField(); +204 */ +205 this.getSignatureAlgorithmField = function() { +206 var hTLV = _getTLVbyListEx(this.hex, 0, [0, 1]); +207 return this.getAlgorithmIdentifierName(hTLV); +208 }; +209 +210 /** +211 * get algorithm name name of AlgorithmIdentifier ASN.1 structure +212 * @name getAlgorithmIdentifierName +213 * @memberOf X509# +214 * @function +215 * @param {String} hTLV hexadecimal string of AlgorithmIdentifier +216 * @return {String} algorithm name (ex. SHA1withRSA, SHA256withECDSA, SHA512withRSAandMGF1, SHA1) +217 * @since jsrsasign 9.0.0 x509 2.0.0 +218 * @description +219 * This method will get a name of AlgorithmIdentifier. +220 * <br/> +221 * @example +222 * var x = new X509(); +223 * algName = x.getAlgorithmIdentifierName("30..."); +224 */ +225 this.getAlgorithmIdentifierName = function(hTLV) { +226 for (var key in _PSSNAME2ASN1TLV) { +227 if (hTLV === _PSSNAME2ASN1TLV[key]) { +228 return key; +229 } +230 } +231 return _oidname(_getVbyListEx(hTLV, 0, [0], "06")); +232 }; +233 +234 /** +235 * get JSON object of issuer field<br/> +236 * @name getIssuer +237 * @memberOf X509# +238 * @function +239 * @return {Array} JSON object of issuer field +240 * @since jsrsasign 9.0.0 x509 2.0.0 +241 * @see X509#getX500Name +242 * @description +243 * @example +244 * var x = new X509(sCertPEM); +245 * x.getIssuer() → +246 * { array: [[{type:'C',value:'JP',ds:'prn'}],...], +247 * str: "/C=JP/..." } +248 */ +249 this.getIssuer = function() { +250 return this.getX500Name(this.getIssuerHex()) +251 }; +252 +253 /** +254 * get hexadecimal string of issuer field TLV of certificate.<br/> +255 * @name getIssuerHex +256 * @memberOf X509# +257 * @function +258 * @return {String} hexadecial string of issuer DN ASN.1 +259 * @example +260 * var x = new X509(); +261 * x.readCertPEM(sCertPEM); +262 * var issuer = x.getIssuerHex(); // return string like "3013..." +263 */ +264 this.getIssuerHex = function() { +265 return _getTLVbyList(this.hex, 0, [0, 3 + this.foffset], "30"); +266 }; +267 +268 /** +269 * get string of issuer field of certificate.<br/> +270 * @name getIssuerString +271 * @memberOf X509# +272 * @function +273 * @return {String} issuer DN string +274 * @example +275 * var x = new X509(); +276 * x.readCertPEM(sCertPEM); +277 * var dn1 = x.getIssuerString(); // return string like "/C=US/O=TEST" +278 * var dn2 = KJUR.asn1.x509.X500Name.compatToLDAP(dn1); // returns "O=TEST, C=US" +279 */ +280 this.getIssuerString = function() { +281 return _X509.hex2dn(this.getIssuerHex()); +282 }; +283 +284 /** +285 * get JSON object of subject field<br/> +286 * @name getSubject +287 * @memberOf X509# +288 * @function +289 * @return {Array} JSON object of subject field +290 * @since jsrsasign 9.0.0 x509 2.0.0 +291 * @see X509#getX500Name +292 * @description +293 * @example +294 * var x = new X509(sCertPEM); +295 * x.getSubject() → +296 * { array: [[{type:'C',value:'JP',ds:'prn'}],...], +297 * str: "/C=JP/..." } +298 */ +299 this.getSubject = function() { +300 return this.getX500Name(this.getSubjectHex()); +301 }; +302 +303 /** +304 * get hexadecimal string of subject field of certificate.<br/> +305 * @name getSubjectHex +306 * @memberOf X509# +307 * @function +308 * @return {String} hexadecial string of subject DN ASN.1 +309 * @example +310 * var x = new X509(); +311 * x.readCertPEM(sCertPEM); +312 * var subject = x.getSubjectHex(); // return string like "3013..." +313 */ +314 this.getSubjectHex = function() { +315 return _getTLVbyList(this.hex, 0, [0, 5 + this.foffset], "30"); +316 }; +317 +318 /** +319 * get string of subject field of certificate.<br/> +320 * @name getSubjectString +321 * @memberOf X509# +322 * @function +323 * @return {String} subject DN string +324 * @example +325 * var x = new X509(); +326 * x.readCertPEM(sCertPEM); +327 * var dn1 = x.getSubjectString(); // return string like "/C=US/O=TEST" +328 * var dn2 = KJUR.asn1.x509.X500Name.compatToLDAP(dn1); // returns "O=TEST, C=US" +329 */ +330 this.getSubjectString = function() { +331 return _X509.hex2dn(this.getSubjectHex()); +332 }; +333 +334 /** +335 * get notBefore field string of certificate.<br/> +336 * @name getNotBefore +337 * @memberOf X509# +338 * @function +339 * @return {String} not before time value (ex. "151231235959Z") +340 * @example +341 * var x = new X509(); +342 * x.readCertPEM(sCertPEM); +343 * var notBefore = x.getNotBefore(); // return string like "151231235959Z" +344 */ +345 this.getNotBefore = function() { +346 var s = _getVbyList(this.hex, 0, [0, 4 + this.foffset, 0]); +347 s = s.replace(/(..)/g, "%$1"); +348 s = decodeURIComponent(s); +349 return s; +350 }; +351 +352 /** +353 * get notAfter field string of certificate.<br/> +354 * @name getNotAfter +355 * @memberOf X509# +356 * @function +357 * @return {String} not after time value (ex. "151231235959Z") +358 * @example +359 * var x = new X509(); +360 * x.readCertPEM(sCertPEM); +361 * var notAfter = x.getNotAfter(); // return string like "151231235959Z" +362 */ +363 this.getNotAfter = function() { +364 var s = _getVbyList(this.hex, 0, [0, 4 + this.foffset, 1]); +365 s = s.replace(/(..)/g, "%$1"); +366 s = decodeURIComponent(s); +367 return s; +368 }; +369 +370 /** +371 * get a hexadecimal string of subjectPublicKeyInfo field.<br/> +372 * @name getPublicKeyHex +373 * @memberOf X509# +374 * @function +375 * @return {String} ASN.1 SEQUENCE hexadecimal string of subjectPublicKeyInfo field +376 * @since jsrsasign 7.1.4 x509 1.1.13 +377 * @example +378 * x = new X509(); +379 * x.readCertPEM(sCertPEM); +380 * hSPKI = x.getPublicKeyHex(); // return string like "30820122..." +381 */ +382 this.getPublicKeyHex = function() { +383 return _ASN1HEX.getTLVbyList(this.hex, 0, [0, 6 + this.foffset], "30"); +384 }; +385 +386 /** +387 * get a string index of subjectPublicKeyInfo field for hexadecimal string certificate.<br/> +388 * @name getPublicKeyIdx +389 * @memberOf X509# +390 * @function +391 * @return {Number} string index of subjectPublicKeyInfo field for hexadecimal string certificate. +392 * @since jsrsasign 7.1.4 x509 1.1.13 +393 * @example +394 * x = new X509(); +395 * x.readCertPEM(sCertPEM); +396 * idx = x.getPublicKeyIdx(); // return string index in x.hex parameter +397 */ +398 this.getPublicKeyIdx = function() { +399 return _getIdxbyList(this.hex, 0, [0, 6 + this.foffset], "30"); +400 }; +401 +402 /** +403 * get a string index of contents of subjectPublicKeyInfo BITSTRING value from hexadecimal certificate<br/> +404 * @name getPublicKeyContentIdx +405 * @memberOf X509# +406 * @function +407 * @return {Integer} string index of key contents +408 * @since jsrsasign 8.0.0 x509 1.2.0 +409 * @example +410 * x = new X509(); +411 * x.readCertPEM(sCertPEM); +412 * idx = x.getPublicKeyContentIdx(); // return string index in x.hex parameter +413 */ +414 // NOTE: Without BITSTRING encapsulation. +415 this.getPublicKeyContentIdx = function() { +416 var idx = this.getPublicKeyIdx(); +417 return _getIdxbyList(this.hex, idx, [1, 0], "30"); +418 }; +419 +420 /** +421 * get a RSAKey/ECDSA/DSA public key object of subjectPublicKeyInfo field.<br/> +422 * @name getPublicKey +423 * @memberOf X509# +424 * @function +425 * @return {Object} RSAKey/ECDSA/DSA public key object of subjectPublicKeyInfo field +426 * @since jsrsasign 7.1.4 x509 1.1.13 +427 * @example +428 * x = new X509(); +429 * x.readCertPEM(sCertPEM); +430 * pubkey= x.getPublicKey(); +431 */ +432 this.getPublicKey = function() { +433 return KEYUTIL.getKey(this.getPublicKeyHex(), null, "pkcs8pub"); +434 }; +435 +436 /** +437 * get signature algorithm name from hexadecimal certificate data +438 * @name getSignatureAlgorithmName +439 * @memberOf X509# +440 * @function +441 * @return {String} signature algorithm name (ex. SHA1withRSA, SHA256withECDSA) +442 * @since jsrsasign 7.2.0 x509 1.1.14 +443 * @see X509#getAlgorithmIdentifierName +444 * @description +445 * This method will get signature algorithm name of certificate: +446 * @example +447 * var x = new X509(); +448 * x.readCertPEM(sCertPEM); +449 * x.getSignatureAlgorithmName() → "SHA256withRSA" +450 */ +451 this.getSignatureAlgorithmName = function() { +452 var hTLV = _getTLVbyList(this.hex, 0, [1], "30"); +453 return this.getAlgorithmIdentifierName(hTLV); +454 }; +455 +456 /** +457 * get signature value as hexadecimal string<br/> +458 * @name getSignatureValueHex +459 * @memberOf X509# +460 * @function +461 * @return {String} signature value hexadecimal string without BitString unused bits +462 * @since jsrsasign 7.2.0 x509 1.1.14 +463 * +464 * @description +465 * This method will get signature value of certificate: +466 * +467 * @example +468 * var x = new X509(); +469 * x.readCertPEM(sCertPEM); +470 * x.getSignatureValueHex() &rarr "8a4c47913..." +471 */ +472 this.getSignatureValueHex = function() { +473 return _getVbyList(this.hex, 0, [2], "03", true); +474 }; +475 +476 /** +477 * verifies signature value by public key<br/> +478 * @name verifySignature +479 * @memberOf X509# +480 * @function +481 * @param {Object} pubKey public key object +482 * @return {Boolean} true if signature value is valid otherwise false +483 * @since jsrsasign 7.2.0 x509 1.1.14 +484 * +485 * @description +486 * This method verifies signature value of hexadecimal string of +487 * X.509 certificate by specified public key object. +488 * The signature algorithm used to verify will refer +489 * signatureAlgorithm field. (See {@link X509#getSignatureAlgorithmField}) +490 * RSA-PSS signature algorithms (SHA{,256,384,512}withRSAandMGF1) +491 * are available. +492 * +493 * @example +494 * pubKey = KEYUTIL.getKey(pemPublicKey); // or certificate +495 * x = new X509(); +496 * x.readCertPEM(pemCert); +497 * x.verifySignature(pubKey) → true, false or raising exception +498 */ +499 this.verifySignature = function(pubKey) { +500 var algName = this.getSignatureAlgorithmField(); +501 var hSigVal = this.getSignatureValueHex(); +502 var hTbsCert = _getTLVbyList(this.hex, 0, [0], "30"); +503 +504 var sig = new KJUR.crypto.Signature({alg: algName}); +505 sig.init(pubKey); +506 sig.updateHex(hTbsCert); +507 return sig.verify(hSigVal); +508 }; +509 +510 // ===== parse extension ====================================== +511 /** +512 * set array of X.509v3 and CSR extesion information such as extension OID, criticality and value index. (DEPRECATED)<br/> +513 * @name parseExt +514 * @memberOf X509# +515 * @function +516 * @param {String} hCSR - PEM string of certificate signing requrest(CSR) (OPTION) +517 * @since jsrsasign 7.2.0 x509 1.1.14 +518 * @deprecated jsrsasign 9.1.1 x509 2.0.1 +519 * +520 * @description +521 * This method will set an array of X.509v3 extension information having +522 * following parameters: +523 * <ul> +524 * <li>oid - extension OID (ex. 2.5.29.19)</li> +525 * <li>critical - true or false</li> +526 * <li>vidx - string index for extension value</li> +527 * <br/> +528 * When you want to parse extensionRequest of CSR, +529 * argument 'hCSR' shall be specified. +530 * <br/> +531 * NOTE: CSR is supported from jsrsasign 8.0.20 x509 1.1.22. +532 * <br/> +533 * This method and X509.aExtInfo property +534 * have been *deprecated* since jsrsasign 9.1.1. +535 * All extension parser method such as X509.getExt* shall be +536 * call with argument "hExtV" and "critical" explicitly. +537 * +538 * @example +539 * x = new X509(); +540 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. +541 * 542 * x.aExtInfo → 543 * [ { oid: "2.5.29,19", critical: true, vidx: 2504 }, ... ] -544 */ -545 this.parseExt = function(hCSR) { -546 var iExtSeq, aExtIdx, h; -547 -548 if (hCSR === undefined) { -549 h = this.hex; -550 if (this.version !== 3) return -1; -551 iExtSeq = _getIdxbyList(h, 0, [0, 7, 0], "30"); -552 aExtIdx = _getChildIdx(h, iExtSeq); -553 } else { -554 h = pemtohex(hCSR); -555 var idx1 = _getIdxbyList(h, 0, [0, 3, 0, 0], "06"); -556 -557 if (_getV(h, idx1) != "2a864886f70d01090e") { -558 this.aExtInfo = new Array(); -559 return; -560 } -561 -562 iExtSeq = _getIdxbyList(h, 0, [0, 3, 0, 1, 0], "30"); -563 aExtIdx = _getChildIdx(h, iExtSeq); -564 -565 this.hex = h; -566 } -567 -568 this.aExtInfo = new Array(); -569 for (var i = 0; i < aExtIdx.length; i++) { -570 var item = {}; -571 item.critical = false; -572 var a = _getChildIdx(h, aExtIdx[i]); -573 var offset = 0; -574 -575 if (a.length === 3) { -576 item.critical = true; -577 offset = 1; -578 } -579 -580 item.oid = _ASN1HEX.hextooidstr(_getVbyList(h, aExtIdx[i], [0], "06")); -581 var octidx = _getIdxbyList(h, aExtIdx[i], [1 + offset]); -582 item.vidx = _getVidx(h, octidx); -583 this.aExtInfo.push(item); -584 } -585 }; -586 -587 /** -588 * get a X.509v3 extesion information such as extension OID, criticality and value index for specified oid or name.<br/> -589 * @name getExtInfo -590 * @memberOf X509# -591 * @function -592 * @param {String} oidOrName X.509 extension oid or name (ex. keyUsage or 2.5.29.19) -593 * @return X.509 extension information such as extension OID or value indx (see {@link X509#parseExt}) -594 * @since jsrsasign 7.2.0 x509 1.1.14 -595 * @description -596 * This method will get an X.509v3 extension information JSON object -597 * having extension OID, criticality and value idx for specified -598 * extension OID or name. -599 * If there is no such extension, this returns undefined. -600 * @example -601 * x = new X509(); -602 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. -603 * -604 * x.getExtInfo("keyUsage") → { oid: "2.5.29.15", critical: true, vidx: 1714 } -605 * x.getExtInfo("unknownExt") → undefined -606 */ -607 this.getExtInfo = function(oidOrName) { -608 var a = this.aExtInfo; -609 var oid = oidOrName; -610 if (! oidOrName.match(/^[0-9.]+$/)) { -611 oid = KJUR.asn1.x509.OID.name2oid(oidOrName); -612 } -613 if (oid === '') return undefined; -614 -615 for (var i = 0; i < a.length; i++) { -616 if (a[i].oid === oid) return a[i]; -617 } -618 return undefined; -619 }; +544 * +545 * // to parse CSR +546 * X = new X509() +547 * x.parseExt("-----BEGIN CERTIFICATE REQUEST-----..."); +548 * x.aExtInfo → +549 * [ { oid: "2.5.29,19", critical: true, vidx: 2504 }, ... ] +550 */ +551 this.parseExt = function(hCSR) { +552 var iExtSeq, aExtIdx, h; +553 +554 if (hCSR === undefined) { +555 h = this.hex; +556 if (this.version !== 3) return -1; +557 iExtSeq = _getIdxbyList(h, 0, [0, 7, 0], "30"); +558 aExtIdx = _getChildIdx(h, iExtSeq); +559 } else { +560 h = pemtohex(hCSR); +561 var idx1 = _getIdxbyList(h, 0, [0, 3, 0, 0], "06"); +562 +563 if (_getV(h, idx1) != "2a864886f70d01090e") { +564 this.aExtInfo = new Array(); +565 return; +566 } +567 +568 iExtSeq = _getIdxbyList(h, 0, [0, 3, 0, 1, 0], "30"); +569 aExtIdx = _getChildIdx(h, iExtSeq); +570 +571 this.hex = h; +572 } +573 +574 this.aExtInfo = new Array(); +575 for (var i = 0; i < aExtIdx.length; i++) { +576 var item = {}; +577 item.critical = false; +578 var a = _getChildIdx(h, aExtIdx[i]); +579 var offset = 0; +580 +581 if (a.length === 3) { +582 item.critical = true; +583 offset = 1; +584 } +585 +586 item.oid = _ASN1HEX.hextooidstr(_getVbyList(h, aExtIdx[i], [0], "06")); +587 var octidx = _getIdxbyList(h, aExtIdx[i], [1 + offset]); +588 item.vidx = _getVidx(h, octidx); +589 this.aExtInfo.push(item); +590 } +591 }; +592 +593 /** +594 * get a X.509v3 extesion information such as extension OID, criticality and value index for specified oid or name.<br/> +595 * @name getExtInfo +596 * @memberOf X509# +597 * @function +598 * @param {String} oidOrName X.509 extension oid or name (ex. keyUsage or 2.5.29.19) +599 * @return X.509 extension information such as extension OID or value indx (see {@link X509#parseExt}) +600 * @since jsrsasign 7.2.0 x509 1.1.14 +601 * @description +602 * This method will get an X.509v3 extension information JSON object +603 * having extension OID, criticality and value idx for specified +604 * extension OID or name. +605 * If there is no such extension, this returns undefined. +606 * @example +607 * x = new X509(); +608 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. +609 * +610 * x.getExtInfo("keyUsage") → { oid: "2.5.29.15", critical: true, vidx: 1714 } +611 * x.getExtInfo("unknownExt") → undefined +612 */ +613 this.getExtInfo = function(oidOrName) { +614 var a = this.aExtInfo; +615 var oid = oidOrName; +616 if (! oidOrName.match(/^[0-9.]+$/)) { +617 oid = KJUR.asn1.x509.OID.name2oid(oidOrName); +618 } +619 if (oid === '') return undefined; 620 -621 /** -622 * get BasicConstraints extension value as object in the certificate -623 * @name getExtBasicConstraints -624 * @memberOf X509# -625 * @function -626 * @param {String} hExtV hexadecimal string of extension value (OPTIONAL) -627 * @param {Boolean} critical flag (OPTIONAL) -628 * @return {Array} JSON object of BasicConstraints parameter or undefined -629 * @since jsrsasign 7.2.0 x509 1.1.14 -630 * @see KJUR.asn1.x509.BasicConstraints -631 * @description -632 * This method will get basic constraints extension value as object with following paramters. -633 * <ul> -634 * <li>{Boolean}cA - CA flag whether CA or not</li> -635 * <li>{Integer}pathLen - maximum intermediate certificate length</li> -636 * <li>{Boolean}critical - critical flag</li> -637 * </ul> -638 * There are use cases for return values: +621 for (var i = 0; i < a.length; i++) { +622 if (a[i].oid === oid) return a[i]; +623 } +624 return undefined; +625 }; +626 +627 /** +628 * get BasicConstraints extension value as object in the certificate +629 * @name getExtBasicConstraints +630 * @memberOf X509# +631 * @function +632 * @param {String} hExtV hexadecimal string of extension value (OPTIONAL) +633 * @param {Boolean} critical flag (OPTIONAL) +634 * @return {Array} JSON object of BasicConstraints parameter or undefined +635 * @since jsrsasign 7.2.0 x509 1.1.14 +636 * @see KJUR.asn1.x509.BasicConstraints +637 * @description +638 * This method will get basic constraints extension value as object with following paramters. 639 * <ul> -640 * <li>{cA:true,pathLen:3,critical:true} - cA flag is true and pathLen is 3</li> -641 * <li>{cA:true,critical:true} - cA flag is true and no pathLen</li> -642 * <li>{} - basic constraints has no value in case of end entity certificate</li> -643 * <li>undefined - there is no basic constraints extension</li> -644 * </ul> -645 * @example -646 * x = new X509(); -647 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. -648 * x.getExtBasicConstraints() → {cA:true,pathLen:3,critical:true} -649 */ -650 this.getExtBasicConstraints = function(hExtV, critical) { -651 if (hExtV === undefined && critical === undefined) { -652 var info = this.getExtInfo("basicConstraints"); -653 if (info === undefined) return undefined; -654 hExtV = _getTLV(this.hex, info.vidx); -655 critical = info.critical; -656 } -657 -658 var result = {extname:"basicConstraints"}; -659 if (critical) result.critical = true; -660 -661 if (hExtV === '3000') return result; -662 if (hExtV === '30030101ff') { -663 result.cA = true; -664 return result; -665 } -666 if (hExtV.substr(0, 12) === '30060101ff02') { -667 var pathLexHex = _getV(hExtV, 10); -668 var pathLen = parseInt(pathLexHex, 16); +640 * <li>{Boolean}cA - CA flag whether CA or not</li> +641 * <li>{Integer}pathLen - maximum intermediate certificate length</li> +642 * <li>{Boolean}critical - critical flag</li> +643 * </ul> +644 * There are use cases for return values: +645 * <ul> +646 * <li>{cA:true,pathLen:3,critical:true} - cA flag is true and pathLen is 3</li> +647 * <li>{cA:true,critical:true} - cA flag is true and no pathLen</li> +648 * <li>{} - basic constraints has no value in case of end entity certificate</li> +649 * <li>undefined - there is no basic constraints extension</li> +650 * </ul> +651 * @example +652 * x = new X509(); +653 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. +654 * x.getExtBasicConstraints() → {cA:true,pathLen:3,critical:true} +655 */ +656 this.getExtBasicConstraints = function(hExtV, critical) { +657 if (hExtV === undefined && critical === undefined) { +658 var info = this.getExtInfo("basicConstraints"); +659 if (info === undefined) return undefined; +660 hExtV = _getTLV(this.hex, info.vidx); +661 critical = info.critical; +662 } +663 +664 var result = {extname:"basicConstraints"}; +665 if (critical) result.critical = true; +666 +667 if (hExtV === '3000') return result; +668 if (hExtV === '30030101ff') { 669 result.cA = true; -670 result.pathLen = pathLen; -671 return result; -672 } -673 throw new Error("hExtV parse error: " + hExtV); -674 }; -675 -676 /** -677 * get KeyUsage extension value as JSON object -678 * @memberOf X509# -679 * @function -680 * @name getExtKeyUsage -681 * @param {String} hExtV hexadecimal string of extension value (OPTIONAL) -682 * @param {Boolean} critical flag (OPTIONAL) -683 * @return {Array} JSON object of KeyUsage parameter or undefined -684 * @since jsrsasign 9.0.0 x509 2.0.0 -685 * @see KJUR.asn1.x509.KeyUsage -686 * @see X509#getExtKeyUsageString -687 * @description -688 * This method parse keyUsage extension. When arguments are -689 * not specified, its extension in X509 object will be parsed. -690 * Result of this method can be passed to -691 * {@link KJUR.asn1.x509.KeyUsage} constructor. -692 * <br> -693 * When hExtV and critical specified as arguments, return value -694 * will be generated from them. -695 * <pre> -696 * id-ce-keyUsage OBJECT IDENTIFIER ::= { id-ce 15 } -697 * KeyUsage ::= BIT STRING { -698 * digitalSignature (0), -699 * nonRepudiation (1), -700 * keyEncipherment (2), -701 * dataEncipherment (3), -702 * keyAgreement (4), -703 * keyCertSign (5), -704 * cRLSign (6), -705 * encipherOnly (7), -706 * decipherOnly (8) } -707 * </pre> -708 * @example -709 * x = new X509(); -710 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. -711 * x.getExtKeyUsage() → -712 * { -713 * critial: true, -714 * names: ["digitalSignature", "decipherOnly"] -715 * } -716 * -717 * x = new X509(); -718 * x.getExtKeyUsage("306230...") -719 * x.getExtKeyUsage("306230...", true) -720 */ -721 this.getExtKeyUsage = function(hExtV, critical) { -722 if (hExtV === undefined && critical === undefined) { -723 var info = this.getExtInfo("keyUsage"); -724 if (info === undefined) return undefined; -725 hExtV = _getTLV(this.hex, info.vidx); -726 critical = info.critical; -727 } -728 -729 var result = {extname:"keyUsage"}; -730 if (critical) result.critical = true; -731 -732 result.names = this.getExtKeyUsageString(hExtV).split(","); -733 -734 return result; -735 }; -736 -737 /** -738 * get KeyUsage extension value as binary string in the certificate<br/> -739 * @name getExtKeyUsageBin -740 * @memberOf X509# -741 * @function -742 * @param {String} hExtV hexadecimal string of extension value (OPTIONAL) -743 * @return {String} binary string of key usage bits (ex. '101') -744 * @since jsrsasign 7.2.0 x509 1.1.14 -745 * @see X509#getExtKeyUsage -746 * @description -747 * This method will get key usage extension value -748 * as binary string such like '101'. -749 * Key usage bits definition is in the RFC 5280. -750 * If there is no key usage extension in the certificate, -751 * it returns empty string (i.e. ''). -752 * <br/> -753 * NOTE: argument 'hExtV' supported since jsrsasign 9.0.0 x509 2.0.0. -754 * @example -755 * x = new X509(); -756 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. -757 * x.getExtKeyUsageBin() → '101' -758 * // 1 - digitalSignature -759 * // 0 - nonRepudiation -760 * // 1 - keyEncipherment -761 */ -762 this.getExtKeyUsageBin = function(hExtV) { -763 if (hExtV === undefined) { -764 var info = this.getExtInfo("keyUsage"); -765 if (info === undefined) return ''; -766 hExtV = _getTLV(this.hex, info.vidx); -767 } -768 -769 if (hExtV.length != 8 && hExtV.length != 10) -770 throw new Error("malformed key usage value: " + hExtV); -771 -772 var s = "000000000000000" + parseInt(hExtV.substr(6), 16).toString(2); -773 if (hExtV.length == 8) s = s.slice(-8); -774 if (hExtV.length == 10) s = s.slice(-16); -775 s = s.replace(/0+$/, ''); -776 if (s == '') s = '0'; -777 return s; -778 }; -779 -780 /** -781 * get KeyUsage extension value as names in the certificate<br/> -782 * @name getExtKeyUsageString -783 * @memberOf X509# -784 * @function -785 * @param {String} hExtV hexadecimal string of extension value (OPTIONAL) -786 * @return {String} comma separated string of key usage -787 * @since jsrsasign 7.2.0 x509 1.1.14 -788 * @see X509#getExtKeyUsage -789 * @description -790 * This method will get key usage extension value -791 * as comma separated string of usage names. -792 * If there is no key usage extension in the certificate, -793 * it returns empty string (i.e. ''). -794 * <br/> -795 * NOTE: argument 'hExtV' supported since jsrsasign 9.0.0 x509 2.0.0. -796 * @example -797 * x = new X509(); -798 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. -799 * x.getExtKeyUsageString() → "digitalSignature,keyEncipherment" -800 */ -801 this.getExtKeyUsageString = function(hExtV) { -802 var bKeyUsage = this.getExtKeyUsageBin(hExtV); -803 var a = new Array(); -804 for (var i = 0; i < bKeyUsage.length; i++) { -805 if (bKeyUsage.substr(i, 1) == "1") a.push(X509.KEYUSAGE_NAME[i]); -806 } -807 return a.join(","); -808 }; -809 -810 /** -811 * get subjectKeyIdentifier value as hexadecimal string in the certificate<br/> -812 * @name getExtSubjectKeyIdentifier -813 * @memberOf X509# -814 * @function -815 * @param {String} hExtV hexadecimal string of extension value (OPTIONAL) -816 * @param {Boolean} critical flag (OPTIONAL) -817 * @return {Array} JSON object of SubjectKeyIdentifier parameter or undefined -818 * @since jsrsasign 7.2.0 x509 1.1.14 -819 * @description -820 * This method will get -821 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.2"> -822 * SubjectKeyIdentifier extension</a> value as JSON object. -823 * <br> -824 * When hExtV and critical specified as arguments, return value -825 * will be generated from them. -826 * If there is no such extension in the certificate, it returns undefined. -827 * <br> -828 * Result of this method can be passed to -829 * {@link KJUR.asn1.x509.SubjectKeyIdentifier} constructor. -830 * <pre> -831 * id-ce-subjectKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 14 } -832 * SubjectKeyIdentifier ::= KeyIdentifier -833 * </pre> -834 * <br> -835 * CAUTION: -836 * Returned JSON value format have been changed without -837 * backward compatibility since jsrsasign 9.0.0 x509 2.0.0. -838 * -839 * @example -840 * x = new X509(); -841 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. -842 * x.getExtSubjectKeyIdentifier() → -843 * { kid: {hex: "1b3347ab..."}, critical: true }; -844 */ -845 this.getExtSubjectKeyIdentifier = function(hExtV, critical) { -846 if (hExtV === undefined && critical === undefined) { -847 var info = this.getExtInfo("subjectKeyIdentifier"); -848 if (info === undefined) return undefined; -849 hExtV = _getTLV(this.hex, info.vidx); -850 critical = info.critical; -851 } -852 -853 var result = {extname:"subjectKeyIdentifier"}; -854 if (critical) result.critical = true; -855 -856 var hKID = _getV(hExtV, 0); -857 result.kid = {hex: hKID}; +670 return result; +671 } +672 if (hExtV.substr(0, 12) === '30060101ff02') { +673 var pathLexHex = _getV(hExtV, 10); +674 var pathLen = parseInt(pathLexHex, 16); +675 result.cA = true; +676 result.pathLen = pathLen; +677 return result; +678 } +679 throw new Error("hExtV parse error: " + hExtV); +680 }; +681 +682 /** +683 * get KeyUsage extension value as JSON object +684 * @memberOf X509# +685 * @function +686 * @name getExtKeyUsage +687 * @param {String} hExtV hexadecimal string of extension value (OPTIONAL) +688 * @param {Boolean} critical flag (OPTIONAL) +689 * @return {Array} JSON object of KeyUsage parameter or undefined +690 * @since jsrsasign 9.0.0 x509 2.0.0 +691 * @see KJUR.asn1.x509.KeyUsage +692 * @see X509#getExtKeyUsageString +693 * @description +694 * This method parse keyUsage extension. When arguments are +695 * not specified, its extension in X509 object will be parsed. +696 * Result of this method can be passed to +697 * {@link KJUR.asn1.x509.KeyUsage} constructor. +698 * <br> +699 * When hExtV and critical specified as arguments, return value +700 * will be generated from them. +701 * <pre> +702 * id-ce-keyUsage OBJECT IDENTIFIER ::= { id-ce 15 } +703 * KeyUsage ::= BIT STRING { +704 * digitalSignature (0), +705 * nonRepudiation (1), +706 * keyEncipherment (2), +707 * dataEncipherment (3), +708 * keyAgreement (4), +709 * keyCertSign (5), +710 * cRLSign (6), +711 * encipherOnly (7), +712 * decipherOnly (8) } +713 * </pre> +714 * @example +715 * x = new X509(); +716 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. +717 * x.getExtKeyUsage() → +718 * { +719 * critial: true, +720 * names: ["digitalSignature", "decipherOnly"] +721 * } +722 * +723 * x = new X509(); +724 * x.getExtKeyUsage("306230...") +725 * x.getExtKeyUsage("306230...", true) +726 */ +727 this.getExtKeyUsage = function(hExtV, critical) { +728 if (hExtV === undefined && critical === undefined) { +729 var info = this.getExtInfo("keyUsage"); +730 if (info === undefined) return undefined; +731 hExtV = _getTLV(this.hex, info.vidx); +732 critical = info.critical; +733 } +734 +735 var result = {extname:"keyUsage"}; +736 if (critical) result.critical = true; +737 +738 result.names = this.getExtKeyUsageString(hExtV).split(","); +739 +740 return result; +741 }; +742 +743 /** +744 * get KeyUsage extension value as binary string in the certificate<br/> +745 * @name getExtKeyUsageBin +746 * @memberOf X509# +747 * @function +748 * @param {String} hExtV hexadecimal string of extension value (OPTIONAL) +749 * @return {String} binary string of key usage bits (ex. '101') +750 * @since jsrsasign 7.2.0 x509 1.1.14 +751 * @see X509#getExtKeyUsage +752 * @description +753 * This method will get key usage extension value +754 * as binary string such like '101'. +755 * Key usage bits definition is in the RFC 5280. +756 * If there is no key usage extension in the certificate, +757 * it returns empty string (i.e. ''). +758 * <br/> +759 * NOTE: argument 'hExtV' supported since jsrsasign 9.0.0 x509 2.0.0. +760 * @example +761 * x = new X509(); +762 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. +763 * x.getExtKeyUsageBin() → '101' +764 * // 1 - digitalSignature +765 * // 0 - nonRepudiation +766 * // 1 - keyEncipherment +767 */ +768 this.getExtKeyUsageBin = function(hExtV) { +769 if (hExtV === undefined) { +770 var info = this.getExtInfo("keyUsage"); +771 if (info === undefined) return ''; +772 hExtV = _getTLV(this.hex, info.vidx); +773 } +774 +775 if (hExtV.length != 8 && hExtV.length != 10) +776 throw new Error("malformed key usage value: " + hExtV); +777 +778 var s = "000000000000000" + parseInt(hExtV.substr(6), 16).toString(2); +779 if (hExtV.length == 8) s = s.slice(-8); +780 if (hExtV.length == 10) s = s.slice(-16); +781 s = s.replace(/0+$/, ''); +782 if (s == '') s = '0'; +783 return s; +784 }; +785 +786 /** +787 * get KeyUsage extension value as names in the certificate<br/> +788 * @name getExtKeyUsageString +789 * @memberOf X509# +790 * @function +791 * @param {String} hExtV hexadecimal string of extension value (OPTIONAL) +792 * @return {String} comma separated string of key usage +793 * @since jsrsasign 7.2.0 x509 1.1.14 +794 * @see X509#getExtKeyUsage +795 * @description +796 * This method will get key usage extension value +797 * as comma separated string of usage names. +798 * If there is no key usage extension in the certificate, +799 * it returns empty string (i.e. ''). +800 * <br/> +801 * NOTE: argument 'hExtV' supported since jsrsasign 9.0.0 x509 2.0.0. +802 * @example +803 * x = new X509(); +804 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. +805 * x.getExtKeyUsageString() → "digitalSignature,keyEncipherment" +806 */ +807 this.getExtKeyUsageString = function(hExtV) { +808 var bKeyUsage = this.getExtKeyUsageBin(hExtV); +809 var a = new Array(); +810 for (var i = 0; i < bKeyUsage.length; i++) { +811 if (bKeyUsage.substr(i, 1) == "1") a.push(X509.KEYUSAGE_NAME[i]); +812 } +813 return a.join(","); +814 }; +815 +816 /** +817 * get subjectKeyIdentifier value as hexadecimal string in the certificate<br/> +818 * @name getExtSubjectKeyIdentifier +819 * @memberOf X509# +820 * @function +821 * @param {String} hExtV hexadecimal string of extension value (OPTIONAL) +822 * @param {Boolean} critical flag (OPTIONAL) +823 * @return {Array} JSON object of SubjectKeyIdentifier parameter or undefined +824 * @since jsrsasign 7.2.0 x509 1.1.14 +825 * @description +826 * This method will get +827 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.2"> +828 * SubjectKeyIdentifier extension</a> value as JSON object. +829 * <br> +830 * When hExtV and critical specified as arguments, return value +831 * will be generated from them. +832 * If there is no such extension in the certificate, it returns undefined. +833 * <br> +834 * Result of this method can be passed to +835 * {@link KJUR.asn1.x509.SubjectKeyIdentifier} constructor. +836 * <pre> +837 * id-ce-subjectKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 14 } +838 * SubjectKeyIdentifier ::= KeyIdentifier +839 * </pre> +840 * <br> +841 * CAUTION: +842 * Returned JSON value format have been changed without +843 * backward compatibility since jsrsasign 9.0.0 x509 2.0.0. +844 * +845 * @example +846 * x = new X509(); +847 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. +848 * x.getExtSubjectKeyIdentifier() → +849 * { kid: {hex: "1b3347ab..."}, critical: true }; +850 */ +851 this.getExtSubjectKeyIdentifier = function(hExtV, critical) { +852 if (hExtV === undefined && critical === undefined) { +853 var info = this.getExtInfo("subjectKeyIdentifier"); +854 if (info === undefined) return undefined; +855 hExtV = _getTLV(this.hex, info.vidx); +856 critical = info.critical; +857 } 858 -859 return result; -860 }; +859 var result = {extname:"subjectKeyIdentifier"}; +860 if (critical) result.critical = true; 861 -862 /** -863 * get authorityKeyIdentifier value as JSON object in the certificate<br/> -864 * @name getExtAuthorityKeyIdentifier -865 * @memberOf X509# -866 * @function -867 * @param {String} hExtV hexadecimal string of extension value (OPTIONAL) -868 * @param {Boolean} critical flag (OPTIONAL) -869 * @return {Array} JSON object of AuthorityKeyIdentifier parameter or undefined -870 * @since jsrsasign 7.2.0 x509 1.1.14 -871 * @see KJUR.asn1.x509.AuthorityKeyIdentifier -872 * @description -873 * This method will get -874 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.1"> -875 * AuthorityKeyIdentifier extension</a> value as JSON object. -876 * <br> -877 * When hExtV and critical specified as arguments, return value -878 * will be generated from them. -879 * If there is no such extension in the certificate, it returns undefined. -880 * <br/> -881 * Result of this method can be passed to -882 * {@link KJUR.asn1.x509.AuthorityKeyIdentifier} constructor. -883 * <pre> -884 * id-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 35 } -885 * AuthorityKeyIdentifier ::= SEQUENCE { -886 * keyIdentifier [0] KeyIdentifier OPTIONAL, -887 * authorityCertIssuer [1] GeneralNames OPTIONAL, -888 * authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL } -889 * KeyIdentifier ::= OCTET STRING -890 * </pre> -891 * Constructor may have following parameters: -892 * <ul> -893 * <li>{Array}kid - JSON object of {@link KJUR.asn1.DEROctetString} parameters</li> -894 * <li>{Array}issuer - JSON object of {@link KJUR.asn1.x509.X500Name} parameters</li> -895 * <li>{Array}sn - JSON object of {@link KJUR.asn1.DERInteger} parameters</li> -896 * <li>{Boolean}critical - critical flag</li> -897 * </ul> -898 * <br> -899 * NOTE: The 'authorityCertIssuer' and 'authorityCertSerialNumber' -900 * supported since jsrsasign 9.0.0 x509 2.0.0. -901 * @example -902 * x = new X509(); -903 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. -904 * x.getExtAuthorityKeyIdentifier() → -905 * { kid: {hex: "1234abcd..."}, -906 * issuer: {hex: "30..."}, -907 * sn: {hex: "1234..."}, -908 * critical: true} -909 */ -910 this.getExtAuthorityKeyIdentifier = function(hExtV, critical) { -911 if (hExtV === undefined && critical === undefined) { -912 var info = this.getExtInfo("authorityKeyIdentifier"); -913 if (info === undefined) return undefined; -914 hExtV = _getTLV(this.hex, info.vidx); -915 critical = info.critical; -916 } -917 -918 var result = {extname:"authorityKeyIdentifier"}; -919 if (critical) result.critical = true; -920 -921 var a = _getChildIdx(hExtV, 0); -922 for (var i = 0; i < a.length; i++) { -923 var tag = hExtV.substr(a[i], 2); -924 if (tag === "80") { -925 result.kid = {hex: _getV(hExtV, a[i])}; -926 } -927 if (tag === "a1") { -928 var hGNS = _getTLV(hExtV, a[i]); -929 var gnsParam = this.getGeneralNames(hGNS); -930 result.issuer = gnsParam[0]["dn"]; -931 } -932 if (tag === "82") { -933 result.sn = {hex: _getV(hExtV, a[i])}; -934 } -935 } -936 return result; -937 }; -938 -939 /** -940 * get extKeyUsage value as JSON object -941 * @name getExtExtKeyUsage -942 * @memberOf X509# -943 * @function -944 * @param {String} hExtV hexadecimal string of extension value (OPTIONAL) -945 * @param {Boolean} critical flag (OPTIONAL) -946 * @return {Array} JSON object of ExtKeyUsage parameter or undefined -947 * @return {Object} JSONarray of extended key usage ID name or oid -948 * @since jsrsasign 9.0.0 x509 2.0.0 -949 * @see KJUR.asn1.x509.ExtKeyUsage -950 * @description -951 * This method parse extKeyUsage extension. When arguments are -952 * not specified, its extension in X509 object will be parsed. -953 * Result of this method can be passed to -954 * {@link KJUR.asn1.x509.ExtKeyUsage} constructor. -955 * <br> -956 * When hExtV and critical specified as arguments, return value -957 * will be generated from them. -958 * @example -959 * x = new X509(); -960 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. -961 * x.getExtExtKeyUsage() → -962 * { array: ["clientAuth", "emailProtection", "1.3.6.1.4.1.311.10.3.4"], -963 * critical: true}, -964 */ -965 this.getExtExtKeyUsage = function(hExtV, critical) { -966 if (hExtV === undefined && critical === undefined) { -967 var info = this.getExtInfo("extKeyUsage"); -968 if (info === undefined) return undefined; -969 hExtV = _getTLV(this.hex, info.vidx); -970 critical = info.critical; -971 } -972 -973 var result = {extname:"extKeyUsage",array:[]}; -974 if (critical) result.critical = true; -975 -976 var a = _getChildIdx(hExtV, 0); -977 -978 for (var i = 0; i < a.length; i++) { -979 result.array.push(_oidname(_getV(hExtV, a[i]))); -980 } +862 var hKID = _getV(hExtV, 0); +863 result.kid = {hex: hKID}; +864 +865 return result; +866 }; +867 +868 /** +869 * get authorityKeyIdentifier value as JSON object in the certificate<br/> +870 * @name getExtAuthorityKeyIdentifier +871 * @memberOf X509# +872 * @function +873 * @param {String} hExtV hexadecimal string of extension value (OPTIONAL) +874 * @param {Boolean} critical flag (OPTIONAL) +875 * @return {Array} JSON object of AuthorityKeyIdentifier parameter or undefined +876 * @since jsrsasign 7.2.0 x509 1.1.14 +877 * @see KJUR.asn1.x509.AuthorityKeyIdentifier +878 * @description +879 * This method will get +880 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.1"> +881 * AuthorityKeyIdentifier extension</a> value as JSON object. +882 * <br> +883 * When hExtV and critical specified as arguments, return value +884 * will be generated from them. +885 * If there is no such extension in the certificate, it returns undefined. +886 * <br/> +887 * Result of this method can be passed to +888 * {@link KJUR.asn1.x509.AuthorityKeyIdentifier} constructor. +889 * <pre> +890 * id-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::= { id-ce 35 } +891 * AuthorityKeyIdentifier ::= SEQUENCE { +892 * keyIdentifier [0] KeyIdentifier OPTIONAL, +893 * authorityCertIssuer [1] GeneralNames OPTIONAL, +894 * authorityCertSerialNumber [2] CertificateSerialNumber OPTIONAL } +895 * KeyIdentifier ::= OCTET STRING +896 * </pre> +897 * Constructor may have following parameters: +898 * <ul> +899 * <li>{Array}kid - JSON object of {@link KJUR.asn1.DEROctetString} parameters</li> +900 * <li>{Array}issuer - JSON object of {@link KJUR.asn1.x509.X500Name} parameters</li> +901 * <li>{Array}sn - JSON object of {@link KJUR.asn1.DERInteger} parameters</li> +902 * <li>{Boolean}critical - critical flag</li> +903 * </ul> +904 * <br> +905 * NOTE: The 'authorityCertIssuer' and 'authorityCertSerialNumber' +906 * supported since jsrsasign 9.0.0 x509 2.0.0. +907 * @example +908 * x = new X509(); +909 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. +910 * x.getExtAuthorityKeyIdentifier() → +911 * { kid: {hex: "1234abcd..."}, +912 * issuer: {hex: "30..."}, +913 * sn: {hex: "1234..."}, +914 * critical: true} +915 */ +916 this.getExtAuthorityKeyIdentifier = function(hExtV, critical) { +917 if (hExtV === undefined && critical === undefined) { +918 var info = this.getExtInfo("authorityKeyIdentifier"); +919 if (info === undefined) return undefined; +920 hExtV = _getTLV(this.hex, info.vidx); +921 critical = info.critical; +922 } +923 +924 var result = {extname:"authorityKeyIdentifier"}; +925 if (critical) result.critical = true; +926 +927 var a = _getChildIdx(hExtV, 0); +928 for (var i = 0; i < a.length; i++) { +929 var tag = hExtV.substr(a[i], 2); +930 if (tag === "80") { +931 result.kid = {hex: _getV(hExtV, a[i])}; +932 } +933 if (tag === "a1") { +934 var hGNS = _getTLV(hExtV, a[i]); +935 var gnsParam = this.getGeneralNames(hGNS); +936 result.issuer = gnsParam[0]["dn"]; +937 } +938 if (tag === "82") { +939 result.sn = {hex: _getV(hExtV, a[i])}; +940 } +941 } +942 return result; +943 }; +944 +945 /** +946 * get extKeyUsage value as JSON object +947 * @name getExtExtKeyUsage +948 * @memberOf X509# +949 * @function +950 * @param {String} hExtV hexadecimal string of extension value (OPTIONAL) +951 * @param {Boolean} critical flag (OPTIONAL) +952 * @return {Array} JSON object of ExtKeyUsage parameter or undefined +953 * @return {Object} JSONarray of extended key usage ID name or oid +954 * @since jsrsasign 9.0.0 x509 2.0.0 +955 * @see KJUR.asn1.x509.ExtKeyUsage +956 * @description +957 * This method parse extKeyUsage extension. When arguments are +958 * not specified, its extension in X509 object will be parsed. +959 * Result of this method can be passed to +960 * {@link KJUR.asn1.x509.ExtKeyUsage} constructor. +961 * <br> +962 * When hExtV and critical specified as arguments, return value +963 * will be generated from them. +964 * @example +965 * x = new X509(); +966 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. +967 * x.getExtExtKeyUsage() → +968 * { array: ["clientAuth", "emailProtection", "1.3.6.1.4.1.311.10.3.4"], +969 * critical: true}, +970 */ +971 this.getExtExtKeyUsage = function(hExtV, critical) { +972 if (hExtV === undefined && critical === undefined) { +973 var info = this.getExtInfo("extKeyUsage"); +974 if (info === undefined) return undefined; +975 hExtV = _getTLV(this.hex, info.vidx); +976 critical = info.critical; +977 } +978 +979 var result = {extname:"extKeyUsage",array:[]}; +980 if (critical) result.critical = true; 981 -982 return result; -983 }; -984 -985 /** -986 * get extKeyUsage value as array of name string in the certificate(DEPRECATED)<br/> -987 * @name getExtExtKeyUsageName -988 * @memberOf X509# -989 * @function -990 * @return {Object} array of extended key usage ID name or oid -991 * @since jsrsasign 7.2.0 x509 1.1.14 -992 * @deprecated since jsrsasign 9.0.0 x509 2.0.0 -993 * @description -994 * This method will get extended key usage extension value -995 * as array of name or OID string. -996 * If there is this in the certificate, it returns undefined; -997 * <br> -998 * NOTE: Supported extended key usage ID names are defined in -999 * name2oidList parameter in asn1x509.js file. -1000 * @example -1001 * x = new X509(); -1002 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. -1003 * x.getExtExtKeyUsageName() → ["serverAuth", "clientAuth", "0.1.2.3.4.5"] -1004 */ -1005 this.getExtExtKeyUsageName = function() { -1006 var info = this.getExtInfo("extKeyUsage"); -1007 if (info === undefined) return info; -1008 -1009 var result = new Array(); -1010 -1011 var h = _getTLV(this.hex, info.vidx); -1012 if (h === '') return result; -1013 -1014 var a = _getChildIdx(h, 0); -1015 for (var i = 0; i < a.length; i++) { -1016 result.push(_oidname(_getV(h, a[i]))); -1017 } -1018 -1019 return result; -1020 }; -1021 -1022 /** -1023 * get subjectAltName value as array of string in the certificate -1024 * @name getExtSubjectAltName -1025 * @memberOf X509# -1026 * @function -1027 * @param {String} hExtV hexadecimal string of extension value (OPTIONAL) -1028 * @param {Boolean} critical flag (OPTIONAL) -1029 * @return {Array} JSON object of SubjectAltName parameters or undefined -1030 * @since jsrsasign 7.2.0 x509 1.1.14 -1031 * @see KJUR.asn1.x509.SubjectAltName -1032 * @see X509#getExtIssuerAltName -1033 * @description -1034 * This method will get subjectAltName value -1035 * as an array of JSON object which has properties defined -1036 * in {@link KJUR.asn1.x509.SubjectAltName}. -1037 * Result of this method can be passed to -1038 * {@link KJUR.asn1.x509.SubjectAltName} constructor. -1039 * If there is no this extension in the certificate, -1040 * it returns undefined. -1041 * <br> -1042 * When hExtV and critical specified as arguments, return value -1043 * will be generated from them. -1044 * <br> -1045 * CAUTION: return value of JSON object format have been changed -1046 * from jsrsasign 9.0.0 x509 2.0.0 without backword compatibility. -1047 * @example -1048 * x = new X509(); -1049 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. -1050 * x.getExtSubjectAltName() → -1051 * { array: [ -1052 * {uri: "http://example.com/"}, -1053 * {rfc822: "user1@example.com"}, -1054 * {dns: "example.com"} -1055 * ], -1056 * critical: true -1057 * } -1058 * -1059 * x.getExtSubjectAltName("3026...") → -1060 * { array: [{ip: "192.168.1.1"}] } -1061 */ -1062 this.getExtSubjectAltName = function(hExtV, critical) { -1063 if (hExtV === undefined && critical === undefined) { -1064 var info = this.getExtInfo("subjectAltName"); -1065 if (info === undefined) return undefined; -1066 hExtV = _getTLV(this.hex, info.vidx); -1067 critical = info.critical; -1068 } -1069 -1070 var result = {extname:"subjectAltName",array:[]}; -1071 if (critical) result.critical = true; -1072 -1073 result.array = this.getGeneralNames(hExtV); -1074 -1075 return result; -1076 }; -1077 -1078 /** -1079 * get issuerAltName value as array of string in the certificate -1080 * @name getExtIssuerAltName -1081 * @memberOf X509# -1082 * @function -1083 * @param {String} hExtV hexadecimal string of extension value (OPTIONAL) -1084 * @param {Boolean} critical flag (OPTIONAL) -1085 * @return {Array} JSON object of IssuerAltName parameters -1086 * @since jsrsasign 9.0.0 x509 2.0.0 -1087 * @see KJUR.asn1.x509.IssuerAltName -1088 * @see X509#getExtSubjectAltName -1089 * @description -1090 * This method will get issuerAltName value -1091 * as an array of JSON object which has properties defined -1092 * in {@link KJUR.asn1.x509.IssuerAltName}. -1093 * Result of this method can be passed to -1094 * {@link KJUR.asn1.x509.IssuerAltName} constructor. -1095 * If there is no this extension in the certificate, -1096 * it returns undefined. -1097 * <br> -1098 * When hExtV and critical specified as arguments, return value -1099 * will be generated from them. -1100 * @example -1101 * x = new X509(); -1102 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. -1103 * x.getExtIssuerAltName() → -1104 * { array: [ -1105 * {uri: "http://example.com/"}, -1106 * {rfc822: "user1@example.com"}, -1107 * {dns: "example.com"} -1108 * ], -1109 * critical: true -1110 * } -1111 * -1112 * x.getExtIssuerAltName("3026...") → -1113 * { array: [{ip: "192.168.1.1"}] } -1114 */ -1115 this.getExtIssuerAltName = function(hExtV, critical) { -1116 if (hExtV === undefined && critical === undefined) { -1117 var info = this.getExtInfo("issuerAltName"); -1118 if (info === undefined) return undefined; -1119 hExtV = _getTLV(this.hex, info.vidx); -1120 critical = info.critical; -1121 } -1122 -1123 var result = {extname:"issuerAltName",array:[]}; -1124 if (critical) result.critical = true; -1125 -1126 result.array = this.getGeneralNames(hExtV); -1127 -1128 return result; -1129 }; -1130 -1131 /** -1132 * get GeneralNames ASN.1 structure parameter as JSON object -1133 * @name getGeneralNames -1134 * @memberOf X509# -1135 * @function -1136 * @param {String} h hexadecimal string of GeneralNames -1137 * @return {Array} array of GeneralNames parameters -1138 * @see KJUR.asn1.x509.GeneralNames -1139 * @see KJUR.asn1.x509.GeneralName -1140 * @see X509#getGeneralNames -1141 * @since jsrsasign 9.0.0 x509 2.0.0 -1142 * @description -1143 * This method will get GeneralNames parameters defined in -1144 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.6"> -1145 * RFC 5280 4.2.1.6</a>. -1146 * <pre> -1147 * GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName -1148 * </pre> -1149 * Result of this method can be passed to -1150 * {@link KJUR.asn1.x509.GeneralNames} constructor. -1151 * @example -1152 * x = new X509(); -1153 * x.getGeneralNames("3011860f687474703a2f2f6161612e636f6d2f") -1154 * → [{uri: "http://aaa.com/"}] -1155 * -1156 * x.getGeneralNames("301ea41c30...") → -1157 * [{ dn: { -1158 * array: [ -1159 * [{type:"C", value:"JP", ds:"prn"}], -1160 * [{type:"O", value:"T1", ds:"utf8"}] -1161 * ], -1162 * str: "/C=JP/O=T1" } }] -1163 */ -1164 this.getGeneralNames = function(h) { -1165 var aIdx = _getChildIdx(h, 0); -1166 var result = []; -1167 for (var i = 0; i < aIdx.length; i++) { -1168 var gnParam = this.getGeneralName(_getTLV(h, aIdx[i])); -1169 if (gnParam !== undefined) result.push(gnParam); -1170 } -1171 return result; -1172 }; -1173 -1174 /** -1175 * get GeneralName ASN.1 structure parameter as JSON object -1176 * @name getGeneralName -1177 * @memberOf X509# -1178 * @function -1179 * @param {String} h hexadecimal string of GeneralName -1180 * @return {Array} JSON object of GeneralName parameters or undefined -1181 * @see KJUR.asn1.x509.GeneralNames -1182 * @see X509#getGeneralName -1183 * @since jsrsasign 9.0.0 x509 2.0.0 -1184 * @description -1185 * This method will get GeneralName parameters defined in -1186 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.6"> -1187 * RFC 5280 4.2.1.6</a>. -1188 * <pre> -1189 * GeneralName ::= CHOICE { -1190 * otherName [0] OtherName, -1191 * rfc822Name [1] IA5String, -1192 * dNSName [2] IA5String, -1193 * x400Address [3] ORAddress, -1194 * directoryName [4] Name, -1195 * ediPartyName [5] EDIPartyName, -1196 * uniformResourceIdentifier [6] IA5String, -1197 * iPAddress [7] OCTET STRING, -1198 * registeredID [8] OBJECT IDENTIFIER } -1199 * </pre> -1200 * Result of this method can be passed to -1201 * {@link KJUR.asn1.x509.GeneralName} constructor. -1202 * @example -1203 * x = new X509(); -1204 * x.getGeneralName("860f687474703a2f2f6161612e636f6d2f") -1205 * → {uri: "http://aaa.com/"} -1206 * x.getGeneralName("a41c30...") → -1207 * { dn: { -1208 * array: [ -1209 * [{type:"C", value:"JP", ds:"prn"}], -1210 * [{type:"O", value:"T1", ds:"utf8"}] -1211 * ], -1212 * str: "/C=JP/O=T1" } } -1213 */ -1214 this.getGeneralName = function(h) { -1215 var tag = h.substr(0, 2); -1216 var hValue = _getV(h, 0); -1217 var sValue = hextorstr(hValue); -1218 if (tag == "81") return {rfc822: sValue}; -1219 if (tag == "82") return {dns: sValue}; -1220 if (tag == "86") return {uri: sValue}; -1221 if (tag == "87") return {ip: hextoip(hValue)}; -1222 if (tag == "a4") return {dn: this.getX500Name(hValue)}; -1223 return undefined; -1224 }; -1225 -1226 /** -1227 * get subjectAltName value as array of string in the certificate (DEPRECATED) -1228 * @name getExtSubjectAltName2 -1229 * @memberOf X509# -1230 * @function -1231 * @return {Object} array of alt name array -1232 * @since jsrsasign 8.0.1 x509 1.1.17 -1233 * @deprecated jsrsasign 9.0.0 x509 2.0.0 -1234 * @description -1235 * This method will get subject alt name extension value -1236 * as array of type and name. -1237 * If there is this in the certificate, it returns undefined; -1238 * Type of GeneralName will be shown as following: -1239 * <ul> -1240 * <li>"MAIL" - [1]rfc822Name</li> -1241 * <li>"DNS" - [2]dNSName</li> -1242 * <li>"DN" - [4]directoryName</li> -1243 * <li>"URI" - [6]uniformResourceIdentifier</li> -1244 * <li>"IP" - [7]iPAddress</li> -1245 * </ul> -1246 * @example -1247 * x = new X509(); -1248 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. -1249 * x.getExtSubjectAltName2() → -1250 * [["DNS", "example.com"], -1251 * ["DNS", "example.org"], -1252 * ["MAIL", "foo@example.com"], -1253 * ["IP", "192.168.1.1"], -1254 * ["IP", "2001:db8::2:1"], -1255 * ["DN", "/C=US/O=TEST1"]] -1256 */ -1257 this.getExtSubjectAltName2 = function() { -1258 var gnValueHex, gnValueStr, gnTag; -1259 var info = this.getExtInfo("subjectAltName"); -1260 if (info === undefined) return info; -1261 -1262 var result = new Array(); -1263 var h = _getTLV(this.hex, info.vidx); -1264 -1265 var a = _getChildIdx(h, 0); -1266 for (var i = 0; i < a.length; i++) { -1267 gnTag = h.substr(a[i], 2); -1268 gnValueHex = _getV(h, a[i]); -1269 -1270 if (gnTag === "81") { // rfc822Name [1] -1271 gnValueStr = hextoutf8(gnValueHex); -1272 result.push(["MAIL", gnValueStr]); -1273 } -1274 if (gnTag === "82") { // dNSName [2] -1275 gnValueStr = hextoutf8(gnValueHex); -1276 result.push(["DNS", gnValueStr]); -1277 } -1278 if (gnTag === "84") { // directoryName [4] -1279 gnValueStr = X509.hex2dn(gnValueHex, 0); -1280 result.push(["DN", gnValueStr]); -1281 } -1282 if (gnTag === "86") { // uniformResourceIdentifier [6] -1283 gnValueStr = hextoutf8(gnValueHex); -1284 result.push(["URI", gnValueStr]); -1285 } -1286 if (gnTag === "87") { // iPAddress [7] -1287 gnValueStr = hextoip(gnValueHex); -1288 result.push(["IP", gnValueStr]); -1289 } -1290 } -1291 return result; -1292 }; -1293 -1294 /** -1295 * get CRLDistributionPoints extension value as JSON object -1296 * @name getExtCRLDistributionPoints -1297 * @memberOf X509# -1298 * @function -1299 * @param {String} hExtV hexadecimal string of extension value (OPTIONAL) -1300 * @param {Boolean} critical flag (OPTIONAL) -1301 * @return {Object} JSON object of CRLDistributionPoints parameters or undefined -1302 * @since jsrsasign 9.0.0 x509 2.0.0 -1303 * @see KJUR.asn1.x509.CRLDistributionPoints -1304 * @see X509#getDistributionPoint -1305 * @see X509#getDistributionPointName -1306 * @see X509#getGeneralNames -1307 * @see X509#getGeneralName -1308 * @description -1309 * This method will get certificate policies value -1310 * as an array of JSON object which has properties defined -1311 * in {@link KJUR.asn1.x509.CRLDistributionPoints}. -1312 * Result of this method can be passed to -1313 * {@link KJUR.asn1.x509.CRLDistributionPoints} constructor. -1314 * If there is no this extension in the certificate, -1315 * it returns undefined. -1316 * @example -1317 * x = new X509(); -1318 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. -1319 * x.getExtCRLDistributionPoints() → -1320 * {array: [ -1321 * {dpname: {full: [{uri: "http://example.com/"}]}}, -1322 * {dpname: {full: [{uri: "ldap://example.com/"}]}} -1323 * ], -1324 * critical: true} -1325 */ -1326 this.getExtCRLDistributionPoints = function(hExtV, critical) { -1327 if (hExtV === undefined && critical === undefined) { -1328 var info = this.getExtInfo("cRLDistributionPoints"); -1329 if (info === undefined) return undefined; -1330 hExtV = _getTLV(this.hex, info.vidx); -1331 critical = info.critical; -1332 } -1333 -1334 var result = {extname:"cRLDistributionPoints",array:[]}; -1335 if (critical) result.critical = true; -1336 -1337 var a = _getChildIdx(hExtV, 0); -1338 for (var i = 0; i < a.length; i++) { -1339 var hTLV = _getTLV(hExtV, a[i]); -1340 result.array.push(this.getDistributionPoint(hTLV)); -1341 } +982 var a = _getChildIdx(hExtV, 0); +983 +984 for (var i = 0; i < a.length; i++) { +985 result.array.push(_oidname(_getV(hExtV, a[i]))); +986 } +987 +988 return result; +989 }; +990 +991 /** +992 * get extKeyUsage value as array of name string in the certificate(DEPRECATED)<br/> +993 * @name getExtExtKeyUsageName +994 * @memberOf X509# +995 * @function +996 * @return {Object} array of extended key usage ID name or oid +997 * @since jsrsasign 7.2.0 x509 1.1.14 +998 * @deprecated since jsrsasign 9.0.0 x509 2.0.0 +999 * @description +1000 * This method will get extended key usage extension value +1001 * as array of name or OID string. +1002 * If there is this in the certificate, it returns undefined; +1003 * <br> +1004 * NOTE: Supported extended key usage ID names are defined in +1005 * name2oidList parameter in asn1x509.js file. +1006 * @example +1007 * x = new X509(); +1008 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. +1009 * x.getExtExtKeyUsageName() → ["serverAuth", "clientAuth", "0.1.2.3.4.5"] +1010 */ +1011 this.getExtExtKeyUsageName = function() { +1012 var info = this.getExtInfo("extKeyUsage"); +1013 if (info === undefined) return info; +1014 +1015 var result = new Array(); +1016 +1017 var h = _getTLV(this.hex, info.vidx); +1018 if (h === '') return result; +1019 +1020 var a = _getChildIdx(h, 0); +1021 for (var i = 0; i < a.length; i++) { +1022 result.push(_oidname(_getV(h, a[i]))); +1023 } +1024 +1025 return result; +1026 }; +1027 +1028 /** +1029 * get subjectAltName value as array of string in the certificate +1030 * @name getExtSubjectAltName +1031 * @memberOf X509# +1032 * @function +1033 * @param {String} hExtV hexadecimal string of extension value (OPTIONAL) +1034 * @param {Boolean} critical flag (OPTIONAL) +1035 * @return {Array} JSON object of SubjectAltName parameters or undefined +1036 * @since jsrsasign 7.2.0 x509 1.1.14 +1037 * @see KJUR.asn1.x509.SubjectAltName +1038 * @see X509#getExtIssuerAltName +1039 * @description +1040 * This method will get subjectAltName value +1041 * as an array of JSON object which has properties defined +1042 * in {@link KJUR.asn1.x509.SubjectAltName}. +1043 * Result of this method can be passed to +1044 * {@link KJUR.asn1.x509.SubjectAltName} constructor. +1045 * If there is no this extension in the certificate, +1046 * it returns undefined. +1047 * <br> +1048 * When hExtV and critical specified as arguments, return value +1049 * will be generated from them. +1050 * <br> +1051 * CAUTION: return value of JSON object format have been changed +1052 * from jsrsasign 9.0.0 x509 2.0.0 without backword compatibility. +1053 * @example +1054 * x = new X509(); +1055 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. +1056 * x.getExtSubjectAltName() → +1057 * { array: [ +1058 * {uri: "http://example.com/"}, +1059 * {rfc822: "user1@example.com"}, +1060 * {dns: "example.com"} +1061 * ], +1062 * critical: true +1063 * } +1064 * +1065 * x.getExtSubjectAltName("3026...") → +1066 * { array: [{ip: "192.168.1.1"}] } +1067 */ +1068 this.getExtSubjectAltName = function(hExtV, critical) { +1069 if (hExtV === undefined && critical === undefined) { +1070 var info = this.getExtInfo("subjectAltName"); +1071 if (info === undefined) return undefined; +1072 hExtV = _getTLV(this.hex, info.vidx); +1073 critical = info.critical; +1074 } +1075 +1076 var result = {extname:"subjectAltName",array:[]}; +1077 if (critical) result.critical = true; +1078 +1079 result.array = this.getGeneralNames(hExtV); +1080 +1081 return result; +1082 }; +1083 +1084 /** +1085 * get issuerAltName value as array of string in the certificate +1086 * @name getExtIssuerAltName +1087 * @memberOf X509# +1088 * @function +1089 * @param {String} hExtV hexadecimal string of extension value (OPTIONAL) +1090 * @param {Boolean} critical flag (OPTIONAL) +1091 * @return {Array} JSON object of IssuerAltName parameters +1092 * @since jsrsasign 9.0.0 x509 2.0.0 +1093 * @see KJUR.asn1.x509.IssuerAltName +1094 * @see X509#getExtSubjectAltName +1095 * @description +1096 * This method will get issuerAltName value +1097 * as an array of JSON object which has properties defined +1098 * in {@link KJUR.asn1.x509.IssuerAltName}. +1099 * Result of this method can be passed to +1100 * {@link KJUR.asn1.x509.IssuerAltName} constructor. +1101 * If there is no this extension in the certificate, +1102 * it returns undefined. +1103 * <br> +1104 * When hExtV and critical specified as arguments, return value +1105 * will be generated from them. +1106 * @example +1107 * x = new X509(); +1108 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. +1109 * x.getExtIssuerAltName() → +1110 * { array: [ +1111 * {uri: "http://example.com/"}, +1112 * {rfc822: "user1@example.com"}, +1113 * {dns: "example.com"} +1114 * ], +1115 * critical: true +1116 * } +1117 * +1118 * x.getExtIssuerAltName("3026...") → +1119 * { array: [{ip: "192.168.1.1"}] } +1120 */ +1121 this.getExtIssuerAltName = function(hExtV, critical) { +1122 if (hExtV === undefined && critical === undefined) { +1123 var info = this.getExtInfo("issuerAltName"); +1124 if (info === undefined) return undefined; +1125 hExtV = _getTLV(this.hex, info.vidx); +1126 critical = info.critical; +1127 } +1128 +1129 var result = {extname:"issuerAltName",array:[]}; +1130 if (critical) result.critical = true; +1131 +1132 result.array = this.getGeneralNames(hExtV); +1133 +1134 return result; +1135 }; +1136 +1137 /** +1138 * get GeneralNames ASN.1 structure parameter as JSON object +1139 * @name getGeneralNames +1140 * @memberOf X509# +1141 * @function +1142 * @param {String} h hexadecimal string of GeneralNames +1143 * @return {Array} array of GeneralNames parameters +1144 * @see KJUR.asn1.x509.GeneralNames +1145 * @see KJUR.asn1.x509.GeneralName +1146 * @see X509#getGeneralNames +1147 * @since jsrsasign 9.0.0 x509 2.0.0 +1148 * @description +1149 * This method will get GeneralNames parameters defined in +1150 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.6"> +1151 * RFC 5280 4.2.1.6</a>. +1152 * <pre> +1153 * GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName +1154 * </pre> +1155 * Result of this method can be passed to +1156 * {@link KJUR.asn1.x509.GeneralNames} constructor. +1157 * @example +1158 * x = new X509(); +1159 * x.getGeneralNames("3011860f687474703a2f2f6161612e636f6d2f") +1160 * → [{uri: "http://aaa.com/"}] +1161 * +1162 * x.getGeneralNames("301ea41c30...") → +1163 * [{ dn: { +1164 * array: [ +1165 * [{type:"C", value:"JP", ds:"prn"}], +1166 * [{type:"O", value:"T1", ds:"utf8"}] +1167 * ], +1168 * str: "/C=JP/O=T1" } }] +1169 */ +1170 this.getGeneralNames = function(h) { +1171 var aIdx = _getChildIdx(h, 0); +1172 var result = []; +1173 for (var i = 0; i < aIdx.length; i++) { +1174 var gnParam = this.getGeneralName(_getTLV(h, aIdx[i])); +1175 if (gnParam !== undefined) result.push(gnParam); +1176 } +1177 return result; +1178 }; +1179 +1180 /** +1181 * get GeneralName ASN.1 structure parameter as JSON object +1182 * @name getGeneralName +1183 * @memberOf X509# +1184 * @function +1185 * @param {String} h hexadecimal string of GeneralName +1186 * @return {Array} JSON object of GeneralName parameters or undefined +1187 * @see KJUR.asn1.x509.GeneralNames +1188 * @see X509#getGeneralName +1189 * @since jsrsasign 9.0.0 x509 2.0.0 +1190 * @description +1191 * This method will get GeneralName parameters defined in +1192 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.6"> +1193 * RFC 5280 4.2.1.6</a>. +1194 * <pre> +1195 * GeneralName ::= CHOICE { +1196 * otherName [0] OtherName, +1197 * rfc822Name [1] IA5String, +1198 * dNSName [2] IA5String, +1199 * x400Address [3] ORAddress, +1200 * directoryName [4] Name, +1201 * ediPartyName [5] EDIPartyName, +1202 * uniformResourceIdentifier [6] IA5String, +1203 * iPAddress [7] OCTET STRING, +1204 * registeredID [8] OBJECT IDENTIFIER } +1205 * </pre> +1206 * Result of this method can be passed to +1207 * {@link KJUR.asn1.x509.GeneralName} constructor. +1208 * @example +1209 * x = new X509(); +1210 * x.getGeneralName("860f687474703a2f2f6161612e636f6d2f") +1211 * → {uri: "http://aaa.com/"} +1212 * x.getGeneralName("a41c30...") → +1213 * { dn: { +1214 * array: [ +1215 * [{type:"C", value:"JP", ds:"prn"}], +1216 * [{type:"O", value:"T1", ds:"utf8"}] +1217 * ], +1218 * str: "/C=JP/O=T1" } } +1219 */ +1220 this.getGeneralName = function(h) { +1221 var tag = h.substr(0, 2); +1222 var hValue = _getV(h, 0); +1223 var sValue = hextorstr(hValue); +1224 if (tag == "81") return {rfc822: sValue}; +1225 if (tag == "82") return {dns: sValue}; +1226 if (tag == "86") return {uri: sValue}; +1227 if (tag == "87") return {ip: hextoip(hValue)}; +1228 if (tag == "a4") return {dn: this.getX500Name(hValue)}; +1229 return undefined; +1230 }; +1231 +1232 /** +1233 * get subjectAltName value as array of string in the certificate (DEPRECATED) +1234 * @name getExtSubjectAltName2 +1235 * @memberOf X509# +1236 * @function +1237 * @return {Object} array of alt name array +1238 * @since jsrsasign 8.0.1 x509 1.1.17 +1239 * @deprecated jsrsasign 9.0.0 x509 2.0.0 +1240 * @description +1241 * This method will get subject alt name extension value +1242 * as array of type and name. +1243 * If there is this in the certificate, it returns undefined; +1244 * Type of GeneralName will be shown as following: +1245 * <ul> +1246 * <li>"MAIL" - [1]rfc822Name</li> +1247 * <li>"DNS" - [2]dNSName</li> +1248 * <li>"DN" - [4]directoryName</li> +1249 * <li>"URI" - [6]uniformResourceIdentifier</li> +1250 * <li>"IP" - [7]iPAddress</li> +1251 * </ul> +1252 * @example +1253 * x = new X509(); +1254 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. +1255 * x.getExtSubjectAltName2() → +1256 * [["DNS", "example.com"], +1257 * ["DNS", "example.org"], +1258 * ["MAIL", "foo@example.com"], +1259 * ["IP", "192.168.1.1"], +1260 * ["IP", "2001:db8::2:1"], +1261 * ["DN", "/C=US/O=TEST1"]] +1262 */ +1263 this.getExtSubjectAltName2 = function() { +1264 var gnValueHex, gnValueStr, gnTag; +1265 var info = this.getExtInfo("subjectAltName"); +1266 if (info === undefined) return info; +1267 +1268 var result = new Array(); +1269 var h = _getTLV(this.hex, info.vidx); +1270 +1271 var a = _getChildIdx(h, 0); +1272 for (var i = 0; i < a.length; i++) { +1273 gnTag = h.substr(a[i], 2); +1274 gnValueHex = _getV(h, a[i]); +1275 +1276 if (gnTag === "81") { // rfc822Name [1] +1277 gnValueStr = hextoutf8(gnValueHex); +1278 result.push(["MAIL", gnValueStr]); +1279 } +1280 if (gnTag === "82") { // dNSName [2] +1281 gnValueStr = hextoutf8(gnValueHex); +1282 result.push(["DNS", gnValueStr]); +1283 } +1284 if (gnTag === "84") { // directoryName [4] +1285 gnValueStr = X509.hex2dn(gnValueHex, 0); +1286 result.push(["DN", gnValueStr]); +1287 } +1288 if (gnTag === "86") { // uniformResourceIdentifier [6] +1289 gnValueStr = hextoutf8(gnValueHex); +1290 result.push(["URI", gnValueStr]); +1291 } +1292 if (gnTag === "87") { // iPAddress [7] +1293 gnValueStr = hextoip(gnValueHex); +1294 result.push(["IP", gnValueStr]); +1295 } +1296 } +1297 return result; +1298 }; +1299 +1300 /** +1301 * get CRLDistributionPoints extension value as JSON object +1302 * @name getExtCRLDistributionPoints +1303 * @memberOf X509# +1304 * @function +1305 * @param {String} hExtV hexadecimal string of extension value (OPTIONAL) +1306 * @param {Boolean} critical flag (OPTIONAL) +1307 * @return {Object} JSON object of CRLDistributionPoints parameters or undefined +1308 * @since jsrsasign 9.0.0 x509 2.0.0 +1309 * @see KJUR.asn1.x509.CRLDistributionPoints +1310 * @see X509#getDistributionPoint +1311 * @see X509#getDistributionPointName +1312 * @see X509#getGeneralNames +1313 * @see X509#getGeneralName +1314 * @description +1315 * This method will get certificate policies value +1316 * as an array of JSON object which has properties defined +1317 * in {@link KJUR.asn1.x509.CRLDistributionPoints}. +1318 * Result of this method can be passed to +1319 * {@link KJUR.asn1.x509.CRLDistributionPoints} constructor. +1320 * If there is no this extension in the certificate, +1321 * it returns undefined. +1322 * @example +1323 * x = new X509(); +1324 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. +1325 * x.getExtCRLDistributionPoints() → +1326 * {array: [ +1327 * {dpname: {full: [{uri: "http://example.com/"}]}}, +1328 * {dpname: {full: [{uri: "ldap://example.com/"}]}} +1329 * ], +1330 * critical: true} +1331 */ +1332 this.getExtCRLDistributionPoints = function(hExtV, critical) { +1333 if (hExtV === undefined && critical === undefined) { +1334 var info = this.getExtInfo("cRLDistributionPoints"); +1335 if (info === undefined) return undefined; +1336 hExtV = _getTLV(this.hex, info.vidx); +1337 critical = info.critical; +1338 } +1339 +1340 var result = {extname:"cRLDistributionPoints",array:[]}; +1341 if (critical) result.critical = true; 1342 -1343 return result; -1344 }; -1345 -1346 /** -1347 * get DistributionPoint ASN.1 structure parameter as JSON object -1348 * @name getDistributionPoint -1349 * @memberOf X509# -1350 * @function -1351 * @param {String} h hexadecimal string of DistributionPoint -1352 * @return {Object} JSON object of DistributionPoint parameters -1353 * @since jsrsasign 9.0.0 x509 2.0.0 -1354 * @see X509#getExtCRLDistributionPoints -1355 * @see X509#getDistributionPointName -1356 * @see X509#getGeneralNames -1357 * @see X509#getGeneralName -1358 * @description -1359 * This method will get DistributionPoint parameters. -1360 * Result of this method can be passed to -1361 * {@link KJUR.asn1.x509.DistributionPoint} constructor. -1362 * <br/> -1363 * NOTE: reasons[1] and CRLIssuer[2] field not supported -1364 * @example -1365 * x = new X509(); -1366 * x.getDistributionPoint("30...") → -1367 * {dpname: {full: [{uri: "http://aaa.com/"}]}} -1368 */ -1369 this.getDistributionPoint = function(h) { -1370 var result = {}; -1371 var a = _getChildIdx(h, 0); -1372 for (var i = 0; i < a.length; i++) { -1373 var tag = h.substr(a[i], 2); -1374 var hTLV = _getTLV(h, a[i]); -1375 if (tag == "a0") { -1376 result.dpname = this.getDistributionPointName(hTLV); -1377 } -1378 } -1379 return result; -1380 }; -1381 -1382 /** -1383 * get DistributionPointName ASN.1 structure parameter as JSON object -1384 * @name getDistributionPointName -1385 * @memberOf X509# -1386 * @function -1387 * @param {String} h hexadecimal string of DistributionPointName -1388 * @return {Object} JSON object of DistributionPointName parameters -1389 * @since jsrsasign 9.0.0 x509 2.0.0 -1390 * @see X509#getExtCRLDistributionPoints -1391 * @see X509#getDistributionPoint -1392 * @see X509#getGeneralNames -1393 * @see X509#getGeneralName -1394 * @description -1395 * This method will get DistributionPointName parameters. -1396 * Result of this method can be passed to -1397 * {@link KJUR.asn1.x509.DistributionPointName} constructor. -1398 * <br/> -1399 * NOTE: nameRelativeToCRLIssuer[1] not supported -1400 * @example -1401 * x = new X509(); -1402 * x.getDistributionPointName("a0...") → -1403 * {full: [{uri: "http://aaa.com/"}]} -1404 */ -1405 this.getDistributionPointName = function(h) { -1406 var result = {}; -1407 var a = _getChildIdx(h, 0); -1408 for (var i = 0; i < a.length; i++) { -1409 var tag = h.substr(a[i], 2); -1410 var hTLV = _getTLV(h, a[i]); -1411 if (tag == "a0") { -1412 result.full = this.getGeneralNames(hTLV); -1413 } -1414 } -1415 return result; -1416 }; -1417 -1418 /** -1419 * get array of string for fullName URIs in cRLDistributionPoints(CDP) in the certificate (DEPRECATED) -1420 * @name getExtCRLDistributionPointsURI -1421 * @memberOf X509# -1422 * @function -1423 * @return {Object} array of fullName URIs of CDP of the certificate -1424 * @since jsrsasign 7.2.0 x509 1.1.14 -1425 * @description -1426 * This method will get all fullName URIs of cRLDistributionPoints extension -1427 * in the certificate as array of URI string. -1428 * If there is this in the certificate, it returns undefined; -1429 * <br> -1430 * NOTE: Currently this method supports only fullName URI so that -1431 * other parameters will not be returned. -1432 * @example -1433 * x = new X509(); -1434 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. -1435 * x.getExtCRLDistributionPointsURI() → -1436 * ["http://example.com/aaa.crl", "http://example.org/aaa.crl"] -1437 */ -1438 this.getExtCRLDistributionPointsURI = function() { -1439 var info = this.getExtInfo("cRLDistributionPoints"); -1440 if (info === undefined) return info; -1441 -1442 var result = new Array(); -1443 var a = _getChildIdx(this.hex, info.vidx); -1444 for (var i = 0; i < a.length; i++) { -1445 try { -1446 var hURI = _getVbyList(this.hex, a[i], [0, 0, 0], "86"); -1447 var uri = hextoutf8(hURI); -1448 result.push(uri); -1449 } catch(ex) {}; -1450 } -1451 -1452 return result; -1453 }; -1454 -1455 /** -1456 * get AuthorityInfoAccess extension value in the certificate as associative array -1457 * @name getExtAIAInfo -1458 * @memberOf X509# -1459 * @function -1460 * @return {Object} associative array of AIA extension properties -1461 * @since jsrsasign 7.2.0 x509 1.1.14 -1462 * @description -1463 * This method will get authority info access value -1464 * as associate array which has following properties: -1465 * <ul> -1466 * <li>ocsp - array of string for OCSP responder URL</li> -1467 * <li>caissuer - array of string for caIssuer value (i.e. CA certificates URL)</li> -1468 * </ul> -1469 * If there is this in the certificate, it returns undefined; -1470 * @example -1471 * x = new X509(); -1472 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. -1473 * x.getExtAIAInfo(hCert) → -1474 * { ocsp: ["http://ocsp.foo.com"], -1475 * caissuer: ["http://rep.foo.com/aaa.p8m"] } -1476 */ -1477 this.getExtAIAInfo = function() { -1478 var info = this.getExtInfo("authorityInfoAccess"); -1479 if (info === undefined) return info; -1480 -1481 var result = { ocsp: [], caissuer: [] }; -1482 var a = _getChildIdx(this.hex, info.vidx); -1483 for (var i = 0; i < a.length; i++) { -1484 var hOID = _getVbyList(this.hex, a[i], [0], "06"); -1485 var hName = _getVbyList(this.hex, a[i], [1], "86"); -1486 if (hOID === "2b06010505073001") { -1487 result.ocsp.push(hextoutf8(hName)); -1488 } -1489 if (hOID === "2b06010505073002") { -1490 result.caissuer.push(hextoutf8(hName)); -1491 } -1492 } -1493 -1494 return result; -1495 }; -1496 -1497 /** -1498 * get AuthorityInfoAccess extension value as JSON object -1499 * @name getExtAuthorityInfoAccess -1500 * @memberOf X509# -1501 * @function -1502 * @param {String} hExtV hexadecimal string of extension value (OPTIONAL) -1503 * @param {Boolean} critical flag (OPTIONAL) -1504 * @return {Array} JSON object of AuthorityInfoAccess parameters or undefined -1505 * @since jsrsasign 9.0.0 x509 2.0.0 -1506 * @see KJUR.asn1.x509.AuthorityInfoAccess -1507 * @description -1508 * This method parse authorityInfoAccess extension. When arguments are -1509 * not specified, its extension in X509 object will be parsed. -1510 * Result of this method can be passed to -1511 * {@link KJUR.asn1.x509.AuthorityInfoAccess} constructor. -1512 * <br> -1513 * When hExtV and critical specified as arguments, return value -1514 * will be generated from them. -1515 * @example -1516 * x = new X509(); -1517 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. -1518 * x.getExtAuthorityInfoAccess() → -1519 * { -1520 * critial: true, // -1521 * array: [{ocsp: http://ocsp.example.com/}, -1522 * {caissuer: https://repository.example.com/}] -1523 * } -1524 * -1525 * x = new X509(); -1526 * x.getExtAuthorityInfoAccesss("306230...") -1527 * x.getExtAuthorityInfoAccesss("306230...", true) -1528 */ -1529 this.getExtAuthorityInfoAccess = function(hExtV, critical) { -1530 if (hExtV === undefined && critical === undefined) { -1531 var info = this.getExtInfo("authorityInfoAccess"); -1532 if (info === undefined) return undefined; -1533 hExtV = _getTLV(this.hex, info.vidx); -1534 critical = info.critical; -1535 } -1536 -1537 var result = {extname:"authorityInfoAccess",array:[]}; -1538 if (critical) result.critical = true; -1539 -1540 var a = _getChildIdx(hExtV, 0); -1541 for (var i = 0; i < a.length; i++) { -1542 var hMethod = _getVbyListEx(hExtV, a[i], [0], "06"); -1543 var hLoc = _getVbyList(hExtV, a[i], [1], "86"); -1544 var sLoc = hextoutf8(hLoc); -1545 if (hMethod == "2b06010505073001") { -1546 result.array.push({ocsp: sLoc}); -1547 } else if (hMethod == "2b06010505073002") { -1548 result.array.push({caissuer: sLoc}); -1549 } else { -1550 throw new Error("unknown method: " + hMethod); -1551 } -1552 } -1553 -1554 return result; -1555 } -1556 -1557 /** -1558 * get CertificatePolicies extension value as JSON object -1559 * @name getExtCertificatePolicies -1560 * @memberOf X509# -1561 * @function -1562 * @param {String} hExtV hexadecimal string of extension value (OPTIONAL) -1563 * @param {Boolean} critical flag (OPTIONAL) -1564 * @return {Object} JSON object of CertificatePolicies parameters or undefined -1565 * @since jsrsasign 7.2.0 x509 1.1.14 -1566 * @description -1567 * This method will get certificate policies value -1568 * as an array of JSON object which has properties defined -1569 * in {@link KJUR.asn1.x509.CertificatePolicies}. -1570 * Result of this method can be passed to -1571 * {@link KJUR.asn1.x509.CertificatePolicies} constructor. -1572 * If there is no this extension in the certificate, -1573 * it returns undefined. -1574 * <br> -1575 * CAUTION: return value of JSON object format have been changed -1576 * from jsrsasign 9.0.0 without backword compatibility. -1577 * <br> -1578 * When hExtV and critical specified as arguments, return value -1579 * will be generated from them. -1580 * @example -1581 * x = new X509(); -1582 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. -1583 * x.getExtCertificatePolicies() → -1584 * { array: [ -1585 * { policyoid: "1.2.3.4" } -1586 * { policyoid: "1.2.3.5", -1587 * array: [ -1588 * { cps: "https://example.com/" }, -1589 * { unotice: { exptext: { type: "bmp", str: "sample text" } } } -1590 * ] -1591 * } -1592 * ]} -1593 */ -1594 this.getExtCertificatePolicies = function(hExtV, critical) { -1595 if (hExtV === undefined && critical === undefined) { -1596 var info = this.getExtInfo("certificatePolicies"); -1597 if (info === undefined) return undefined; -1598 hExtV = _getTLV(this.hex, info.vidx); -1599 critical = info.critical; -1600 } -1601 var result = {extname:"certificatePolicies",array:[]}; -1602 if (critical) result.critical = true; -1603 -1604 var aIdxPI = _getChildIdx(hExtV, 0); // PolicyInformation list index -1605 for (var i = 0; i < aIdxPI.length; i++) { -1606 var hPolicyInformation = _getTLV(hExtV, aIdxPI[i]); -1607 var polinfo = this.getPolicyInformation(hPolicyInformation); -1608 result.array.push(polinfo); -1609 } -1610 return result; -1611 } -1612 -1613 /** -1614 * get PolicyInformation ASN.1 structure parameter as JSON object -1615 * @name getPolicyInformation -1616 * @memberOf X509# -1617 * @function -1618 * @param {String} h hexadecimal string of PolicyInformation -1619 * @return {Object} JSON object of PolicyInformation parameters -1620 * @since jsrsasign 9.0.0 x509 2.0.0 -1621 * @description -1622 * This method will get PolicyInformation parameters defined in -1623 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.4"> -1624 * RFC 5280 4.2.1.4</a>. -1625 * <pre> -1626 * PolicyInformation ::= SEQUENCE { -1627 * policyIdentifier CertPolicyId, -1628 * policyQualifiers SEQUENCE SIZE (1..MAX) OF -1629 * PolicyQualifierInfo OPTIONAL } -1630 * </pre> -1631 * Result of this method can be passed to -1632 * {@link KJUR.asn1.x509.PolicyInformation} constructor. -1633 * @example -1634 * x = new X509(); -1635 * x.getPolicyInformation("30...") → -1636 * { -1637 * policyoid: "2.16.840.1.114412.2.1", -1638 * array: [{cps: "https://www.digicert.com/CPS"}] -1639 * } -1640 */ -1641 this.getPolicyInformation = function(h) { -1642 var result = {}; -1643 -1644 var hPOLICYOID = _getVbyList(h, 0, [0], "06"); -1645 result.policyoid = _oidname(hPOLICYOID); -1646 -1647 var idxPQSEQ = _getIdxbyListEx(h, 0, [1], "30"); -1648 if (idxPQSEQ != -1) { -1649 result.array = []; -1650 var aIdx = _getChildIdx(h, idxPQSEQ); -1651 for (var j = 0; j < aIdx.length; j++) { -1652 var hPQI = _getTLV(h, aIdx[j]); -1653 var pqinfo = this.getPolicyQualifierInfo(hPQI); -1654 result.array.push(pqinfo); -1655 } -1656 } -1657 -1658 return result; -1659 }; -1660 -1661 /** -1662 * get PolicyQualifierInfo ASN.1 structure parameter as JSON object -1663 * @name getPolicyQualifierInfo -1664 * @memberOf X509# -1665 * @function -1666 * @param {String} h hexadecimal string of PolicyQualifierInfo -1667 * @return {Object} JSON object of PolicyQualifierInfo parameters -1668 * @since jsrsasign 9.0.0 x509 2.0.0 -1669 * @see X509#getExtCertificatePolicies -1670 * @see X509#getPolicyInformation -1671 * @description -1672 * This method will get -1673 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.4"> -1674 * PolicyQualifierInfo</a> parameters. -1675 * <pre> -1676 * PolicyQualifierInfo ::= SEQUENCE { -1677 * policyQualifierId PolicyQualifierId, -1678 * qualifier ANY DEFINED BY policyQualifierId } -1679 * id-qt OBJECT IDENTIFIER ::= { id-pkix 2 } -1680 * id-qt-cps OBJECT IDENTIFIER ::= { id-qt 1 } -1681 * id-qt-unotice OBJECT IDENTIFIER ::= { id-qt 2 } -1682 * PolicyQualifierId ::= OBJECT IDENTIFIER ( id-qt-cps | id-qt-unotice ) -1683 * Qualifier ::= CHOICE { -1684 * cPSuri CPSuri, -1685 * userNotice UserNotice } -1686 * CPSuri ::= IA5String -1687 * </pre> -1688 * Result of this method can be passed to -1689 * {@link KJUR.asn1.x509.PolicyQualifierInfo} constructor. -1690 * @example -1691 * x = new X509(); -1692 * x.getPolicyQualifierInfo("30...") -1693 * → {unotice: {exptext: {type: 'utf8', str: 'aaa'}}} -1694 * x.getPolicyQualifierInfo("30...") -1695 * → {cps: "https://repository.example.com/"} -1696 */ -1697 this.getPolicyQualifierInfo = function(h) { -1698 var result = {}; -1699 var hPQOID = _getVbyList(h, 0, [0], "06"); -1700 if (hPQOID === "2b06010505070201") { // cps -1701 var hCPSURI = _getVbyListEx(h, 0, [1], "16"); -1702 result.cps = hextorstr(hCPSURI); -1703 } else if (hPQOID === "2b06010505070202") { // unotice -1704 var hUserNotice = _getTLVbyList(h, 0, [1], "30"); -1705 result.unotice = this.getUserNotice(hUserNotice); -1706 } -1707 return result; -1708 }; -1709 -1710 /** -1711 * get UserNotice ASN.1 structure parameter as JSON object -1712 * @name getUserNotice -1713 * @memberOf X509# -1714 * @function -1715 * @param {String} h hexadecimal string of UserNotice -1716 * @return {Object} JSON object of UserNotice parameters -1717 * @since jsrsasign 9.0.0 x509 2.0.0 -1718 * @see X509#getExtCertificatePolicies -1719 * @see X509#getPolicyInformation -1720 * @see X509#getPolicyQualifierInfo -1721 * @description -1722 * This method will get -1723 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.4"> -1724 * UserNotice</a> parameters. -1725 * <pre> -1726 * UserNotice ::= SEQUENCE { -1727 * noticeRef NoticeReference OPTIONAL, -1728 * explicitText DisplayText OPTIONAL } -1729 * </pre> -1730 * Result of this method can be passed to -1731 * {@link KJUR.asn1.x509.NoticeReference} constructor. -1732 * <br/> -1733 * NOTE: NoticeReference parsing is currently not supported and -1734 * it will be ignored. -1735 * @example -1736 * x = new X509(); -1737 * x.getUserNotice("30...") → {exptext: {type: 'utf8', str: 'aaa'}} -1738 */ -1739 this.getUserNotice = function(h) { -1740 var result = {}; -1741 var a = _getChildIdx(h, 0); -1742 for (var i = 0; i < a.length; i++) { -1743 var hItem = _getTLV(h, a[i]); -1744 if (hItem.substr(0, 2) != "30") { -1745 result.exptext = this.getDisplayText(hItem); -1746 } -1747 } -1748 return result; -1749 }; -1750 -1751 /** -1752 * get DisplayText ASN.1 structure parameter as JSON object -1753 * @name getDisplayText -1754 * @memberOf X509# -1755 * @function -1756 * @param {String} h hexadecimal string of DisplayText -1757 * @return {Object} JSON object of DisplayText parameters -1758 * @since jsrsasign 9.0.0 x509 2.0.0 -1759 * @see X509#getExtCertificatePolicies -1760 * @see X509#getPolicyInformation -1761 * @description -1762 * This method will get -1763 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.4"> -1764 * DisplayText</a> parameters. -1765 * <pre> -1766 * DisplayText ::= CHOICE { -1767 * ia5String IA5String (SIZE (1..200)), -1768 * visibleString VisibleString (SIZE (1..200)), -1769 * bmpString BMPString (SIZE (1..200)), -1770 * utf8String UTF8String (SIZE (1..200)) } -1771 * </pre> -1772 * Result of this method can be passed to -1773 * {@link KJUR.asn1.x509.DisplayText} constructor. -1774 * @example -1775 * x = new X509(); -1776 * x.getDisplayText("0c03616161") &rarr {type: 'utf8', str: 'aaa'} -1777 * x.getDisplayText("1e03616161") &rarr {type: 'bmp', str: 'aaa'} -1778 */ -1779 this.getDisplayText = function(h) { -1780 var _DISPLAYTEXTTAG = {"0c": "utf8", "16": "ia5", "1a": "vis" , "1e": "bmp"}; -1781 var result = {}; -1782 result.type = _DISPLAYTEXTTAG[h.substr(0, 2)]; -1783 result.str = hextorstr(_getV(h, 0)); -1784 return result; -1785 }; -1786 -1787 /** -1788 * parse cRLNumber CRL extension as JSON object<br/> -1789 * @name getExtCRLNumber -1790 * @memberOf X509# -1791 * @function -1792 * @param {String} hExtV hexadecimal string of extension value -1793 * @param {Boolean} critical flag -1794 * @since jsrsasign 9.1.1 x509 2.0.1 -1795 * @see KJUR.asn1.x509.CRLNumber -1796 * @see X509#getExtParamArray -1797 * @description -1798 * This method parses -1799 * CRLNumber CRL extension value defined in -1800 * <a href="https://tools.ietf.org/html/rfc5280#section-5.2.3"> -1801 * RFC 5280 5.2.3</a> as JSON object. -1802 * <pre> -1803 * id-ce-cRLNumber OBJECT IDENTIFIER ::= { id-ce 20 } -1804 * CRLNumber ::= INTEGER (0..MAX) -1805 * </pre> -1806 * <br/> -1807 * Result of this method can be passed to -1808 * {@link KJUR.asn1.x509.CRLNumber} constructor. -1809 * @example -1810 * crl = X509CRL("-----BEGIN X509 CRL..."); -1811 * ... get hExtV and critical flag ... -1812 * crl.getExtCRLNumber("02...", false) → -1813 * {extname: "cRLNumber", num: {hex: "12af"}} -1814 */ -1815 this.getExtCRLNumber = function(hExtV, critical) { -1816 var result = {extname:"cRLNumber"}; -1817 if (critical) result.critical = true; -1818 -1819 if (hExtV.substr(0, 2) == "02") { -1820 result.num = {hex: _getV(hExtV, 0)}; -1821 return result; -1822 } -1823 throw new Error("hExtV parse error: " + hExtV); -1824 }; -1825 -1826 /** -1827 * parse cRLReason CRL entry extension as JSON object<br/> -1828 * @name getExtCRLReason -1829 * @memberOf X509# -1830 * @function -1831 * @param {String} hExtV hexadecimal string of extension value -1832 * @param {Boolean} critical flag -1833 * @since jsrsasign 9.1.1 x509 2.0.1 -1834 * @see KJUR.asn1.x509.CRLReason -1835 * @see X509#getExtParamArray -1836 * @description -1837 * This method parses -1838 * CRLReason CRL entry extension value defined in -1839 * <a href="https://tools.ietf.org/html/rfc5280#section-5.3.1"> -1840 * RFC 5280 5.3.1</a> as JSON object. -1841 * <pre> -1842 * id-ce-cRLReasons OBJECT IDENTIFIER ::= { id-ce 21 } -1843 * -- reasonCode ::= { CRLReason } -1844 * CRLReason ::= ENUMERATED { -1845 * unspecified (0), -1846 * keyCompromise (1), -1847 * cACompromise (2), -1848 * affiliationChanged (3), -1849 * superseded (4), -1850 * cessationOfOperation (5), -1851 * certificateHold (6), -1852 * removeFromCRL (8), -1853 * privilegeWithdrawn (9), -1854 * aACompromise (10) } -1855 * </pre> -1856 * <br/> -1857 * Result of this method can be passed to -1858 * {@link KJUR.asn1.x509.CRLReason} constructor. -1859 * @example -1860 * crl = X509CRL("-----BEGIN X509 CRL..."); -1861 * ... get hExtV and critical flag ... -1862 * crl.getExtCRLReason("02...", false) → -1863 * {extname: "cRLReason", code: 3} -1864 */ -1865 this.getExtCRLReason = function(hExtV, critical) { -1866 var result = {extname:"cRLReason"}; -1867 if (critical) result.critical = true; -1868 -1869 if (hExtV.substr(0, 2) == "0a") { -1870 result.code = parseInt(_getV(hExtV, 0), 16); -1871 return result; -1872 } -1873 throw new Error("hExtV parse error: " + hExtV); -1874 }; -1875 -1876 /** -1877 * parse OCSPNonce OCSP extension as JSON object<br/> -1878 * @name getExtOCSPNonce -1879 * @memberOf X509# -1880 * @function -1881 * @param {String} hExtV hexadecimal string of extension value -1882 * @param {Boolean} critical flag -1883 * @return {Array} JSON object of parsed OCSPNonce extension -1884 * @since jsrsasign 9.1.6 x509 2.0.3 -1885 * @see KJUR.asn1.x509.OCSPNonce -1886 * @see X509#getExtParamArray -1887 * @see X509#getExtParam -1888 * @description -1889 * This method parses -1890 * Nonce OCSP extension value defined in -1891 * <a href="https://tools.ietf.org/html/rfc6960#section-4.4.1"> -1892 * RFC 6960 4.4.1</a> as JSON object. -1893 * <pre> -1894 * id-pkix-ocsp OBJECT IDENTIFIER ::= { id-ad-ocsp } -1895 * id-pkix-ocsp-nonce OBJECT IDENTIFIER ::= { id-pkix-ocsp 2 } -1896 * Nonce ::= OCTET STRING -1897 * </pre> -1898 * <br/> -1899 * Result of this method can be passed to -1900 * {@link KJUR.asn1.x509.OCSPNonce} constructor. -1901 * @example -1902 * x = new X509(); -1903 * x.getExtOCSPNonce(<<extn hex value >>) → -1904 * { extname: "ocspNonce", hex: "1a2b..." } -1905 */ -1906 this.getExtOcspNonce = function(hExtV, critical) { -1907 var result = {extname:"ocspNonce"}; -1908 if (critical) result.critical = true; -1909 -1910 var hNonce = _getV(hExtV, 0); -1911 result.hex = hNonce; -1912 -1913 return result; -1914 }; +1343 var a = _getChildIdx(hExtV, 0); +1344 for (var i = 0; i < a.length; i++) { +1345 var hTLV = _getTLV(hExtV, a[i]); +1346 result.array.push(this.getDistributionPoint(hTLV)); +1347 } +1348 +1349 return result; +1350 }; +1351 +1352 /** +1353 * get DistributionPoint ASN.1 structure parameter as JSON object +1354 * @name getDistributionPoint +1355 * @memberOf X509# +1356 * @function +1357 * @param {String} h hexadecimal string of DistributionPoint +1358 * @return {Object} JSON object of DistributionPoint parameters +1359 * @since jsrsasign 9.0.0 x509 2.0.0 +1360 * @see X509#getExtCRLDistributionPoints +1361 * @see X509#getDistributionPointName +1362 * @see X509#getGeneralNames +1363 * @see X509#getGeneralName +1364 * @description +1365 * This method will get DistributionPoint parameters. +1366 * Result of this method can be passed to +1367 * {@link KJUR.asn1.x509.DistributionPoint} constructor. +1368 * <br/> +1369 * NOTE: reasons[1] and CRLIssuer[2] field not supported +1370 * @example +1371 * x = new X509(); +1372 * x.getDistributionPoint("30...") → +1373 * {dpname: {full: [{uri: "http://aaa.com/"}]}} +1374 */ +1375 this.getDistributionPoint = function(h) { +1376 var result = {}; +1377 var a = _getChildIdx(h, 0); +1378 for (var i = 0; i < a.length; i++) { +1379 var tag = h.substr(a[i], 2); +1380 var hTLV = _getTLV(h, a[i]); +1381 if (tag == "a0") { +1382 result.dpname = this.getDistributionPointName(hTLV); +1383 } +1384 } +1385 return result; +1386 }; +1387 +1388 /** +1389 * get DistributionPointName ASN.1 structure parameter as JSON object +1390 * @name getDistributionPointName +1391 * @memberOf X509# +1392 * @function +1393 * @param {String} h hexadecimal string of DistributionPointName +1394 * @return {Object} JSON object of DistributionPointName parameters +1395 * @since jsrsasign 9.0.0 x509 2.0.0 +1396 * @see X509#getExtCRLDistributionPoints +1397 * @see X509#getDistributionPoint +1398 * @see X509#getGeneralNames +1399 * @see X509#getGeneralName +1400 * @description +1401 * This method will get DistributionPointName parameters. +1402 * Result of this method can be passed to +1403 * {@link KJUR.asn1.x509.DistributionPointName} constructor. +1404 * <br/> +1405 * NOTE: nameRelativeToCRLIssuer[1] not supported +1406 * @example +1407 * x = new X509(); +1408 * x.getDistributionPointName("a0...") → +1409 * {full: [{uri: "http://aaa.com/"}]} +1410 */ +1411 this.getDistributionPointName = function(h) { +1412 var result = {}; +1413 var a = _getChildIdx(h, 0); +1414 for (var i = 0; i < a.length; i++) { +1415 var tag = h.substr(a[i], 2); +1416 var hTLV = _getTLV(h, a[i]); +1417 if (tag == "a0") { +1418 result.full = this.getGeneralNames(hTLV); +1419 } +1420 } +1421 return result; +1422 }; +1423 +1424 /** +1425 * get array of string for fullName URIs in cRLDistributionPoints(CDP) in the certificate (DEPRECATED) +1426 * @name getExtCRLDistributionPointsURI +1427 * @memberOf X509# +1428 * @function +1429 * @return {Object} array of fullName URIs of CDP of the certificate +1430 * @since jsrsasign 7.2.0 x509 1.1.14 +1431 * @description +1432 * This method will get all fullName URIs of cRLDistributionPoints extension +1433 * in the certificate as array of URI string. +1434 * If there is this in the certificate, it returns undefined; +1435 * <br> +1436 * NOTE: Currently this method supports only fullName URI so that +1437 * other parameters will not be returned. +1438 * @example +1439 * x = new X509(); +1440 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. +1441 * x.getExtCRLDistributionPointsURI() → +1442 * ["http://example.com/aaa.crl", "http://example.org/aaa.crl"] +1443 */ +1444 this.getExtCRLDistributionPointsURI = function() { +1445 var info = this.getExtInfo("cRLDistributionPoints"); +1446 if (info === undefined) return info; +1447 +1448 var result = new Array(); +1449 var a = _getChildIdx(this.hex, info.vidx); +1450 for (var i = 0; i < a.length; i++) { +1451 try { +1452 var hURI = _getVbyList(this.hex, a[i], [0, 0, 0], "86"); +1453 var uri = hextoutf8(hURI); +1454 result.push(uri); +1455 } catch(ex) {}; +1456 } +1457 +1458 return result; +1459 }; +1460 +1461 /** +1462 * get AuthorityInfoAccess extension value in the certificate as associative array +1463 * @name getExtAIAInfo +1464 * @memberOf X509# +1465 * @function +1466 * @return {Object} associative array of AIA extension properties +1467 * @since jsrsasign 7.2.0 x509 1.1.14 +1468 * @description +1469 * This method will get authority info access value +1470 * as associate array which has following properties: +1471 * <ul> +1472 * <li>ocsp - array of string for OCSP responder URL</li> +1473 * <li>caissuer - array of string for caIssuer value (i.e. CA certificates URL)</li> +1474 * </ul> +1475 * If there is this in the certificate, it returns undefined; +1476 * @example +1477 * x = new X509(); +1478 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. +1479 * x.getExtAIAInfo(hCert) → +1480 * { ocsp: ["http://ocsp.foo.com"], +1481 * caissuer: ["http://rep.foo.com/aaa.p8m"] } +1482 */ +1483 this.getExtAIAInfo = function() { +1484 var info = this.getExtInfo("authorityInfoAccess"); +1485 if (info === undefined) return info; +1486 +1487 var result = { ocsp: [], caissuer: [] }; +1488 var a = _getChildIdx(this.hex, info.vidx); +1489 for (var i = 0; i < a.length; i++) { +1490 var hOID = _getVbyList(this.hex, a[i], [0], "06"); +1491 var hName = _getVbyList(this.hex, a[i], [1], "86"); +1492 if (hOID === "2b06010505073001") { +1493 result.ocsp.push(hextoutf8(hName)); +1494 } +1495 if (hOID === "2b06010505073002") { +1496 result.caissuer.push(hextoutf8(hName)); +1497 } +1498 } +1499 +1500 return result; +1501 }; +1502 +1503 /** +1504 * get AuthorityInfoAccess extension value as JSON object +1505 * @name getExtAuthorityInfoAccess +1506 * @memberOf X509# +1507 * @function +1508 * @param {String} hExtV hexadecimal string of extension value (OPTIONAL) +1509 * @param {Boolean} critical flag (OPTIONAL) +1510 * @return {Array} JSON object of AuthorityInfoAccess parameters or undefined +1511 * @since jsrsasign 9.0.0 x509 2.0.0 +1512 * @see KJUR.asn1.x509.AuthorityInfoAccess +1513 * @description +1514 * This method parse authorityInfoAccess extension. When arguments are +1515 * not specified, its extension in X509 object will be parsed. +1516 * Result of this method can be passed to +1517 * {@link KJUR.asn1.x509.AuthorityInfoAccess} constructor. +1518 * <br> +1519 * When hExtV and critical specified as arguments, return value +1520 * will be generated from them. +1521 * @example +1522 * x = new X509(); +1523 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. +1524 * x.getExtAuthorityInfoAccess() → +1525 * { +1526 * critial: true, // +1527 * array: [{ocsp: http://ocsp.example.com/}, +1528 * {caissuer: https://repository.example.com/}] +1529 * } +1530 * +1531 * x = new X509(); +1532 * x.getExtAuthorityInfoAccesss("306230...") +1533 * x.getExtAuthorityInfoAccesss("306230...", true) +1534 */ +1535 this.getExtAuthorityInfoAccess = function(hExtV, critical) { +1536 if (hExtV === undefined && critical === undefined) { +1537 var info = this.getExtInfo("authorityInfoAccess"); +1538 if (info === undefined) return undefined; +1539 hExtV = _getTLV(this.hex, info.vidx); +1540 critical = info.critical; +1541 } +1542 +1543 var result = {extname:"authorityInfoAccess",array:[]}; +1544 if (critical) result.critical = true; +1545 +1546 var a = _getChildIdx(hExtV, 0); +1547 for (var i = 0; i < a.length; i++) { +1548 var hMethod = _getVbyListEx(hExtV, a[i], [0], "06"); +1549 var hLoc = _getVbyList(hExtV, a[i], [1], "86"); +1550 var sLoc = hextoutf8(hLoc); +1551 if (hMethod == "2b06010505073001") { +1552 result.array.push({ocsp: sLoc}); +1553 } else if (hMethod == "2b06010505073002") { +1554 result.array.push({caissuer: sLoc}); +1555 } else { +1556 throw new Error("unknown method: " + hMethod); +1557 } +1558 } +1559 +1560 return result; +1561 } +1562 +1563 /** +1564 * get CertificatePolicies extension value as JSON object +1565 * @name getExtCertificatePolicies +1566 * @memberOf X509# +1567 * @function +1568 * @param {String} hExtV hexadecimal string of extension value (OPTIONAL) +1569 * @param {Boolean} critical flag (OPTIONAL) +1570 * @return {Object} JSON object of CertificatePolicies parameters or undefined +1571 * @since jsrsasign 7.2.0 x509 1.1.14 +1572 * @description +1573 * This method will get certificate policies value +1574 * as an array of JSON object which has properties defined +1575 * in {@link KJUR.asn1.x509.CertificatePolicies}. +1576 * Result of this method can be passed to +1577 * {@link KJUR.asn1.x509.CertificatePolicies} constructor. +1578 * If there is no this extension in the certificate, +1579 * it returns undefined. +1580 * <br> +1581 * CAUTION: return value of JSON object format have been changed +1582 * from jsrsasign 9.0.0 without backword compatibility. +1583 * <br> +1584 * When hExtV and critical specified as arguments, return value +1585 * will be generated from them. +1586 * @example +1587 * x = new X509(); +1588 * x.readCertPEM(sCertPEM); // parseExt() will also be called internally. +1589 * x.getExtCertificatePolicies() → +1590 * { array: [ +1591 * { policyoid: "1.2.3.4" } +1592 * { policyoid: "1.2.3.5", +1593 * array: [ +1594 * { cps: "https://example.com/" }, +1595 * { unotice: { exptext: { type: "bmp", str: "sample text" } } } +1596 * ] +1597 * } +1598 * ]} +1599 */ +1600 this.getExtCertificatePolicies = function(hExtV, critical) { +1601 if (hExtV === undefined && critical === undefined) { +1602 var info = this.getExtInfo("certificatePolicies"); +1603 if (info === undefined) return undefined; +1604 hExtV = _getTLV(this.hex, info.vidx); +1605 critical = info.critical; +1606 } +1607 var result = {extname:"certificatePolicies",array:[]}; +1608 if (critical) result.critical = true; +1609 +1610 var aIdxPI = _getChildIdx(hExtV, 0); // PolicyInformation list index +1611 for (var i = 0; i < aIdxPI.length; i++) { +1612 var hPolicyInformation = _getTLV(hExtV, aIdxPI[i]); +1613 var polinfo = this.getPolicyInformation(hPolicyInformation); +1614 result.array.push(polinfo); +1615 } +1616 return result; +1617 } +1618 +1619 /** +1620 * get PolicyInformation ASN.1 structure parameter as JSON object +1621 * @name getPolicyInformation +1622 * @memberOf X509# +1623 * @function +1624 * @param {String} h hexadecimal string of PolicyInformation +1625 * @return {Object} JSON object of PolicyInformation parameters +1626 * @since jsrsasign 9.0.0 x509 2.0.0 +1627 * @description +1628 * This method will get PolicyInformation parameters defined in +1629 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.4"> +1630 * RFC 5280 4.2.1.4</a>. +1631 * <pre> +1632 * PolicyInformation ::= SEQUENCE { +1633 * policyIdentifier CertPolicyId, +1634 * policyQualifiers SEQUENCE SIZE (1..MAX) OF +1635 * PolicyQualifierInfo OPTIONAL } +1636 * </pre> +1637 * Result of this method can be passed to +1638 * {@link KJUR.asn1.x509.PolicyInformation} constructor. +1639 * @example +1640 * x = new X509(); +1641 * x.getPolicyInformation("30...") → +1642 * { +1643 * policyoid: "2.16.840.1.114412.2.1", +1644 * array: [{cps: "https://www.digicert.com/CPS"}] +1645 * } +1646 */ +1647 this.getPolicyInformation = function(h) { +1648 var result = {}; +1649 +1650 var hPOLICYOID = _getVbyList(h, 0, [0], "06"); +1651 result.policyoid = _oidname(hPOLICYOID); +1652 +1653 var idxPQSEQ = _getIdxbyListEx(h, 0, [1], "30"); +1654 if (idxPQSEQ != -1) { +1655 result.array = []; +1656 var aIdx = _getChildIdx(h, idxPQSEQ); +1657 for (var j = 0; j < aIdx.length; j++) { +1658 var hPQI = _getTLV(h, aIdx[j]); +1659 var pqinfo = this.getPolicyQualifierInfo(hPQI); +1660 result.array.push(pqinfo); +1661 } +1662 } +1663 +1664 return result; +1665 }; +1666 +1667 /** +1668 * get PolicyQualifierInfo ASN.1 structure parameter as JSON object +1669 * @name getPolicyQualifierInfo +1670 * @memberOf X509# +1671 * @function +1672 * @param {String} h hexadecimal string of PolicyQualifierInfo +1673 * @return {Object} JSON object of PolicyQualifierInfo parameters +1674 * @since jsrsasign 9.0.0 x509 2.0.0 +1675 * @see X509#getExtCertificatePolicies +1676 * @see X509#getPolicyInformation +1677 * @description +1678 * This method will get +1679 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.4"> +1680 * PolicyQualifierInfo</a> parameters. +1681 * <pre> +1682 * PolicyQualifierInfo ::= SEQUENCE { +1683 * policyQualifierId PolicyQualifierId, +1684 * qualifier ANY DEFINED BY policyQualifierId } +1685 * id-qt OBJECT IDENTIFIER ::= { id-pkix 2 } +1686 * id-qt-cps OBJECT IDENTIFIER ::= { id-qt 1 } +1687 * id-qt-unotice OBJECT IDENTIFIER ::= { id-qt 2 } +1688 * PolicyQualifierId ::= OBJECT IDENTIFIER ( id-qt-cps | id-qt-unotice ) +1689 * Qualifier ::= CHOICE { +1690 * cPSuri CPSuri, +1691 * userNotice UserNotice } +1692 * CPSuri ::= IA5String +1693 * </pre> +1694 * Result of this method can be passed to +1695 * {@link KJUR.asn1.x509.PolicyQualifierInfo} constructor. +1696 * @example +1697 * x = new X509(); +1698 * x.getPolicyQualifierInfo("30...") +1699 * → {unotice: {exptext: {type: 'utf8', str: 'aaa'}}} +1700 * x.getPolicyQualifierInfo("30...") +1701 * → {cps: "https://repository.example.com/"} +1702 */ +1703 this.getPolicyQualifierInfo = function(h) { +1704 var result = {}; +1705 var hPQOID = _getVbyList(h, 0, [0], "06"); +1706 if (hPQOID === "2b06010505070201") { // cps +1707 var hCPSURI = _getVbyListEx(h, 0, [1], "16"); +1708 result.cps = hextorstr(hCPSURI); +1709 } else if (hPQOID === "2b06010505070202") { // unotice +1710 var hUserNotice = _getTLVbyList(h, 0, [1], "30"); +1711 result.unotice = this.getUserNotice(hUserNotice); +1712 } +1713 return result; +1714 }; +1715 +1716 /** +1717 * get UserNotice ASN.1 structure parameter as JSON object +1718 * @name getUserNotice +1719 * @memberOf X509# +1720 * @function +1721 * @param {String} h hexadecimal string of UserNotice +1722 * @return {Object} JSON object of UserNotice parameters +1723 * @since jsrsasign 9.0.0 x509 2.0.0 +1724 * @see X509#getExtCertificatePolicies +1725 * @see X509#getPolicyInformation +1726 * @see X509#getPolicyQualifierInfo +1727 * @description +1728 * This method will get +1729 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.4"> +1730 * UserNotice</a> parameters. +1731 * <pre> +1732 * UserNotice ::= SEQUENCE { +1733 * noticeRef NoticeReference OPTIONAL, +1734 * explicitText DisplayText OPTIONAL } +1735 * </pre> +1736 * Result of this method can be passed to +1737 * {@link KJUR.asn1.x509.NoticeReference} constructor. +1738 * <br/> +1739 * NOTE: NoticeReference parsing is currently not supported and +1740 * it will be ignored. +1741 * @example +1742 * x = new X509(); +1743 * x.getUserNotice("30...") → {exptext: {type: 'utf8', str: 'aaa'}} +1744 */ +1745 this.getUserNotice = function(h) { +1746 var result = {}; +1747 var a = _getChildIdx(h, 0); +1748 for (var i = 0; i < a.length; i++) { +1749 var hItem = _getTLV(h, a[i]); +1750 if (hItem.substr(0, 2) != "30") { +1751 result.exptext = this.getDisplayText(hItem); +1752 } +1753 } +1754 return result; +1755 }; +1756 +1757 /** +1758 * get DisplayText ASN.1 structure parameter as JSON object +1759 * @name getDisplayText +1760 * @memberOf X509# +1761 * @function +1762 * @param {String} h hexadecimal string of DisplayText +1763 * @return {Object} JSON object of DisplayText parameters +1764 * @since jsrsasign 9.0.0 x509 2.0.0 +1765 * @see X509#getExtCertificatePolicies +1766 * @see X509#getPolicyInformation +1767 * @description +1768 * This method will get +1769 * <a href="https://tools.ietf.org/html/rfc5280#section-4.2.1.4"> +1770 * DisplayText</a> parameters. +1771 * <pre> +1772 * DisplayText ::= CHOICE { +1773 * ia5String IA5String (SIZE (1..200)), +1774 * visibleString VisibleString (SIZE (1..200)), +1775 * bmpString BMPString (SIZE (1..200)), +1776 * utf8String UTF8String (SIZE (1..200)) } +1777 * </pre> +1778 * Result of this method can be passed to +1779 * {@link KJUR.asn1.x509.DisplayText} constructor. +1780 * @example +1781 * x = new X509(); +1782 * x.getDisplayText("0c03616161") &rarr {type: 'utf8', str: 'aaa'} +1783 * x.getDisplayText("1e03616161") &rarr {type: 'bmp', str: 'aaa'} +1784 */ +1785 this.getDisplayText = function(h) { +1786 var _DISPLAYTEXTTAG = {"0c": "utf8", "16": "ia5", "1a": "vis" , "1e": "bmp"}; +1787 var result = {}; +1788 result.type = _DISPLAYTEXTTAG[h.substr(0, 2)]; +1789 result.str = hextorstr(_getV(h, 0)); +1790 return result; +1791 }; +1792 +1793 /** +1794 * parse cRLNumber CRL extension as JSON object<br/> +1795 * @name getExtCRLNumber +1796 * @memberOf X509# +1797 * @function +1798 * @param {String} hExtV hexadecimal string of extension value +1799 * @param {Boolean} critical flag +1800 * @since jsrsasign 9.1.1 x509 2.0.1 +1801 * @see KJUR.asn1.x509.CRLNumber +1802 * @see X509#getExtParamArray +1803 * @description +1804 * This method parses +1805 * CRLNumber CRL extension value defined in +1806 * <a href="https://tools.ietf.org/html/rfc5280#section-5.2.3"> +1807 * RFC 5280 5.2.3</a> as JSON object. +1808 * <pre> +1809 * id-ce-cRLNumber OBJECT IDENTIFIER ::= { id-ce 20 } +1810 * CRLNumber ::= INTEGER (0..MAX) +1811 * </pre> +1812 * <br/> +1813 * Result of this method can be passed to +1814 * {@link KJUR.asn1.x509.CRLNumber} constructor. +1815 * @example +1816 * crl = X509CRL("-----BEGIN X509 CRL..."); +1817 * ... get hExtV and critical flag ... +1818 * crl.getExtCRLNumber("02...", false) → +1819 * {extname: "cRLNumber", num: {hex: "12af"}} +1820 */ +1821 this.getExtCRLNumber = function(hExtV, critical) { +1822 var result = {extname:"cRLNumber"}; +1823 if (critical) result.critical = true; +1824 +1825 if (hExtV.substr(0, 2) == "02") { +1826 result.num = {hex: _getV(hExtV, 0)}; +1827 return result; +1828 } +1829 throw new Error("hExtV parse error: " + hExtV); +1830 }; +1831 +1832 /** +1833 * parse cRLReason CRL entry extension as JSON object<br/> +1834 * @name getExtCRLReason +1835 * @memberOf X509# +1836 * @function +1837 * @param {String} hExtV hexadecimal string of extension value +1838 * @param {Boolean} critical flag +1839 * @since jsrsasign 9.1.1 x509 2.0.1 +1840 * @see KJUR.asn1.x509.CRLReason +1841 * @see X509#getExtParamArray +1842 * @description +1843 * This method parses +1844 * CRLReason CRL entry extension value defined in +1845 * <a href="https://tools.ietf.org/html/rfc5280#section-5.3.1"> +1846 * RFC 5280 5.3.1</a> as JSON object. +1847 * <pre> +1848 * id-ce-cRLReasons OBJECT IDENTIFIER ::= { id-ce 21 } +1849 * -- reasonCode ::= { CRLReason } +1850 * CRLReason ::= ENUMERATED { +1851 * unspecified (0), +1852 * keyCompromise (1), +1853 * cACompromise (2), +1854 * affiliationChanged (3), +1855 * superseded (4), +1856 * cessationOfOperation (5), +1857 * certificateHold (6), +1858 * removeFromCRL (8), +1859 * privilegeWithdrawn (9), +1860 * aACompromise (10) } +1861 * </pre> +1862 * <br/> +1863 * Result of this method can be passed to +1864 * {@link KJUR.asn1.x509.CRLReason} constructor. +1865 * @example +1866 * crl = X509CRL("-----BEGIN X509 CRL..."); +1867 * ... get hExtV and critical flag ... +1868 * crl.getExtCRLReason("02...", false) → +1869 * {extname: "cRLReason", code: 3} +1870 */ +1871 this.getExtCRLReason = function(hExtV, critical) { +1872 var result = {extname:"cRLReason"}; +1873 if (critical) result.critical = true; +1874 +1875 if (hExtV.substr(0, 2) == "0a") { +1876 result.code = parseInt(_getV(hExtV, 0), 16); +1877 return result; +1878 } +1879 throw new Error("hExtV parse error: " + hExtV); +1880 }; +1881 +1882 /** +1883 * parse OCSPNonce OCSP extension as JSON object<br/> +1884 * @name getExtOCSPNonce +1885 * @memberOf X509# +1886 * @function +1887 * @param {String} hExtV hexadecimal string of extension value +1888 * @param {Boolean} critical flag +1889 * @return {Array} JSON object of parsed OCSPNonce extension +1890 * @since jsrsasign 9.1.6 x509 2.0.3 +1891 * @see KJUR.asn1.x509.OCSPNonce +1892 * @see X509#getExtParamArray +1893 * @see X509#getExtParam +1894 * @description +1895 * This method parses +1896 * Nonce OCSP extension value defined in +1897 * <a href="https://tools.ietf.org/html/rfc6960#section-4.4.1"> +1898 * RFC 6960 4.4.1</a> as JSON object. +1899 * <pre> +1900 * id-pkix-ocsp OBJECT IDENTIFIER ::= { id-ad-ocsp } +1901 * id-pkix-ocsp-nonce OBJECT IDENTIFIER ::= { id-pkix-ocsp 2 } +1902 * Nonce ::= OCTET STRING +1903 * </pre> +1904 * <br/> +1905 * Result of this method can be passed to +1906 * {@link KJUR.asn1.x509.OCSPNonce} constructor. +1907 * @example +1908 * x = new X509(); +1909 * x.getExtOCSPNonce(<<extn hex value >>) → +1910 * { extname: "ocspNonce", hex: "1a2b..." } +1911 */ +1912 this.getExtOcspNonce = function(hExtV, critical) { +1913 var result = {extname:"ocspNonce"}; +1914 if (critical) result.critical = true; 1915 -1916 /** -1917 * parse OCSPNoCheck OCSP extension as JSON object<br/> -1918 * @name getExtOCSPNoCheck -1919 * @memberOf X509# -1920 * @function -1921 * @param {String} hExtV hexadecimal string of extension value -1922 * @param {Boolean} critical flag -1923 * @return {Array} JSON object of parsed OCSPNoCheck extension -1924 * @since jsrsasign 9.1.6 x509 2.0.3 -1925 * @see KJUR.asn1.x509.OCSPNoCheck -1926 * @see X509#getExtParamArray -1927 * @see X509#getExtParam -1928 * @description -1929 * This method parses -1930 * OCSPNoCheck extension value defined in -1931 * <a href="https://tools.ietf.org/html/rfc6960#section-4.2.2.2.1"> -1932 * RFC 6960 4.2.2.2.1</a> as JSON object. -1933 * <pre> -1934 * id-pkix-ocsp-nocheck OBJECT IDENTIFIER ::= { id-pkix-ocsp 5 } -1935 * </pre> -1936 * <br/> -1937 * Result of this method can be passed to -1938 * {@link KJUR.asn1.x509.OCSPNoCheck} constructor. -1939 * @example -1940 * x = new X509(); -1941 * x.getExtOCSPNoCheck(<<extn hex value >>) → -1942 * { extname: "ocspNoCheck" } -1943 */ -1944 this.getExtOcspNoCheck = function(hExtV, critical) { -1945 var result = {extname:"ocspNoCheck"}; -1946 if (critical) result.critical = true; -1947 -1948 return result; -1949 }; -1950 -1951 /** -1952 * parse AdobeTimeStamp extension as JSON object<br/> -1953 * @name getExtAdobeTimeStamp -1954 * @memberOf X509# -1955 * @function -1956 * @param {String} hExtV hexadecimal string of extension value -1957 * @param {Boolean} critical flag -1958 * @return {Array} JSON object of parsed AdobeTimeStamp extension -1959 * @since jsrsasign 10.0.1 x509 2.0.5 -1960 * @see KJUR.asn1.x509.AdobeTimeStamp -1961 * @see X509#getExtParamArray -1962 * @see X509#getExtParam -1963 * @description -1964 * This method parses -1965 * X.509v3 AdobeTimeStamp private extension value defined in the -1966 * <a href="https://www.adobe.com/devnet-docs/acrobatetk/tools/DigSigDC/oids.html"> -1967 * Adobe site</a> as JSON object. -1968 * This extension provides the URL location for time stamp service. -1969 * <pre> -1970 * adbe- OBJECT IDENTIFIER ::= { adbe(1.2.840.113583) acrobat(1) security(1) x509Ext(9) 1 } -1971 * ::= SEQUENCE { -1972 * version INTEGER { v1(1) }, -- extension version -1973 * location GeneralName (In v1 GeneralName can be only uniformResourceIdentifier) -1974 * requiresAuth boolean (default false), OPTIONAL } -1975 * </pre> -1976 * <br/> -1977 * Result of this method can be passed to -1978 * {@link KJUR.asn1.x509.AdobeTimeStamp} constructor. -1979 * <br/> -1980 * NOTE: This extesion doesn't seem to have official name. This may be called as "pdfTimeStamp". -1981 * @example -1982 * x.getExtAdobeTimeStamp(<<extn hex value >>) → -1983 * { extname: "adobeTimeStamp", uri: "http://tsa.example.com/" reqauth: true } -1984 */ -1985 this.getExtAdobeTimeStamp = function(hExtV, critical) { -1986 if (hExtV === undefined && critical === undefined) { -1987 var info = this.getExtInfo("adobeTimeStamp"); -1988 if (info === undefined) return undefined; -1989 hExtV = _getTLV(this.hex, info.vidx); -1990 critical = info.critical; -1991 } -1992 -1993 var result = {extname:"adobeTimeStamp"}; -1994 if (critical) result.critical = true; -1995 -1996 var a = _getChildIdx(hExtV, 0); -1997 if (a.length > 1) { -1998 var hGN = _getTLV(hExtV, a[1]) -1999 var gnParam = this.getGeneralName(hGN); -2000 if (gnParam.uri != undefined) { -2001 result.uri = gnParam.uri; -2002 } -2003 } -2004 if (a.length > 2) { -2005 var hBool = _getTLV(hExtV, a[2]); -2006 if (hBool == "0101ff") result.reqauth = true; -2007 if (hBool == "010100") result.reqauth = false; -2008 } -2009 -2010 return result; -2011 }; -2012 -2013 // ===== BEGIN X500Name related ===================================== -2014 -2015 this.getX500NameRule = function(aDN) { -2016 var isPRNRule = true; -2017 var isUTF8Rule = true; -2018 var isMixedRule = false; -2019 var logfull = ""; -2020 var logcheck = ""; -2021 var lasttag = null; -2022 -2023 var a = []; -2024 for (var i = 0; i < aDN.length; i++) { -2025 var aRDN = aDN[i]; -2026 for (var j = 0; j < aRDN.length; j++) { -2027 a.push(aRDN[j]); -2028 } -2029 } -2030 -2031 for (var i = 0; i < a.length; i++) { -2032 var item = a[i]; -2033 var tag = item.ds; -2034 var value = item.value; -2035 var type = item.type; -2036 logfull += ":" + tag; -2037 -2038 if (tag != "prn" && tag != "utf8" && tag != "ia5") { -2039 return "mixed"; -2040 } -2041 if (tag == "ia5") { -2042 if (type != "CN") { -2043 return "mixed"; -2044 } else { -2045 if (! KJUR.lang.String.isMail(value)) { -2046 return "mixed"; -2047 } else { -2048 continue; -2049 } -2050 } -2051 } -2052 if (type == "C") { -2053 if (tag == "prn") { -2054 continue; -2055 } else { -2056 return "mixed"; -2057 } -2058 } -2059 logcheck += ":" + tag; -2060 if (lasttag == null) { -2061 lasttag = tag; -2062 } else { -2063 if (lasttag !== tag) return "mixed"; +1916 var hNonce = _getV(hExtV, 0); +1917 result.hex = hNonce; +1918 +1919 return result; +1920 }; +1921 +1922 /** +1923 * parse OCSPNoCheck OCSP extension as JSON object<br/> +1924 * @name getExtOCSPNoCheck +1925 * @memberOf X509# +1926 * @function +1927 * @param {String} hExtV hexadecimal string of extension value +1928 * @param {Boolean} critical flag +1929 * @return {Array} JSON object of parsed OCSPNoCheck extension +1930 * @since jsrsasign 9.1.6 x509 2.0.3 +1931 * @see KJUR.asn1.x509.OCSPNoCheck +1932 * @see X509#getExtParamArray +1933 * @see X509#getExtParam +1934 * @description +1935 * This method parses +1936 * OCSPNoCheck extension value defined in +1937 * <a href="https://tools.ietf.org/html/rfc6960#section-4.2.2.2.1"> +1938 * RFC 6960 4.2.2.2.1</a> as JSON object. +1939 * <pre> +1940 * id-pkix-ocsp-nocheck OBJECT IDENTIFIER ::= { id-pkix-ocsp 5 } +1941 * </pre> +1942 * <br/> +1943 * Result of this method can be passed to +1944 * {@link KJUR.asn1.x509.OCSPNoCheck} constructor. +1945 * @example +1946 * x = new X509(); +1947 * x.getExtOCSPNoCheck(<<extn hex value >>) → +1948 * { extname: "ocspNoCheck" } +1949 */ +1950 this.getExtOcspNoCheck = function(hExtV, critical) { +1951 var result = {extname:"ocspNoCheck"}; +1952 if (critical) result.critical = true; +1953 +1954 return result; +1955 }; +1956 +1957 /** +1958 * parse AdobeTimeStamp extension as JSON object<br/> +1959 * @name getExtAdobeTimeStamp +1960 * @memberOf X509# +1961 * @function +1962 * @param {String} hExtV hexadecimal string of extension value +1963 * @param {Boolean} critical flag +1964 * @return {Array} JSON object of parsed AdobeTimeStamp extension +1965 * @since jsrsasign 10.0.1 x509 2.0.5 +1966 * @see KJUR.asn1.x509.AdobeTimeStamp +1967 * @see X509#getExtParamArray +1968 * @see X509#getExtParam +1969 * @description +1970 * This method parses +1971 * X.509v3 AdobeTimeStamp private extension value defined in the +1972 * <a href="https://www.adobe.com/devnet-docs/acrobatetk/tools/DigSigDC/oids.html"> +1973 * Adobe site</a> as JSON object. +1974 * This extension provides the URL location for time stamp service. +1975 * <pre> +1976 * adbe- OBJECT IDENTIFIER ::= { adbe(1.2.840.113583) acrobat(1) security(1) x509Ext(9) 1 } +1977 * ::= SEQUENCE { +1978 * version INTEGER { v1(1) }, -- extension version +1979 * location GeneralName (In v1 GeneralName can be only uniformResourceIdentifier) +1980 * requiresAuth boolean (default false), OPTIONAL } +1981 * </pre> +1982 * <br/> +1983 * Result of this method can be passed to +1984 * {@link KJUR.asn1.x509.AdobeTimeStamp} constructor. +1985 * <br/> +1986 * NOTE: This extesion doesn't seem to have official name. This may be called as "pdfTimeStamp". +1987 * @example +1988 * x.getExtAdobeTimeStamp(<<extn hex value >>) → +1989 * { extname: "adobeTimeStamp", uri: "http://tsa.example.com/" reqauth: true } +1990 */ +1991 this.getExtAdobeTimeStamp = function(hExtV, critical) { +1992 if (hExtV === undefined && critical === undefined) { +1993 var info = this.getExtInfo("adobeTimeStamp"); +1994 if (info === undefined) return undefined; +1995 hExtV = _getTLV(this.hex, info.vidx); +1996 critical = info.critical; +1997 } +1998 +1999 var result = {extname:"adobeTimeStamp"}; +2000 if (critical) result.critical = true; +2001 +2002 var a = _getChildIdx(hExtV, 0); +2003 if (a.length > 1) { +2004 var hGN = _getTLV(hExtV, a[1]) +2005 var gnParam = this.getGeneralName(hGN); +2006 if (gnParam.uri != undefined) { +2007 result.uri = gnParam.uri; +2008 } +2009 } +2010 if (a.length > 2) { +2011 var hBool = _getTLV(hExtV, a[2]); +2012 if (hBool == "0101ff") result.reqauth = true; +2013 if (hBool == "010100") result.reqauth = false; +2014 } +2015 +2016 return result; +2017 }; +2018 +2019 // ===== BEGIN X500Name related ===================================== +2020 +2021 this.getX500NameRule = function(aDN) { +2022 var isPRNRule = true; +2023 var isUTF8Rule = true; +2024 var isMixedRule = false; +2025 var logfull = ""; +2026 var logcheck = ""; +2027 var lasttag = null; +2028 +2029 var a = []; +2030 for (var i = 0; i < aDN.length; i++) { +2031 var aRDN = aDN[i]; +2032 for (var j = 0; j < aRDN.length; j++) { +2033 a.push(aRDN[j]); +2034 } +2035 } +2036 +2037 for (var i = 0; i < a.length; i++) { +2038 var item = a[i]; +2039 var tag = item.ds; +2040 var value = item.value; +2041 var type = item.type; +2042 logfull += ":" + tag; +2043 +2044 if (tag != "prn" && tag != "utf8" && tag != "ia5") { +2045 return "mixed"; +2046 } +2047 if (tag == "ia5") { +2048 if (type != "CN") { +2049 return "mixed"; +2050 } else { +2051 if (! KJUR.lang.String.isMail(value)) { +2052 return "mixed"; +2053 } else { +2054 continue; +2055 } +2056 } +2057 } +2058 if (type == "C") { +2059 if (tag == "prn") { +2060 continue; +2061 } else { +2062 return "mixed"; +2063 } 2064 } -2065 } -2066 if (lasttag == null) { -2067 return "prn"; -2068 } else { -2069 return lasttag; -2070 } -2071 }; -2072 -2073 /** -2074 * get Name ASN.1 structure parameter array<br/> -2075 * @name getX500Name -2076 * @memberOf X509# -2077 * @function -2078 * @param {String} h hexadecimal string of Name -2079 * @return {Array} array of RDN parameter array -2080 * @since jsrsasign 9.0.0 x509 2.0.0 -2081 * @see X509#getX500NameArray -2082 * @see X509#getRDN -2083 * @see X509#getAttrTypeAndValue -2084 * @see KJUR.asn1.x509.X500Name -2085 * @see KJUR.asn1.x509.GeneralName -2086 * @see KJUR.asn1.x509.GeneralNames -2087 * @description -2088 * This method will get Name parameter defined in -2089 * <a href="https://tools.ietf.org/html/rfc5280#section-4.1.2.4"> -2090 * RFC 5280 4.1.2.4</a>. -2091 * <pre> -2092 * Name ::= CHOICE { -- only one possibility for now -- -2093 * rdnSequence RDNSequence } -2094 * RDNSequence ::= SEQUENCE OF RelativeDistinguishedName -2095 * </pre> -2096 * @example -2097 * x = new X509(); -2098 * x.getX500Name("30...") → -2099 * { array: [ -2100 * [{type:"C",value:"US",ds:"prn"}], -2101 * [{type:"O",value:"Sample Corp.",ds:"utf8"}], -2102 * [{type:"CN",value:"john.smith@example.com",ds:"ia5"}] -2103 * ], -2104 * str: "/C=US/O=Sample Corp./CN=john.smith@example.com", -2105 * hex: "30..." -2106 * } -2107 */ -2108 this.getX500Name = function(h) { -2109 var a = this.getX500NameArray(h); -2110 var s = this.dnarraytostr(a); -2111 return { array: a, str: s }; -2112 }; -2113 -2114 /** -2115 * get X.500 Name ASN.1 structure parameter array<br/> -2116 * @name getX500NameArray -2117 * @memberOf X509# -2118 * @function -2119 * @param {String} h hexadecimal string of Name -2120 * @return {Array} array of RDN parameter array -2121 * @since jsrsasign 10.0.6 x509 2.0.9 -2122 * @see X509#getX500Name -2123 * @see X509#getRDN -2124 * @see X509#getAttrTypeAndValue -2125 * @description -2126 * This method will get Name parameter defined in -2127 * <a href="https://tools.ietf.org/html/rfc5280#section-4.1.2.4"> -2128 * RFC 5280 4.1.2.4</a>. -2129 * <pre> -2130 * Name ::= CHOICE { -- only one possibility for now -- -2131 * rdnSequence RDNSequence } -2132 * RDNSequence ::= SEQUENCE OF RelativeDistinguishedName -2133 * </pre> -2134 * @example -2135 * x = new X509(); -2136 * x.getX500NameArray("30...") → -2137 * [[{type:"C",value:"US",ds:"prn"}], -2138 * [{type:"O",value:"Sample Corp.",ds:"utf8"}], -2139 * [{type:"CN",value:"john.smith@example.com",ds:"ia5"}]] -2140 */ -2141 this.getX500NameArray = function(h) { -2142 var result = []; -2143 var a = _getChildIdx(h, 0); -2144 for (var i = 0; i < a.length; i++) { -2145 result.push(this.getRDN(_getTLV(h, a[i]))); -2146 } -2147 return result; -2148 }; -2149 -2150 /** -2151 * get RelativeDistinguishedName ASN.1 structure parameter array<br/> -2152 * @name getRDN -2153 * @memberOf X509# -2154 * @function -2155 * @param {String} h hexadecimal string of RDN -2156 * @return {Array} array of AttrTypeAndValue parameters -2157 * @since jsrsasign 9.0.0 x509 2.0.0 -2158 * @see X509#getX500Name -2159 * @see X509#getRDN -2160 * @see X509#getAttrTypeAndValue -2161 * @description -2162 * This method will get RelativeDistinguishedName parameters defined in -2163 * <a href="https://tools.ietf.org/html/rfc5280#section-4.1.2.4"> -2164 * RFC 5280 4.1.2.4</a>. -2165 * <pre> -2166 * RelativeDistinguishedName ::= -2167 * SET SIZE (1..MAX) OF AttributeTypeAndValue -2168 * </pre> -2169 * @example -2170 * x = new X509(); -2171 * x.getRDN("31...") → -2172 * [{type:"C",value:"US",ds:"prn"}] or -2173 * [{type:"O",value:"Sample Corp.",ds:"prn"}] or -2174 * [{type:"CN",value:"john.smith@example.com",ds:"ia5"}] -2175 */ -2176 this.getRDN = function(h) { -2177 var result = []; -2178 var a = _getChildIdx(h, 0); -2179 for (var i = 0; i < a.length; i++) { -2180 result.push(this.getAttrTypeAndValue(_getTLV(h, a[i]))); -2181 } -2182 return result; -2183 }; -2184 -2185 /** -2186 * get AttributeTypeAndValue ASN.1 structure parameter as JSON object<br/> -2187 * @name getAttrTypeAndValue -2188 * @memberOf X509# -2189 * @function -2190 * @param {String} h hexadecimal string of AttributeTypeAndValue -2191 * @return {Object} JSON object of AttributeTypeAndValue parameters -2192 * @since jsrsasign 9.0.0 x509 2.0.0 -2193 * @see X509#getX500Name -2194 * @see X509#getRDN -2195 * @description -2196 * This method will get AttributeTypeAndValue parameters defined in -2197 * <a href="https://tools.ietf.org/html/rfc5280#section-4.1.2.4"> -2198 * RFC 5280 4.1.2.4</a>. -2199 * <pre> -2200 * AttributeTypeAndValue ::= SEQUENCE { -2201 * type AttributeType, -2202 * value AttributeValue } -2203 * AttributeType ::= OBJECT IDENTIFIER -2204 * AttributeValue ::= ANY -- DEFINED BY AttributeType -2205 * </pre> -2206 * <ul> -2207 * <li>{String}type - AttributeType name or OID(ex. C,O,CN)</li> -2208 * <li>{String}value - raw string of ASN.1 value of AttributeValue</li> -2209 * <li>{String}ds - DirectoryString type of AttributeValue</li> -2210 * </ul> -2211 * "ds" has one of following value: +2065 logcheck += ":" + tag; +2066 if (lasttag == null) { +2067 lasttag = tag; +2068 } else { +2069 if (lasttag !== tag) return "mixed"; +2070 } +2071 } +2072 if (lasttag == null) { +2073 return "prn"; +2074 } else { +2075 return lasttag; +2076 } +2077 }; +2078 +2079 /** +2080 * get Name ASN.1 structure parameter array<br/> +2081 * @name getX500Name +2082 * @memberOf X509# +2083 * @function +2084 * @param {String} h hexadecimal string of Name +2085 * @return {Array} array of RDN parameter array +2086 * @since jsrsasign 9.0.0 x509 2.0.0 +2087 * @see X509#getX500NameArray +2088 * @see X509#getRDN +2089 * @see X509#getAttrTypeAndValue +2090 * @see KJUR.asn1.x509.X500Name +2091 * @see KJUR.asn1.x509.GeneralName +2092 * @see KJUR.asn1.x509.GeneralNames +2093 * @description +2094 * This method will get Name parameter defined in +2095 * <a href="https://tools.ietf.org/html/rfc5280#section-4.1.2.4"> +2096 * RFC 5280 4.1.2.4</a>. +2097 * <pre> +2098 * Name ::= CHOICE { -- only one possibility for now -- +2099 * rdnSequence RDNSequence } +2100 * RDNSequence ::= SEQUENCE OF RelativeDistinguishedName +2101 * </pre> +2102 * @example +2103 * x = new X509(); +2104 * x.getX500Name("30...") → +2105 * { array: [ +2106 * [{type:"C",value:"US",ds:"prn"}], +2107 * [{type:"O",value:"Sample Corp.",ds:"utf8"}], +2108 * [{type:"CN",value:"john.smith@example.com",ds:"ia5"}] +2109 * ], +2110 * str: "/C=US/O=Sample Corp./CN=john.smith@example.com", +2111 * hex: "30..." +2112 * } +2113 */ +2114 this.getX500Name = function(h) { +2115 var a = this.getX500NameArray(h); +2116 var s = this.dnarraytostr(a); +2117 return { array: a, str: s }; +2118 }; +2119 +2120 /** +2121 * get X.500 Name ASN.1 structure parameter array<br/> +2122 * @name getX500NameArray +2123 * @memberOf X509# +2124 * @function +2125 * @param {String} h hexadecimal string of Name +2126 * @return {Array} array of RDN parameter array +2127 * @since jsrsasign 10.0.6 x509 2.0.9 +2128 * @see X509#getX500Name +2129 * @see X509#getRDN +2130 * @see X509#getAttrTypeAndValue +2131 * @description +2132 * This method will get Name parameter defined in +2133 * <a href="https://tools.ietf.org/html/rfc5280#section-4.1.2.4"> +2134 * RFC 5280 4.1.2.4</a>. +2135 * <pre> +2136 * Name ::= CHOICE { -- only one possibility for now -- +2137 * rdnSequence RDNSequence } +2138 * RDNSequence ::= SEQUENCE OF RelativeDistinguishedName +2139 * </pre> +2140 * @example +2141 * x = new X509(); +2142 * x.getX500NameArray("30...") → +2143 * [[{type:"C",value:"US",ds:"prn"}], +2144 * [{type:"O",value:"Sample Corp.",ds:"utf8"}], +2145 * [{type:"CN",value:"john.smith@example.com",ds:"ia5"}]] +2146 */ +2147 this.getX500NameArray = function(h) { +2148 var result = []; +2149 var a = _getChildIdx(h, 0); +2150 for (var i = 0; i < a.length; i++) { +2151 result.push(this.getRDN(_getTLV(h, a[i]))); +2152 } +2153 return result; +2154 }; +2155 +2156 /** +2157 * get RelativeDistinguishedName ASN.1 structure parameter array<br/> +2158 * @name getRDN +2159 * @memberOf X509# +2160 * @function +2161 * @param {String} h hexadecimal string of RDN +2162 * @return {Array} array of AttrTypeAndValue parameters +2163 * @since jsrsasign 9.0.0 x509 2.0.0 +2164 * @see X509#getX500Name +2165 * @see X509#getRDN +2166 * @see X509#getAttrTypeAndValue +2167 * @description +2168 * This method will get RelativeDistinguishedName parameters defined in +2169 * <a href="https://tools.ietf.org/html/rfc5280#section-4.1.2.4"> +2170 * RFC 5280 4.1.2.4</a>. +2171 * <pre> +2172 * RelativeDistinguishedName ::= +2173 * SET SIZE (1..MAX) OF AttributeTypeAndValue +2174 * </pre> +2175 * @example +2176 * x = new X509(); +2177 * x.getRDN("31...") → +2178 * [{type:"C",value:"US",ds:"prn"}] or +2179 * [{type:"O",value:"Sample Corp.",ds:"prn"}] or +2180 * [{type:"CN",value:"john.smith@example.com",ds:"ia5"}] +2181 */ +2182 this.getRDN = function(h) { +2183 var result = []; +2184 var a = _getChildIdx(h, 0); +2185 for (var i = 0; i < a.length; i++) { +2186 result.push(this.getAttrTypeAndValue(_getTLV(h, a[i]))); +2187 } +2188 return result; +2189 }; +2190 +2191 /** +2192 * get AttributeTypeAndValue ASN.1 structure parameter as JSON object<br/> +2193 * @name getAttrTypeAndValue +2194 * @memberOf X509# +2195 * @function +2196 * @param {String} h hexadecimal string of AttributeTypeAndValue +2197 * @return {Object} JSON object of AttributeTypeAndValue parameters +2198 * @since jsrsasign 9.0.0 x509 2.0.0 +2199 * @see X509#getX500Name +2200 * @see X509#getRDN +2201 * @description +2202 * This method will get AttributeTypeAndValue parameters defined in +2203 * <a href="https://tools.ietf.org/html/rfc5280#section-4.1.2.4"> +2204 * RFC 5280 4.1.2.4</a>. +2205 * <pre> +2206 * AttributeTypeAndValue ::= SEQUENCE { +2207 * type AttributeType, +2208 * value AttributeValue } +2209 * AttributeType ::= OBJECT IDENTIFIER +2210 * AttributeValue ::= ANY -- DEFINED BY AttributeType +2211 * </pre> 2212 * <ul> -2213 * <li>utf8 - (0x0c) UTF8String</li> -2214 * <li>prn - (0x13) PrintableString</li> -2215 * <li>ia5 - (0x16) IA5String</li> -2216 * <li>vis - (0x1a) VisibleString</li> -2217 * <li>bmp - (0x1e) BMPString</li> -2218 * </ul> -2219 * @example -2220 * x = new X509(); -2221 * x.getAttrTypeAndValue("30...") → -2222 * {type:"CN",value:"john.smith@example.com",ds:"ia5"} or -2223 * {type:"O",value:"Sample Corp.",ds:"prn"} -2224 */ -2225 // tel - (0x14) TeletexString ... for future -2226 // num - (0x12) NumericString ... for future -2227 // unv - (0x1c??) UniversalString ... for future -2228 this.getAttrTypeAndValue = function(h) { -2229 var result = {type: null, value: null, ds: null}; -2230 var a = _getChildIdx(h, 0); -2231 var hOID = _getVbyList(h, a[0], [], "06"); -2232 var hValue = _getVbyList(h, a[1], []); -2233 var oid = KJUR.asn1.ASN1Util.oidHexToInt(hOID); -2234 result.type = KJUR.asn1.x509.OID.oid2atype(oid); -2235 result.value = hextorstr(hValue); -2236 result.ds = this.HEX2STAG[h.substr(a[1], 2)]; -2237 return result; -2238 }; -2239 -2240 // ===== END X500Name related ===================================== -2241 -2242 // ===== BEGIN read certificate ===================================== -2243 /** -2244 * read PEM formatted X.509 certificate from string.<br/> -2245 * @name readCertPEM -2246 * @memberOf X509# -2247 * @function -2248 * @param {String} sCertPEM string for PEM formatted X.509 certificate -2249 * @example -2250 * x = new X509(); -2251 * x.readCertPEM(sCertPEM); // read certificate -2252 */ -2253 this.readCertPEM = function(sCertPEM) { -2254 this.readCertHex(_pemtohex(sCertPEM)); -2255 }; -2256 -2257 /** -2258 * read a hexadecimal string of X.509 certificate<br/> -2259 * @name readCertHex -2260 * @memberOf X509# -2261 * @function -2262 * @param {String} sCertHex hexadecimal string of X.509 certificate -2263 * @since jsrsasign 7.1.4 x509 1.1.13 -2264 * @description -2265 * NOTE: {@link X509#parseExt} will called internally since jsrsasign 7.2.0. -2266 * @example -2267 * x = new X509(); -2268 * x.readCertHex("3082..."); // read certificate -2269 */ -2270 this.readCertHex = function(sCertHex) { -2271 this.hex = sCertHex; -2272 this.getVersion(); // set version parameter -2273 -2274 try { -2275 _getIdxbyList(this.hex, 0, [0, 7], "a3"); // has [3] v3ext -2276 this.parseExt(); -2277 } catch(ex) {}; -2278 }; +2213 * <li>{String}type - AttributeType name or OID(ex. C,O,CN)</li> +2214 * <li>{String}value - raw string of ASN.1 value of AttributeValue</li> +2215 * <li>{String}ds - DirectoryString type of AttributeValue</li> +2216 * </ul> +2217 * "ds" has one of following value: +2218 * <ul> +2219 * <li>utf8 - (0x0c) UTF8String</li> +2220 * <li>prn - (0x13) PrintableString</li> +2221 * <li>ia5 - (0x16) IA5String</li> +2222 * <li>vis - (0x1a) VisibleString</li> +2223 * <li>bmp - (0x1e) BMPString</li> +2224 * </ul> +2225 * @example +2226 * x = new X509(); +2227 * x.getAttrTypeAndValue("30...") → +2228 * {type:"CN",value:"john.smith@example.com",ds:"ia5"} or +2229 * {type:"O",value:"Sample Corp.",ds:"prn"} +2230 */ +2231 // tel - (0x14) TeletexString ... for future +2232 // num - (0x12) NumericString ... for future +2233 // unv - (0x1c??) UniversalString ... for future +2234 this.getAttrTypeAndValue = function(h) { +2235 var result = {type: null, value: null, ds: null}; +2236 var a = _getChildIdx(h, 0); +2237 var hOID = _getVbyList(h, a[0], [], "06"); +2238 var hValue = _getVbyList(h, a[1], []); +2239 var oid = KJUR.asn1.ASN1Util.oidHexToInt(hOID); +2240 result.type = KJUR.asn1.x509.OID.oid2atype(oid); +2241 result.value = hextorstr(hValue); +2242 result.ds = this.HEX2STAG[h.substr(a[1], 2)]; +2243 return result; +2244 }; +2245 +2246 // ===== END X500Name related ===================================== +2247 +2248 // ===== BEGIN read certificate ===================================== +2249 /** +2250 * read PEM formatted X.509 certificate from string.<br/> +2251 * @name readCertPEM +2252 * @memberOf X509# +2253 * @function +2254 * @param {String} sCertPEM string for PEM formatted X.509 certificate +2255 * @example +2256 * x = new X509(); +2257 * x.readCertPEM(sCertPEM); // read certificate +2258 */ +2259 this.readCertPEM = function(sCertPEM) { +2260 this.readCertHex(_pemtohex(sCertPEM)); +2261 }; +2262 +2263 /** +2264 * read a hexadecimal string of X.509 certificate<br/> +2265 * @name readCertHex +2266 * @memberOf X509# +2267 * @function +2268 * @param {String} sCertHex hexadecimal string of X.509 certificate +2269 * @since jsrsasign 7.1.4 x509 1.1.13 +2270 * @description +2271 * NOTE: {@link X509#parseExt} will called internally since jsrsasign 7.2.0. +2272 * @example +2273 * x = new X509(); +2274 * x.readCertHex("3082..."); // read certificate +2275 */ +2276 this.readCertHex = function(sCertHex) { +2277 this.hex = sCertHex; +2278 this.getVersion(); // set version parameter 2279 -2280 // ===== END read certificate ===================================== -2281 -2282 /** -2283 * get JSON object of certificate parameters<br/> -2284 * @name getParam -2285 * @memberOf X509# -2286 * @function -2287 * @return {Array} JSON object of certificate parameters -2288 * @since jsrsasign 9.0.0 x509 2.0.0 -2289 * @see KJUR.asn1.x509.X509Util.newCertPEM -2290 * @description -2291 * This method returns a JSON object of the certificate -2292 * parameters. Return value can be passed to -2293 * {@link KJUR.asn1.x509.X509Util.newCertPEM}. -2294 * @example -2295 * x = new X509(); -2296 * x.readCertPEM("-----BEGIN CERTIFICATE..."); -2297 * x.getParam() → -2298 * {version:3, -2299 * serial:{hex:"12ab"}, -2300 * sigalg:"SHA256withRSA", -2301 * issuer: {array:[[{type:'CN',value:'CA1',ds:'prn'}]],str:"/O=CA1"}, -2302 * notbefore:"160403023700Z", -2303 * notafter:"160702023700Z", -2304 * subject: {array:[[{type:'CN',value:'Test1',ds:'prn'}]],str:"/CN=Test1"}, -2305 * sbjpubkey:"-----BEGIN PUBLIC KEY...", -2306 * ext:[ -2307 * {extname:"keyUsage",critical:true,names:["digitalSignature"]}, -2308 * {extname:"basicConstraints",critical:true}, -2309 * {extname:"subjectKeyIdentifier",kid:{hex:"f2eb..."}}, -2310 * {extname:"authorityKeyIdentifier",kid:{hex:"12ab..."}}, -2311 * {extname:"authorityInfoAccess",array:[{ocsp:"http://ocsp.example.com/"}]}, -2312 * {extname:"certificatePolicies",array:[{policyoid:"2.23.140.1.2.1"}]} -2313 * ], -2314 * sighex:"0b76...8" -2315 * }; -2316 */ -2317 this.getParam = function() { -2318 var result = {}; -2319 result.version = this.getVersion(); -2320 result.serial = {hex: this.getSerialNumberHex()}; -2321 result.sigalg = this.getSignatureAlgorithmField(); -2322 result.issuer = this.getIssuer(); -2323 result.notbefore = this.getNotBefore(); -2324 result.notafter = this.getNotAfter(); -2325 result.subject = this.getSubject(); -2326 result.sbjpubkey = hextopem(this.getPublicKeyHex(), "PUBLIC KEY"); -2327 if (this.aExtInfo.length > 0) { -2328 result.ext = this.getExtParamArray(); -2329 } -2330 result.sighex = this.getSignatureValueHex(); -2331 return result; -2332 }; -2333 -2334 /** -2335 * get array of certificate extension parameter JSON object<br/> -2336 * @name getExtParamArray -2337 * @memberOf X509# -2338 * @function -2339 * @param {String} hExtSeq hexadecimal string of SEQUENCE of Extension -2340 * @return {Array} array of certificate extension parameter JSON object -2341 * @since jsrsasign 9.0.0 x509 2.0.0 -2342 * @see KJUR.asn1.x509.X509Util.newCertPEM -2343 * @see X509#getParam -2344 * @see X509#getExtParam -2345 * @see X509CRL#getParam -2346 * @see KJUR.asn1.csr.CSRUtil.getParam -2347 * -2348 * @description -2349 * This method returns an array of certificate extension -2350 * parameters. -2351 * <br/> -2352 * NOTE: Argument "hExtSeq" have been supported since jsrsasign 9.1.1. +2280 try { +2281 _getIdxbyList(this.hex, 0, [0, 7], "a3"); // has [3] v3ext +2282 this.parseExt(); +2283 } catch(ex) {}; +2284 }; +2285 +2286 // ===== END read certificate ===================================== +2287 +2288 /** +2289 * get JSON object of certificate parameters<br/> +2290 * @name getParam +2291 * @memberOf X509# +2292 * @function +2293 * @return {Array} JSON object of certificate parameters +2294 * @since jsrsasign 9.0.0 x509 2.0.0 +2295 * @see KJUR.asn1.x509.X509Util.newCertPEM +2296 * @description +2297 * This method returns a JSON object of the certificate +2298 * parameters. Return value can be passed to +2299 * {@link KJUR.asn1.x509.X509Util.newCertPEM}. +2300 * @example +2301 * x = new X509(); +2302 * x.readCertPEM("-----BEGIN CERTIFICATE..."); +2303 * x.getParam() → +2304 * {version:3, +2305 * serial:{hex:"12ab"}, +2306 * sigalg:"SHA256withRSA", +2307 * issuer: {array:[[{type:'CN',value:'CA1',ds:'prn'}]],str:"/O=CA1"}, +2308 * notbefore:"160403023700Z", +2309 * notafter:"160702023700Z", +2310 * subject: {array:[[{type:'CN',value:'Test1',ds:'prn'}]],str:"/CN=Test1"}, +2311 * sbjpubkey:"-----BEGIN PUBLIC KEY...", +2312 * ext:[ +2313 * {extname:"keyUsage",critical:true,names:["digitalSignature"]}, +2314 * {extname:"basicConstraints",critical:true}, +2315 * {extname:"subjectKeyIdentifier",kid:{hex:"f2eb..."}}, +2316 * {extname:"authorityKeyIdentifier",kid:{hex:"12ab..."}}, +2317 * {extname:"authorityInfoAccess",array:[{ocsp:"http://ocsp.example.com/"}]}, +2318 * {extname:"certificatePolicies",array:[{policyoid:"2.23.140.1.2.1"}]} +2319 * ], +2320 * sighex:"0b76...8" +2321 * }; +2322 */ +2323 this.getParam = function() { +2324 var result = {}; +2325 result.version = this.getVersion(); +2326 result.serial = {hex: this.getSerialNumberHex()}; +2327 result.sigalg = this.getSignatureAlgorithmField(); +2328 result.issuer = this.getIssuer(); +2329 result.notbefore = this.getNotBefore(); +2330 result.notafter = this.getNotAfter(); +2331 result.subject = this.getSubject(); +2332 result.sbjpubkey = hextopem(this.getPublicKeyHex(), "PUBLIC KEY"); +2333 if (this.aExtInfo.length > 0) { +2334 result.ext = this.getExtParamArray(); +2335 } +2336 result.sighex = this.getSignatureValueHex(); +2337 return result; +2338 }; +2339 +2340 /** +2341 * get array of certificate extension parameter JSON object<br/> +2342 * @name getExtParamArray +2343 * @memberOf X509# +2344 * @function +2345 * @param {String} hExtSeq hexadecimal string of SEQUENCE of Extension +2346 * @return {Array} array of certificate extension parameter JSON object +2347 * @since jsrsasign 9.0.0 x509 2.0.0 +2348 * @see KJUR.asn1.x509.X509Util.newCertPEM +2349 * @see X509#getParam +2350 * @see X509#getExtParam +2351 * @see X509CRL#getParam +2352 * @see KJUR.asn1.csr.CSRUtil.getParam 2353 * -2354 * @example -2355 * x = new X509(); -2356 * x.readCertPEM("-----BEGIN CERTIFICATE..."); -2357 * x.getExtParamArray() → -2358 * [ {extname:"keyUsage",critical:true,names:["digitalSignature"]}, -2359 * {extname:"basicConstraints",critical:true}, -2360 * {extname:"subjectKeyIdentifier",kid:{hex:"f2eb..."}}, -2361 * {extname:"authorityKeyIdentifier",kid:{hex:"12ab..."}}, -2362 * {extname:"authorityInfoAccess",array:[{ocsp:"http://ocsp.example.com/"}]}, -2363 * {extname:"certificatePolicies",array:[{policyoid:"2.23.140.1.2.1"}]}] -2364 */ -2365 this.getExtParamArray = function(hExtSeq) { -2366 if (hExtSeq == undefined) { -2367 // for X.509v3 certificate -2368 var idx1 = _getIdxbyListEx(this.hex, 0, [0, "[3]"]); -2369 if (idx1 != -1) { -2370 hExtSeq = _getTLVbyListEx(this.hex, 0, [0, "[3]", 0], "30"); -2371 } -2372 } -2373 var result = []; -2374 var aIdx = _getChildIdx(hExtSeq, 0); -2375 -2376 for (var i = 0; i < aIdx.length; i++) { -2377 var hExt = _getTLV(hExtSeq, aIdx[i]); -2378 var extParam = this.getExtParam(hExt); -2379 if (extParam != null) result.push(extParam); -2380 } +2354 * @description +2355 * This method returns an array of certificate extension +2356 * parameters. +2357 * <br/> +2358 * NOTE: Argument "hExtSeq" have been supported since jsrsasign 9.1.1. +2359 * +2360 * @example +2361 * x = new X509(); +2362 * x.readCertPEM("-----BEGIN CERTIFICATE..."); +2363 * x.getExtParamArray() → +2364 * [ {extname:"keyUsage",critical:true,names:["digitalSignature"]}, +2365 * {extname:"basicConstraints",critical:true}, +2366 * {extname:"subjectKeyIdentifier",kid:{hex:"f2eb..."}}, +2367 * {extname:"authorityKeyIdentifier",kid:{hex:"12ab..."}}, +2368 * {extname:"authorityInfoAccess",array:[{ocsp:"http://ocsp.example.com/"}]}, +2369 * {extname:"certificatePolicies",array:[{policyoid:"2.23.140.1.2.1"}]}] +2370 */ +2371 this.getExtParamArray = function(hExtSeq) { +2372 if (hExtSeq == undefined) { +2373 // for X.509v3 certificate +2374 var idx1 = _getIdxbyListEx(this.hex, 0, [0, "[3]"]); +2375 if (idx1 != -1) { +2376 hExtSeq = _getTLVbyListEx(this.hex, 0, [0, "[3]", 0], "30"); +2377 } +2378 } +2379 var result = []; +2380 var aIdx = _getChildIdx(hExtSeq, 0); 2381 -2382 return result; -2383 }; -2384 -2385 /** -2386 * get a extension parameter JSON object<br/> -2387 * @name getExtParam -2388 * @memberOf X509# -2389 * @function -2390 * @param {String} hExt hexadecimal string of Extension -2391 * @return {Array} Extension parameter JSON object -2392 * @since jsrsasign 9.1.1 x509 2.0.1 -2393 * @see KJUR.asn1.x509.X509Util.newCertPEM -2394 * @see X509#getParam -2395 * @see X509#getExtParamArray -2396 * @see X509CRL#getParam -2397 * @see KJUR.asn1.csr.CSRUtil.getParam -2398 * -2399 * @description -2400 * This method returns a extension parameters as JSON object. -2401 * -2402 * @example -2403 * x = new X509(); -2404 * ... -2405 * x.getExtParam("30...") → -2406 * {extname:"keyUsage",critical:true,names:["digitalSignature"]} -2407 */ -2408 this.getExtParam = function(hExt) { -2409 var result = {}; -2410 var aIdx = _getChildIdx(hExt, 0); -2411 var aIdxLen = aIdx.length; -2412 if (aIdxLen != 2 && aIdxLen != 3) -2413 throw new Error("wrong number elements in Extension: " + -2414 aIdxLen + " " + hExt); -2415 -2416 var oid = _hextooidstr(_getVbyList(hExt, 0, [0], "06")); -2417 -2418 var critical = false; -2419 if (aIdxLen == 3 && _getTLVbyList(hExt, 0, [1]) == "0101ff") -2420 critical = true; +2382 for (var i = 0; i < aIdx.length; i++) { +2383 var hExt = _getTLV(hExtSeq, aIdx[i]); +2384 var extParam = this.getExtParam(hExt); +2385 if (extParam != null) result.push(extParam); +2386 } +2387 +2388 return result; +2389 }; +2390 +2391 /** +2392 * get a extension parameter JSON object<br/> +2393 * @name getExtParam +2394 * @memberOf X509# +2395 * @function +2396 * @param {String} hExt hexadecimal string of Extension +2397 * @return {Array} Extension parameter JSON object +2398 * @since jsrsasign 9.1.1 x509 2.0.1 +2399 * @see KJUR.asn1.x509.X509Util.newCertPEM +2400 * @see X509#getParam +2401 * @see X509#getExtParamArray +2402 * @see X509CRL#getParam +2403 * @see KJUR.asn1.csr.CSRUtil.getParam +2404 * +2405 * @description +2406 * This method returns a extension parameters as JSON object. +2407 * +2408 * @example +2409 * x = new X509(); +2410 * ... +2411 * x.getExtParam("30...") → +2412 * {extname:"keyUsage",critical:true,names:["digitalSignature"]} +2413 */ +2414 this.getExtParam = function(hExt) { +2415 var result = {}; +2416 var aIdx = _getChildIdx(hExt, 0); +2417 var aIdxLen = aIdx.length; +2418 if (aIdxLen != 2 && aIdxLen != 3) +2419 throw new Error("wrong number elements in Extension: " + +2420 aIdxLen + " " + hExt); 2421 -2422 var hExtV = _getTLVbyList(hExt, 0, [aIdxLen - 1, 0]); +2422 var oid = _hextooidstr(_getVbyList(hExt, 0, [0], "06")); 2423 -2424 var extParam = undefined; -2425 if (oid == "2.5.29.14") { -2426 extParam = this.getExtSubjectKeyIdentifier(hExtV, critical); -2427 } else if (oid == "2.5.29.15") { -2428 extParam = this.getExtKeyUsage(hExtV, critical); -2429 } else if (oid == "2.5.29.17") { -2430 extParam = this.getExtSubjectAltName(hExtV, critical); -2431 } else if (oid == "2.5.29.18") { -2432 extParam = this.getExtIssuerAltName(hExtV, critical); -2433 } else if (oid == "2.5.29.19") { -2434 extParam = this.getExtBasicConstraints(hExtV, critical); -2435 } else if (oid == "2.5.29.31") { -2436 extParam = this.getExtCRLDistributionPoints(hExtV, critical); -2437 } else if (oid == "2.5.29.32") { -2438 extParam = this.getExtCertificatePolicies(hExtV, critical); -2439 } else if (oid == "2.5.29.35") { -2440 extParam = this.getExtAuthorityKeyIdentifier(hExtV, critical); -2441 } else if (oid == "2.5.29.37") { -2442 extParam = this.getExtExtKeyUsage(hExtV, critical); -2443 } else if (oid == "1.3.6.1.5.5.7.1.1") { -2444 extParam = this.getExtAuthorityInfoAccess(hExtV, critical); -2445 } else if (oid == "2.5.29.20") { -2446 extParam = this.getExtCRLNumber(hExtV, critical); -2447 } else if (oid == "2.5.29.21") { -2448 extParam = this.getExtCRLReason(hExtV, critical); -2449 } else if (oid == "1.3.6.1.5.5.7.48.1.2") { -2450 extParam = this.getExtOcspNonce(hExtV, critical); -2451 } else if (oid == "1.3.6.1.5.5.7.48.1.5") { -2452 extParam = this.getExtOcspNoCheck(hExtV, critical); -2453 } else if (oid == "1.2.840.113583.1.1.9.1") { -2454 extParam = this.getExtAdobeTimeStamp(hExtV, critical); -2455 } -2456 if (extParam != undefined) return extParam; -2457 -2458 var privateParam = { extname: oid, extn: hExtV }; -2459 if (critical) privateParam.critical = true; -2460 return privateParam; -2461 }; -2462 -2463 /** -2464 * find extension parameter in array<br/> -2465 * @name findExt -2466 * @memberOf X509# -2467 * @function -2468 * @param {Array} aExt array of extension parameters -2469 * @param {String} extname extension name -2470 * @return {Array} extension parameter in the array or null -2471 * @since jsrsasign 10.0.3 x509 2.0.7 -2472 * @see X509#getParam -2473 * -2474 * @description -2475 * This method returns an extension parameter for -2476 * specified extension name in the array. -2477 * This method is useful to update extension parameter value. -2478 * When there is no such extension with the extname, -2479 * this returns "null". -2480 * -2481 * @example -2482 * // (1) -2483 * x = new X509(CERTPEM); -2484 * params = x.getParam(); -2485 * pSKID = x.findExt(params.ext, "subjectKeyIdentifier"); -2486 * pSKID.kid = "1234abced..."; // skid in the params is updated. -2487 * // then params was updated -2488 * -2489 * // (2) another example -2490 * aExt = [ -2491 * {extname:"keyUsage",critical:true,names:["digitalSignature"]}, -2492 * {extname:"basicConstraints",critical:true}, -2493 * {extname:"subjectKeyIdentifier",kid:{hex:"f2eb..."}}, -2494 * {extname:"authorityKeyIdentifier",kid:{hex:"12ab..."}}, -2495 * {extname:"authorityInfoAccess",array:[{ocsp:"http://ocsp.example.com/"}]}, -2496 * {extname:"certificatePolicies",array:[{policyoid:"2.23.140.1.2.1"}]} -2497 * ]; -2498 * var x = new X509(); -2499 * x.findExt(aExt, "authorityKeyInfoAccess").array[0].ocsp = "http://aaa.com"; -2500 * pKU = x.findExt(aExt, "keyUsage"); -2501 * delete pKU["critical"]; // clear criticla flag -2502 * pKU.names = ["keyCertSign", "cRLSign"]; -2503 * // then aExt was updated -2504 */ -2505 this.findExt = function(aExt, extname) { -2506 for (var i = 0; i < aExt.length; i++) { -2507 if (aExt[i].extname == extname) return aExt[i]; -2508 } -2509 return null; -2510 -2511 }; -2512 -2513 /** -2514 * update CRLDistributionPoints Full URI in parameter<br/> -2515 * @name updateCDPFullURI -2516 * @memberOf X509# -2517 * @function -2518 * @param {Array} aExt array of extension parameters -2519 * @param {String} newURI string of new uri -2520 * @since jsrsasign 10.0.4 x509 2.0.8 -2521 * @see X509#findExt -2522 * @see KJUR.asn1.x509.CRLDistributionPoints -2523 * -2524 * @description -2525 * This method updates Full URI of CRLDistributionPoints extension -2526 * in the extension parameter array if it exists. -2527 * -2528 * @example -2529 * aExt = [ -2530 * {extname:"authorityKeyIdentifier",kid:{hex:"12ab..."}}, -2531 * {extname:"cRLDistributionPoints", -2532 * array:[{dpname:{full:[{uri:"http://example.com/a.crl"}]}}]}, -2533 * ]; -2534 * x = new X509(); -2535 * x.updateCDPFullURI(aExt, "http://crl2.example.new/b.crl"); -2536 */ -2537 this.updateExtCDPFullURI = function(aExt, newURI) { -2538 var pExt = this.findExt(aExt, "cRLDistributionPoints"); -2539 if (pExt == null) return; -2540 if (pExt.array == undefined) return; -2541 var aDP = pExt.array; -2542 for (var i = 0; i < aDP.length; i++) { -2543 if (aDP[i].dpname == undefined) continue; -2544 if (aDP[i].dpname.full == undefined) continue; -2545 var aURI = aDP[i].dpname.full; -2546 for (var j = 0; j < aURI.length; j++) { -2547 var pURI = aURI[i]; -2548 if (pURI.uri == undefined) continue; -2549 pURI.uri = newURI; -2550 } -2551 } -2552 }; -2553 -2554 /** -2555 * update authorityInfoAccess ocsp in parameter<br/> -2556 * @name updateAIAOCSP -2557 * @memberOf X509# -2558 * @function -2559 * @param {Array} aExt array of extension parameters -2560 * @param {String} newURI string of new uri -2561 * @since jsrsasign 10.0.4 x509 2.0.8 -2562 * @see X509#findExt -2563 * @see KJUR.asn1.x509.AuthorityInfoAccess -2564 * -2565 * @description -2566 * This method updates "ocsp" accessMethod URI of -2567 * AuthorityInfoAccess extension -2568 * in the extension parameter array if it exists. -2569 * -2570 * @example -2571 * aExt = [ -2572 * {extname:"authorityKeyIdentifier",kid:{hex:"12ab..."}}, -2573 * {extname:"authoriyInfoAccess", -2574 * array:[ -2575 * {ocsp: "http://ocsp1.example.com"}, -2576 * {caissuer: "http://example.com/a.crt"} -2577 * ]} -2578 * ]; -2579 * x = new X509(); -2580 * x.updateAIAOCSP(aExt, "http://ocsp2.example.net"); -2581 */ -2582 this.updateExtAIAOCSP = function(aExt, newURI) { -2583 var pExt = this.findExt(aExt, "authorityInfoAccess"); -2584 if (pExt == null) return; -2585 if (pExt.array == undefined) return; -2586 var a = pExt.array; -2587 for (var i = 0; i < a.length; i++) { -2588 if (a[i].ocsp != undefined) a[i].ocsp = newURI; -2589 } -2590 }; -2591 -2592 /** -2593 * update authorityInfoAccess caIssuer in parameter<br/> -2594 * @name updateAIACAIssuer -2595 * @memberOf X509# -2596 * @function -2597 * @param {Array} aExt array of extension parameters -2598 * @param {String} newURI string of new uri -2599 * @since jsrsasign 10.0.4 x509 2.0.8 -2600 * @see X509#findExt -2601 * @see KJUR.asn1.x509.AuthorityInfoAccess -2602 * -2603 * @description -2604 * This method updates "caIssuer" accessMethod URI of -2605 * AuthorityInfoAccess extension -2606 * in the extension parameter array if it exists. -2607 * -2608 * @example -2609 * aExt = [ -2610 * {extname:"authorityKeyIdentifier",kid:{hex:"12ab..."}}, -2611 * {extname:"authoriyInfoAccess", -2612 * array:[ -2613 * {ocsp: "http://ocsp1.example.com"}, -2614 * {caissuer: "http://example.com/a.crt"} -2615 * ]} -2616 * ]; -2617 * x = new X509(); -2618 * x.updateAIACAIssuer(aExt, "http://example.net/b.crt"); -2619 */ -2620 this.updateExtAIACAIssuer = function(aExt, newURI) { -2621 var pExt = this.findExt(aExt, "authorityInfoAccess"); -2622 if (pExt == null) return; -2623 if (pExt.array == undefined) return; -2624 var a = pExt.array; -2625 for (var i = 0; i < a.length; i++) { -2626 if (a[i].caissuer != undefined) a[i].caissuer = newURI; -2627 } -2628 }; -2629 -2630 /** -2631 * convert array for X500 distinguish name to distinguish name string<br/> -2632 * @name dnarraytostr -2633 * @memberOf X509# -2634 * @function -2635 * @param {Array} aDN array for X500 distinguish name -2636 * @return {String} distinguish name -2637 * @since jsrsasign 10.0.6 x509 2.0.8 -2638 * @see X509#getX500Name -2639 * @see X509#getX500NameArray -2640 * @see KJUR.asn1.x509.X500Name -2641 * -2642 * @description -2643 * This method converts from an array representation of -2644 * X.500 distinguished name to X.500 name string. -2645 * This supports multi-valued RDN. -2646 * -2647 * @example -2648 * var x = new X509(); -2649 * x.dnarraytostr( -2650 * [[{type:"C",value:"JP",ds:"prn"}], -2651 * [{type:"O",value:"T1",ds:"prn"}]]) → "/C=JP/O=T1" -2652 * x.dnarraytostr( -2653 * [[{type:"C",value:"JP",ds:"prn"}], -2654 * [{type:"O",value:"T1",ds:"prn"} -2655 * {type:"CN",value:"Bob",ds:"prn"}]]) → "/C=JP/O=T1+CN=Bob" -2656 */ -2657 this.dnarraytostr = function(aDN) { -2658 function rdnarraytostr(aRDN) { -2659 return aRDN.map(function(x){return atvtostr(x);}).join("+"); -2660 }; -2661 -2662 function atvtostr(pATV) { -2663 return pATV.type + "=" + pATV.value; -2664 }; -2665 -2666 return "/" + aDN.map(function(x){return rdnarraytostr(x);}).join("/"); -2667 }; -2668 -2669 /** -2670 * get certificate information as string.<br/> -2671 * @name getInfo -2672 * @memberOf X509# -2673 * @function -2674 * @return {String} certificate information string -2675 * @since jsrsasign 5.0.10 x509 1.1.8 -2676 * @example -2677 * x = new X509(); -2678 * x.readCertPEM(certPEM); -2679 * console.log(x.getInfo()); -2680 * // this shows as following -2681 * Basic Fields -2682 * serial number: 02ac5c266a0b409b8f0b79f2ae462577 -2683 * signature algorithm: SHA1withRSA -2684 * issuer: /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA -2685 * notBefore: 061110000000Z -2686 * notAfter: 311110000000Z -2687 * subject: /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA -2688 * subject public key info: -2689 * key algorithm: RSA -2690 * n=c6cce573e6fbd4bb... -2691 * e=10001 -2692 * X509v3 Extensions: -2693 * keyUsage CRITICAL: -2694 * digitalSignature,keyCertSign,cRLSign -2695 * basicConstraints CRITICAL: -2696 * cA=true -2697 * subjectKeyIdentifier : -2698 * b13ec36903f8bf4701d498261a0802ef63642bc3 -2699 * authorityKeyIdentifier : -2700 * kid=b13ec36903f8bf4701d498261a0802ef63642bc3 -2701 * signature algorithm: SHA1withRSA -2702 * signature: 1c1a0697dcd79c9f... -2703 */ -2704 this.getInfo = function() { -2705 var _getSubjectAltNameStr = function(params) { -2706 var s = JSON.stringify(params.array).replace(/[\[\]\{\}\"]/g, ''); -2707 return s; -2708 }; -2709 var _getCertificatePoliciesStr = function(params) { -2710 var s = ""; -2711 var a = params.array; -2712 for (var i = 0; i < a.length; i++) { -2713 var pi = a[i]; -2714 s += " policy oid: " + pi.policyoid + "\n"; -2715 if (pi.array === undefined) continue; -2716 for (var j = 0; j < pi.array.length; j++) { -2717 var pqi = pi.array[j]; -2718 if (pqi.cps !== undefined) { -2719 s += " cps: " + pqi.cps + "\n"; -2720 } -2721 } -2722 } -2723 return s; -2724 }; -2725 var _getCRLDistributionPointsStr = function(params) { -2726 var s = ""; -2727 var a = params.array; -2728 for (var i = 0; i < a.length; i++) { -2729 var dp = a[i]; -2730 try { -2731 if (dp.dpname.full[0].uri !== undefined) -2732 s += " " + dp.dpname.full[0].uri + "\n"; -2733 } catch(ex) {}; -2734 try { -2735 if (dp.dname.full[0].dn.hex !== undefined) -2736 s += " " + X509.hex2dn(dp.dpname.full[0].dn.hex) + "\n"; -2737 } catch(ex) {}; -2738 } -2739 return s; -2740 } -2741 var _getAuthorityInfoAccessStr = function(params) { -2742 var s = ""; -2743 var a = params.array; -2744 for (var i = 0; i < a.length; i++) { -2745 var ad = a[i]; -2746 -2747 if (ad.caissuer !== undefined) -2748 s += " caissuer: " + ad.caissuer + "\n"; -2749 if (ad.ocsp !== undefined) -2750 s += " ocsp: " + ad.ocsp + "\n"; -2751 } -2752 return s; -2753 }; -2754 var _X509 = X509; -2755 var s, pubkey, aExt; -2756 s = "Basic Fields\n"; -2757 s += " serial number: " + this.getSerialNumberHex() + "\n"; -2758 s += " signature algorithm: " + this.getSignatureAlgorithmField() + "\n"; -2759 s += " issuer: " + this.getIssuerString() + "\n"; -2760 s += " notBefore: " + this.getNotBefore() + "\n"; -2761 s += " notAfter: " + this.getNotAfter() + "\n"; -2762 s += " subject: " + this.getSubjectString() + "\n"; -2763 s += " subject public key info: " + "\n"; -2764 -2765 // subject public key info -2766 pubkey = this.getPublicKey(); -2767 s += " key algorithm: " + pubkey.type + "\n"; -2768 -2769 if (pubkey.type === "RSA") { -2770 s += " n=" + hextoposhex(pubkey.n.toString(16)).substr(0, 16) + "...\n"; -2771 s += " e=" + hextoposhex(pubkey.e.toString(16)) + "\n"; -2772 } -2773 -2774 // X.509v3 Extensions -2775 aExt = this.aExtInfo; -2776 -2777 if (aExt !== undefined && aExt !== null) { -2778 s += "X509v3 Extensions:\n"; -2779 -2780 for (var i = 0; i < aExt.length; i++) { -2781 var info = aExt[i]; +2424 var critical = false; +2425 if (aIdxLen == 3 && _getTLVbyList(hExt, 0, [1]) == "0101ff") +2426 critical = true; +2427 +2428 var hExtV = _getTLVbyList(hExt, 0, [aIdxLen - 1, 0]); +2429 +2430 var extParam = undefined; +2431 if (oid == "2.5.29.14") { +2432 extParam = this.getExtSubjectKeyIdentifier(hExtV, critical); +2433 } else if (oid == "2.5.29.15") { +2434 extParam = this.getExtKeyUsage(hExtV, critical); +2435 } else if (oid == "2.5.29.17") { +2436 extParam = this.getExtSubjectAltName(hExtV, critical); +2437 } else if (oid == "2.5.29.18") { +2438 extParam = this.getExtIssuerAltName(hExtV, critical); +2439 } else if (oid == "2.5.29.19") { +2440 extParam = this.getExtBasicConstraints(hExtV, critical); +2441 } else if (oid == "2.5.29.31") { +2442 extParam = this.getExtCRLDistributionPoints(hExtV, critical); +2443 } else if (oid == "2.5.29.32") { +2444 extParam = this.getExtCertificatePolicies(hExtV, critical); +2445 } else if (oid == "2.5.29.35") { +2446 extParam = this.getExtAuthorityKeyIdentifier(hExtV, critical); +2447 } else if (oid == "2.5.29.37") { +2448 extParam = this.getExtExtKeyUsage(hExtV, critical); +2449 } else if (oid == "1.3.6.1.5.5.7.1.1") { +2450 extParam = this.getExtAuthorityInfoAccess(hExtV, critical); +2451 } else if (oid == "2.5.29.20") { +2452 extParam = this.getExtCRLNumber(hExtV, critical); +2453 } else if (oid == "2.5.29.21") { +2454 extParam = this.getExtCRLReason(hExtV, critical); +2455 } else if (oid == "1.3.6.1.5.5.7.48.1.2") { +2456 extParam = this.getExtOcspNonce(hExtV, critical); +2457 } else if (oid == "1.3.6.1.5.5.7.48.1.5") { +2458 extParam = this.getExtOcspNoCheck(hExtV, critical); +2459 } else if (oid == "1.2.840.113583.1.1.9.1") { +2460 extParam = this.getExtAdobeTimeStamp(hExtV, critical); +2461 } +2462 if (extParam != undefined) return extParam; +2463 +2464 var privateParam = { extname: oid, extn: hExtV }; +2465 if (critical) privateParam.critical = true; +2466 return privateParam; +2467 }; +2468 +2469 /** +2470 * find extension parameter in array<br/> +2471 * @name findExt +2472 * @memberOf X509# +2473 * @function +2474 * @param {Array} aExt array of extension parameters +2475 * @param {String} extname extension name +2476 * @return {Array} extension parameter in the array or null +2477 * @since jsrsasign 10.0.3 x509 2.0.7 +2478 * @see X509#getParam +2479 * +2480 * @description +2481 * This method returns an extension parameter for +2482 * specified extension name in the array. +2483 * This method is useful to update extension parameter value. +2484 * When there is no such extension with the extname, +2485 * this returns "null". +2486 * +2487 * @example +2488 * // (1) +2489 * x = new X509(CERTPEM); +2490 * params = x.getParam(); +2491 * pSKID = x.findExt(params.ext, "subjectKeyIdentifier"); +2492 * pSKID.kid = "1234abced..."; // skid in the params is updated. +2493 * // then params was updated +2494 * +2495 * // (2) another example +2496 * aExt = [ +2497 * {extname:"keyUsage",critical:true,names:["digitalSignature"]}, +2498 * {extname:"basicConstraints",critical:true}, +2499 * {extname:"subjectKeyIdentifier",kid:{hex:"f2eb..."}}, +2500 * {extname:"authorityKeyIdentifier",kid:{hex:"12ab..."}}, +2501 * {extname:"authorityInfoAccess",array:[{ocsp:"http://ocsp.example.com/"}]}, +2502 * {extname:"certificatePolicies",array:[{policyoid:"2.23.140.1.2.1"}]} +2503 * ]; +2504 * var x = new X509(); +2505 * x.findExt(aExt, "authorityKeyInfoAccess").array[0].ocsp = "http://aaa.com"; +2506 * pKU = x.findExt(aExt, "keyUsage"); +2507 * delete pKU["critical"]; // clear criticla flag +2508 * pKU.names = ["keyCertSign", "cRLSign"]; +2509 * // then aExt was updated +2510 */ +2511 this.findExt = function(aExt, extname) { +2512 for (var i = 0; i < aExt.length; i++) { +2513 if (aExt[i].extname == extname) return aExt[i]; +2514 } +2515 return null; +2516 +2517 }; +2518 +2519 /** +2520 * update CRLDistributionPoints Full URI in parameter<br/> +2521 * @name updateCDPFullURI +2522 * @memberOf X509# +2523 * @function +2524 * @param {Array} aExt array of extension parameters +2525 * @param {String} newURI string of new uri +2526 * @since jsrsasign 10.0.4 x509 2.0.8 +2527 * @see X509#findExt +2528 * @see KJUR.asn1.x509.CRLDistributionPoints +2529 * +2530 * @description +2531 * This method updates Full URI of CRLDistributionPoints extension +2532 * in the extension parameter array if it exists. +2533 * +2534 * @example +2535 * aExt = [ +2536 * {extname:"authorityKeyIdentifier",kid:{hex:"12ab..."}}, +2537 * {extname:"cRLDistributionPoints", +2538 * array:[{dpname:{full:[{uri:"http://example.com/a.crl"}]}}]}, +2539 * ]; +2540 * x = new X509(); +2541 * x.updateCDPFullURI(aExt, "http://crl2.example.new/b.crl"); +2542 */ +2543 this.updateExtCDPFullURI = function(aExt, newURI) { +2544 var pExt = this.findExt(aExt, "cRLDistributionPoints"); +2545 if (pExt == null) return; +2546 if (pExt.array == undefined) return; +2547 var aDP = pExt.array; +2548 for (var i = 0; i < aDP.length; i++) { +2549 if (aDP[i].dpname == undefined) continue; +2550 if (aDP[i].dpname.full == undefined) continue; +2551 var aURI = aDP[i].dpname.full; +2552 for (var j = 0; j < aURI.length; j++) { +2553 var pURI = aURI[i]; +2554 if (pURI.uri == undefined) continue; +2555 pURI.uri = newURI; +2556 } +2557 } +2558 }; +2559 +2560 /** +2561 * update authorityInfoAccess ocsp in parameter<br/> +2562 * @name updateAIAOCSP +2563 * @memberOf X509# +2564 * @function +2565 * @param {Array} aExt array of extension parameters +2566 * @param {String} newURI string of new uri +2567 * @since jsrsasign 10.0.4 x509 2.0.8 +2568 * @see X509#findExt +2569 * @see KJUR.asn1.x509.AuthorityInfoAccess +2570 * +2571 * @description +2572 * This method updates "ocsp" accessMethod URI of +2573 * AuthorityInfoAccess extension +2574 * in the extension parameter array if it exists. +2575 * +2576 * @example +2577 * aExt = [ +2578 * {extname:"authorityKeyIdentifier",kid:{hex:"12ab..."}}, +2579 * {extname:"authoriyInfoAccess", +2580 * array:[ +2581 * {ocsp: "http://ocsp1.example.com"}, +2582 * {caissuer: "http://example.com/a.crt"} +2583 * ]} +2584 * ]; +2585 * x = new X509(); +2586 * x.updateAIAOCSP(aExt, "http://ocsp2.example.net"); +2587 */ +2588 this.updateExtAIAOCSP = function(aExt, newURI) { +2589 var pExt = this.findExt(aExt, "authorityInfoAccess"); +2590 if (pExt == null) return; +2591 if (pExt.array == undefined) return; +2592 var a = pExt.array; +2593 for (var i = 0; i < a.length; i++) { +2594 if (a[i].ocsp != undefined) a[i].ocsp = newURI; +2595 } +2596 }; +2597 +2598 /** +2599 * update authorityInfoAccess caIssuer in parameter<br/> +2600 * @name updateAIACAIssuer +2601 * @memberOf X509# +2602 * @function +2603 * @param {Array} aExt array of extension parameters +2604 * @param {String} newURI string of new uri +2605 * @since jsrsasign 10.0.4 x509 2.0.8 +2606 * @see X509#findExt +2607 * @see KJUR.asn1.x509.AuthorityInfoAccess +2608 * +2609 * @description +2610 * This method updates "caIssuer" accessMethod URI of +2611 * AuthorityInfoAccess extension +2612 * in the extension parameter array if it exists. +2613 * +2614 * @example +2615 * aExt = [ +2616 * {extname:"authorityKeyIdentifier",kid:{hex:"12ab..."}}, +2617 * {extname:"authoriyInfoAccess", +2618 * array:[ +2619 * {ocsp: "http://ocsp1.example.com"}, +2620 * {caissuer: "http://example.com/a.crt"} +2621 * ]} +2622 * ]; +2623 * x = new X509(); +2624 * x.updateAIACAIssuer(aExt, "http://example.net/b.crt"); +2625 */ +2626 this.updateExtAIACAIssuer = function(aExt, newURI) { +2627 var pExt = this.findExt(aExt, "authorityInfoAccess"); +2628 if (pExt == null) return; +2629 if (pExt.array == undefined) return; +2630 var a = pExt.array; +2631 for (var i = 0; i < a.length; i++) { +2632 if (a[i].caissuer != undefined) a[i].caissuer = newURI; +2633 } +2634 }; +2635 +2636 /** +2637 * convert array for X500 distinguish name to distinguish name string<br/> +2638 * @name dnarraytostr +2639 * @memberOf X509# +2640 * @function +2641 * @param {Array} aDN array for X500 distinguish name +2642 * @return {String} distinguish name +2643 * @since jsrsasign 10.0.6 x509 2.0.8 +2644 * @see X509#getX500Name +2645 * @see X509#getX500NameArray +2646 * @see KJUR.asn1.x509.X500Name +2647 * +2648 * @description +2649 * This method converts from an array representation of +2650 * X.500 distinguished name to X.500 name string. +2651 * This supports multi-valued RDN. +2652 * +2653 * @example +2654 * var x = new X509(); +2655 * x.dnarraytostr( +2656 * [[{type:"C",value:"JP",ds:"prn"}], +2657 * [{type:"O",value:"T1",ds:"prn"}]]) → "/C=JP/O=T1" +2658 * x.dnarraytostr( +2659 * [[{type:"C",value:"JP",ds:"prn"}], +2660 * [{type:"O",value:"T1",ds:"prn"} +2661 * {type:"CN",value:"Bob",ds:"prn"}]]) → "/C=JP/O=T1+CN=Bob" +2662 */ +2663 this.dnarraytostr = function(aDN) { +2664 function rdnarraytostr(aRDN) { +2665 return aRDN.map(function(x){return atvtostr(x);}).join("+"); +2666 }; +2667 +2668 function atvtostr(pATV) { +2669 return pATV.type + "=" + pATV.value; +2670 }; +2671 +2672 return "/" + aDN.map(function(x){return rdnarraytostr(x);}).join("/"); +2673 }; +2674 +2675 /** +2676 * get certificate information as string.<br/> +2677 * @name getInfo +2678 * @memberOf X509# +2679 * @function +2680 * @return {String} certificate information string +2681 * @since jsrsasign 5.0.10 x509 1.1.8 +2682 * @example +2683 * x = new X509(); +2684 * x.readCertPEM(certPEM); +2685 * console.log(x.getInfo()); +2686 * // this shows as following +2687 * Basic Fields +2688 * serial number: 02ac5c266a0b409b8f0b79f2ae462577 +2689 * signature algorithm: SHA1withRSA +2690 * issuer: /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA +2691 * notBefore: 061110000000Z +2692 * notAfter: 311110000000Z +2693 * subject: /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert High Assurance EV Root CA +2694 * subject public key info: +2695 * key algorithm: RSA +2696 * n=c6cce573e6fbd4bb... +2697 * e=10001 +2698 * X509v3 Extensions: +2699 * keyUsage CRITICAL: +2700 * digitalSignature,keyCertSign,cRLSign +2701 * basicConstraints CRITICAL: +2702 * cA=true +2703 * subjectKeyIdentifier : +2704 * b13ec36903f8bf4701d498261a0802ef63642bc3 +2705 * authorityKeyIdentifier : +2706 * kid=b13ec36903f8bf4701d498261a0802ef63642bc3 +2707 * signature algorithm: SHA1withRSA +2708 * signature: 1c1a0697dcd79c9f... +2709 */ +2710 this.getInfo = function() { +2711 var _getSubjectAltNameStr = function(params) { +2712 var s = JSON.stringify(params.array).replace(/[\[\]\{\}\"]/g, ''); +2713 return s; +2714 }; +2715 var _getCertificatePoliciesStr = function(params) { +2716 var s = ""; +2717 var a = params.array; +2718 for (var i = 0; i < a.length; i++) { +2719 var pi = a[i]; +2720 s += " policy oid: " + pi.policyoid + "\n"; +2721 if (pi.array === undefined) continue; +2722 for (var j = 0; j < pi.array.length; j++) { +2723 var pqi = pi.array[j]; +2724 if (pqi.cps !== undefined) { +2725 s += " cps: " + pqi.cps + "\n"; +2726 } +2727 } +2728 } +2729 return s; +2730 }; +2731 var _getCRLDistributionPointsStr = function(params) { +2732 var s = ""; +2733 var a = params.array; +2734 for (var i = 0; i < a.length; i++) { +2735 var dp = a[i]; +2736 try { +2737 if (dp.dpname.full[0].uri !== undefined) +2738 s += " " + dp.dpname.full[0].uri + "\n"; +2739 } catch(ex) {}; +2740 try { +2741 if (dp.dname.full[0].dn.hex !== undefined) +2742 s += " " + X509.hex2dn(dp.dpname.full[0].dn.hex) + "\n"; +2743 } catch(ex) {}; +2744 } +2745 return s; +2746 } +2747 var _getAuthorityInfoAccessStr = function(params) { +2748 var s = ""; +2749 var a = params.array; +2750 for (var i = 0; i < a.length; i++) { +2751 var ad = a[i]; +2752 +2753 if (ad.caissuer !== undefined) +2754 s += " caissuer: " + ad.caissuer + "\n"; +2755 if (ad.ocsp !== undefined) +2756 s += " ocsp: " + ad.ocsp + "\n"; +2757 } +2758 return s; +2759 }; +2760 var _X509 = X509; +2761 var s, pubkey, aExt; +2762 s = "Basic Fields\n"; +2763 s += " serial number: " + this.getSerialNumberHex() + "\n"; +2764 s += " signature algorithm: " + this.getSignatureAlgorithmField() + "\n"; +2765 s += " issuer: " + this.getIssuerString() + "\n"; +2766 s += " notBefore: " + this.getNotBefore() + "\n"; +2767 s += " notAfter: " + this.getNotAfter() + "\n"; +2768 s += " subject: " + this.getSubjectString() + "\n"; +2769 s += " subject public key info: " + "\n"; +2770 +2771 // subject public key info +2772 pubkey = this.getPublicKey(); +2773 s += " key algorithm: " + pubkey.type + "\n"; +2774 +2775 if (pubkey.type === "RSA") { +2776 s += " n=" + hextoposhex(pubkey.n.toString(16)).substr(0, 16) + "...\n"; +2777 s += " e=" + hextoposhex(pubkey.e.toString(16)) + "\n"; +2778 } +2779 +2780 // X.509v3 Extensions +2781 aExt = this.aExtInfo; 2782 -2783 // show extension name and critical flag -2784 var extName = KJUR.asn1.x509.OID.oid2name(info["oid"]); -2785 if (extName === '') extName = info["oid"]; -2786 -2787 var critical = ''; -2788 if (info["critical"] === true) critical = "CRITICAL"; -2789 -2790 s += " " + extName + " " + critical + ":\n"; -2791 -2792 // show extension value if supported -2793 if (extName === "basicConstraints") { -2794 var bc = this.getExtBasicConstraints(); -2795 if (bc.cA === undefined) { -2796 s += " {}\n"; -2797 } else { -2798 s += " cA=true"; -2799 if (bc.pathLen !== undefined) -2800 s += ", pathLen=" + bc.pathLen; -2801 s += "\n"; -2802 } -2803 } else if (extName === "keyUsage") { -2804 s += " " + this.getExtKeyUsageString() + "\n"; -2805 } else if (extName === "subjectKeyIdentifier") { -2806 s += " " + this.getExtSubjectKeyIdentifier().kid.hex + "\n"; -2807 } else if (extName === "authorityKeyIdentifier") { -2808 var akid = this.getExtAuthorityKeyIdentifier(); -2809 if (akid.kid !== undefined) -2810 s += " kid=" + akid.kid.hex + "\n"; -2811 } else if (extName === "extKeyUsage") { -2812 var eku = this.getExtExtKeyUsage().array; -2813 s += " " + eku.join(", ") + "\n"; -2814 } else if (extName === "subjectAltName") { -2815 var san = _getSubjectAltNameStr(this.getExtSubjectAltName()); -2816 s += " " + san + "\n"; -2817 } else if (extName === "cRLDistributionPoints") { -2818 var cdp = this.getExtCRLDistributionPoints(); -2819 s += _getCRLDistributionPointsStr(cdp); -2820 } else if (extName === "authorityInfoAccess") { -2821 var aia = this.getExtAuthorityInfoAccess(); -2822 s += _getAuthorityInfoAccessStr(aia); -2823 } else if (extName === "certificatePolicies") { -2824 s += _getCertificatePoliciesStr(this.getExtCertificatePolicies()); -2825 } -2826 } -2827 } -2828 -2829 s += "signature algorithm: " + this.getSignatureAlgorithmName() + "\n"; -2830 s += "signature: " + this.getSignatureValueHex().substr(0, 16) + "...\n"; -2831 return s; -2832 }; -2833 -2834 if (typeof params == "string") { -2835 if (params.indexOf("-----BEGIN") != -1) { -2836 this.readCertPEM(params); -2837 } else if (KJUR.lang.String.isHex(params)) { -2838 this.readCertHex(params); -2839 } -2840 } -2841 }; -2842 // ----- END of X509 class ----- -2843 -2844 /** -2845 * get distinguished name string in OpenSSL online format from hexadecimal string of ASN.1 DER X.500 name<br/> -2846 * @name hex2dn -2847 * @memberOf X509 -2848 * @function -2849 * @param {String} hex hexadecimal string of ASN.1 DER distinguished name -2850 * @param {Integer} idx index of hexadecimal string (DEFAULT=0) -2851 * @return {String} OpenSSL online format distinguished name -2852 * @description -2853 * This static method converts from a hexadecimal string of -2854 * distinguished name (DN) -2855 * specified by 'hex' and 'idx' to OpenSSL oneline string representation (ex. /C=US/O=a). -2856 * @example -2857 * X509.hex2dn("3031310b3...") → /C=US/O=a/CN=b2+OU=b1 -2858 */ -2859 X509.hex2dn = function(hex, idx) { -2860 if (idx === undefined) idx = 0; -2861 if (hex.substr(idx, 2) !== "30") throw new Error("malformed DN"); -2862 -2863 var a = new Array(); -2864 -2865 var aIdx = ASN1HEX.getChildIdx(hex, idx); -2866 for (var i = 0; i < aIdx.length; i++) { -2867 a.push(X509.hex2rdn(hex, aIdx[i])); -2868 } -2869 -2870 a = a.map(function(s) { return s.replace("/", "\\/"); }); -2871 return "/" + a.join("/"); -2872 }; -2873 -2874 /** -2875 * get relative distinguished name string in OpenSSL online format from hexadecimal string of ASN.1 DER RDN<br/> -2876 * @name hex2rdn -2877 * @memberOf X509 -2878 * @function -2879 * @param {String} hex hexadecimal string of ASN.1 DER concludes relative distinguished name -2880 * @param {Integer} idx index of hexadecimal string (DEFAULT=0) -2881 * @return {String} OpenSSL online format relative distinguished name -2882 * @description -2883 * This static method converts from a hexadecimal string of -2884 * relative distinguished name (RDN) -2885 * specified by 'hex' and 'idx' to LDAP string representation (ex. O=test+CN=test).<br/> -2886 * NOTE: Multi-valued RDN is supported since jsnrsasign 6.2.2 x509 1.1.10. -2887 * @example -2888 * X509.hex2rdn("310a3008060355040a0c0161") → O=a -2889 * X509.hex2rdn("31143008060355040a0c01613008060355040a0c0162") → O=a+O=b -2890 */ -2891 X509.hex2rdn = function(hex, idx) { -2892 if (idx === undefined) idx = 0; -2893 if (hex.substr(idx, 2) !== "31") throw new Error("malformed RDN"); -2894 -2895 var a = new Array(); -2896 -2897 var aIdx = ASN1HEX.getChildIdx(hex, idx); -2898 for (var i = 0; i < aIdx.length; i++) { -2899 a.push(X509.hex2attrTypeValue(hex, aIdx[i])); -2900 } -2901 -2902 a = a.map(function(s) { return s.replace("+", "\\+"); }); -2903 return a.join("+"); -2904 }; -2905 -2906 /** -2907 * get string from hexadecimal string of ASN.1 DER AttributeTypeAndValue<br/> -2908 * @name hex2attrTypeValue -2909 * @memberOf X509 -2910 * @function -2911 * @param {String} hex hexadecimal string of ASN.1 DER concludes AttributeTypeAndValue -2912 * @param {Integer} idx index of hexadecimal string (DEFAULT=0) -2913 * @return {String} string representation of AttributeTypeAndValue (ex. C=US) -2914 * @description -2915 * This static method converts from a hexadecimal string of AttributeTypeAndValue -2916 * specified by 'hex' and 'idx' to LDAP string representation (ex. C=US). -2917 * @example -2918 * X509.hex2attrTypeValue("3008060355040a0c0161") → O=a -2919 * X509.hex2attrTypeValue("300806035504060c0161") → C=a -2920 * X509.hex2attrTypeValue("...3008060355040a0c0161...", 128) → O=a -2921 */ -2922 X509.hex2attrTypeValue = function(hex, idx) { -2923 var _ASN1HEX = ASN1HEX; -2924 var _getV = _ASN1HEX.getV; -2925 -2926 if (idx === undefined) idx = 0; -2927 if (hex.substr(idx, 2) !== "30") -2928 throw new Error("malformed attribute type and value"); -2929 -2930 var aIdx = _ASN1HEX.getChildIdx(hex, idx); -2931 if (aIdx.length !== 2 || hex.substr(aIdx[0], 2) !== "06") -2932 "malformed attribute type and value"; -2933 -2934 var oidHex = _getV(hex, aIdx[0]); -2935 var oidInt = KJUR.asn1.ASN1Util.oidHexToInt(oidHex); -2936 var atype = KJUR.asn1.x509.OID.oid2atype(oidInt); -2937 -2938 var hV = _getV(hex, aIdx[1]); -2939 var rawV = hextorstr(hV); -2940 -2941 return atype + "=" + rawV; -2942 }; +2783 if (aExt !== undefined && aExt !== null) { +2784 s += "X509v3 Extensions:\n"; +2785 +2786 for (var i = 0; i < aExt.length; i++) { +2787 var info = aExt[i]; +2788 +2789 // show extension name and critical flag +2790 var extName = KJUR.asn1.x509.OID.oid2name(info["oid"]); +2791 if (extName === '') extName = info["oid"]; +2792 +2793 var critical = ''; +2794 if (info["critical"] === true) critical = "CRITICAL"; +2795 +2796 s += " " + extName + " " + critical + ":\n"; +2797 +2798 // show extension value if supported +2799 if (extName === "basicConstraints") { +2800 var bc = this.getExtBasicConstraints(); +2801 if (bc.cA === undefined) { +2802 s += " {}\n"; +2803 } else { +2804 s += " cA=true"; +2805 if (bc.pathLen !== undefined) +2806 s += ", pathLen=" + bc.pathLen; +2807 s += "\n"; +2808 } +2809 } else if (extName === "keyUsage") { +2810 s += " " + this.getExtKeyUsageString() + "\n"; +2811 } else if (extName === "subjectKeyIdentifier") { +2812 s += " " + this.getExtSubjectKeyIdentifier().kid.hex + "\n"; +2813 } else if (extName === "authorityKeyIdentifier") { +2814 var akid = this.getExtAuthorityKeyIdentifier(); +2815 if (akid.kid !== undefined) +2816 s += " kid=" + akid.kid.hex + "\n"; +2817 } else if (extName === "extKeyUsage") { +2818 var eku = this.getExtExtKeyUsage().array; +2819 s += " " + eku.join(", ") + "\n"; +2820 } else if (extName === "subjectAltName") { +2821 var san = _getSubjectAltNameStr(this.getExtSubjectAltName()); +2822 s += " " + san + "\n"; +2823 } else if (extName === "cRLDistributionPoints") { +2824 var cdp = this.getExtCRLDistributionPoints(); +2825 s += _getCRLDistributionPointsStr(cdp); +2826 } else if (extName === "authorityInfoAccess") { +2827 var aia = this.getExtAuthorityInfoAccess(); +2828 s += _getAuthorityInfoAccessStr(aia); +2829 } else if (extName === "certificatePolicies") { +2830 s += _getCertificatePoliciesStr(this.getExtCertificatePolicies()); +2831 } +2832 } +2833 } +2834 +2835 s += "signature algorithm: " + this.getSignatureAlgorithmName() + "\n"; +2836 s += "signature: " + this.getSignatureValueHex().substr(0, 16) + "...\n"; +2837 return s; +2838 }; +2839 +2840 if (typeof params == "string") { +2841 if (params.indexOf("-----BEGIN") != -1) { +2842 this.readCertPEM(params); +2843 } else if (KJUR.lang.String.isHex(params)) { +2844 this.readCertHex(params); +2845 } +2846 } +2847 }; +2848 // ----- END of X509 class ----- +2849 +2850 /** +2851 * get distinguished name string in OpenSSL online format from hexadecimal string of ASN.1 DER X.500 name<br/> +2852 * @name hex2dn +2853 * @memberOf X509 +2854 * @function +2855 * @param {String} hex hexadecimal string of ASN.1 DER distinguished name +2856 * @param {Integer} idx index of hexadecimal string (DEFAULT=0) +2857 * @return {String} OpenSSL online format distinguished name +2858 * @description +2859 * This static method converts from a hexadecimal string of +2860 * distinguished name (DN) +2861 * specified by 'hex' and 'idx' to OpenSSL oneline string representation (ex. /C=US/O=a). +2862 * @example +2863 * X509.hex2dn("3031310b3...") → /C=US/O=a/CN=b2+OU=b1 +2864 */ +2865 X509.hex2dn = function(hex, idx) { +2866 if (idx === undefined) idx = 0; +2867 if (hex.substr(idx, 2) !== "30") throw new Error("malformed DN"); +2868 +2869 var a = new Array(); +2870 +2871 var aIdx = ASN1HEX.getChildIdx(hex, idx); +2872 for (var i = 0; i < aIdx.length; i++) { +2873 a.push(X509.hex2rdn(hex, aIdx[i])); +2874 } +2875 +2876 a = a.map(function(s) { return s.replace("/", "\\/"); }); +2877 return "/" + a.join("/"); +2878 }; +2879 +2880 /** +2881 * get relative distinguished name string in OpenSSL online format from hexadecimal string of ASN.1 DER RDN<br/> +2882 * @name hex2rdn +2883 * @memberOf X509 +2884 * @function +2885 * @param {String} hex hexadecimal string of ASN.1 DER concludes relative distinguished name +2886 * @param {Integer} idx index of hexadecimal string (DEFAULT=0) +2887 * @return {String} OpenSSL online format relative distinguished name +2888 * @description +2889 * This static method converts from a hexadecimal string of +2890 * relative distinguished name (RDN) +2891 * specified by 'hex' and 'idx' to LDAP string representation (ex. O=test+CN=test).<br/> +2892 * NOTE: Multi-valued RDN is supported since jsnrsasign 6.2.2 x509 1.1.10. +2893 * @example +2894 * X509.hex2rdn("310a3008060355040a0c0161") → O=a +2895 * X509.hex2rdn("31143008060355040a0c01613008060355040a0c0162") → O=a+O=b +2896 */ +2897 X509.hex2rdn = function(hex, idx) { +2898 if (idx === undefined) idx = 0; +2899 if (hex.substr(idx, 2) !== "31") throw new Error("malformed RDN"); +2900 +2901 var a = new Array(); +2902 +2903 var aIdx = ASN1HEX.getChildIdx(hex, idx); +2904 for (var i = 0; i < aIdx.length; i++) { +2905 a.push(X509.hex2attrTypeValue(hex, aIdx[i])); +2906 } +2907 +2908 a = a.map(function(s) { return s.replace("+", "\\+"); }); +2909 return a.join("+"); +2910 }; +2911 +2912 /** +2913 * get string from hexadecimal string of ASN.1 DER AttributeTypeAndValue<br/> +2914 * @name hex2attrTypeValue +2915 * @memberOf X509 +2916 * @function +2917 * @param {String} hex hexadecimal string of ASN.1 DER concludes AttributeTypeAndValue +2918 * @param {Integer} idx index of hexadecimal string (DEFAULT=0) +2919 * @return {String} string representation of AttributeTypeAndValue (ex. C=US) +2920 * @description +2921 * This static method converts from a hexadecimal string of AttributeTypeAndValue +2922 * specified by 'hex' and 'idx' to LDAP string representation (ex. C=US). +2923 * @example +2924 * X509.hex2attrTypeValue("3008060355040a0c0161") → O=a +2925 * X509.hex2attrTypeValue("300806035504060c0161") → C=a +2926 * X509.hex2attrTypeValue("...3008060355040a0c0161...", 128) → O=a +2927 */ +2928 X509.hex2attrTypeValue = function(hex, idx) { +2929 var _ASN1HEX = ASN1HEX; +2930 var _getV = _ASN1HEX.getV; +2931 +2932 if (idx === undefined) idx = 0; +2933 if (hex.substr(idx, 2) !== "30") +2934 throw new Error("malformed attribute type and value"); +2935 +2936 var aIdx = _ASN1HEX.getChildIdx(hex, idx); +2937 if (aIdx.length !== 2 || hex.substr(aIdx[0], 2) !== "06") +2938 "malformed attribute type and value"; +2939 +2940 var oidHex = _getV(hex, aIdx[0]); +2941 var oidInt = KJUR.asn1.ASN1Util.oidHexToInt(oidHex); +2942 var atype = KJUR.asn1.x509.OID.oid2atype(oidInt); 2943 -2944 /** -2945 * get RSA/DSA/ECDSA public key object from X.509 certificate hexadecimal string<br/> -2946 * @name getPublicKeyFromCertHex -2947 * @memberOf X509 -2948 * @function -2949 * @param {String} h hexadecimal string of X.509 certificate for RSA/ECDSA/DSA public key -2950 * @return returns RSAKey/KJUR.crypto.{ECDSA,DSA} object of public key -2951 * @since jsrasign 7.1.0 x509 1.1.11 -2952 */ -2953 X509.getPublicKeyFromCertHex = function(h) { -2954 var x = new X509(); -2955 x.readCertHex(h); -2956 return x.getPublicKey(); -2957 }; -2958 -2959 /** -2960 * get RSA/DSA/ECDSA public key object from PEM certificate string -2961 * @name getPublicKeyFromCertPEM -2962 * @memberOf X509 -2963 * @function -2964 * @param {String} sCertPEM PEM formatted RSA/ECDSA/DSA X.509 certificate -2965 * @return returns RSAKey/KJUR.crypto.{ECDSA,DSA} object of public key -2966 * @since x509 1.1.1 -2967 * @description -2968 * NOTE: DSA is also supported since x509 1.1.2. -2969 */ -2970 X509.getPublicKeyFromCertPEM = function(sCertPEM) { -2971 var x = new X509(); -2972 x.readCertPEM(sCertPEM); -2973 return x.getPublicKey(); -2974 }; -2975 -2976 /** -2977 * get public key information from PEM certificate -2978 * @name getPublicKeyInfoPropOfCertPEM -2979 * @memberOf X509 -2980 * @function -2981 * @param {String} sCertPEM string of PEM formatted certificate -2982 * @return {Hash} hash of information for public key -2983 * @since x509 1.1.1 -2984 * @description -2985 * Resulted associative array has following properties:<br/> -2986 * <ul> -2987 * <li>algoid - hexadecimal string of OID of asymmetric key algorithm</li> -2988 * <li>algparam - hexadecimal string of OID of ECC curve name or null</li> -2989 * <li>keyhex - hexadecimal string of key in the certificate</li> -2990 * </ul> -2991 * NOTE: X509v1 certificate is also supported since x509.js 1.1.9. -2992 */ -2993 X509.getPublicKeyInfoPropOfCertPEM = function(sCertPEM) { -2994 var _ASN1HEX = ASN1HEX; -2995 var _getVbyList = _ASN1HEX.getVbyList; -2996 -2997 var result = {}; -2998 var x, hSPKI, pubkey; -2999 result.algparam = null; -3000 -3001 x = new X509(); -3002 x.readCertPEM(sCertPEM); -3003 -3004 hSPKI = x.getPublicKeyHex(); -3005 result.keyhex = _getVbyList(hSPKI, 0, [1], "03").substr(2); -3006 result.algoid = _getVbyList(hSPKI, 0, [0, 0], "06"); -3007 -3008 if (result.algoid === "2a8648ce3d0201") { // ecPublicKey -3009 result.algparam = _getVbyList(hSPKI, 0, [0, 1], "06"); -3010 }; -3011 -3012 return result; -3013 }; -3014 -3015 /* ====================================================================== -3016 * Specific V3 Extensions -3017 * ====================================================================== */ -3018 -3019 X509.KEYUSAGE_NAME = [ -3020 "digitalSignature", -3021 "nonRepudiation", -3022 "keyEncipherment", -3023 "dataEncipherment", -3024 "keyAgreement", -3025 "keyCertSign", -3026 "cRLSign", -3027 "encipherOnly", -3028 "decipherOnly" -3029 ]; -3030 \ No newline at end of file +2944 var hV = _getV(hex, aIdx[1]); +2945 var rawV = hextorstr(hV); +2946 +2947 return atype + "=" + rawV; +2948 }; +2949 +2950 /** +2951 * get RSA/DSA/ECDSA public key object from X.509 certificate hexadecimal string<br/> +2952 * @name getPublicKeyFromCertHex +2953 * @memberOf X509 +2954 * @function +2955 * @param {String} h hexadecimal string of X.509 certificate for RSA/ECDSA/DSA public key +2956 * @return returns RSAKey/KJUR.crypto.{ECDSA,DSA} object of public key +2957 * @since jsrasign 7.1.0 x509 1.1.11 +2958 */ +2959 X509.getPublicKeyFromCertHex = function(h) { +2960 var x = new X509(); +2961 x.readCertHex(h); +2962 return x.getPublicKey(); +2963 }; +2964 +2965 /** +2966 * get RSA/DSA/ECDSA public key object from PEM certificate string +2967 * @name getPublicKeyFromCertPEM +2968 * @memberOf X509 +2969 * @function +2970 * @param {String} sCertPEM PEM formatted RSA/ECDSA/DSA X.509 certificate +2971 * @return returns RSAKey/KJUR.crypto.{ECDSA,DSA} object of public key +2972 * @since x509 1.1.1 +2973 * @description +2974 * NOTE: DSA is also supported since x509 1.1.2. +2975 */ +2976 X509.getPublicKeyFromCertPEM = function(sCertPEM) { +2977 var x = new X509(); +2978 x.readCertPEM(sCertPEM); +2979 return x.getPublicKey(); +2980 }; +2981 +2982 /** +2983 * get public key information from PEM certificate +2984 * @name getPublicKeyInfoPropOfCertPEM +2985 * @memberOf X509 +2986 * @function +2987 * @param {String} sCertPEM string of PEM formatted certificate +2988 * @return {Hash} hash of information for public key +2989 * @since x509 1.1.1 +2990 * @description +2991 * Resulted associative array has following properties:<br/> +2992 * <ul> +2993 * <li>algoid - hexadecimal string of OID of asymmetric key algorithm</li> +2994 * <li>algparam - hexadecimal string of OID of ECC curve name or null</li> +2995 * <li>keyhex - hexadecimal string of key in the certificate</li> +2996 * </ul> +2997 * NOTE: X509v1 certificate is also supported since x509.js 1.1.9. +2998 */ +2999 X509.getPublicKeyInfoPropOfCertPEM = function(sCertPEM) { +3000 var _ASN1HEX = ASN1HEX; +3001 var _getVbyList = _ASN1HEX.getVbyList; +3002 +3003 var result = {}; +3004 var x, hSPKI, pubkey; +3005 result.algparam = null; +3006 +3007 x = new X509(); +3008 x.readCertPEM(sCertPEM); +3009 +3010 hSPKI = x.getPublicKeyHex(); +3011 result.keyhex = _getVbyList(hSPKI, 0, [1], "03").substr(2); +3012 result.algoid = _getVbyList(hSPKI, 0, [0, 0], "06"); +3013 +3014 if (result.algoid === "2a8648ce3d0201") { // ecPublicKey +3015 result.algparam = _getVbyList(hSPKI, 0, [0, 1], "06"); +3016 }; +3017 +3018 return result; +3019 }; +3020 +3021 /* ====================================================================== +3022 * Specific V3 Extensions +3023 * ====================================================================== */ +3024 +3025 X509.KEYUSAGE_NAME = [ +3026 "digitalSignature", +3027 "nonRepudiation", +3028 "keyEncipherment", +3029 "dataEncipherment", +3030 "keyAgreement", +3031 "keyCertSign", +3032 "cRLSign", +3033 "encipherOnly", +3034 "decipherOnly" +3035 ]; +3036 \ No newline at end of file diff --git a/bower.json b/bower.json index 69fae8af..38ba3bb2 100644 --- a/bower.json +++ b/bower.json @@ -1,6 +1,6 @@ { "name": "kjur-jsrsasign", - "version": "10.1.10", + "version": "10.1.11", "main": "jsrsasign-all-min.js", "description": "The 'jsrsasign' (RSA-Sign JavaScript Library) is an opensource free cryptography library supporting RSA/RSAPSS/ECDSA/DSA signing/validation, ASN.1, PKCS#1/5/8 private/public key, X.509 certificate, CRL, OCSP, CMS SignedData, TimeStamp, CAdES, JWS and JWT in pure JavaScript.", "license": "MIT", diff --git a/jsrsasign-all-min.js b/jsrsasign-all-min.js index 99b5b71f..e7801440 100644 --- a/jsrsasign-all-min.js +++ b/jsrsasign-all-min.js @@ -1,5 +1,5 @@ /* - * jsrsasign(all) 10.1.10 (2021-02-14) (c) 2010-2021 Kenji Urushima | kjur.github.com/jsrsasign/license + * jsrsasign(all) 10.1.11 (2021-02-19) (c) 2010-2021 Kenji Urushima | kjur.github.com/jsrsasign/license */ /*! @@ -241,7 +241,7 @@ if(typeof KJUR=="undefined"||!KJUR){KJUR={}}if(typeof KJUR.crypto=="undefined"|| var KEYUTIL=function(){var d=function(p,r,q){return k(CryptoJS.AES,p,r,q)};var e=function(p,r,q){return k(CryptoJS.TripleDES,p,r,q)};var a=function(p,r,q){return k(CryptoJS.DES,p,r,q)};var k=function(s,x,u,q){var r=CryptoJS.enc.Hex.parse(x);var w=CryptoJS.enc.Hex.parse(u);var p=CryptoJS.enc.Hex.parse(q);var t={};t.key=w;t.iv=p;t.ciphertext=r;var v=s.decrypt(t,w,{iv:p});return CryptoJS.enc.Hex.stringify(v)};var l=function(p,r,q){return g(CryptoJS.AES,p,r,q)};var o=function(p,r,q){return g(CryptoJS.TripleDES,p,r,q)};var f=function(p,r,q){return g(CryptoJS.DES,p,r,q)};var g=function(t,y,v,q){var s=CryptoJS.enc.Hex.parse(y);var x=CryptoJS.enc.Hex.parse(v);var p=CryptoJS.enc.Hex.parse(q);var w=t.encrypt(s,x,{iv:p});var r=CryptoJS.enc.Hex.parse(w.toString());var u=CryptoJS.enc.Base64.stringify(r);return u};var i={"AES-256-CBC":{proc:d,eproc:l,keylen:32,ivlen:16},"AES-192-CBC":{proc:d,eproc:l,keylen:24,ivlen:16},"AES-128-CBC":{proc:d,eproc:l,keylen:16,ivlen:16},"DES-EDE3-CBC":{proc:e,eproc:o,keylen:24,ivlen:8},"DES-CBC":{proc:a,eproc:f,keylen:8,ivlen:8}};var c=function(p){return i[p]["proc"]};var m=function(p){var r=CryptoJS.lib.WordArray.random(p);var q=CryptoJS.enc.Hex.stringify(r);return q};var n=function(v){var w={};var q=v.match(new RegExp("DEK-Info: ([^,]+),([0-9A-Fa-f]+)","m"));if(q){w.cipher=q[1];w.ivsalt=q[2]}var p=v.match(new RegExp("-----BEGIN ([A-Z]+) PRIVATE KEY-----"));if(p){w.type=p[1]}var u=-1;var x=0;if(v.indexOf("\r\n\r\n")!=-1){u=v.indexOf("\r\n\r\n");x=2}if(v.indexOf("\n\n")!=-1){u=v.indexOf("\n\n");x=1}var t=v.indexOf("-----END");if(u!=-1&&t!=-1){var r=v.substring(u+x*2,t-x);r=r.replace(/\s+/g,"");w.data=r}return w};var j=function(q,y,p){var v=p.substring(0,16);var t=CryptoJS.enc.Hex.parse(v);var r=CryptoJS.enc.Utf8.parse(y);var u=i[q]["keylen"]+i[q]["ivlen"];var x="";var w=null;for(;;){var s=CryptoJS.algo.MD5.create();if(w!=null){s.update(w)}s.update(r);s.update(t);w=s.finalize();x=x+CryptoJS.enc.Hex.stringify(w);if(x.length>=u*2){break}}var z={};z.keyhex=x.substr(0,i[q]["keylen"]*2);z.ivhex=x.substr(i[q]["keylen"]*2,i[q]["ivlen"]*2);return z};var b=function(p,v,r,w){var s=CryptoJS.enc.Base64.parse(p);var q=CryptoJS.enc.Hex.stringify(s);var u=i[v]["proc"];var t=u(q,r,w);return t};var h=function(p,s,q,u){var r=i[s]["eproc"];var t=r(p,q,u);return t};return{version:"1.0.0",parsePKCS5PEM:function(p){return n(p)},getKeyAndUnusedIvByPasscodeAndIvsalt:function(q,p,r){return j(q,p,r)},decryptKeyB64:function(p,r,q,s){return b(p,r,q,s)},getDecryptedKeyHex:function(y,x){var q=n(y);var t=q.type;var r=q.cipher;var p=q.ivsalt;var s=q.data;var w=j(r,x,p);var v=w.keyhex;var u=b(s,r,v,p);return u},getEncryptedPKCS5PEMFromPrvKeyHex:function(x,s,A,t,r){var p="";if(typeof t=="undefined"||t==null){t="AES-256-CBC"}if(typeof i[t]=="undefined"){throw"KEYUTIL unsupported algorithm: "+t}if(typeof r=="undefined"||r==null){var v=i[t]["ivlen"];var u=m(v);r=u.toUpperCase()}var z=j(t,A,r);var y=z.keyhex;var w=h(s,t,y,r);var q=w.replace(/(.{64})/g,"$1\r\n");var p="-----BEGIN "+x+" PRIVATE KEY-----\r\n";p+="Proc-Type: 4,ENCRYPTED\r\n";p+="DEK-Info: "+t+","+r+"\r\n";p+="\r\n";p+=q;p+="\r\n-----END "+x+" PRIVATE KEY-----\r\n";return p},parseHexOfEncryptedPKCS8:function(y){var B=ASN1HEX;var z=B.getChildIdx;var w=B.getV;var t={};var r=z(y,0);if(r.length!=2){throw"malformed format: SEQUENCE(0).items != 2: "+r.length}t.ciphertext=w(y,r[1]);var A=z(y,r[0]);if(A.length!=2){throw"malformed format: SEQUENCE(0.0).items != 2: "+A.length}if(w(y,A[0])!="2a864886f70d01050d"){throw"this only supports pkcs5PBES2"}var p=z(y,A[1]);if(A.length!=2){throw"malformed format: SEQUENCE(0.0.1).items != 2: "+p.length}var q=z(y,p[1]);if(q.length!=2){throw"malformed format: SEQUENCE(0.0.1.1).items != 2: "+q.length}if(w(y,q[0])!="2a864886f70d0307"){throw"this only supports TripleDES"}t.encryptionSchemeAlg="TripleDES";t.encryptionSchemeIV=w(y,q[1]);var s=z(y,p[0]);if(s.length!=2){throw"malformed format: SEQUENCE(0.0.1.0).items != 2: "+s.length}if(w(y,s[0])!="2a864886f70d01050c"){throw"this only supports pkcs5PBKDF2"}var x=z(y,s[1]);if(x.length<2){throw"malformed format: SEQUENCE(0.0.1.0.1).items < 2: "+x.length}t.pbkdf2Salt=w(y,x[0]);var u=w(y,x[1]);try{t.pbkdf2Iter=parseInt(u,16)}catch(v){throw"malformed format pbkdf2Iter: "+u}return t},getPBKDF2KeyHexFromParam:function(u,p){var t=CryptoJS.enc.Hex.parse(u.pbkdf2Salt);var q=u.pbkdf2Iter;var s=CryptoJS.PBKDF2(p,t,{keySize:192/32,iterations:q});var r=CryptoJS.enc.Hex.stringify(s);return r},_getPlainPKCS8HexFromEncryptedPKCS8PEM:function(x,y){var r=pemtohex(x,"ENCRYPTED PRIVATE KEY");var p=this.parseHexOfEncryptedPKCS8(r);var u=KEYUTIL.getPBKDF2KeyHexFromParam(p,y);var v={};v.ciphertext=CryptoJS.enc.Hex.parse(p.ciphertext);var t=CryptoJS.enc.Hex.parse(u);var s=CryptoJS.enc.Hex.parse(p.encryptionSchemeIV);var w=CryptoJS.TripleDES.decrypt(v,t,{iv:s});var q=CryptoJS.enc.Hex.stringify(w);return q},getKeyFromEncryptedPKCS8PEM:function(s,q){var p=this._getPlainPKCS8HexFromEncryptedPKCS8PEM(s,q);var r=this.getKeyFromPlainPrivatePKCS8Hex(p);return r},parsePlainPrivatePKCS8Hex:function(s){var v=ASN1HEX;var u=v.getChildIdx;var t=v.getV;var q={};q.algparam=null;if(s.substr(0,2)!="30"){throw new Error("malformed plain PKCS8 private key(code:001)")}var r=u(s,0);if(r.length<3){throw new Error("malformed plain PKCS8 private key(code:002)")}if(s.substr(r[1],2)!="30"){throw new Error("malformed PKCS8 private key(code:003)")}var p=u(s,r[1]);if(p.length!=2){throw new Error("malformed PKCS8 private key(code:004)")}if(s.substr(p[0],2)!="06"){throw new Error("malformed PKCS8 private key(code:005)")}q.algoid=t(s,p[0]);if(s.substr(p[1],2)=="06"){q.algparam=t(s,p[1])}if(s.substr(r[2],2)!="04"){throw new Error("malformed PKCS8 private key(code:006)")}q.keyidx=v.getVidx(s,r[2]);return q},getKeyFromPlainPrivatePKCS8PEM:function(q){var p=pemtohex(q,"PRIVATE KEY");var r=this.getKeyFromPlainPrivatePKCS8Hex(p);return r},getKeyFromPlainPrivatePKCS8Hex:function(p){var q=this.parsePlainPrivatePKCS8Hex(p);var r;if(q.algoid=="2a864886f70d010101"){r=new RSAKey()}else{if(q.algoid=="2a8648ce380401"){r=new KJUR.crypto.DSA()}else{if(q.algoid=="2a8648ce3d0201"){r=new KJUR.crypto.ECDSA()}else{throw"unsupported private key algorithm"}}}r.readPKCS8PrvKeyHex(p);return r},_getKeyFromPublicPKCS8Hex:function(q){var p;var r=ASN1HEX.getVbyList(q,0,[0,0],"06");if(r==="2a864886f70d010101"){p=new RSAKey()}else{if(r==="2a8648ce380401"){p=new KJUR.crypto.DSA()}else{if(r==="2a8648ce3d0201"){p=new KJUR.crypto.ECDSA()}else{throw"unsupported PKCS#8 public key hex"}}}p.readPKCS8PubKeyHex(q);return p},parsePublicRawRSAKeyHex:function(r){var u=ASN1HEX;var t=u.getChildIdx;var s=u.getV;var p={};if(r.substr(0,2)!="30"){throw"malformed RSA key(code:001)"}var q=t(r,0);if(q.length!=2){throw"malformed RSA key(code:002)"}if(r.substr(q[0],2)!="02"){throw"malformed RSA key(code:003)"}p.n=s(r,q[0]);if(r.substr(q[1],2)!="02"){throw"malformed RSA key(code:004)"}p.e=s(r,q[1]);return p},parsePublicPKCS8Hex:function(t){var v=ASN1HEX;var u=v.getChildIdx;var s=v.getV;var q={};q.algparam=null;var r=u(t,0);if(r.length!=2){throw"outer DERSequence shall have 2 elements: "+r.length}var w=r[0];if(t.substr(w,2)!="30"){throw"malformed PKCS8 public key(code:001)"}var p=u(t,w);if(p.length!=2){throw"malformed PKCS8 public key(code:002)"}if(t.substr(p[0],2)!="06"){throw"malformed PKCS8 public key(code:003)"}q.algoid=s(t,p[0]);if(t.substr(p[1],2)=="06"){q.algparam=s(t,p[1])}else{if(t.substr(p[1],2)=="30"){q.algparam={};q.algparam.p=v.getVbyList(t,p[1],[0],"02");q.algparam.q=v.getVbyList(t,p[1],[1],"02");q.algparam.g=v.getVbyList(t,p[1],[2],"02")}}if(t.substr(r[1],2)!="03"){throw"malformed PKCS8 public key(code:004)"}q.key=s(t,r[1]).substr(2);return q},}}();KEYUTIL.getKey=function(l,k,n){var G=ASN1HEX,L=G.getChildIdx,v=G.getV,d=G.getVbyList,c=KJUR.crypto,i=c.ECDSA,C=c.DSA,w=RSAKey,M=pemtohex,F=KEYUTIL;if(typeof w!="undefined"&&l instanceof w){return l}if(typeof i!="undefined"&&l instanceof i){return l}if(typeof C!="undefined"&&l instanceof C){return l}if(l.curve!==undefined&&l.xy!==undefined&&l.d===undefined){return new i({pub:l.xy,curve:l.curve})}if(l.curve!==undefined&&l.d!==undefined){return new i({prv:l.d,curve:l.curve})}if(l.kty===undefined&&l.n!==undefined&&l.e!==undefined&&l.d===undefined){var P=new w();P.setPublic(l.n,l.e);return P}if(l.kty===undefined&&l.n!==undefined&&l.e!==undefined&&l.d!==undefined&&l.p!==undefined&&l.q!==undefined&&l.dp!==undefined&&l.dq!==undefined&&l.co!==undefined&&l.qi===undefined){var P=new w();P.setPrivateEx(l.n,l.e,l.d,l.p,l.q,l.dp,l.dq,l.co);return P}if(l.kty===undefined&&l.n!==undefined&&l.e!==undefined&&l.d!==undefined&&l.p===undefined){var P=new w();P.setPrivate(l.n,l.e,l.d);return P}if(l.p!==undefined&&l.q!==undefined&&l.g!==undefined&&l.y!==undefined&&l.x===undefined){var P=new C();P.setPublic(l.p,l.q,l.g,l.y);return P}if(l.p!==undefined&&l.q!==undefined&&l.g!==undefined&&l.y!==undefined&&l.x!==undefined){var P=new C();P.setPrivate(l.p,l.q,l.g,l.y,l.x);return P}if(l.kty==="RSA"&&l.n!==undefined&&l.e!==undefined&&l.d===undefined){var P=new w();P.setPublic(b64utohex(l.n),b64utohex(l.e));return P}if(l.kty==="RSA"&&l.n!==undefined&&l.e!==undefined&&l.d!==undefined&&l.p!==undefined&&l.q!==undefined&&l.dp!==undefined&&l.dq!==undefined&&l.qi!==undefined){var P=new w();P.setPrivateEx(b64utohex(l.n),b64utohex(l.e),b64utohex(l.d),b64utohex(l.p),b64utohex(l.q),b64utohex(l.dp),b64utohex(l.dq),b64utohex(l.qi));return P}if(l.kty==="RSA"&&l.n!==undefined&&l.e!==undefined&&l.d!==undefined){var P=new w();P.setPrivate(b64utohex(l.n),b64utohex(l.e),b64utohex(l.d));return P}if(l.kty==="EC"&&l.crv!==undefined&&l.x!==undefined&&l.y!==undefined&&l.d===undefined){var j=new i({curve:l.crv});var t=j.ecparams.keylen/4;var B=("0000000000"+b64utohex(l.x)).slice(-t);var z=("0000000000"+b64utohex(l.y)).slice(-t);var u="04"+B+z;j.setPublicKeyHex(u);return j}if(l.kty==="EC"&&l.crv!==undefined&&l.x!==undefined&&l.y!==undefined&&l.d!==undefined){var j=new i({curve:l.crv});var t=j.ecparams.keylen/4;var B=("0000000000"+b64utohex(l.x)).slice(-t);var z=("0000000000"+b64utohex(l.y)).slice(-t);var u="04"+B+z;var b=("0000000000"+b64utohex(l.d)).slice(-t);j.setPublicKeyHex(u);j.setPrivateKeyHex(b);return j}if(n==="pkcs5prv"){var J=l,G=ASN1HEX,N,P;N=L(J,0);if(N.length===9){P=new w();P.readPKCS5PrvKeyHex(J)}else{if(N.length===6){P=new C();P.readPKCS5PrvKeyHex(J)}else{if(N.length>2&&J.substr(N[1],2)==="04"){P=new i();P.readPKCS5PrvKeyHex(J)}else{throw"unsupported PKCS#1/5 hexadecimal key"}}}return P}if(n==="pkcs8prv"){var P=F.getKeyFromPlainPrivatePKCS8Hex(l);return P}if(n==="pkcs8pub"){return F._getKeyFromPublicPKCS8Hex(l)}if(n==="x509pub"){return X509.getPublicKeyFromCertHex(l)}if(l.indexOf("-END CERTIFICATE-",0)!=-1||l.indexOf("-END X509 CERTIFICATE-",0)!=-1||l.indexOf("-END TRUSTED CERTIFICATE-",0)!=-1){return X509.getPublicKeyFromCertPEM(l)}if(l.indexOf("-END PUBLIC KEY-")!=-1){var O=pemtohex(l,"PUBLIC KEY");return F._getKeyFromPublicPKCS8Hex(O)}if(l.indexOf("-END RSA PRIVATE KEY-")!=-1&&l.indexOf("4,ENCRYPTED")==-1){var m=M(l,"RSA PRIVATE KEY");return F.getKey(m,null,"pkcs5prv")}if(l.indexOf("-END DSA PRIVATE KEY-")!=-1&&l.indexOf("4,ENCRYPTED")==-1){var I=M(l,"DSA PRIVATE KEY");var E=d(I,0,[1],"02");var D=d(I,0,[2],"02");var K=d(I,0,[3],"02");var r=d(I,0,[4],"02");var s=d(I,0,[5],"02");var P=new C();P.setPrivate(new BigInteger(E,16),new BigInteger(D,16),new BigInteger(K,16),new BigInteger(r,16),new BigInteger(s,16));return P}if(l.indexOf("-END EC PRIVATE KEY-")!=-1&&l.indexOf("4,ENCRYPTED")==-1){var m=M(l,"EC PRIVATE KEY");return F.getKey(m,null,"pkcs5prv")}if(l.indexOf("-END PRIVATE KEY-")!=-1){return F.getKeyFromPlainPrivatePKCS8PEM(l)}if(l.indexOf("-END RSA PRIVATE KEY-")!=-1&&l.indexOf("4,ENCRYPTED")!=-1){var o=F.getDecryptedKeyHex(l,k);var H=new RSAKey();H.readPKCS5PrvKeyHex(o);return H}if(l.indexOf("-END EC PRIVATE KEY-")!=-1&&l.indexOf("4,ENCRYPTED")!=-1){var I=F.getDecryptedKeyHex(l,k);var P=d(I,0,[1],"04");var f=d(I,0,[2,0],"06");var A=d(I,0,[3,0],"03").substr(2);var e="";if(KJUR.crypto.OID.oidhex2name[f]!==undefined){e=KJUR.crypto.OID.oidhex2name[f]}else{throw"undefined OID(hex) in KJUR.crypto.OID: "+f}var j=new i({curve:e});j.setPublicKeyHex(A);j.setPrivateKeyHex(P);j.isPublic=false;return j}if(l.indexOf("-END DSA PRIVATE KEY-")!=-1&&l.indexOf("4,ENCRYPTED")!=-1){var I=F.getDecryptedKeyHex(l,k);var E=d(I,0,[1],"02");var D=d(I,0,[2],"02");var K=d(I,0,[3],"02");var r=d(I,0,[4],"02");var s=d(I,0,[5],"02");var P=new C();P.setPrivate(new BigInteger(E,16),new BigInteger(D,16),new BigInteger(K,16),new BigInteger(r,16),new BigInteger(s,16));return P}if(l.indexOf("-END ENCRYPTED PRIVATE KEY-")!=-1){return F.getKeyFromEncryptedPKCS8PEM(l,k)}throw new Error("not supported argument")};KEYUTIL.generateKeypair=function(a,c){if(a=="RSA"){var b=c;var h=new RSAKey();h.generate(b,"10001");h.isPrivate=true;h.isPublic=true;var f=new RSAKey();var e=h.n.toString(16);var i=h.e.toString(16);f.setPublic(e,i);f.isPrivate=false;f.isPublic=true;var k={};k.prvKeyObj=h;k.pubKeyObj=f;return k}else{if(a=="EC"){var d=c;var g=new KJUR.crypto.ECDSA({curve:d});var j=g.generateKeyPairHex();var h=new KJUR.crypto.ECDSA({curve:d});h.setPublicKeyHex(j.ecpubhex);h.setPrivateKeyHex(j.ecprvhex);h.isPrivate=true;h.isPublic=false;var f=new KJUR.crypto.ECDSA({curve:d});f.setPublicKeyHex(j.ecpubhex);f.isPrivate=false;f.isPublic=true;var k={};k.prvKeyObj=h;k.pubKeyObj=f;return k}else{throw"unknown algorithm: "+a}}};KEYUTIL.getPEM=function(b,D,y,m,q,j){var F=KJUR,k=F.asn1,z=k.DERObjectIdentifier,f=k.DERInteger,l=k.ASN1Util.newObject,a=k.x509,C=a.SubjectPublicKeyInfo,e=F.crypto,u=e.DSA,r=e.ECDSA,n=RSAKey;function A(s){var G=l({seq:[{"int":0},{"int":{bigint:s.n}},{"int":s.e},{"int":{bigint:s.d}},{"int":{bigint:s.p}},{"int":{bigint:s.q}},{"int":{bigint:s.dmp1}},{"int":{bigint:s.dmq1}},{"int":{bigint:s.coeff}}]});return G}function B(G){var s=l({seq:[{"int":1},{octstr:{hex:G.prvKeyHex}},{tag:["a0",true,{oid:{name:G.curveName}}]},{tag:["a1",true,{bitstr:{hex:"00"+G.pubKeyHex}}]}]});return s}function x(s){var G=l({seq:[{"int":0},{"int":{bigint:s.p}},{"int":{bigint:s.q}},{"int":{bigint:s.g}},{"int":{bigint:s.y}},{"int":{bigint:s.x}}]});return G}if(((n!==undefined&&b instanceof n)||(u!==undefined&&b instanceof u)||(r!==undefined&&b instanceof r))&&b.isPublic==true&&(D===undefined||D=="PKCS8PUB")){var E=new C(b);var w=E.getEncodedHex();return hextopem(w,"PUBLIC KEY")}if(D=="PKCS1PRV"&&n!==undefined&&b instanceof n&&(y===undefined||y==null)&&b.isPrivate==true){var E=A(b);var w=E.getEncodedHex();return hextopem(w,"RSA PRIVATE KEY")}if(D=="PKCS1PRV"&&r!==undefined&&b instanceof r&&(y===undefined||y==null)&&b.isPrivate==true){var i=new z({name:b.curveName});var v=i.getEncodedHex();var h=B(b);var t=h.getEncodedHex();var p="";p+=hextopem(v,"EC PARAMETERS");p+=hextopem(t,"EC PRIVATE KEY");return p}if(D=="PKCS1PRV"&&u!==undefined&&b instanceof u&&(y===undefined||y==null)&&b.isPrivate==true){var E=x(b);var w=E.getEncodedHex();return hextopem(w,"DSA PRIVATE KEY")}if(D=="PKCS5PRV"&&n!==undefined&&b instanceof n&&(y!==undefined&&y!=null)&&b.isPrivate==true){var E=A(b);var w=E.getEncodedHex();if(m===undefined){m="DES-EDE3-CBC"}return this.getEncryptedPKCS5PEMFromPrvKeyHex("RSA",w,y,m,j)}if(D=="PKCS5PRV"&&r!==undefined&&b instanceof r&&(y!==undefined&&y!=null)&&b.isPrivate==true){var E=B(b);var w=E.getEncodedHex();if(m===undefined){m="DES-EDE3-CBC"}return this.getEncryptedPKCS5PEMFromPrvKeyHex("EC",w,y,m,j)}if(D=="PKCS5PRV"&&u!==undefined&&b instanceof u&&(y!==undefined&&y!=null)&&b.isPrivate==true){var E=x(b);var w=E.getEncodedHex();if(m===undefined){m="DES-EDE3-CBC"}return this.getEncryptedPKCS5PEMFromPrvKeyHex("DSA",w,y,m,j)}var o=function(G,s){var I=c(G,s);var H=new l({seq:[{seq:[{oid:{name:"pkcs5PBES2"}},{seq:[{seq:[{oid:{name:"pkcs5PBKDF2"}},{seq:[{octstr:{hex:I.pbkdf2Salt}},{"int":I.pbkdf2Iter}]}]},{seq:[{oid:{name:"des-EDE3-CBC"}},{octstr:{hex:I.encryptionSchemeIV}}]}]}]},{octstr:{hex:I.ciphertext}}]});return H.getEncodedHex()};var c=function(N,O){var H=100;var M=CryptoJS.lib.WordArray.random(8);var L="DES-EDE3-CBC";var s=CryptoJS.lib.WordArray.random(8);var I=CryptoJS.PBKDF2(O,M,{keySize:192/32,iterations:H});var J=CryptoJS.enc.Hex.parse(N);var K=CryptoJS.TripleDES.encrypt(J,I,{iv:s})+"";var G={};G.ciphertext=K;G.pbkdf2Salt=CryptoJS.enc.Hex.stringify(M);G.pbkdf2Iter=H;G.encryptionSchemeAlg=L;G.encryptionSchemeIV=CryptoJS.enc.Hex.stringify(s);return G};if(D=="PKCS8PRV"&&n!=undefined&&b instanceof n&&b.isPrivate==true){var g=A(b);var d=g.getEncodedHex();var E=l({seq:[{"int":0},{seq:[{oid:{name:"rsaEncryption"}},{"null":true}]},{octstr:{hex:d}}]});var w=E.getEncodedHex();if(y===undefined||y==null){return hextopem(w,"PRIVATE KEY")}else{var t=o(w,y);return hextopem(t,"ENCRYPTED PRIVATE KEY")}}if(D=="PKCS8PRV"&&r!==undefined&&b instanceof r&&b.isPrivate==true){var g=new l({seq:[{"int":1},{octstr:{hex:b.prvKeyHex}},{tag:["a1",true,{bitstr:{hex:"00"+b.pubKeyHex}}]}]});var d=g.getEncodedHex();var E=l({seq:[{"int":0},{seq:[{oid:{name:"ecPublicKey"}},{oid:{name:b.curveName}}]},{octstr:{hex:d}}]});var w=E.getEncodedHex();if(y===undefined||y==null){return hextopem(w,"PRIVATE KEY")}else{var t=o(w,y);return hextopem(t,"ENCRYPTED PRIVATE KEY")}}if(D=="PKCS8PRV"&&u!==undefined&&b instanceof u&&b.isPrivate==true){var g=new f({bigint:b.x});var d=g.getEncodedHex();var E=l({seq:[{"int":0},{seq:[{oid:{name:"dsa"}},{seq:[{"int":{bigint:b.p}},{"int":{bigint:b.q}},{"int":{bigint:b.g}}]}]},{octstr:{hex:d}}]});var w=E.getEncodedHex();if(y===undefined||y==null){return hextopem(w,"PRIVATE KEY")}else{var t=o(w,y);return hextopem(t,"ENCRYPTED PRIVATE KEY")}}throw new Error("unsupported object nor format")};KEYUTIL.getKeyFromCSRPEM=function(b){var a=pemtohex(b,"CERTIFICATE REQUEST");var c=KEYUTIL.getKeyFromCSRHex(a);return c};KEYUTIL.getKeyFromCSRHex=function(a){var c=KEYUTIL.parseCSRHex(a);var b=KEYUTIL.getKey(c.p8pubkeyhex,null,"pkcs8pub");return b};KEYUTIL.parseCSRHex=function(d){var i=ASN1HEX;var f=i.getChildIdx;var c=i.getTLV;var b={};var g=d;if(g.substr(0,2)!="30"){throw"malformed CSR(code:001)"}var e=f(g,0);if(e.length<1){throw"malformed CSR(code:002)"}if(g.substr(e[0],2)!="30"){throw"malformed CSR(code:003)"}var a=f(g,e[0]);if(a.length<3){throw"malformed CSR(code:004)"}b.p8pubkeyhex=c(g,a[2]);return b};KEYUTIL.getKeyID=function(f){var c=KEYUTIL;var e=ASN1HEX;if(typeof f==="string"&&f.indexOf("BEGIN ")!=-1){f=c.getKey(f)}var d=pemtohex(c.getPEM(f));var b=e.getIdxbyList(d,0,[1]);var a=e.getV(d,b).substring(2);return KJUR.crypto.Util.hashHex(a,"sha1")};KEYUTIL.getJWKFromKey=function(d){var b={};if(d instanceof RSAKey&&d.isPrivate){b.kty="RSA";b.n=hextob64u(d.n.toString(16));b.e=hextob64u(d.e.toString(16));b.d=hextob64u(d.d.toString(16));b.p=hextob64u(d.p.toString(16));b.q=hextob64u(d.q.toString(16));b.dp=hextob64u(d.dmp1.toString(16));b.dq=hextob64u(d.dmq1.toString(16));b.qi=hextob64u(d.coeff.toString(16));return b}else{if(d instanceof RSAKey&&d.isPublic){b.kty="RSA";b.n=hextob64u(d.n.toString(16));b.e=hextob64u(d.e.toString(16));return b}else{if(d instanceof KJUR.crypto.ECDSA&&d.isPrivate){var a=d.getShortNISTPCurveName();if(a!=="P-256"&&a!=="P-384"){throw"unsupported curve name for JWT: "+a}var c=d.getPublicKeyXYHex();b.kty="EC";b.crv=a;b.x=hextob64u(c.x);b.y=hextob64u(c.y);b.d=hextob64u(d.prvKeyHex);return b}else{if(d instanceof KJUR.crypto.ECDSA&&d.isPublic){var a=d.getShortNISTPCurveName();if(a!=="P-256"&&a!=="P-384"){throw"unsupported curve name for JWT: "+a}var c=d.getPublicKeyXYHex();b.kty="EC";b.crv=a;b.x=hextob64u(c.x);b.y=hextob64u(c.y);return b}}}}throw"not supported key object"}; RSAKey.getPosArrayOfChildrenFromHex=function(a){return ASN1HEX.getChildIdx(a,0)};RSAKey.getHexValueArrayOfChildrenFromHex=function(f){var n=ASN1HEX;var i=n.getV;var k=RSAKey.getPosArrayOfChildrenFromHex(f);var e=i(f,k[0]);var j=i(f,k[1]);var b=i(f,k[2]);var c=i(f,k[3]);var h=i(f,k[4]);var g=i(f,k[5]);var m=i(f,k[6]);var l=i(f,k[7]);var d=i(f,k[8]);var k=new Array();k.push(e,j,b,c,h,g,m,l,d);return k};RSAKey.prototype.readPrivateKeyFromPEMString=function(d){var c=pemtohex(d);var b=RSAKey.getHexValueArrayOfChildrenFromHex(c);this.setPrivateEx(b[1],b[2],b[3],b[4],b[5],b[6],b[7],b[8])};RSAKey.prototype.readPKCS5PrvKeyHex=function(c){var b=RSAKey.getHexValueArrayOfChildrenFromHex(c);this.setPrivateEx(b[1],b[2],b[3],b[4],b[5],b[6],b[7],b[8])};RSAKey.prototype.readPKCS8PrvKeyHex=function(e){var c,i,k,b,a,f,d,j;var m=ASN1HEX;var l=m.getVbyListEx;if(m.isASN1HEX(e)===false){throw new Error("not ASN.1 hex string")}try{c=l(e,0,[2,0,1],"02");i=l(e,0,[2,0,2],"02");k=l(e,0,[2,0,3],"02");b=l(e,0,[2,0,4],"02");a=l(e,0,[2,0,5],"02");f=l(e,0,[2,0,6],"02");d=l(e,0,[2,0,7],"02");j=l(e,0,[2,0,8],"02")}catch(g){throw new Error("malformed PKCS#8 plain RSA private key")}this.setPrivateEx(c,i,k,b,a,f,d,j)};RSAKey.prototype.readPKCS5PubKeyHex=function(c){var e=ASN1HEX;var b=e.getV;if(e.isASN1HEX(c)===false){throw new Error("keyHex is not ASN.1 hex string")}var a=e.getChildIdx(c,0);if(a.length!==2||c.substr(a[0],2)!=="02"||c.substr(a[1],2)!=="02"){throw new Error("wrong hex for PKCS#5 public key")}var f=b(c,a[0]);var d=b(c,a[1]);this.setPublic(f,d)};RSAKey.prototype.readPKCS8PubKeyHex=function(b){var c=ASN1HEX;if(c.isASN1HEX(b)===false){throw new Error("not ASN.1 hex string")}if(c.getTLVbyListEx(b,0,[0,0])!=="06092a864886f70d010101"){throw new Error("not PKCS8 RSA public key")}var a=c.getTLVbyListEx(b,0,[1,0]);this.readPKCS5PubKeyHex(a)};RSAKey.prototype.readCertPubKeyHex=function(b,d){var a,c;a=new X509();a.readCertHex(b);c=a.getPublicKeyHex();this.readPKCS8PubKeyHex(c)}; var _RE_HEXDECONLY=new RegExp("[^0-9a-f]","gi");function _rsasign_getHexPaddedDigestInfoForString(d,e,a){var b=function(f){return KJUR.crypto.Util.hashString(f,a)};var c=b(d);return KJUR.crypto.Util.getPaddedDigestInfoHex(c,a,e)}function _zeroPaddingOfSignature(e,d){var c="";var a=d/4-e.length;for(var b=0;b>24,(d&16711680)>>16,(d&65280)>>8,d&255]))));d+=1}return b}RSAKey.prototype.signPSS=function(e,a,d){var c=function(f){return KJUR.crypto.Util.hashHex(f,a)};var b=c(rstrtohex(e));if(d===undefined){d=-1}return this.signWithMessageHashPSS(b,a,d)};RSAKey.prototype.signWithMessageHashPSS=function(l,a,k){var b=hextorstr(l);var g=b.length;var m=this.n.bitLength()-1;var c=Math.ceil(m/8);var d;var o=function(i){return KJUR.crypto.Util.hashHex(i,a)};if(k===-1||k===undefined){k=g}else{if(k===-2){k=c-g-2}else{if(k<-2){throw new Error("invalid salt length")}}}if(c<(g+k+2)){throw new Error("data too long")}var f="";if(k>0){f=new Array(k);new SecureRandom().nextBytes(f);f=String.fromCharCode.apply(String,f)}var n=hextorstr(o(rstrtohex("\x00\x00\x00\x00\x00\x00\x00\x00"+b+f)));var j=[];for(d=0;d>(8*c-m))&255;q[0]&=~p;for(d=0;dthis.n.bitLength()){return 0}var i=this.doPublic(b);var e=i.toString(16).replace(/^1f+00/,"");var g=_rsasign_getAlgNameAndHashFromHexDisgestInfo(e);if(g.length==0){return false}var d=g[0];var h=g[1];var a=function(k){return KJUR.crypto.Util.hashString(k,d)};var c=a(f);return(h==c)};RSAKey.prototype.verifyWithMessageHash=function(e,a){if(a.length!=Math.ceil(this.n.bitLength()/4)){return false}var b=parseBigInt(a,16);if(b.bitLength()>this.n.bitLength()){return 0}var h=this.doPublic(b);var g=h.toString(16).replace(/^1f+00/,"");var c=_rsasign_getAlgNameAndHashFromHexDisgestInfo(g);if(c.length==0){return false}var d=c[0];var f=c[1];return(f==e)};RSAKey.prototype.verifyPSS=function(c,b,a,f){var e=function(g){return KJUR.crypto.Util.hashHex(g,a)};var d=e(rstrtohex(c));if(f===undefined){f=-1}return this.verifyWithMessageHashPSS(d,b,a,f)};RSAKey.prototype.verifyWithMessageHashPSS=function(f,s,l,c){if(s.length!=Math.ceil(this.n.bitLength()/4)){return false}var k=new BigInteger(s,16);var r=function(i){return KJUR.crypto.Util.hashHex(i,l)};var j=hextorstr(f);var h=j.length;var g=this.n.bitLength()-1;var m=Math.ceil(g/8);var q;if(c===-1||c===undefined){c=h}else{if(c===-2){c=m-h-2}else{if(c<-2){throw new Error("invalid salt length")}}}if(m<(h+c+2)){throw new Error("data too long")}var a=this.doPublic(k).toByteArray();for(q=0;q>(8*m-g))&255;if((d.charCodeAt(0)&p)!==0){throw new Error("bits beyond keysize not zero")}var n=pss_mgf1_str(e,d.length,r);var o=[];for(q=0;q1){var z=b(v,u[1]);var t=this.getGeneralName(z);if(t.uri!=undefined){s.uri=t.uri}}if(u.length>2){var w=b(v,u[2]);if(w=="0101ff"){s.reqauth=true}if(w=="010100"){s.reqauth=false}}return s};this.getX500NameRule=function(s){var z=true;var D=true;var C=false;var t="";var w="";var F=null;var A=[];for(var v=0;v0){s.ext=this.getExtParamArray()}s.sighex=this.getSignatureValueHex();return s};this.getExtParamArray=function(t){if(t==undefined){var v=e(this.hex,0,[0,"[3]"]);if(v!=-1){t=l(this.hex,0,[0,"[3]",0],"30")}}var s=[];var u=n(t,0);for(var w=0;w1){var A=b(w,v[1]);var u=this.getGeneralName(A);if(u.uri!=undefined){t.uri=u.uri}}if(v.length>2){var x=b(w,v[2]);if(x=="0101ff"){t.reqauth=true}if(x=="010100"){t.reqauth=false}}return t};this.getX500NameRule=function(t){var A=true;var E=true;var D=false;var u="";var x="";var G=null;var B=[];for(var w=0;w0){t.ext=this.getExtParamArray()}t.sighex=this.getSignatureValueHex();return t};this.getExtParamArray=function(u){if(u==undefined){var w=e(this.hex,0,[0,"[3]"]);if(w!=-1){u=l(this.hex,0,[0,"[3]",0],"30")}}var t=[];var v=n(u,0);for(var x=0;x0){var b=":"+n.join(":")+":";if(b.indexOf(":"+k+":")==-1){throw"algorithm '"+k+"' not accepted in the list"}}if(k!="none"&&B===null){throw"key shall be specified to verify."}if(typeof B=="string"&&B.indexOf("-----BEGIN ")!=-1){B=KEYUTIL.getKey(B)}if(z=="RS"||z=="PS"){if(!(B instanceof m)){throw"key shall be a RSAKey obj for RS* and PS* algs"}}if(z=="ES"){if(!(B instanceof p)){throw"key shall be a ECDSA obj for ES* algs"}}if(k=="none"){}var u=null;if(t.jwsalg2sigalg[l.alg]===undefined){throw"unsupported alg name: "+k}else{u=t.jwsalg2sigalg[k]}if(u=="none"){throw"not supported"}else{if(u.substr(0,4)=="Hmac"){var o=null;if(B===undefined){throw"hexadecimal key shall be specified for HMAC"}var j=new s({alg:u,pass:B});j.updateString(c);o=j.doFinal();return A==o}else{if(u.indexOf("withECDSA")!=-1){var h=null;try{h=p.concatSigToASN1Sig(A)}catch(v){return false}var g=new d({alg:u});g.init(B);g.updateString(c);return g.verify(h)}else{var g=new d({alg:u});g.init(B);g.updateString(c);return g.verify(A)}}}};KJUR.jws.JWS.parse=function(g){var c=g.split(".");var b={};var f,e,d;if(c.length!=2&&c.length!=3){throw"malformed sJWS: wrong number of '.' splitted elements"}f=c[0];e=c[1];if(c.length==3){d=c[2]}b.headerObj=KJUR.jws.JWS.readSafeJSONString(b64utoutf8(f));b.payloadObj=KJUR.jws.JWS.readSafeJSONString(b64utoutf8(e));b.headerPP=JSON.stringify(b.headerObj,null," ");if(b.payloadObj==null){b.payloadPP=b64utoutf8(e)}else{b.payloadPP=JSON.stringify(b.payloadObj,null," ")}if(d!==undefined){b.sigHex=b64utohex(d)}return b};KJUR.jws.JWS.verifyJWT=function(e,l,r){var d=KJUR,j=d.jws,o=j.JWS,n=o.readSafeJSONString,p=o.inArray,f=o.includedArray;var k=e.split(".");var c=k[0];var i=k[1];var q=c+"."+i;var m=b64utohex(k[2]);var h=n(b64utoutf8(c));var g=n(b64utoutf8(i));if(h.alg===undefined){return false}if(r.alg===undefined){throw"acceptField.alg shall be specified"}if(!p(h.alg,r.alg)){return false}if(g.iss!==undefined&&typeof r.iss==="object"){if(!p(g.iss,r.iss)){return false}}if(g.sub!==undefined&&typeof r.sub==="object"){if(!p(g.sub,r.sub)){return false}}if(g.aud!==undefined&&typeof r.aud==="object"){if(typeof g.aud=="string"){if(!p(g.aud,r.aud)){return false}}else{if(typeof g.aud=="object"){if(!f(g.aud,r.aud)){return false}}}}var b=j.IntDate.getNow();if(r.verifyAt!==undefined&&typeof r.verifyAt==="number"){b=r.verifyAt}if(r.gracePeriod===undefined||typeof r.gracePeriod!=="number"){r.gracePeriod=0}if(g.exp!==undefined&&typeof g.exp=="number"){if(g.exp+r.gracePeriodl){this.aHeader.pop()}if(this.aSignature.length>l){this.aSignature.pop()}throw"addSignature failed: "+i}};this.verifyAll=function(h){if(this.aHeader.length!==h.length||this.aSignature.length!==h.length){return false}for(var g=0;g0){this.aHeader=g.headers}else{throw"malformed header"}if(typeof g.payload==="string"){this.sPayload=g.payload}else{throw"malformed signatures"}if(g.signatures.length>0){this.aSignature=g.signatures}else{throw"malformed signatures"}}catch(e){throw"malformed JWS-JS JSON object: "+e}}};this.getJSON=function(){return{headers:this.aHeader,payload:this.sPayload,signatures:this.aSignature}};this.isEmpty=function(){if(this.aHeader.length==0){return 1}return 0}}; diff --git a/jsrsasign-jwths-min.js b/jsrsasign-jwths-min.js index b4fd02eb..123b54a1 100644 --- a/jsrsasign-jwths-min.js +++ b/jsrsasign-jwths-min.js @@ -1,5 +1,5 @@ /* - * jsrsasign(jwths) 10.1.10 (2021-02-14) (c) 2010-2021 Kenji Urushima | kjur.github.com/jsrsasign/license + * jsrsasign(jwths) 10.1.11 (2021-02-19) (c) 2010-2021 Kenji Urushima | kjur.github.com/jsrsasign/license */ /*! diff --git a/jsrsasign-rsa-min.js b/jsrsasign-rsa-min.js index 8141b837..adddbdfa 100644 --- a/jsrsasign-rsa-min.js +++ b/jsrsasign-rsa-min.js @@ -1,5 +1,5 @@ /* - * jsrsasign(rsa) 10.1.10 (2021-02-14) (c) 2010-2021 Kenji Urushima | kjur.github.com/jsrsasign/license + * jsrsasign(rsa) 10.1.11 (2021-02-19) (c) 2010-2021 Kenji Urushima | kjur.github.com/jsrsasign/license */ /*! diff --git a/min/x509-1.1.min.js b/min/x509-1.1.min.js index 0836266c..18fc3f23 100644 --- a/min/x509-1.1.min.js +++ b/min/x509-1.1.min.js @@ -1 +1 @@ -function X509(q){var j=ASN1HEX,n=j.getChildIdx,g=j.getV,b=j.getTLV,c=j.getVbyList,k=j.getVbyListEx,a=j.getTLVbyList,l=j.getTLVbyListEx,h=j.getIdxbyList,e=j.getIdxbyListEx,i=j.getVidx,p=j.oidname,m=j.hextooidstr,d=X509,r=pemtohex,f;try{f=KJUR.asn1.x509.AlgorithmIdentifier.PSSNAME2ASN1TLV}catch(o){}this.HEX2STAG={"0c":"utf8","13":"prn","16":"ia5","1a":"vis","1e":"bmp"};this.hex=null;this.version=0;this.foffset=0;this.aExtInfo=null;this.getVersion=function(){if(this.hex===null||this.version!==0){return this.version}if(a(this.hex,0,[0,0])!=="a003020102"){this.version=1;this.foffset=-1;return 1}this.version=3;return 3};this.getSerialNumberHex=function(){return k(this.hex,0,[0,0],"02")};this.getSignatureAlgorithmField=function(){var s=l(this.hex,0,[0,1]);return this.getAlgorithmIdentifierName(s)};this.getAlgorithmIdentifierName=function(s){for(var t in f){if(s===f[t]){return t}}return p(k(s,0,[0],"06"))};this.getIssuer=function(){return this.getX500Name(this.getIssuerHex())};this.getIssuerHex=function(){return a(this.hex,0,[0,3+this.foffset],"30")};this.getIssuerString=function(){return d.hex2dn(this.getIssuerHex())};this.getSubject=function(){return this.getX500Name(this.getSubjectHex())};this.getSubjectHex=function(){return a(this.hex,0,[0,5+this.foffset],"30")};this.getSubjectString=function(){return d.hex2dn(this.getSubjectHex())};this.getNotBefore=function(){var t=c(this.hex,0,[0,4+this.foffset,0]);t=t.replace(/(..)/g,"%$1");t=decodeURIComponent(t);return t};this.getNotAfter=function(){var t=c(this.hex,0,[0,4+this.foffset,1]);t=t.replace(/(..)/g,"%$1");t=decodeURIComponent(t);return t};this.getPublicKeyHex=function(){return j.getTLVbyList(this.hex,0,[0,6+this.foffset],"30")};this.getPublicKeyIdx=function(){return h(this.hex,0,[0,6+this.foffset],"30")};this.getPublicKeyContentIdx=function(){var s=this.getPublicKeyIdx();return h(this.hex,s,[1,0],"30")};this.getPublicKey=function(){return KEYUTIL.getKey(this.getPublicKeyHex(),null,"pkcs8pub")};this.getSignatureAlgorithmName=function(){var s=a(this.hex,0,[1],"30");return this.getAlgorithmIdentifierName(s)};this.getSignatureValueHex=function(){return c(this.hex,0,[2],"03",true)};this.verifySignature=function(u){var v=this.getSignatureAlgorithmField();var s=this.getSignatureValueHex();var t=a(this.hex,0,[0],"30");var w=new KJUR.crypto.Signature({alg:v});w.init(u);w.updateHex(t);return w.verify(s)};this.parseExt=function(B){var u,s,w;if(B===undefined){w=this.hex;if(this.version!==3){return -1}u=h(w,0,[0,7,0],"30");s=n(w,u)}else{w=pemtohex(B);var x=h(w,0,[0,3,0,0],"06");if(g(w,x)!="2a864886f70d01090e"){this.aExtInfo=new Array();return}u=h(w,0,[0,3,0,1,0],"30");s=n(w,u);this.hex=w}this.aExtInfo=new Array();for(var v=0;v1){var z=b(v,u[1]);var t=this.getGeneralName(z);if(t.uri!=undefined){s.uri=t.uri}}if(u.length>2){var w=b(v,u[2]);if(w=="0101ff"){s.reqauth=true}if(w=="010100"){s.reqauth=false}}return s};this.getX500NameRule=function(s){var z=true;var D=true;var C=false;var t="";var w="";var F=null;var A=[];for(var v=0;v0){s.ext=this.getExtParamArray()}s.sighex=this.getSignatureValueHex();return s};this.getExtParamArray=function(t){if(t==undefined){var v=e(this.hex,0,[0,"[3]"]);if(v!=-1){t=l(this.hex,0,[0,"[3]",0],"30")}}var s=[];var u=n(t,0);for(var w=0;w1){var A=b(w,v[1]);var u=this.getGeneralName(A);if(u.uri!=undefined){t.uri=u.uri}}if(v.length>2){var x=b(w,v[2]);if(x=="0101ff"){t.reqauth=true}if(x=="010100"){t.reqauth=false}}return t};this.getX500NameRule=function(t){var A=true;var E=true;var D=false;var u="";var x="";var G=null;var B=[];for(var w=0;w0){t.ext=this.getExtParamArray()}t.sighex=this.getSignatureValueHex();return t};this.getExtParamArray=function(u){if(u==undefined){var w=e(this.hex,0,[0,"[3]"]);if(w!=-1){u=l(this.hex,0,[0,"[3]",0],"30")}}var t=[];var v=n(u,0);for(var x=0;x=u*2){break}}var z={};z.keyhex=x.substr(0,i[q]["keylen"]*2);z.ivhex=x.substr(i[q]["keylen"]*2,i[q]["ivlen"]*2);return z};var b=function(p,v,r,w){var s=CryptoJS.enc.Base64.parse(p);var q=CryptoJS.enc.Hex.stringify(s);var u=i[v]["proc"];var t=u(q,r,w);return t};var h=function(p,s,q,u){var r=i[s]["eproc"];var t=r(p,q,u);return t};return{version:"1.0.0",parsePKCS5PEM:function(p){return n(p)},getKeyAndUnusedIvByPasscodeAndIvsalt:function(q,p,r){return j(q,p,r)},decryptKeyB64:function(p,r,q,s){return b(p,r,q,s)},getDecryptedKeyHex:function(y,x){var q=n(y);var t=q.type;var r=q.cipher;var p=q.ivsalt;var s=q.data;var w=j(r,x,p);var v=w.keyhex;var u=b(s,r,v,p);return u},getEncryptedPKCS5PEMFromPrvKeyHex:function(x,s,A,t,r){var p="";if(typeof t=="undefined"||t==null){t="AES-256-CBC"}if(typeof i[t]=="undefined"){throw"KEYUTIL unsupported algorithm: "+t}if(typeof r=="undefined"||r==null){var v=i[t]["ivlen"];var u=m(v);r=u.toUpperCase()}var z=j(t,A,r);var y=z.keyhex;var w=h(s,t,y,r);var q=w.replace(/(.{64})/g,"$1\r\n");var p="-----BEGIN "+x+" PRIVATE KEY-----\r\n";p+="Proc-Type: 4,ENCRYPTED\r\n";p+="DEK-Info: "+t+","+r+"\r\n";p+="\r\n";p+=q;p+="\r\n-----END "+x+" PRIVATE KEY-----\r\n";return p},parseHexOfEncryptedPKCS8:function(y){var B=ASN1HEX;var z=B.getChildIdx;var w=B.getV;var t={};var r=z(y,0);if(r.length!=2){throw"malformed format: SEQUENCE(0).items != 2: "+r.length}t.ciphertext=w(y,r[1]);var A=z(y,r[0]);if(A.length!=2){throw"malformed format: SEQUENCE(0.0).items != 2: "+A.length}if(w(y,A[0])!="2a864886f70d01050d"){throw"this only supports pkcs5PBES2"}var p=z(y,A[1]);if(A.length!=2){throw"malformed format: SEQUENCE(0.0.1).items != 2: "+p.length}var q=z(y,p[1]);if(q.length!=2){throw"malformed format: SEQUENCE(0.0.1.1).items != 2: "+q.length}if(w(y,q[0])!="2a864886f70d0307"){throw"this only supports TripleDES"}t.encryptionSchemeAlg="TripleDES";t.encryptionSchemeIV=w(y,q[1]);var s=z(y,p[0]);if(s.length!=2){throw"malformed format: SEQUENCE(0.0.1.0).items != 2: "+s.length}if(w(y,s[0])!="2a864886f70d01050c"){throw"this only supports pkcs5PBKDF2"}var x=z(y,s[1]);if(x.length<2){throw"malformed format: SEQUENCE(0.0.1.0.1).items < 2: "+x.length}t.pbkdf2Salt=w(y,x[0]);var u=w(y,x[1]);try{t.pbkdf2Iter=parseInt(u,16)}catch(v){throw"malformed format pbkdf2Iter: "+u}return t},getPBKDF2KeyHexFromParam:function(u,p){var t=CryptoJS.enc.Hex.parse(u.pbkdf2Salt);var q=u.pbkdf2Iter;var s=CryptoJS.PBKDF2(p,t,{keySize:192/32,iterations:q});var r=CryptoJS.enc.Hex.stringify(s);return r},_getPlainPKCS8HexFromEncryptedPKCS8PEM:function(x,y){var r=pemtohex(x,"ENCRYPTED PRIVATE KEY");var p=this.parseHexOfEncryptedPKCS8(r);var u=KEYUTIL.getPBKDF2KeyHexFromParam(p,y);var v={};v.ciphertext=CryptoJS.enc.Hex.parse(p.ciphertext);var t=CryptoJS.enc.Hex.parse(u);var s=CryptoJS.enc.Hex.parse(p.encryptionSchemeIV);var w=CryptoJS.TripleDES.decrypt(v,t,{iv:s});var q=CryptoJS.enc.Hex.stringify(w);return q},getKeyFromEncryptedPKCS8PEM:function(s,q){var p=this._getPlainPKCS8HexFromEncryptedPKCS8PEM(s,q);var r=this.getKeyFromPlainPrivatePKCS8Hex(p);return r},parsePlainPrivatePKCS8Hex:function(s){var v=ASN1HEX;var u=v.getChildIdx;var t=v.getV;var q={};q.algparam=null;if(s.substr(0,2)!="30"){throw new Error("malformed plain PKCS8 private key(code:001)")}var r=u(s,0);if(r.length<3){throw new Error("malformed plain PKCS8 private key(code:002)")}if(s.substr(r[1],2)!="30"){throw new Error("malformed PKCS8 private key(code:003)")}var p=u(s,r[1]);if(p.length!=2){throw new Error("malformed PKCS8 private key(code:004)")}if(s.substr(p[0],2)!="06"){throw new Error("malformed PKCS8 private key(code:005)")}q.algoid=t(s,p[0]);if(s.substr(p[1],2)=="06"){q.algparam=t(s,p[1])}if(s.substr(r[2],2)!="04"){throw new Error("malformed PKCS8 private key(code:006)")}q.keyidx=v.getVidx(s,r[2]);return q},getKeyFromPlainPrivatePKCS8PEM:function(q){var p=pemtohex(q,"PRIVATE KEY");var r=this.getKeyFromPlainPrivatePKCS8Hex(p);return r},getKeyFromPlainPrivatePKCS8Hex:function(p){var q=this.parsePlainPrivatePKCS8Hex(p);var r;if(q.algoid=="2a864886f70d010101"){r=new RSAKey()}else{if(q.algoid=="2a8648ce380401"){r=new KJUR.crypto.DSA()}else{if(q.algoid=="2a8648ce3d0201"){r=new KJUR.crypto.ECDSA()}else{throw"unsupported private key algorithm"}}}r.readPKCS8PrvKeyHex(p);return r},_getKeyFromPublicPKCS8Hex:function(q){var p;var r=ASN1HEX.getVbyList(q,0,[0,0],"06");if(r==="2a864886f70d010101"){p=new RSAKey()}else{if(r==="2a8648ce380401"){p=new KJUR.crypto.DSA()}else{if(r==="2a8648ce3d0201"){p=new KJUR.crypto.ECDSA()}else{throw"unsupported PKCS#8 public key hex"}}}p.readPKCS8PubKeyHex(q);return p},parsePublicRawRSAKeyHex:function(r){var u=ASN1HEX;var t=u.getChildIdx;var s=u.getV;var p={};if(r.substr(0,2)!="30"){throw"malformed RSA key(code:001)"}var q=t(r,0);if(q.length!=2){throw"malformed RSA key(code:002)"}if(r.substr(q[0],2)!="02"){throw"malformed RSA key(code:003)"}p.n=s(r,q[0]);if(r.substr(q[1],2)!="02"){throw"malformed RSA key(code:004)"}p.e=s(r,q[1]);return p},parsePublicPKCS8Hex:function(t){var v=ASN1HEX;var u=v.getChildIdx;var s=v.getV;var q={};q.algparam=null;var r=u(t,0);if(r.length!=2){throw"outer DERSequence shall have 2 elements: "+r.length}var w=r[0];if(t.substr(w,2)!="30"){throw"malformed PKCS8 public key(code:001)"}var p=u(t,w);if(p.length!=2){throw"malformed PKCS8 public key(code:002)"}if(t.substr(p[0],2)!="06"){throw"malformed PKCS8 public key(code:003)"}q.algoid=s(t,p[0]);if(t.substr(p[1],2)=="06"){q.algparam=s(t,p[1])}else{if(t.substr(p[1],2)=="30"){q.algparam={};q.algparam.p=v.getVbyList(t,p[1],[0],"02");q.algparam.q=v.getVbyList(t,p[1],[1],"02");q.algparam.g=v.getVbyList(t,p[1],[2],"02")}}if(t.substr(r[1],2)!="03"){throw"malformed PKCS8 public key(code:004)"}q.key=s(t,r[1]).substr(2);return q},}}();KEYUTIL.getKey=function(l,k,n){var G=ASN1HEX,L=G.getChildIdx,v=G.getV,d=G.getVbyList,c=KJUR.crypto,i=c.ECDSA,C=c.DSA,w=RSAKey,M=pemtohex,F=KEYUTIL;if(typeof w!="undefined"&&l instanceof w){return l}if(typeof i!="undefined"&&l instanceof i){return l}if(typeof C!="undefined"&&l instanceof C){return l}if(l.curve!==undefined&&l.xy!==undefined&&l.d===undefined){return new i({pub:l.xy,curve:l.curve})}if(l.curve!==undefined&&l.d!==undefined){return new i({prv:l.d,curve:l.curve})}if(l.kty===undefined&&l.n!==undefined&&l.e!==undefined&&l.d===undefined){var P=new w();P.setPublic(l.n,l.e);return P}if(l.kty===undefined&&l.n!==undefined&&l.e!==undefined&&l.d!==undefined&&l.p!==undefined&&l.q!==undefined&&l.dp!==undefined&&l.dq!==undefined&&l.co!==undefined&&l.qi===undefined){var P=new w();P.setPrivateEx(l.n,l.e,l.d,l.p,l.q,l.dp,l.dq,l.co);return P}if(l.kty===undefined&&l.n!==undefined&&l.e!==undefined&&l.d!==undefined&&l.p===undefined){var P=new w();P.setPrivate(l.n,l.e,l.d);return P}if(l.p!==undefined&&l.q!==undefined&&l.g!==undefined&&l.y!==undefined&&l.x===undefined){var P=new C();P.setPublic(l.p,l.q,l.g,l.y);return P}if(l.p!==undefined&&l.q!==undefined&&l.g!==undefined&&l.y!==undefined&&l.x!==undefined){var P=new C();P.setPrivate(l.p,l.q,l.g,l.y,l.x);return P}if(l.kty==="RSA"&&l.n!==undefined&&l.e!==undefined&&l.d===undefined){var P=new w();P.setPublic(b64utohex(l.n),b64utohex(l.e));return P}if(l.kty==="RSA"&&l.n!==undefined&&l.e!==undefined&&l.d!==undefined&&l.p!==undefined&&l.q!==undefined&&l.dp!==undefined&&l.dq!==undefined&&l.qi!==undefined){var P=new w();P.setPrivateEx(b64utohex(l.n),b64utohex(l.e),b64utohex(l.d),b64utohex(l.p),b64utohex(l.q),b64utohex(l.dp),b64utohex(l.dq),b64utohex(l.qi));return P}if(l.kty==="RSA"&&l.n!==undefined&&l.e!==undefined&&l.d!==undefined){var P=new w();P.setPrivate(b64utohex(l.n),b64utohex(l.e),b64utohex(l.d));return P}if(l.kty==="EC"&&l.crv!==undefined&&l.x!==undefined&&l.y!==undefined&&l.d===undefined){var j=new i({curve:l.crv});var t=j.ecparams.keylen/4;var B=("0000000000"+b64utohex(l.x)).slice(-t);var z=("0000000000"+b64utohex(l.y)).slice(-t);var u="04"+B+z;j.setPublicKeyHex(u);return j}if(l.kty==="EC"&&l.crv!==undefined&&l.x!==undefined&&l.y!==undefined&&l.d!==undefined){var j=new i({curve:l.crv});var t=j.ecparams.keylen/4;var B=("0000000000"+b64utohex(l.x)).slice(-t);var z=("0000000000"+b64utohex(l.y)).slice(-t);var u="04"+B+z;var b=("0000000000"+b64utohex(l.d)).slice(-t);j.setPublicKeyHex(u);j.setPrivateKeyHex(b);return j}if(n==="pkcs5prv"){var J=l,G=ASN1HEX,N,P;N=L(J,0);if(N.length===9){P=new w();P.readPKCS5PrvKeyHex(J)}else{if(N.length===6){P=new C();P.readPKCS5PrvKeyHex(J)}else{if(N.length>2&&J.substr(N[1],2)==="04"){P=new i();P.readPKCS5PrvKeyHex(J)}else{throw"unsupported PKCS#1/5 hexadecimal key"}}}return P}if(n==="pkcs8prv"){var P=F.getKeyFromPlainPrivatePKCS8Hex(l);return P}if(n==="pkcs8pub"){return F._getKeyFromPublicPKCS8Hex(l)}if(n==="x509pub"){return X509.getPublicKeyFromCertHex(l)}if(l.indexOf("-END CERTIFICATE-",0)!=-1||l.indexOf("-END X509 CERTIFICATE-",0)!=-1||l.indexOf("-END TRUSTED CERTIFICATE-",0)!=-1){return X509.getPublicKeyFromCertPEM(l)}if(l.indexOf("-END PUBLIC KEY-")!=-1){var O=pemtohex(l,"PUBLIC KEY");return F._getKeyFromPublicPKCS8Hex(O)}if(l.indexOf("-END RSA PRIVATE KEY-")!=-1&&l.indexOf("4,ENCRYPTED")==-1){var m=M(l,"RSA PRIVATE KEY");return F.getKey(m,null,"pkcs5prv")}if(l.indexOf("-END DSA PRIVATE KEY-")!=-1&&l.indexOf("4,ENCRYPTED")==-1){var I=M(l,"DSA PRIVATE KEY");var E=d(I,0,[1],"02");var D=d(I,0,[2],"02");var K=d(I,0,[3],"02");var r=d(I,0,[4],"02");var s=d(I,0,[5],"02");var P=new C();P.setPrivate(new BigInteger(E,16),new BigInteger(D,16),new BigInteger(K,16),new BigInteger(r,16),new BigInteger(s,16));return P}if(l.indexOf("-END EC PRIVATE KEY-")!=-1&&l.indexOf("4,ENCRYPTED")==-1){var m=M(l,"EC PRIVATE KEY");return F.getKey(m,null,"pkcs5prv")}if(l.indexOf("-END PRIVATE KEY-")!=-1){return F.getKeyFromPlainPrivatePKCS8PEM(l)}if(l.indexOf("-END RSA PRIVATE KEY-")!=-1&&l.indexOf("4,ENCRYPTED")!=-1){var o=F.getDecryptedKeyHex(l,k);var H=new RSAKey();H.readPKCS5PrvKeyHex(o);return H}if(l.indexOf("-END EC PRIVATE KEY-")!=-1&&l.indexOf("4,ENCRYPTED")!=-1){var I=F.getDecryptedKeyHex(l,k);var P=d(I,0,[1],"04");var f=d(I,0,[2,0],"06");var A=d(I,0,[3,0],"03").substr(2);var e="";if(KJUR.crypto.OID.oidhex2name[f]!==undefined){e=KJUR.crypto.OID.oidhex2name[f]}else{throw"undefined OID(hex) in KJUR.crypto.OID: "+f}var j=new i({curve:e});j.setPublicKeyHex(A);j.setPrivateKeyHex(P);j.isPublic=false;return j}if(l.indexOf("-END DSA PRIVATE KEY-")!=-1&&l.indexOf("4,ENCRYPTED")!=-1){var I=F.getDecryptedKeyHex(l,k);var E=d(I,0,[1],"02");var D=d(I,0,[2],"02");var K=d(I,0,[3],"02");var r=d(I,0,[4],"02");var s=d(I,0,[5],"02");var P=new C();P.setPrivate(new BigInteger(E,16),new BigInteger(D,16),new BigInteger(K,16),new BigInteger(r,16),new BigInteger(s,16));return P}if(l.indexOf("-END ENCRYPTED PRIVATE KEY-")!=-1){return F.getKeyFromEncryptedPKCS8PEM(l,k)}throw new Error("not supported argument")};KEYUTIL.generateKeypair=function(a,c){if(a=="RSA"){var b=c;var h=new RSAKey();h.generate(b,"10001");h.isPrivate=true;h.isPublic=true;var f=new RSAKey();var e=h.n.toString(16);var i=h.e.toString(16);f.setPublic(e,i);f.isPrivate=false;f.isPublic=true;var k={};k.prvKeyObj=h;k.pubKeyObj=f;return k}else{if(a=="EC"){var d=c;var g=new KJUR.crypto.ECDSA({curve:d});var j=g.generateKeyPairHex();var h=new KJUR.crypto.ECDSA({curve:d});h.setPublicKeyHex(j.ecpubhex);h.setPrivateKeyHex(j.ecprvhex);h.isPrivate=true;h.isPublic=false;var f=new KJUR.crypto.ECDSA({curve:d});f.setPublicKeyHex(j.ecpubhex);f.isPrivate=false;f.isPublic=true;var k={};k.prvKeyObj=h;k.pubKeyObj=f;return k}else{throw"unknown algorithm: "+a}}};KEYUTIL.getPEM=function(b,D,y,m,q,j){var F=KJUR,k=F.asn1,z=k.DERObjectIdentifier,f=k.DERInteger,l=k.ASN1Util.newObject,a=k.x509,C=a.SubjectPublicKeyInfo,e=F.crypto,u=e.DSA,r=e.ECDSA,n=RSAKey;function A(s){var G=l({seq:[{"int":0},{"int":{bigint:s.n}},{"int":s.e},{"int":{bigint:s.d}},{"int":{bigint:s.p}},{"int":{bigint:s.q}},{"int":{bigint:s.dmp1}},{"int":{bigint:s.dmq1}},{"int":{bigint:s.coeff}}]});return G}function B(G){var s=l({seq:[{"int":1},{octstr:{hex:G.prvKeyHex}},{tag:["a0",true,{oid:{name:G.curveName}}]},{tag:["a1",true,{bitstr:{hex:"00"+G.pubKeyHex}}]}]});return s}function x(s){var G=l({seq:[{"int":0},{"int":{bigint:s.p}},{"int":{bigint:s.q}},{"int":{bigint:s.g}},{"int":{bigint:s.y}},{"int":{bigint:s.x}}]});return G}if(((n!==undefined&&b instanceof n)||(u!==undefined&&b instanceof u)||(r!==undefined&&b instanceof r))&&b.isPublic==true&&(D===undefined||D=="PKCS8PUB")){var E=new C(b);var w=E.getEncodedHex();return hextopem(w,"PUBLIC KEY")}if(D=="PKCS1PRV"&&n!==undefined&&b instanceof n&&(y===undefined||y==null)&&b.isPrivate==true){var E=A(b);var w=E.getEncodedHex();return hextopem(w,"RSA PRIVATE KEY")}if(D=="PKCS1PRV"&&r!==undefined&&b instanceof r&&(y===undefined||y==null)&&b.isPrivate==true){var i=new z({name:b.curveName});var v=i.getEncodedHex();var h=B(b);var t=h.getEncodedHex();var p="";p+=hextopem(v,"EC PARAMETERS");p+=hextopem(t,"EC PRIVATE KEY");return p}if(D=="PKCS1PRV"&&u!==undefined&&b instanceof u&&(y===undefined||y==null)&&b.isPrivate==true){var E=x(b);var w=E.getEncodedHex();return hextopem(w,"DSA PRIVATE KEY")}if(D=="PKCS5PRV"&&n!==undefined&&b instanceof n&&(y!==undefined&&y!=null)&&b.isPrivate==true){var E=A(b);var w=E.getEncodedHex();if(m===undefined){m="DES-EDE3-CBC"}return this.getEncryptedPKCS5PEMFromPrvKeyHex("RSA",w,y,m,j)}if(D=="PKCS5PRV"&&r!==undefined&&b instanceof r&&(y!==undefined&&y!=null)&&b.isPrivate==true){var E=B(b);var w=E.getEncodedHex();if(m===undefined){m="DES-EDE3-CBC"}return this.getEncryptedPKCS5PEMFromPrvKeyHex("EC",w,y,m,j)}if(D=="PKCS5PRV"&&u!==undefined&&b instanceof u&&(y!==undefined&&y!=null)&&b.isPrivate==true){var E=x(b);var w=E.getEncodedHex();if(m===undefined){m="DES-EDE3-CBC"}return this.getEncryptedPKCS5PEMFromPrvKeyHex("DSA",w,y,m,j)}var o=function(G,s){var I=c(G,s);var H=new l({seq:[{seq:[{oid:{name:"pkcs5PBES2"}},{seq:[{seq:[{oid:{name:"pkcs5PBKDF2"}},{seq:[{octstr:{hex:I.pbkdf2Salt}},{"int":I.pbkdf2Iter}]}]},{seq:[{oid:{name:"des-EDE3-CBC"}},{octstr:{hex:I.encryptionSchemeIV}}]}]}]},{octstr:{hex:I.ciphertext}}]});return H.getEncodedHex()};var c=function(N,O){var H=100;var M=CryptoJS.lib.WordArray.random(8);var L="DES-EDE3-CBC";var s=CryptoJS.lib.WordArray.random(8);var I=CryptoJS.PBKDF2(O,M,{keySize:192/32,iterations:H});var J=CryptoJS.enc.Hex.parse(N);var K=CryptoJS.TripleDES.encrypt(J,I,{iv:s})+"";var G={};G.ciphertext=K;G.pbkdf2Salt=CryptoJS.enc.Hex.stringify(M);G.pbkdf2Iter=H;G.encryptionSchemeAlg=L;G.encryptionSchemeIV=CryptoJS.enc.Hex.stringify(s);return G};if(D=="PKCS8PRV"&&n!=undefined&&b instanceof n&&b.isPrivate==true){var g=A(b);var d=g.getEncodedHex();var E=l({seq:[{"int":0},{seq:[{oid:{name:"rsaEncryption"}},{"null":true}]},{octstr:{hex:d}}]});var w=E.getEncodedHex();if(y===undefined||y==null){return hextopem(w,"PRIVATE KEY")}else{var t=o(w,y);return hextopem(t,"ENCRYPTED PRIVATE KEY")}}if(D=="PKCS8PRV"&&r!==undefined&&b instanceof r&&b.isPrivate==true){var g=new l({seq:[{"int":1},{octstr:{hex:b.prvKeyHex}},{tag:["a1",true,{bitstr:{hex:"00"+b.pubKeyHex}}]}]});var d=g.getEncodedHex();var E=l({seq:[{"int":0},{seq:[{oid:{name:"ecPublicKey"}},{oid:{name:b.curveName}}]},{octstr:{hex:d}}]});var w=E.getEncodedHex();if(y===undefined||y==null){return hextopem(w,"PRIVATE KEY")}else{var t=o(w,y);return hextopem(t,"ENCRYPTED PRIVATE KEY")}}if(D=="PKCS8PRV"&&u!==undefined&&b instanceof u&&b.isPrivate==true){var g=new f({bigint:b.x});var d=g.getEncodedHex();var E=l({seq:[{"int":0},{seq:[{oid:{name:"dsa"}},{seq:[{"int":{bigint:b.p}},{"int":{bigint:b.q}},{"int":{bigint:b.g}}]}]},{octstr:{hex:d}}]});var w=E.getEncodedHex();if(y===undefined||y==null){return hextopem(w,"PRIVATE KEY")}else{var t=o(w,y);return hextopem(t,"ENCRYPTED PRIVATE KEY")}}throw new Error("unsupported object nor format")};KEYUTIL.getKeyFromCSRPEM=function(b){var a=pemtohex(b,"CERTIFICATE REQUEST");var c=KEYUTIL.getKeyFromCSRHex(a);return c};KEYUTIL.getKeyFromCSRHex=function(a){var c=KEYUTIL.parseCSRHex(a);var b=KEYUTIL.getKey(c.p8pubkeyhex,null,"pkcs8pub");return b};KEYUTIL.parseCSRHex=function(d){var i=ASN1HEX;var f=i.getChildIdx;var c=i.getTLV;var b={};var g=d;if(g.substr(0,2)!="30"){throw"malformed CSR(code:001)"}var e=f(g,0);if(e.length<1){throw"malformed CSR(code:002)"}if(g.substr(e[0],2)!="30"){throw"malformed CSR(code:003)"}var a=f(g,e[0]);if(a.length<3){throw"malformed CSR(code:004)"}b.p8pubkeyhex=c(g,a[2]);return b};KEYUTIL.getKeyID=function(f){var c=KEYUTIL;var e=ASN1HEX;if(typeof f==="string"&&f.indexOf("BEGIN ")!=-1){f=c.getKey(f)}var d=pemtohex(c.getPEM(f));var b=e.getIdxbyList(d,0,[1]);var a=e.getV(d,b).substring(2);return KJUR.crypto.Util.hashHex(a,"sha1")};KEYUTIL.getJWKFromKey=function(d){var b={};if(d instanceof RSAKey&&d.isPrivate){b.kty="RSA";b.n=hextob64u(d.n.toString(16));b.e=hextob64u(d.e.toString(16));b.d=hextob64u(d.d.toString(16));b.p=hextob64u(d.p.toString(16));b.q=hextob64u(d.q.toString(16));b.dp=hextob64u(d.dmp1.toString(16));b.dq=hextob64u(d.dmq1.toString(16));b.qi=hextob64u(d.coeff.toString(16));return b}else{if(d instanceof RSAKey&&d.isPublic){b.kty="RSA";b.n=hextob64u(d.n.toString(16));b.e=hextob64u(d.e.toString(16));return b}else{if(d instanceof KJUR.crypto.ECDSA&&d.isPrivate){var a=d.getShortNISTPCurveName();if(a!=="P-256"&&a!=="P-384"){throw"unsupported curve name for JWT: "+a}var c=d.getPublicKeyXYHex();b.kty="EC";b.crv=a;b.x=hextob64u(c.x);b.y=hextob64u(c.y);b.d=hextob64u(d.prvKeyHex);return b}else{if(d instanceof KJUR.crypto.ECDSA&&d.isPublic){var a=d.getShortNISTPCurveName();if(a!=="P-256"&&a!=="P-384"){throw"unsupported curve name for JWT: "+a}var c=d.getPublicKeyXYHex();b.kty="EC";b.crv=a;b.x=hextob64u(c.x);b.y=hextob64u(c.y);return b}}}}throw"not supported key object"}; RSAKey.getPosArrayOfChildrenFromHex=function(a){return ASN1HEX.getChildIdx(a,0)};RSAKey.getHexValueArrayOfChildrenFromHex=function(f){var n=ASN1HEX;var i=n.getV;var k=RSAKey.getPosArrayOfChildrenFromHex(f);var e=i(f,k[0]);var j=i(f,k[1]);var b=i(f,k[2]);var c=i(f,k[3]);var h=i(f,k[4]);var g=i(f,k[5]);var m=i(f,k[6]);var l=i(f,k[7]);var d=i(f,k[8]);var k=new Array();k.push(e,j,b,c,h,g,m,l,d);return k};RSAKey.prototype.readPrivateKeyFromPEMString=function(d){var c=pemtohex(d);var b=RSAKey.getHexValueArrayOfChildrenFromHex(c);this.setPrivateEx(b[1],b[2],b[3],b[4],b[5],b[6],b[7],b[8])};RSAKey.prototype.readPKCS5PrvKeyHex=function(c){var b=RSAKey.getHexValueArrayOfChildrenFromHex(c);this.setPrivateEx(b[1],b[2],b[3],b[4],b[5],b[6],b[7],b[8])};RSAKey.prototype.readPKCS8PrvKeyHex=function(e){var c,i,k,b,a,f,d,j;var m=ASN1HEX;var l=m.getVbyListEx;if(m.isASN1HEX(e)===false){throw new Error("not ASN.1 hex string")}try{c=l(e,0,[2,0,1],"02");i=l(e,0,[2,0,2],"02");k=l(e,0,[2,0,3],"02");b=l(e,0,[2,0,4],"02");a=l(e,0,[2,0,5],"02");f=l(e,0,[2,0,6],"02");d=l(e,0,[2,0,7],"02");j=l(e,0,[2,0,8],"02")}catch(g){throw new Error("malformed PKCS#8 plain RSA private key")}this.setPrivateEx(c,i,k,b,a,f,d,j)};RSAKey.prototype.readPKCS5PubKeyHex=function(c){var e=ASN1HEX;var b=e.getV;if(e.isASN1HEX(c)===false){throw new Error("keyHex is not ASN.1 hex string")}var a=e.getChildIdx(c,0);if(a.length!==2||c.substr(a[0],2)!=="02"||c.substr(a[1],2)!=="02"){throw new Error("wrong hex for PKCS#5 public key")}var f=b(c,a[0]);var d=b(c,a[1]);this.setPublic(f,d)};RSAKey.prototype.readPKCS8PubKeyHex=function(b){var c=ASN1HEX;if(c.isASN1HEX(b)===false){throw new Error("not ASN.1 hex string")}if(c.getTLVbyListEx(b,0,[0,0])!=="06092a864886f70d010101"){throw new Error("not PKCS8 RSA public key")}var a=c.getTLVbyListEx(b,0,[1,0]);this.readPKCS5PubKeyHex(a)};RSAKey.prototype.readCertPubKeyHex=function(b,d){var a,c;a=new X509();a.readCertHex(b);c=a.getPublicKeyHex();this.readPKCS8PubKeyHex(c)}; var _RE_HEXDECONLY=new RegExp("[^0-9a-f]","gi");function _rsasign_getHexPaddedDigestInfoForString(d,e,a){var b=function(f){return KJUR.crypto.Util.hashString(f,a)};var c=b(d);return KJUR.crypto.Util.getPaddedDigestInfoHex(c,a,e)}function _zeroPaddingOfSignature(e,d){var c="";var a=d/4-e.length;for(var b=0;b>24,(d&16711680)>>16,(d&65280)>>8,d&255]))));d+=1}return b}RSAKey.prototype.signPSS=function(e,a,d){var c=function(f){return KJUR.crypto.Util.hashHex(f,a)};var b=c(rstrtohex(e));if(d===undefined){d=-1}return this.signWithMessageHashPSS(b,a,d)};RSAKey.prototype.signWithMessageHashPSS=function(l,a,k){var b=hextorstr(l);var g=b.length;var m=this.n.bitLength()-1;var c=Math.ceil(m/8);var d;var o=function(i){return KJUR.crypto.Util.hashHex(i,a)};if(k===-1||k===undefined){k=g}else{if(k===-2){k=c-g-2}else{if(k<-2){throw new Error("invalid salt length")}}}if(c<(g+k+2)){throw new Error("data too long")}var f="";if(k>0){f=new Array(k);new SecureRandom().nextBytes(f);f=String.fromCharCode.apply(String,f)}var n=hextorstr(o(rstrtohex("\x00\x00\x00\x00\x00\x00\x00\x00"+b+f)));var j=[];for(d=0;d>(8*c-m))&255;q[0]&=~p;for(d=0;dthis.n.bitLength()){return 0}var i=this.doPublic(b);var e=i.toString(16).replace(/^1f+00/,"");var g=_rsasign_getAlgNameAndHashFromHexDisgestInfo(e);if(g.length==0){return false}var d=g[0];var h=g[1];var a=function(k){return KJUR.crypto.Util.hashString(k,d)};var c=a(f);return(h==c)};RSAKey.prototype.verifyWithMessageHash=function(e,a){if(a.length!=Math.ceil(this.n.bitLength()/4)){return false}var b=parseBigInt(a,16);if(b.bitLength()>this.n.bitLength()){return 0}var h=this.doPublic(b);var g=h.toString(16).replace(/^1f+00/,"");var c=_rsasign_getAlgNameAndHashFromHexDisgestInfo(g);if(c.length==0){return false}var d=c[0];var f=c[1];return(f==e)};RSAKey.prototype.verifyPSS=function(c,b,a,f){var e=function(g){return KJUR.crypto.Util.hashHex(g,a)};var d=e(rstrtohex(c));if(f===undefined){f=-1}return this.verifyWithMessageHashPSS(d,b,a,f)};RSAKey.prototype.verifyWithMessageHashPSS=function(f,s,l,c){if(s.length!=Math.ceil(this.n.bitLength()/4)){return false}var k=new BigInteger(s,16);var r=function(i){return KJUR.crypto.Util.hashHex(i,l)};var j=hextorstr(f);var h=j.length;var g=this.n.bitLength()-1;var m=Math.ceil(g/8);var q;if(c===-1||c===undefined){c=h}else{if(c===-2){c=m-h-2}else{if(c<-2){throw new Error("invalid salt length")}}}if(m<(h+c+2)){throw new Error("data too long")}var a=this.doPublic(k).toByteArray();for(q=0;q>(8*m-g))&255;if((d.charCodeAt(0)&p)!==0){throw new Error("bits beyond keysize not zero")}var n=pss_mgf1_str(e,d.length,r);var o=[];for(q=0;q1){var z=b(v,u[1]);var t=this.getGeneralName(z);if(t.uri!=undefined){s.uri=t.uri}}if(u.length>2){var w=b(v,u[2]);if(w=="0101ff"){s.reqauth=true}if(w=="010100"){s.reqauth=false}}return s};this.getX500NameRule=function(s){var z=true;var D=true;var C=false;var t="";var w="";var F=null;var A=[];for(var v=0;v0){s.ext=this.getExtParamArray()}s.sighex=this.getSignatureValueHex();return s};this.getExtParamArray=function(t){if(t==undefined){var v=e(this.hex,0,[0,"[3]"]);if(v!=-1){t=l(this.hex,0,[0,"[3]",0],"30")}}var s=[];var u=n(t,0);for(var w=0;w1){var A=b(w,v[1]);var u=this.getGeneralName(A);if(u.uri!=undefined){t.uri=u.uri}}if(v.length>2){var x=b(w,v[2]);if(x=="0101ff"){t.reqauth=true}if(x=="010100"){t.reqauth=false}}return t};this.getX500NameRule=function(t){var A=true;var E=true;var D=false;var u="";var x="";var G=null;var B=[];for(var w=0;w0){t.ext=this.getExtParamArray()}t.sighex=this.getSignatureValueHex();return t};this.getExtParamArray=function(u){if(u==undefined){var w=e(this.hex,0,[0,"[3]"]);if(w!=-1){u=l(this.hex,0,[0,"[3]",0],"30")}}var t=[];var v=n(u,0);for(var x=0;x0){var b=":"+n.join(":")+":";if(b.indexOf(":"+k+":")==-1){throw"algorithm '"+k+"' not accepted in the list"}}if(k!="none"&&B===null){throw"key shall be specified to verify."}if(typeof B=="string"&&B.indexOf("-----BEGIN ")!=-1){B=KEYUTIL.getKey(B)}if(z=="RS"||z=="PS"){if(!(B instanceof m)){throw"key shall be a RSAKey obj for RS* and PS* algs"}}if(z=="ES"){if(!(B instanceof p)){throw"key shall be a ECDSA obj for ES* algs"}}if(k=="none"){}var u=null;if(t.jwsalg2sigalg[l.alg]===undefined){throw"unsupported alg name: "+k}else{u=t.jwsalg2sigalg[k]}if(u=="none"){throw"not supported"}else{if(u.substr(0,4)=="Hmac"){var o=null;if(B===undefined){throw"hexadecimal key shall be specified for HMAC"}var j=new s({alg:u,pass:B});j.updateString(c);o=j.doFinal();return A==o}else{if(u.indexOf("withECDSA")!=-1){var h=null;try{h=p.concatSigToASN1Sig(A)}catch(v){return false}var g=new d({alg:u});g.init(B);g.updateString(c);return g.verify(h)}else{var g=new d({alg:u});g.init(B);g.updateString(c);return g.verify(A)}}}};KJUR.jws.JWS.parse=function(g){var c=g.split(".");var b={};var f,e,d;if(c.length!=2&&c.length!=3){throw"malformed sJWS: wrong number of '.' splitted elements"}f=c[0];e=c[1];if(c.length==3){d=c[2]}b.headerObj=KJUR.jws.JWS.readSafeJSONString(b64utoutf8(f));b.payloadObj=KJUR.jws.JWS.readSafeJSONString(b64utoutf8(e));b.headerPP=JSON.stringify(b.headerObj,null," ");if(b.payloadObj==null){b.payloadPP=b64utoutf8(e)}else{b.payloadPP=JSON.stringify(b.payloadObj,null," ")}if(d!==undefined){b.sigHex=b64utohex(d)}return b};KJUR.jws.JWS.verifyJWT=function(e,l,r){var d=KJUR,j=d.jws,o=j.JWS,n=o.readSafeJSONString,p=o.inArray,f=o.includedArray;var k=e.split(".");var c=k[0];var i=k[1];var q=c+"."+i;var m=b64utohex(k[2]);var h=n(b64utoutf8(c));var g=n(b64utoutf8(i));if(h.alg===undefined){return false}if(r.alg===undefined){throw"acceptField.alg shall be specified"}if(!p(h.alg,r.alg)){return false}if(g.iss!==undefined&&typeof r.iss==="object"){if(!p(g.iss,r.iss)){return false}}if(g.sub!==undefined&&typeof r.sub==="object"){if(!p(g.sub,r.sub)){return false}}if(g.aud!==undefined&&typeof r.aud==="object"){if(typeof g.aud=="string"){if(!p(g.aud,r.aud)){return false}}else{if(typeof g.aud=="object"){if(!f(g.aud,r.aud)){return false}}}}var b=j.IntDate.getNow();if(r.verifyAt!==undefined&&typeof r.verifyAt==="number"){b=r.verifyAt}if(r.gracePeriod===undefined||typeof r.gracePeriod!=="number"){r.gracePeriod=0}if(g.exp!==undefined&&typeof g.exp=="number"){if(g.exp+r.gracePeriodl){this.aHeader.pop()}if(this.aSignature.length>l){this.aSignature.pop()}throw"addSignature failed: "+i}};this.verifyAll=function(h){if(this.aHeader.length!==h.length||this.aSignature.length!==h.length){return false}for(var g=0;g0){this.aHeader=g.headers}else{throw"malformed header"}if(typeof g.payload==="string"){this.sPayload=g.payload}else{throw"malformed signatures"}if(g.signatures.length>0){this.aSignature=g.signatures}else{throw"malformed signatures"}}catch(e){throw"malformed JWS-JS JSON object: "+e}}};this.getJSON=function(){return{headers:this.aHeader,payload:this.sPayload,signatures:this.aSignature}};this.isEmpty=function(){if(this.aHeader.length==0){return 1}return 0}}; diff --git a/npm/lib/jsrsasign-jwths-min.js b/npm/lib/jsrsasign-jwths-min.js index b4fd02eb..123b54a1 100644 --- a/npm/lib/jsrsasign-jwths-min.js +++ b/npm/lib/jsrsasign-jwths-min.js @@ -1,5 +1,5 @@ /* - * jsrsasign(jwths) 10.1.10 (2021-02-14) (c) 2010-2021 Kenji Urushima | kjur.github.com/jsrsasign/license + * jsrsasign(jwths) 10.1.11 (2021-02-19) (c) 2010-2021 Kenji Urushima | kjur.github.com/jsrsasign/license */ /*! diff --git a/npm/lib/jsrsasign-rsa-min.js b/npm/lib/jsrsasign-rsa-min.js index 8141b837..adddbdfa 100644 --- a/npm/lib/jsrsasign-rsa-min.js +++ b/npm/lib/jsrsasign-rsa-min.js @@ -1,5 +1,5 @@ /* - * jsrsasign(rsa) 10.1.10 (2021-02-14) (c) 2010-2021 Kenji Urushima | kjur.github.com/jsrsasign/license + * jsrsasign(rsa) 10.1.11 (2021-02-19) (c) 2010-2021 Kenji Urushima | kjur.github.com/jsrsasign/license */ /*! diff --git a/npm/lib/jsrsasign.js b/npm/lib/jsrsasign.js index 19fda5c5..8e2fe6a5 100755 --- a/npm/lib/jsrsasign.js +++ b/npm/lib/jsrsasign.js @@ -4,7 +4,7 @@ navigator.userAgent = false; var window = {}; /* - * jsrsasign(all) 10.1.10 (2021-02-14) (c) 2010-2021 Kenji Urushima | kjur.github.com/jsrsasign/license + * jsrsasign(all) 10.1.11 (2021-02-19) (c) 2010-2021 Kenji Urushima | kjur.github.com/jsrsasign/license */ /*! @@ -246,7 +246,7 @@ if(typeof KJUR=="undefined"||!KJUR){KJUR={}}if(typeof KJUR.crypto=="undefined"|| var KEYUTIL=function(){var d=function(p,r,q){return k(CryptoJS.AES,p,r,q)};var e=function(p,r,q){return k(CryptoJS.TripleDES,p,r,q)};var a=function(p,r,q){return k(CryptoJS.DES,p,r,q)};var k=function(s,x,u,q){var r=CryptoJS.enc.Hex.parse(x);var w=CryptoJS.enc.Hex.parse(u);var p=CryptoJS.enc.Hex.parse(q);var t={};t.key=w;t.iv=p;t.ciphertext=r;var v=s.decrypt(t,w,{iv:p});return CryptoJS.enc.Hex.stringify(v)};var l=function(p,r,q){return g(CryptoJS.AES,p,r,q)};var o=function(p,r,q){return g(CryptoJS.TripleDES,p,r,q)};var f=function(p,r,q){return g(CryptoJS.DES,p,r,q)};var g=function(t,y,v,q){var s=CryptoJS.enc.Hex.parse(y);var x=CryptoJS.enc.Hex.parse(v);var p=CryptoJS.enc.Hex.parse(q);var w=t.encrypt(s,x,{iv:p});var r=CryptoJS.enc.Hex.parse(w.toString());var u=CryptoJS.enc.Base64.stringify(r);return u};var i={"AES-256-CBC":{proc:d,eproc:l,keylen:32,ivlen:16},"AES-192-CBC":{proc:d,eproc:l,keylen:24,ivlen:16},"AES-128-CBC":{proc:d,eproc:l,keylen:16,ivlen:16},"DES-EDE3-CBC":{proc:e,eproc:o,keylen:24,ivlen:8},"DES-CBC":{proc:a,eproc:f,keylen:8,ivlen:8}};var c=function(p){return i[p]["proc"]};var m=function(p){var r=CryptoJS.lib.WordArray.random(p);var q=CryptoJS.enc.Hex.stringify(r);return q};var n=function(v){var w={};var q=v.match(new RegExp("DEK-Info: ([^,]+),([0-9A-Fa-f]+)","m"));if(q){w.cipher=q[1];w.ivsalt=q[2]}var p=v.match(new RegExp("-----BEGIN ([A-Z]+) PRIVATE KEY-----"));if(p){w.type=p[1]}var u=-1;var x=0;if(v.indexOf("\r\n\r\n")!=-1){u=v.indexOf("\r\n\r\n");x=2}if(v.indexOf("\n\n")!=-1){u=v.indexOf("\n\n");x=1}var t=v.indexOf("-----END");if(u!=-1&&t!=-1){var r=v.substring(u+x*2,t-x);r=r.replace(/\s+/g,"");w.data=r}return w};var j=function(q,y,p){var v=p.substring(0,16);var t=CryptoJS.enc.Hex.parse(v);var r=CryptoJS.enc.Utf8.parse(y);var u=i[q]["keylen"]+i[q]["ivlen"];var x="";var w=null;for(;;){var s=CryptoJS.algo.MD5.create();if(w!=null){s.update(w)}s.update(r);s.update(t);w=s.finalize();x=x+CryptoJS.enc.Hex.stringify(w);if(x.length>=u*2){break}}var z={};z.keyhex=x.substr(0,i[q]["keylen"]*2);z.ivhex=x.substr(i[q]["keylen"]*2,i[q]["ivlen"]*2);return z};var b=function(p,v,r,w){var s=CryptoJS.enc.Base64.parse(p);var q=CryptoJS.enc.Hex.stringify(s);var u=i[v]["proc"];var t=u(q,r,w);return t};var h=function(p,s,q,u){var r=i[s]["eproc"];var t=r(p,q,u);return t};return{version:"1.0.0",parsePKCS5PEM:function(p){return n(p)},getKeyAndUnusedIvByPasscodeAndIvsalt:function(q,p,r){return j(q,p,r)},decryptKeyB64:function(p,r,q,s){return b(p,r,q,s)},getDecryptedKeyHex:function(y,x){var q=n(y);var t=q.type;var r=q.cipher;var p=q.ivsalt;var s=q.data;var w=j(r,x,p);var v=w.keyhex;var u=b(s,r,v,p);return u},getEncryptedPKCS5PEMFromPrvKeyHex:function(x,s,A,t,r){var p="";if(typeof t=="undefined"||t==null){t="AES-256-CBC"}if(typeof i[t]=="undefined"){throw"KEYUTIL unsupported algorithm: "+t}if(typeof r=="undefined"||r==null){var v=i[t]["ivlen"];var u=m(v);r=u.toUpperCase()}var z=j(t,A,r);var y=z.keyhex;var w=h(s,t,y,r);var q=w.replace(/(.{64})/g,"$1\r\n");var p="-----BEGIN "+x+" PRIVATE KEY-----\r\n";p+="Proc-Type: 4,ENCRYPTED\r\n";p+="DEK-Info: "+t+","+r+"\r\n";p+="\r\n";p+=q;p+="\r\n-----END "+x+" PRIVATE KEY-----\r\n";return p},parseHexOfEncryptedPKCS8:function(y){var B=ASN1HEX;var z=B.getChildIdx;var w=B.getV;var t={};var r=z(y,0);if(r.length!=2){throw"malformed format: SEQUENCE(0).items != 2: "+r.length}t.ciphertext=w(y,r[1]);var A=z(y,r[0]);if(A.length!=2){throw"malformed format: SEQUENCE(0.0).items != 2: "+A.length}if(w(y,A[0])!="2a864886f70d01050d"){throw"this only supports pkcs5PBES2"}var p=z(y,A[1]);if(A.length!=2){throw"malformed format: SEQUENCE(0.0.1).items != 2: "+p.length}var q=z(y,p[1]);if(q.length!=2){throw"malformed format: SEQUENCE(0.0.1.1).items != 2: "+q.length}if(w(y,q[0])!="2a864886f70d0307"){throw"this only supports TripleDES"}t.encryptionSchemeAlg="TripleDES";t.encryptionSchemeIV=w(y,q[1]);var s=z(y,p[0]);if(s.length!=2){throw"malformed format: SEQUENCE(0.0.1.0).items != 2: "+s.length}if(w(y,s[0])!="2a864886f70d01050c"){throw"this only supports pkcs5PBKDF2"}var x=z(y,s[1]);if(x.length<2){throw"malformed format: SEQUENCE(0.0.1.0.1).items < 2: "+x.length}t.pbkdf2Salt=w(y,x[0]);var u=w(y,x[1]);try{t.pbkdf2Iter=parseInt(u,16)}catch(v){throw"malformed format pbkdf2Iter: "+u}return t},getPBKDF2KeyHexFromParam:function(u,p){var t=CryptoJS.enc.Hex.parse(u.pbkdf2Salt);var q=u.pbkdf2Iter;var s=CryptoJS.PBKDF2(p,t,{keySize:192/32,iterations:q});var r=CryptoJS.enc.Hex.stringify(s);return r},_getPlainPKCS8HexFromEncryptedPKCS8PEM:function(x,y){var r=pemtohex(x,"ENCRYPTED PRIVATE KEY");var p=this.parseHexOfEncryptedPKCS8(r);var u=KEYUTIL.getPBKDF2KeyHexFromParam(p,y);var v={};v.ciphertext=CryptoJS.enc.Hex.parse(p.ciphertext);var t=CryptoJS.enc.Hex.parse(u);var s=CryptoJS.enc.Hex.parse(p.encryptionSchemeIV);var w=CryptoJS.TripleDES.decrypt(v,t,{iv:s});var q=CryptoJS.enc.Hex.stringify(w);return q},getKeyFromEncryptedPKCS8PEM:function(s,q){var p=this._getPlainPKCS8HexFromEncryptedPKCS8PEM(s,q);var r=this.getKeyFromPlainPrivatePKCS8Hex(p);return r},parsePlainPrivatePKCS8Hex:function(s){var v=ASN1HEX;var u=v.getChildIdx;var t=v.getV;var q={};q.algparam=null;if(s.substr(0,2)!="30"){throw new Error("malformed plain PKCS8 private key(code:001)")}var r=u(s,0);if(r.length<3){throw new Error("malformed plain PKCS8 private key(code:002)")}if(s.substr(r[1],2)!="30"){throw new Error("malformed PKCS8 private key(code:003)")}var p=u(s,r[1]);if(p.length!=2){throw new Error("malformed PKCS8 private key(code:004)")}if(s.substr(p[0],2)!="06"){throw new Error("malformed PKCS8 private key(code:005)")}q.algoid=t(s,p[0]);if(s.substr(p[1],2)=="06"){q.algparam=t(s,p[1])}if(s.substr(r[2],2)!="04"){throw new Error("malformed PKCS8 private key(code:006)")}q.keyidx=v.getVidx(s,r[2]);return q},getKeyFromPlainPrivatePKCS8PEM:function(q){var p=pemtohex(q,"PRIVATE KEY");var r=this.getKeyFromPlainPrivatePKCS8Hex(p);return r},getKeyFromPlainPrivatePKCS8Hex:function(p){var q=this.parsePlainPrivatePKCS8Hex(p);var r;if(q.algoid=="2a864886f70d010101"){r=new RSAKey()}else{if(q.algoid=="2a8648ce380401"){r=new KJUR.crypto.DSA()}else{if(q.algoid=="2a8648ce3d0201"){r=new KJUR.crypto.ECDSA()}else{throw"unsupported private key algorithm"}}}r.readPKCS8PrvKeyHex(p);return r},_getKeyFromPublicPKCS8Hex:function(q){var p;var r=ASN1HEX.getVbyList(q,0,[0,0],"06");if(r==="2a864886f70d010101"){p=new RSAKey()}else{if(r==="2a8648ce380401"){p=new KJUR.crypto.DSA()}else{if(r==="2a8648ce3d0201"){p=new KJUR.crypto.ECDSA()}else{throw"unsupported PKCS#8 public key hex"}}}p.readPKCS8PubKeyHex(q);return p},parsePublicRawRSAKeyHex:function(r){var u=ASN1HEX;var t=u.getChildIdx;var s=u.getV;var p={};if(r.substr(0,2)!="30"){throw"malformed RSA key(code:001)"}var q=t(r,0);if(q.length!=2){throw"malformed RSA key(code:002)"}if(r.substr(q[0],2)!="02"){throw"malformed RSA key(code:003)"}p.n=s(r,q[0]);if(r.substr(q[1],2)!="02"){throw"malformed RSA key(code:004)"}p.e=s(r,q[1]);return p},parsePublicPKCS8Hex:function(t){var v=ASN1HEX;var u=v.getChildIdx;var s=v.getV;var q={};q.algparam=null;var r=u(t,0);if(r.length!=2){throw"outer DERSequence shall have 2 elements: "+r.length}var w=r[0];if(t.substr(w,2)!="30"){throw"malformed PKCS8 public key(code:001)"}var p=u(t,w);if(p.length!=2){throw"malformed PKCS8 public key(code:002)"}if(t.substr(p[0],2)!="06"){throw"malformed PKCS8 public key(code:003)"}q.algoid=s(t,p[0]);if(t.substr(p[1],2)=="06"){q.algparam=s(t,p[1])}else{if(t.substr(p[1],2)=="30"){q.algparam={};q.algparam.p=v.getVbyList(t,p[1],[0],"02");q.algparam.q=v.getVbyList(t,p[1],[1],"02");q.algparam.g=v.getVbyList(t,p[1],[2],"02")}}if(t.substr(r[1],2)!="03"){throw"malformed PKCS8 public key(code:004)"}q.key=s(t,r[1]).substr(2);return q},}}();KEYUTIL.getKey=function(l,k,n){var G=ASN1HEX,L=G.getChildIdx,v=G.getV,d=G.getVbyList,c=KJUR.crypto,i=c.ECDSA,C=c.DSA,w=RSAKey,M=pemtohex,F=KEYUTIL;if(typeof w!="undefined"&&l instanceof w){return l}if(typeof i!="undefined"&&l instanceof i){return l}if(typeof C!="undefined"&&l instanceof C){return l}if(l.curve!==undefined&&l.xy!==undefined&&l.d===undefined){return new i({pub:l.xy,curve:l.curve})}if(l.curve!==undefined&&l.d!==undefined){return new i({prv:l.d,curve:l.curve})}if(l.kty===undefined&&l.n!==undefined&&l.e!==undefined&&l.d===undefined){var P=new w();P.setPublic(l.n,l.e);return P}if(l.kty===undefined&&l.n!==undefined&&l.e!==undefined&&l.d!==undefined&&l.p!==undefined&&l.q!==undefined&&l.dp!==undefined&&l.dq!==undefined&&l.co!==undefined&&l.qi===undefined){var P=new w();P.setPrivateEx(l.n,l.e,l.d,l.p,l.q,l.dp,l.dq,l.co);return P}if(l.kty===undefined&&l.n!==undefined&&l.e!==undefined&&l.d!==undefined&&l.p===undefined){var P=new w();P.setPrivate(l.n,l.e,l.d);return P}if(l.p!==undefined&&l.q!==undefined&&l.g!==undefined&&l.y!==undefined&&l.x===undefined){var P=new C();P.setPublic(l.p,l.q,l.g,l.y);return P}if(l.p!==undefined&&l.q!==undefined&&l.g!==undefined&&l.y!==undefined&&l.x!==undefined){var P=new C();P.setPrivate(l.p,l.q,l.g,l.y,l.x);return P}if(l.kty==="RSA"&&l.n!==undefined&&l.e!==undefined&&l.d===undefined){var P=new w();P.setPublic(b64utohex(l.n),b64utohex(l.e));return P}if(l.kty==="RSA"&&l.n!==undefined&&l.e!==undefined&&l.d!==undefined&&l.p!==undefined&&l.q!==undefined&&l.dp!==undefined&&l.dq!==undefined&&l.qi!==undefined){var P=new w();P.setPrivateEx(b64utohex(l.n),b64utohex(l.e),b64utohex(l.d),b64utohex(l.p),b64utohex(l.q),b64utohex(l.dp),b64utohex(l.dq),b64utohex(l.qi));return P}if(l.kty==="RSA"&&l.n!==undefined&&l.e!==undefined&&l.d!==undefined){var P=new w();P.setPrivate(b64utohex(l.n),b64utohex(l.e),b64utohex(l.d));return P}if(l.kty==="EC"&&l.crv!==undefined&&l.x!==undefined&&l.y!==undefined&&l.d===undefined){var j=new i({curve:l.crv});var t=j.ecparams.keylen/4;var B=("0000000000"+b64utohex(l.x)).slice(-t);var z=("0000000000"+b64utohex(l.y)).slice(-t);var u="04"+B+z;j.setPublicKeyHex(u);return j}if(l.kty==="EC"&&l.crv!==undefined&&l.x!==undefined&&l.y!==undefined&&l.d!==undefined){var j=new i({curve:l.crv});var t=j.ecparams.keylen/4;var B=("0000000000"+b64utohex(l.x)).slice(-t);var z=("0000000000"+b64utohex(l.y)).slice(-t);var u="04"+B+z;var b=("0000000000"+b64utohex(l.d)).slice(-t);j.setPublicKeyHex(u);j.setPrivateKeyHex(b);return j}if(n==="pkcs5prv"){var J=l,G=ASN1HEX,N,P;N=L(J,0);if(N.length===9){P=new w();P.readPKCS5PrvKeyHex(J)}else{if(N.length===6){P=new C();P.readPKCS5PrvKeyHex(J)}else{if(N.length>2&&J.substr(N[1],2)==="04"){P=new i();P.readPKCS5PrvKeyHex(J)}else{throw"unsupported PKCS#1/5 hexadecimal key"}}}return P}if(n==="pkcs8prv"){var P=F.getKeyFromPlainPrivatePKCS8Hex(l);return P}if(n==="pkcs8pub"){return F._getKeyFromPublicPKCS8Hex(l)}if(n==="x509pub"){return X509.getPublicKeyFromCertHex(l)}if(l.indexOf("-END CERTIFICATE-",0)!=-1||l.indexOf("-END X509 CERTIFICATE-",0)!=-1||l.indexOf("-END TRUSTED CERTIFICATE-",0)!=-1){return X509.getPublicKeyFromCertPEM(l)}if(l.indexOf("-END PUBLIC KEY-")!=-1){var O=pemtohex(l,"PUBLIC KEY");return F._getKeyFromPublicPKCS8Hex(O)}if(l.indexOf("-END RSA PRIVATE KEY-")!=-1&&l.indexOf("4,ENCRYPTED")==-1){var m=M(l,"RSA PRIVATE KEY");return F.getKey(m,null,"pkcs5prv")}if(l.indexOf("-END DSA PRIVATE KEY-")!=-1&&l.indexOf("4,ENCRYPTED")==-1){var I=M(l,"DSA PRIVATE KEY");var E=d(I,0,[1],"02");var D=d(I,0,[2],"02");var K=d(I,0,[3],"02");var r=d(I,0,[4],"02");var s=d(I,0,[5],"02");var P=new C();P.setPrivate(new BigInteger(E,16),new BigInteger(D,16),new BigInteger(K,16),new BigInteger(r,16),new BigInteger(s,16));return P}if(l.indexOf("-END EC PRIVATE KEY-")!=-1&&l.indexOf("4,ENCRYPTED")==-1){var m=M(l,"EC PRIVATE KEY");return F.getKey(m,null,"pkcs5prv")}if(l.indexOf("-END PRIVATE KEY-")!=-1){return F.getKeyFromPlainPrivatePKCS8PEM(l)}if(l.indexOf("-END RSA PRIVATE KEY-")!=-1&&l.indexOf("4,ENCRYPTED")!=-1){var o=F.getDecryptedKeyHex(l,k);var H=new RSAKey();H.readPKCS5PrvKeyHex(o);return H}if(l.indexOf("-END EC PRIVATE KEY-")!=-1&&l.indexOf("4,ENCRYPTED")!=-1){var I=F.getDecryptedKeyHex(l,k);var P=d(I,0,[1],"04");var f=d(I,0,[2,0],"06");var A=d(I,0,[3,0],"03").substr(2);var e="";if(KJUR.crypto.OID.oidhex2name[f]!==undefined){e=KJUR.crypto.OID.oidhex2name[f]}else{throw"undefined OID(hex) in KJUR.crypto.OID: "+f}var j=new i({curve:e});j.setPublicKeyHex(A);j.setPrivateKeyHex(P);j.isPublic=false;return j}if(l.indexOf("-END DSA PRIVATE KEY-")!=-1&&l.indexOf("4,ENCRYPTED")!=-1){var I=F.getDecryptedKeyHex(l,k);var E=d(I,0,[1],"02");var D=d(I,0,[2],"02");var K=d(I,0,[3],"02");var r=d(I,0,[4],"02");var s=d(I,0,[5],"02");var P=new C();P.setPrivate(new BigInteger(E,16),new BigInteger(D,16),new BigInteger(K,16),new BigInteger(r,16),new BigInteger(s,16));return P}if(l.indexOf("-END ENCRYPTED PRIVATE KEY-")!=-1){return F.getKeyFromEncryptedPKCS8PEM(l,k)}throw new Error("not supported argument")};KEYUTIL.generateKeypair=function(a,c){if(a=="RSA"){var b=c;var h=new RSAKey();h.generate(b,"10001");h.isPrivate=true;h.isPublic=true;var f=new RSAKey();var e=h.n.toString(16);var i=h.e.toString(16);f.setPublic(e,i);f.isPrivate=false;f.isPublic=true;var k={};k.prvKeyObj=h;k.pubKeyObj=f;return k}else{if(a=="EC"){var d=c;var g=new KJUR.crypto.ECDSA({curve:d});var j=g.generateKeyPairHex();var h=new KJUR.crypto.ECDSA({curve:d});h.setPublicKeyHex(j.ecpubhex);h.setPrivateKeyHex(j.ecprvhex);h.isPrivate=true;h.isPublic=false;var f=new KJUR.crypto.ECDSA({curve:d});f.setPublicKeyHex(j.ecpubhex);f.isPrivate=false;f.isPublic=true;var k={};k.prvKeyObj=h;k.pubKeyObj=f;return k}else{throw"unknown algorithm: "+a}}};KEYUTIL.getPEM=function(b,D,y,m,q,j){var F=KJUR,k=F.asn1,z=k.DERObjectIdentifier,f=k.DERInteger,l=k.ASN1Util.newObject,a=k.x509,C=a.SubjectPublicKeyInfo,e=F.crypto,u=e.DSA,r=e.ECDSA,n=RSAKey;function A(s){var G=l({seq:[{"int":0},{"int":{bigint:s.n}},{"int":s.e},{"int":{bigint:s.d}},{"int":{bigint:s.p}},{"int":{bigint:s.q}},{"int":{bigint:s.dmp1}},{"int":{bigint:s.dmq1}},{"int":{bigint:s.coeff}}]});return G}function B(G){var s=l({seq:[{"int":1},{octstr:{hex:G.prvKeyHex}},{tag:["a0",true,{oid:{name:G.curveName}}]},{tag:["a1",true,{bitstr:{hex:"00"+G.pubKeyHex}}]}]});return s}function x(s){var G=l({seq:[{"int":0},{"int":{bigint:s.p}},{"int":{bigint:s.q}},{"int":{bigint:s.g}},{"int":{bigint:s.y}},{"int":{bigint:s.x}}]});return G}if(((n!==undefined&&b instanceof n)||(u!==undefined&&b instanceof u)||(r!==undefined&&b instanceof r))&&b.isPublic==true&&(D===undefined||D=="PKCS8PUB")){var E=new C(b);var w=E.getEncodedHex();return hextopem(w,"PUBLIC KEY")}if(D=="PKCS1PRV"&&n!==undefined&&b instanceof n&&(y===undefined||y==null)&&b.isPrivate==true){var E=A(b);var w=E.getEncodedHex();return hextopem(w,"RSA PRIVATE KEY")}if(D=="PKCS1PRV"&&r!==undefined&&b instanceof r&&(y===undefined||y==null)&&b.isPrivate==true){var i=new z({name:b.curveName});var v=i.getEncodedHex();var h=B(b);var t=h.getEncodedHex();var p="";p+=hextopem(v,"EC PARAMETERS");p+=hextopem(t,"EC PRIVATE KEY");return p}if(D=="PKCS1PRV"&&u!==undefined&&b instanceof u&&(y===undefined||y==null)&&b.isPrivate==true){var E=x(b);var w=E.getEncodedHex();return hextopem(w,"DSA PRIVATE KEY")}if(D=="PKCS5PRV"&&n!==undefined&&b instanceof n&&(y!==undefined&&y!=null)&&b.isPrivate==true){var E=A(b);var w=E.getEncodedHex();if(m===undefined){m="DES-EDE3-CBC"}return this.getEncryptedPKCS5PEMFromPrvKeyHex("RSA",w,y,m,j)}if(D=="PKCS5PRV"&&r!==undefined&&b instanceof r&&(y!==undefined&&y!=null)&&b.isPrivate==true){var E=B(b);var w=E.getEncodedHex();if(m===undefined){m="DES-EDE3-CBC"}return this.getEncryptedPKCS5PEMFromPrvKeyHex("EC",w,y,m,j)}if(D=="PKCS5PRV"&&u!==undefined&&b instanceof u&&(y!==undefined&&y!=null)&&b.isPrivate==true){var E=x(b);var w=E.getEncodedHex();if(m===undefined){m="DES-EDE3-CBC"}return this.getEncryptedPKCS5PEMFromPrvKeyHex("DSA",w,y,m,j)}var o=function(G,s){var I=c(G,s);var H=new l({seq:[{seq:[{oid:{name:"pkcs5PBES2"}},{seq:[{seq:[{oid:{name:"pkcs5PBKDF2"}},{seq:[{octstr:{hex:I.pbkdf2Salt}},{"int":I.pbkdf2Iter}]}]},{seq:[{oid:{name:"des-EDE3-CBC"}},{octstr:{hex:I.encryptionSchemeIV}}]}]}]},{octstr:{hex:I.ciphertext}}]});return H.getEncodedHex()};var c=function(N,O){var H=100;var M=CryptoJS.lib.WordArray.random(8);var L="DES-EDE3-CBC";var s=CryptoJS.lib.WordArray.random(8);var I=CryptoJS.PBKDF2(O,M,{keySize:192/32,iterations:H});var J=CryptoJS.enc.Hex.parse(N);var K=CryptoJS.TripleDES.encrypt(J,I,{iv:s})+"";var G={};G.ciphertext=K;G.pbkdf2Salt=CryptoJS.enc.Hex.stringify(M);G.pbkdf2Iter=H;G.encryptionSchemeAlg=L;G.encryptionSchemeIV=CryptoJS.enc.Hex.stringify(s);return G};if(D=="PKCS8PRV"&&n!=undefined&&b instanceof n&&b.isPrivate==true){var g=A(b);var d=g.getEncodedHex();var E=l({seq:[{"int":0},{seq:[{oid:{name:"rsaEncryption"}},{"null":true}]},{octstr:{hex:d}}]});var w=E.getEncodedHex();if(y===undefined||y==null){return hextopem(w,"PRIVATE KEY")}else{var t=o(w,y);return hextopem(t,"ENCRYPTED PRIVATE KEY")}}if(D=="PKCS8PRV"&&r!==undefined&&b instanceof r&&b.isPrivate==true){var g=new l({seq:[{"int":1},{octstr:{hex:b.prvKeyHex}},{tag:["a1",true,{bitstr:{hex:"00"+b.pubKeyHex}}]}]});var d=g.getEncodedHex();var E=l({seq:[{"int":0},{seq:[{oid:{name:"ecPublicKey"}},{oid:{name:b.curveName}}]},{octstr:{hex:d}}]});var w=E.getEncodedHex();if(y===undefined||y==null){return hextopem(w,"PRIVATE KEY")}else{var t=o(w,y);return hextopem(t,"ENCRYPTED PRIVATE KEY")}}if(D=="PKCS8PRV"&&u!==undefined&&b instanceof u&&b.isPrivate==true){var g=new f({bigint:b.x});var d=g.getEncodedHex();var E=l({seq:[{"int":0},{seq:[{oid:{name:"dsa"}},{seq:[{"int":{bigint:b.p}},{"int":{bigint:b.q}},{"int":{bigint:b.g}}]}]},{octstr:{hex:d}}]});var w=E.getEncodedHex();if(y===undefined||y==null){return hextopem(w,"PRIVATE KEY")}else{var t=o(w,y);return hextopem(t,"ENCRYPTED PRIVATE KEY")}}throw new Error("unsupported object nor format")};KEYUTIL.getKeyFromCSRPEM=function(b){var a=pemtohex(b,"CERTIFICATE REQUEST");var c=KEYUTIL.getKeyFromCSRHex(a);return c};KEYUTIL.getKeyFromCSRHex=function(a){var c=KEYUTIL.parseCSRHex(a);var b=KEYUTIL.getKey(c.p8pubkeyhex,null,"pkcs8pub");return b};KEYUTIL.parseCSRHex=function(d){var i=ASN1HEX;var f=i.getChildIdx;var c=i.getTLV;var b={};var g=d;if(g.substr(0,2)!="30"){throw"malformed CSR(code:001)"}var e=f(g,0);if(e.length<1){throw"malformed CSR(code:002)"}if(g.substr(e[0],2)!="30"){throw"malformed CSR(code:003)"}var a=f(g,e[0]);if(a.length<3){throw"malformed CSR(code:004)"}b.p8pubkeyhex=c(g,a[2]);return b};KEYUTIL.getKeyID=function(f){var c=KEYUTIL;var e=ASN1HEX;if(typeof f==="string"&&f.indexOf("BEGIN ")!=-1){f=c.getKey(f)}var d=pemtohex(c.getPEM(f));var b=e.getIdxbyList(d,0,[1]);var a=e.getV(d,b).substring(2);return KJUR.crypto.Util.hashHex(a,"sha1")};KEYUTIL.getJWKFromKey=function(d){var b={};if(d instanceof RSAKey&&d.isPrivate){b.kty="RSA";b.n=hextob64u(d.n.toString(16));b.e=hextob64u(d.e.toString(16));b.d=hextob64u(d.d.toString(16));b.p=hextob64u(d.p.toString(16));b.q=hextob64u(d.q.toString(16));b.dp=hextob64u(d.dmp1.toString(16));b.dq=hextob64u(d.dmq1.toString(16));b.qi=hextob64u(d.coeff.toString(16));return b}else{if(d instanceof RSAKey&&d.isPublic){b.kty="RSA";b.n=hextob64u(d.n.toString(16));b.e=hextob64u(d.e.toString(16));return b}else{if(d instanceof KJUR.crypto.ECDSA&&d.isPrivate){var a=d.getShortNISTPCurveName();if(a!=="P-256"&&a!=="P-384"){throw"unsupported curve name for JWT: "+a}var c=d.getPublicKeyXYHex();b.kty="EC";b.crv=a;b.x=hextob64u(c.x);b.y=hextob64u(c.y);b.d=hextob64u(d.prvKeyHex);return b}else{if(d instanceof KJUR.crypto.ECDSA&&d.isPublic){var a=d.getShortNISTPCurveName();if(a!=="P-256"&&a!=="P-384"){throw"unsupported curve name for JWT: "+a}var c=d.getPublicKeyXYHex();b.kty="EC";b.crv=a;b.x=hextob64u(c.x);b.y=hextob64u(c.y);return b}}}}throw"not supported key object"}; RSAKey.getPosArrayOfChildrenFromHex=function(a){return ASN1HEX.getChildIdx(a,0)};RSAKey.getHexValueArrayOfChildrenFromHex=function(f){var n=ASN1HEX;var i=n.getV;var k=RSAKey.getPosArrayOfChildrenFromHex(f);var e=i(f,k[0]);var j=i(f,k[1]);var b=i(f,k[2]);var c=i(f,k[3]);var h=i(f,k[4]);var g=i(f,k[5]);var m=i(f,k[6]);var l=i(f,k[7]);var d=i(f,k[8]);var k=new Array();k.push(e,j,b,c,h,g,m,l,d);return k};RSAKey.prototype.readPrivateKeyFromPEMString=function(d){var c=pemtohex(d);var b=RSAKey.getHexValueArrayOfChildrenFromHex(c);this.setPrivateEx(b[1],b[2],b[3],b[4],b[5],b[6],b[7],b[8])};RSAKey.prototype.readPKCS5PrvKeyHex=function(c){var b=RSAKey.getHexValueArrayOfChildrenFromHex(c);this.setPrivateEx(b[1],b[2],b[3],b[4],b[5],b[6],b[7],b[8])};RSAKey.prototype.readPKCS8PrvKeyHex=function(e){var c,i,k,b,a,f,d,j;var m=ASN1HEX;var l=m.getVbyListEx;if(m.isASN1HEX(e)===false){throw new Error("not ASN.1 hex string")}try{c=l(e,0,[2,0,1],"02");i=l(e,0,[2,0,2],"02");k=l(e,0,[2,0,3],"02");b=l(e,0,[2,0,4],"02");a=l(e,0,[2,0,5],"02");f=l(e,0,[2,0,6],"02");d=l(e,0,[2,0,7],"02");j=l(e,0,[2,0,8],"02")}catch(g){throw new Error("malformed PKCS#8 plain RSA private key")}this.setPrivateEx(c,i,k,b,a,f,d,j)};RSAKey.prototype.readPKCS5PubKeyHex=function(c){var e=ASN1HEX;var b=e.getV;if(e.isASN1HEX(c)===false){throw new Error("keyHex is not ASN.1 hex string")}var a=e.getChildIdx(c,0);if(a.length!==2||c.substr(a[0],2)!=="02"||c.substr(a[1],2)!=="02"){throw new Error("wrong hex for PKCS#5 public key")}var f=b(c,a[0]);var d=b(c,a[1]);this.setPublic(f,d)};RSAKey.prototype.readPKCS8PubKeyHex=function(b){var c=ASN1HEX;if(c.isASN1HEX(b)===false){throw new Error("not ASN.1 hex string")}if(c.getTLVbyListEx(b,0,[0,0])!=="06092a864886f70d010101"){throw new Error("not PKCS8 RSA public key")}var a=c.getTLVbyListEx(b,0,[1,0]);this.readPKCS5PubKeyHex(a)};RSAKey.prototype.readCertPubKeyHex=function(b,d){var a,c;a=new X509();a.readCertHex(b);c=a.getPublicKeyHex();this.readPKCS8PubKeyHex(c)}; var _RE_HEXDECONLY=new RegExp("[^0-9a-f]","gi");function _rsasign_getHexPaddedDigestInfoForString(d,e,a){var b=function(f){return KJUR.crypto.Util.hashString(f,a)};var c=b(d);return KJUR.crypto.Util.getPaddedDigestInfoHex(c,a,e)}function _zeroPaddingOfSignature(e,d){var c="";var a=d/4-e.length;for(var b=0;b>24,(d&16711680)>>16,(d&65280)>>8,d&255]))));d+=1}return b}RSAKey.prototype.signPSS=function(e,a,d){var c=function(f){return KJUR.crypto.Util.hashHex(f,a)};var b=c(rstrtohex(e));if(d===undefined){d=-1}return this.signWithMessageHashPSS(b,a,d)};RSAKey.prototype.signWithMessageHashPSS=function(l,a,k){var b=hextorstr(l);var g=b.length;var m=this.n.bitLength()-1;var c=Math.ceil(m/8);var d;var o=function(i){return KJUR.crypto.Util.hashHex(i,a)};if(k===-1||k===undefined){k=g}else{if(k===-2){k=c-g-2}else{if(k<-2){throw new Error("invalid salt length")}}}if(c<(g+k+2)){throw new Error("data too long")}var f="";if(k>0){f=new Array(k);new SecureRandom().nextBytes(f);f=String.fromCharCode.apply(String,f)}var n=hextorstr(o(rstrtohex("\x00\x00\x00\x00\x00\x00\x00\x00"+b+f)));var j=[];for(d=0;d>(8*c-m))&255;q[0]&=~p;for(d=0;dthis.n.bitLength()){return 0}var i=this.doPublic(b);var e=i.toString(16).replace(/^1f+00/,"");var g=_rsasign_getAlgNameAndHashFromHexDisgestInfo(e);if(g.length==0){return false}var d=g[0];var h=g[1];var a=function(k){return KJUR.crypto.Util.hashString(k,d)};var c=a(f);return(h==c)};RSAKey.prototype.verifyWithMessageHash=function(e,a){if(a.length!=Math.ceil(this.n.bitLength()/4)){return false}var b=parseBigInt(a,16);if(b.bitLength()>this.n.bitLength()){return 0}var h=this.doPublic(b);var g=h.toString(16).replace(/^1f+00/,"");var c=_rsasign_getAlgNameAndHashFromHexDisgestInfo(g);if(c.length==0){return false}var d=c[0];var f=c[1];return(f==e)};RSAKey.prototype.verifyPSS=function(c,b,a,f){var e=function(g){return KJUR.crypto.Util.hashHex(g,a)};var d=e(rstrtohex(c));if(f===undefined){f=-1}return this.verifyWithMessageHashPSS(d,b,a,f)};RSAKey.prototype.verifyWithMessageHashPSS=function(f,s,l,c){if(s.length!=Math.ceil(this.n.bitLength()/4)){return false}var k=new BigInteger(s,16);var r=function(i){return KJUR.crypto.Util.hashHex(i,l)};var j=hextorstr(f);var h=j.length;var g=this.n.bitLength()-1;var m=Math.ceil(g/8);var q;if(c===-1||c===undefined){c=h}else{if(c===-2){c=m-h-2}else{if(c<-2){throw new Error("invalid salt length")}}}if(m<(h+c+2)){throw new Error("data too long")}var a=this.doPublic(k).toByteArray();for(q=0;q>(8*m-g))&255;if((d.charCodeAt(0)&p)!==0){throw new Error("bits beyond keysize not zero")}var n=pss_mgf1_str(e,d.length,r);var o=[];for(q=0;q1){var z=b(v,u[1]);var t=this.getGeneralName(z);if(t.uri!=undefined){s.uri=t.uri}}if(u.length>2){var w=b(v,u[2]);if(w=="0101ff"){s.reqauth=true}if(w=="010100"){s.reqauth=false}}return s};this.getX500NameRule=function(s){var z=true;var D=true;var C=false;var t="";var w="";var F=null;var A=[];for(var v=0;v0){s.ext=this.getExtParamArray()}s.sighex=this.getSignatureValueHex();return s};this.getExtParamArray=function(t){if(t==undefined){var v=e(this.hex,0,[0,"[3]"]);if(v!=-1){t=l(this.hex,0,[0,"[3]",0],"30")}}var s=[];var u=n(t,0);for(var w=0;w1){var A=b(w,v[1]);var u=this.getGeneralName(A);if(u.uri!=undefined){t.uri=u.uri}}if(v.length>2){var x=b(w,v[2]);if(x=="0101ff"){t.reqauth=true}if(x=="010100"){t.reqauth=false}}return t};this.getX500NameRule=function(t){var A=true;var E=true;var D=false;var u="";var x="";var G=null;var B=[];for(var w=0;w0){t.ext=this.getExtParamArray()}t.sighex=this.getSignatureValueHex();return t};this.getExtParamArray=function(u){if(u==undefined){var w=e(this.hex,0,[0,"[3]"]);if(w!=-1){u=l(this.hex,0,[0,"[3]",0],"30")}}var t=[];var v=n(u,0);for(var x=0;x0){var b=":"+n.join(":")+":";if(b.indexOf(":"+k+":")==-1){throw"algorithm '"+k+"' not accepted in the list"}}if(k!="none"&&B===null){throw"key shall be specified to verify."}if(typeof B=="string"&&B.indexOf("-----BEGIN ")!=-1){B=KEYUTIL.getKey(B)}if(z=="RS"||z=="PS"){if(!(B instanceof m)){throw"key shall be a RSAKey obj for RS* and PS* algs"}}if(z=="ES"){if(!(B instanceof p)){throw"key shall be a ECDSA obj for ES* algs"}}if(k=="none"){}var u=null;if(t.jwsalg2sigalg[l.alg]===undefined){throw"unsupported alg name: "+k}else{u=t.jwsalg2sigalg[k]}if(u=="none"){throw"not supported"}else{if(u.substr(0,4)=="Hmac"){var o=null;if(B===undefined){throw"hexadecimal key shall be specified for HMAC"}var j=new s({alg:u,pass:B});j.updateString(c);o=j.doFinal();return A==o}else{if(u.indexOf("withECDSA")!=-1){var h=null;try{h=p.concatSigToASN1Sig(A)}catch(v){return false}var g=new d({alg:u});g.init(B);g.updateString(c);return g.verify(h)}else{var g=new d({alg:u});g.init(B);g.updateString(c);return g.verify(A)}}}};KJUR.jws.JWS.parse=function(g){var c=g.split(".");var b={};var f,e,d;if(c.length!=2&&c.length!=3){throw"malformed sJWS: wrong number of '.' splitted elements"}f=c[0];e=c[1];if(c.length==3){d=c[2]}b.headerObj=KJUR.jws.JWS.readSafeJSONString(b64utoutf8(f));b.payloadObj=KJUR.jws.JWS.readSafeJSONString(b64utoutf8(e));b.headerPP=JSON.stringify(b.headerObj,null," ");if(b.payloadObj==null){b.payloadPP=b64utoutf8(e)}else{b.payloadPP=JSON.stringify(b.payloadObj,null," ")}if(d!==undefined){b.sigHex=b64utohex(d)}return b};KJUR.jws.JWS.verifyJWT=function(e,l,r){var d=KJUR,j=d.jws,o=j.JWS,n=o.readSafeJSONString,p=o.inArray,f=o.includedArray;var k=e.split(".");var c=k[0];var i=k[1];var q=c+"."+i;var m=b64utohex(k[2]);var h=n(b64utoutf8(c));var g=n(b64utoutf8(i));if(h.alg===undefined){return false}if(r.alg===undefined){throw"acceptField.alg shall be specified"}if(!p(h.alg,r.alg)){return false}if(g.iss!==undefined&&typeof r.iss==="object"){if(!p(g.iss,r.iss)){return false}}if(g.sub!==undefined&&typeof r.sub==="object"){if(!p(g.sub,r.sub)){return false}}if(g.aud!==undefined&&typeof r.aud==="object"){if(typeof g.aud=="string"){if(!p(g.aud,r.aud)){return false}}else{if(typeof g.aud=="object"){if(!f(g.aud,r.aud)){return false}}}}var b=j.IntDate.getNow();if(r.verifyAt!==undefined&&typeof r.verifyAt==="number"){b=r.verifyAt}if(r.gracePeriod===undefined||typeof r.gracePeriod!=="number"){r.gracePeriod=0}if(g.exp!==undefined&&typeof g.exp=="number"){if(g.exp+r.gracePeriodl){this.aHeader.pop()}if(this.aSignature.length>l){this.aSignature.pop()}throw"addSignature failed: "+i}};this.verifyAll=function(h){if(this.aHeader.length!==h.length||this.aSignature.length!==h.length){return false}for(var g=0;g0){this.aHeader=g.headers}else{throw"malformed header"}if(typeof g.payload==="string"){this.sPayload=g.payload}else{throw"malformed signatures"}if(g.signatures.length>0){this.aSignature=g.signatures}else{throw"malformed signatures"}}catch(e){throw"malformed JWS-JS JSON object: "+e}}};this.getJSON=function(){return{headers:this.aHeader,payload:this.sPayload,signatures:this.aSignature}};this.isEmpty=function(){if(this.aHeader.length==0){return 1}return 0}}; diff --git a/npm/package.json b/npm/package.json index ee358f8b..3a080363 100755 --- a/npm/package.json +++ b/npm/package.json @@ -1,6 +1,6 @@ { "name": "jsrsasign", - "version": "10.1.10", + "version": "10.1.11", "description": "opensource free pure JavaScript cryptographic library supports RSA/RSAPSS/ECDSA/DSA signing/validation, ASN.1, PKCS#1/5/8 private/public key, X.509 certificate, CRL, OCSP, CMS SignedData, TimeStamp and CAdES and JSON Web Signature(JWS)/Token(JWT)/Key(JWK).", "main": "lib/jsrsasign.js", "scripts": { diff --git a/src/x509-1.1.js b/src/x509-1.1.js index f4d40d4f..f369a299 100644 --- a/src/x509-1.1.js +++ b/src/x509-1.1.js @@ -107,6 +107,7 @@ function X509(params) { _getIdxbyList = _ASN1HEX.getIdxbyList, _getIdxbyListEx = _ASN1HEX.getIdxbyListEx, _getVidx = _ASN1HEX.getVidx, + _getInt = _ASN1HEX.getInt, _oidname = _ASN1HEX.oidname, _hextooidstr = _ASN1HEX.hextooidstr, _X509 = X509, @@ -150,15 +151,20 @@ function X509(params) { if (this.hex === null || this.version !== 0) return this.version; // check if the first item of tbsCertificate "[0] { INTEGER 2 }" - if (_getTLVbyList(this.hex, 0, [0, 0]) !== - "a003020102") { + var hFirstObj = _getTLVbyList(this.hex, 0, [0, 0]); + if (hFirstObj.substr(0, 2) == "a0") { + var hVersionTLV = _getTLVbyList(hFirstObj, 0, [0]); + var iVersion = _getInt(hVersionTLV, 0); + if (iVersion < 0 || 2 < iVersion) { + throw new Error("malformed version field"); + } + this.version = iVersion + 1; + return this.version; + } else { this.version = 1; this.foffset = -1; return 1; } - - this.version = 3; - return 3; }; /**