jens@17: //
jens@21: //  MYCertificateInfo.m
jens@17: //  MYCrypto
jens@17: //
jens@17: //  Created by Jens Alfke on 6/2/09.
jens@17: //  Copyright 2009 Jens Alfke. All rights reserved.
jens@17: //
jens@17: 
jens@17: // References:
jens@26: // <http://tools.ietf.org/html/rfc3280> "RFC 3280: Internet X.509 Certificate Profile"
jens@20: // <http://www.columbia.edu/~ariel/ssleay/layman.html> "Layman's Guide To ASN.1/BER/DER"
jens@20: // <http://www.cs.auckland.ac.nz/~pgut001/pubs/x509guide.txt> "X.509 Style Guide"
jens@20: // <http://en.wikipedia.org/wiki/X.509> Wikipedia article on X.509
jens@17: 
jens@17: 
jens@21: #import "MYCertificateInfo.h"
jens@21: #import "MYCrypto.h"
jens@17: #import "MYASN1Object.h"
jens@17: #import "MYOID.h"
jens@17: #import "MYBERParser.h"
jens@17: #import "MYDEREncoder.h"
jens@17: #import "MYErrorUtils.h"
jens@17: 
jens@17: 
jens@25: #define kDefaultExpirationTime (60.0 * 60.0 * 24.0 * 365.0)     /* that's 1 year */
jens@19: 
jens@25: /*  X.509 version number to generate. Even though my code doesn't (yet) add any of the post-v1
jens@25:     metadata, it's necessary to write v3 or the resulting certs won't be accepted on some platforms,
jens@25:     notably iPhone OS.
jens@25:     "This field is used mainly for marketing purposes to claim that software is X.509v3 compliant 
jens@25:     (even when it isn't)." --Peter Gutmann */
jens@25: #define kCertRequestVersionNumber 3
jens@19: 
jens@25: 
jens@25: /* "Safe" NSArray accessor -- returns nil if out of range. */
jens@17: static id $atIf(NSArray *array, NSUInteger index) {
jens@17:     return index < array.count ?[array objectAtIndex: index] :nil;
jens@17: }
jens@17: 
jens@17: 
jens@20: @interface MYCertificateName ()
jens@20: - (id) _initWithComponents: (NSArray*)components;
jens@20: @end
jens@20: 
jens@21: @interface MYCertificateInfo ()
jens@21: @property (retain) NSArray *_root;
jens@21: @end
jens@21: 
jens@20: 
jens@20: #pragma mark -
jens@21: @implementation MYCertificateInfo
jens@17: 
jens@17: 
jens@19: static MYOID *kRSAAlgorithmID, *kRSAWithSHA1AlgorithmID, *kCommonNameOID,
jens@25:              *kGivenNameOID, *kSurnameOID, *kDescriptionOID, *kEmailOID;
jens@17: 
jens@17: 
jens@17: + (void) initialize {
jens@19:     if (!kEmailOID) {
jens@19:         kRSAAlgorithmID = [[MYOID alloc] initWithComponents: (UInt32[]){1, 2, 840, 113549, 1, 1, 1,}
jens@19:                                                       count: 7];
jens@19:         kRSAWithSHA1AlgorithmID = [[MYOID alloc] initWithComponents: (UInt32[]){1, 2, 840, 113549, 1, 1, 5}
jens@19:                                                               count: 7];
jens@19:         kCommonNameOID = [[MYOID alloc] initWithComponents: (UInt32[]){2, 5, 4, 3}
jens@19:                                                      count: 4];
jens@19:         kGivenNameOID = [[MYOID alloc] initWithComponents: (UInt32[]){2, 5, 4, 42}
jens@19:                                                     count: 4];
jens@19:         kSurnameOID = [[MYOID alloc] initWithComponents: (UInt32[]){2, 5, 4, 4}
jens@19:                                                   count: 4];
jens@19:         kDescriptionOID = [[MYOID alloc] initWithComponents: (UInt32[]){2, 5, 4, 13}
jens@26:                                                 count: 4];
jens@19:         kEmailOID = [[MYOID alloc] initWithComponents: (UInt32[]){1, 2, 840, 113549, 1, 9, 1}
jens@19:                                                 count: 7];
jens@17:     }
jens@21: }
jens@21: 
jens@21: 
jens@21: - (id) initWithRoot: (NSArray*)root
jens@21: {
jens@21:     self = [super init];
jens@21:     if (self != nil) {
jens@21:         _root = [root retain];
jens@21:     }
jens@21:     return self;
jens@17: }
jens@17: 
jens@17: + (NSString*) validate: (id)root {
jens@17:     NSArray *top = $castIf(NSArray,root);
jens@17:     if (top.count < 3)
jens@17:         return @"Too few top-level components";
jens@17:     NSArray *info = $castIf(NSArray, [top objectAtIndex: 0]);
jens@17:     if (info.count < 7)
jens@17:         return @"Too few identity components";
jens@17:     MYASN1Object *version = $castIf(MYASN1Object, [info objectAtIndex: 0]);
jens@17:     if (!version || version.tag != 0)
jens@17:         return @"Missing or invalid version";
jens@17:     NSArray *versionComps = $castIf(NSArray, version.components);
jens@17:     if (!versionComps || versionComps.count != 1)
jens@17:         return @"Invalid version";
jens@17:     NSNumber *versionNum = $castIf(NSNumber, [versionComps objectAtIndex: 0]);
jens@17:     if (!versionNum || versionNum.intValue < 0 || versionNum.intValue > 2)
jens@17:         return @"Unrecognized version number";
jens@17:     return nil;
jens@17: }
jens@17: 
jens@17: 
jens@17: - (id) initWithCertificateData: (NSData*)data error: (NSError**)outError;
jens@17: {
jens@21:     if (outError) *outError = nil;
jens@21:     id root = MYBERParse(data,outError);
jens@21:     NSString *errorMsg = [[self class] validate: root];
jens@21:     if (errorMsg) {
jens@21:         if (outError && !*outError)
jens@21:             *outError = MYError(2, MYASN1ErrorDomain, @"Invalid certificate: %@", errorMsg);
jens@21:         [self release];
jens@21:         return nil;
jens@17:     }
jens@21: 
jens@24:     self = [self initWithRoot: root];
jens@24:     if (self) {
jens@24:         _data = [data copy];
jens@24:     }
jens@24:     return self;
jens@17: }
jens@17: 
jens@17: - (void) dealloc
jens@17: {
jens@17:     [_root release];
jens@24:     [_data release];
jens@17:     [super dealloc];
jens@17: }
jens@17: 
jens@21: - (BOOL) isEqual: (id)object {
jens@21:     return [object isKindOfClass: [MYCertificateInfo class]]
jens@21:         && [_root isEqual: ((MYCertificateInfo*)object)->_root];
jens@21: }
jens@17: 
jens@19: - (NSArray*) _info       {return $castIf(NSArray,$atIf(_root,0));}
jens@17: 
jens@19: - (NSArray*) _validDates {return $castIf(NSArray, [self._info objectAtIndex: 4]);}
jens@17: 
jens@21: @synthesize _root;
jens@19: 
jens@19: 
jens@19: - (NSDate*) validFrom       {return $castIf(NSDate, $atIf(self._validDates, 0));}
jens@19: - (NSDate*) validTo         {return $castIf(NSDate, $atIf(self._validDates, 1));}
jens@20: 
jens@20: - (MYCertificateName*) subject {
jens@20:     return [[[MYCertificateName alloc] _initWithComponents: [self._info objectAtIndex: 5]] autorelease];
jens@20: }
jens@20: 
jens@20: - (MYCertificateName*) issuer {
jens@20:     return [[[MYCertificateName alloc] _initWithComponents: [self._info objectAtIndex: 3]] autorelease];
jens@20: }
jens@19: 
jens@19: - (BOOL) isSigned           {return [_root count] >= 3;}
jens@19: 
jens@19: - (BOOL) isRoot {
jens@19:     id issuer = $atIf(self._info,3);
jens@19:     return $equal(issuer, $atIf(self._info,5)) || $equal(issuer, $array());
jens@19: }
jens@19: 
jens@19: 
jens@26: - (NSData*) subjectPublicKeyData {
jens@19:     NSArray *keyInfo = $cast(NSArray, $atIf(self._info, 6));
jens@17:     MYOID *keyAlgorithmID = $castIf(MYOID, $atIf($castIf(NSArray,$atIf(keyInfo,0)), 0));
jens@17:     if (!$equal(keyAlgorithmID, kRSAAlgorithmID))
jens@17:         return nil;
jens@26:     return $cast(MYBitString, $atIf(keyInfo, 1)).bits;
jens@26: }
jens@26: 
jens@26: - (MYPublicKey*) subjectPublicKey {
jens@26:     NSData *keyData = self.subjectPublicKeyData;
jens@17:     if (!keyData) return nil;
jens@26:     return [[[MYPublicKey alloc] initWithKeyData: keyData] autorelease];
jens@17: }
jens@17: 
jens@24: - (NSData*) signedData {
jens@24:     if (!_data)
jens@24:         return nil;
jens@24:     // The root object is a sequence; we want to extract the 1st object of that sequence.
jens@24:     const UInt8 *certStart = _data.bytes;
jens@24:     const UInt8 *start = MYBERGetContents(_data, nil);
jens@24:     if (!start) return nil;
jens@24:     size_t length = MYBERGetLength([NSData dataWithBytesNoCopy: (void*)start
jens@24:                                                         length: _data.length - (start-certStart)
jens@24:                                                   freeWhenDone: NO],
jens@24:                                    NULL);
jens@24:     if (length==0)
jens@24:         return nil;
jens@24:     return [NSData dataWithBytes: start length: (start + length - certStart)];
jens@24: }
jens@24: 
jens@24: - (MYOID*) signatureAlgorithmID {
jens@24:     return $castIf(MYOID, $atIf($castIf(NSArray,$atIf(_root,1)), 0));
jens@24: }
jens@24: 
jens@24: - (NSData*) signature {
jens@24:     id signature = $atIf(_root,2);
jens@24:     if ([signature isKindOfClass: [MYBitString class]])
jens@24:         signature = [signature bits];
jens@24:     return $castIf(NSData,signature);
jens@24: }
jens@24: 
jens@24: - (BOOL) verifySignatureWithKey: (MYPublicKey*)issuerPublicKey {
jens@24:     if (!$equal(self.signatureAlgorithmID, kRSAWithSHA1AlgorithmID))
jens@24:         return NO;
jens@24:     NSData *signedData = self.signedData;
jens@24:     NSData *signature = self.signature;
jens@24:     return signedData && signature && [issuerPublicKey verifySignature: signature ofData: signedData];
jens@24: }
jens@24: 
jens@24: 
jens@21: @end
jens@17: 
jens@17: 
jens@17: 
jens@17: 
jens@19: #pragma mark -
jens@21: @implementation MYCertificateRequest
jens@19: 
jens@21: - (id) initWithPublicKey: (MYPublicKey*)publicKey {
jens@21:     Assert(publicKey);
jens@21:     id empty = [NSNull null];
jens@25:     id version = [[MYASN1Object alloc] initWithTag: 0 
jens@25:                                            ofClass: 2
jens@25:                                         components: $array($object(kCertRequestVersionNumber - 1))];
jens@21:     NSArray *root = $array( $marray(version,
jens@21:                                     empty,       // serial #
jens@21:                                     $array(kRSAAlgorithmID),
jens@21:                                     $marray(),
jens@21:                                     $marray(empty, empty),
jens@21:                                     $marray(),
jens@21:                                     $array( $array(kRSAAlgorithmID, empty),
jens@21:                                            [MYBitString bitStringWithData: publicKey.keyData] ) ) );
jens@21:     self = [super initWithRoot: root];
jens@21:     [version release];
jens@23:     if (self) {
jens@23:         _publicKey = publicKey.retain;
jens@23:     }
jens@19:     return self;
jens@19: }
jens@23:     
jens@23: - (void) dealloc
jens@23: {
jens@23:     [_publicKey release];
jens@23:     [super dealloc];
jens@23: }
jens@23: 
jens@19: 
jens@21: - (NSDate*) validFrom       {return [super validFrom];}
jens@21: - (NSDate*) validTo         {return [super validTo];}
jens@19: 
jens@19: - (void) setValidFrom: (NSDate*)validFrom {
jens@19:     [(NSMutableArray*)self._validDates replaceObjectAtIndex: 0 withObject: validFrom];
jens@19: }
jens@19: 
jens@19: - (void) setValidTo: (NSDate*)validTo {
jens@19:     [(NSMutableArray*)self._validDates replaceObjectAtIndex: 1 withObject: validTo];
jens@19: }
jens@19: 
jens@19: 
jens@21: - (void) fillInValues {
jens@19:     NSMutableArray *info = (NSMutableArray*)self._info;
jens@19:     // Set serial number if there isn't one yet:
jens@19:     if (!$castIf(NSNumber, [info objectAtIndex: 1])) {
jens@19:         UInt64 serial = floor(CFAbsoluteTimeGetCurrent() * 1000);
jens@19:         [info replaceObjectAtIndex: 1 withObject: $object(serial)];
jens@19:     }
jens@19:     
jens@19:     // Set up valid date range if there isn't one yet:
jens@19:     NSDate *validFrom = self.validFrom;
jens@19:     if (!validFrom)
jens@19:         validFrom = self.validFrom = [NSDate date];
jens@19:     NSDate *validTo = self.validTo;
jens@19:     if (!validTo)
jens@19:         self.validTo = [validFrom addTimeInterval: kDefaultExpirationTime]; 
jens@21: }
jens@21: 
jens@21: 
jens@21: - (NSData*) requestData: (NSError**)outError {
jens@21:     [self fillInValues];
jens@21:     return [MYDEREncoder encodeRootObject: self._info error: outError];
jens@21: }
jens@21: 
jens@21: 
jens@21: - (NSData*) selfSignWithPrivateKey: (MYPrivateKey*)privateKey 
jens@21:                              error: (NSError**)outError 
jens@21: {
jens@21:     AssertEqual(privateKey.publicKey, _publicKey);  // Keys must form a pair
jens@19:     
jens@21:     // Copy subject to issuer:
jens@21:     NSMutableArray *info = (NSMutableArray*)self._info;
jens@21:     [info replaceObjectAtIndex: 3 withObject: [info objectAtIndex: 5]];
jens@21:     
jens@21:     // Sign the request:
jens@21:     NSData *dataToSign = [self requestData: outError];
jens@19:     if (!dataToSign)
jens@21:         return nil;
jens@21:     MYBitString *signature = [MYBitString bitStringWithData: [privateKey signData: dataToSign]];
jens@19:     
jens@21:     // Generate and encode the certificate:
jens@21:     NSArray *root = $array(info, 
jens@21:                            $array(kRSAWithSHA1AlgorithmID, [NSNull null]),
jens@21:                            signature);
jens@21:     return [MYDEREncoder encodeRootObject: root error: outError];
jens@21: }
jens@21: 
jens@21: 
jens@21: - (MYIdentity*) createSelfSignedIdentityWithPrivateKey: (MYPrivateKey*)privateKey
jens@21:                                                  error: (NSError**)outError
jens@21: {
jens@23:     Assert(privateKey.keychain!=nil);
jens@21:     NSData *certData = [self selfSignWithPrivateKey: privateKey error: outError];
jens@21:     if (!certData)
jens@21:         return nil;
jens@21:     MYCertificate *cert = [privateKey.keychain importCertificate: certData];
jens@21:     Assert(cert!=nil);
jens@23:     Assert(cert.keychain!=nil);
jens@23:     AssertEqual(cert.publicKey.keyData, _publicKey.keyData);
jens@21:     MYIdentity *identity = cert.identity;
jens@21:     Assert(identity!=nil);
jens@21:     return identity;
jens@19: }
jens@19: 
jens@19: 
jens@17: @end
jens@17: 
jens@17: 
jens@17: 
jens@20: #pragma mark -
jens@20: @implementation MYCertificateName
jens@20: 
jens@20: - (id) _initWithComponents: (NSArray*)components
jens@20: {
jens@20:     self = [super init];
jens@20:     if (self != nil) {
jens@20:         _components = [components retain];
jens@20:     }
jens@20:     return self;
jens@20: }
jens@20: 
jens@20: - (void) dealloc
jens@20: {
jens@20:     [_components release];
jens@20:     [super dealloc];
jens@20: }
jens@20: 
jens@20: - (BOOL) isEqual: (id)object {
jens@20:     return [object isKindOfClass: [MYCertificateName class]]
jens@20:         && [_components isEqual: ((MYCertificateName*)object)->_components];
jens@20: }
jens@20: 
jens@20: - (NSArray*) _pairForOID: (MYOID*)oid {
jens@20:     for (id nameEntry in _components) {
jens@20:         for (id pair in $castIf(NSSet,nameEntry)) {
jens@20:             if ([pair isKindOfClass: [NSArray class]] && [pair count] == 2) {
jens@20:                 if ($equal(oid, [pair objectAtIndex: 0]))
jens@20:                     return pair;
jens@20:             }
jens@20:         }
jens@20:     }
jens@20:     return nil;
jens@20: }
jens@20: 
jens@20: - (NSString*) stringForOID: (MYOID*)oid {
jens@20:     return [[self _pairForOID: oid] objectAtIndex: 1];
jens@20: }
jens@20: 
jens@20: - (void) setString: (NSString*)value forOID: (MYOID*)oid {
jens@20:     NSMutableArray *pair = (NSMutableArray*) [self _pairForOID: oid];
jens@26:     if (pair) {
jens@26:         if (value)
jens@26:             [pair replaceObjectAtIndex: 1 withObject: value];
jens@26:         else
jens@26:             Assert(NO,@"-setString:forOID: removing strings is unimplemented");//FIX
jens@26:     } else {
jens@26:         if (value)
jens@26:             [(NSMutableArray*)_components addObject: [NSSet setWithObject: $marray(oid,value)]];
jens@26:     }
jens@20: }
jens@20: 
jens@20: - (NSString*) commonName    {return [self stringForOID: kCommonNameOID];}
jens@20: - (NSString*) givenName     {return [self stringForOID: kGivenNameOID];}
jens@20: - (NSString*) surname       {return [self stringForOID: kSurnameOID];}
jens@20: - (NSString*) nameDescription {return [self stringForOID: kDescriptionOID];}
jens@20: - (NSString*) emailAddress  {return [self stringForOID: kEmailOID];}
jens@20: 
jens@20: - (void) setCommonName: (NSString*)commonName   {[self setString: commonName forOID: kCommonNameOID];}
jens@20: - (void) setGivenName: (NSString*)givenName     {[self setString: givenName forOID: kGivenNameOID];}
jens@20: - (void) setSurname: (NSString*)surname         {[self setString: surname forOID: kSurnameOID];}
jens@20: - (void) setNameDescription: (NSString*)desc    {[self setString: desc forOID: kDescriptionOID];}
jens@20: - (void) setEmailAddress: (NSString*)email      {[self setString: email forOID: kEmailOID];}
jens@20: 
jens@20: 
jens@20: @end
jens@20: 
jens@20: 
jens@21: /*
jens@21:  Copyright (c) 2009, Jens Alfke <jens@mooseyard.com>. All rights reserved.
jens@17:  
jens@21:  Redistribution and use in source and binary forms, with or without modification, are permitted
jens@21:  provided that the following conditions are met:
jens@21:  
jens@21:  * Redistributions of source code must retain the above copyright notice, this list of conditions
jens@21:  and the following disclaimer.
jens@21:  * Redistributions in binary form must reproduce the above copyright notice, this list of conditions
jens@21:  and the following disclaimer in the documentation and/or other materials provided with the
jens@21:  distribution.
jens@21:  
jens@21:  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR
jens@21:  IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND 
jens@21:  FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRI-
jens@21:  BUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
jens@21:  (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR 
jens@21:   PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 
jens@21:  CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF 
jens@21:  THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
jens@21:  */