Documentation
¶
Overview ¶
Package entry defines types related to TBSCertificateLogEntry and MTCLogEntry from https://ietf-plants-wg.github.io/merkle-tree-certs/draft-ietf-plants-merkle-tree-certs.html#name-log-entries, and the entry bundle encoding from https://github.com/C2SP/C2SP/blob/main/tlog-tiles.md#log-entries
The concepts fit together like so:
Entry bundles contain MTCLogEntry. MTCLogEntry contains (typically) TBSCertificateLogEntry.
TBSCertificateLogEntry is part of the X.509 layer. It will be used to build certificates.
MTCLogEntry is part of the Merkle tree layer and is what gets hashed. It provides type switching (needed for null_entry) and extensibility.
Entry bundles are part of the tile storage layer. They provide a simple length-prefixed framing so that MTCLogEntries can be concatenated unambiguously.
Note that neither TBSCertificateLogEntry nor MTCLogEntry carries its own length, since they will always be wrapped or converted into a format that has length information: an entry bundle or an X.509 certificate.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type BundleBuilder ¶
type BundleBuilder struct {
// contains filtered or unexported fields
}
BundleBuilder appends a sequence of MTCLogEntry to a buffer as an entry bundle.
func NewBundleBuilder ¶
func NewBundleBuilder(buf []byte) *BundleBuilder
NewBundleBuilder returns a BundleBuilder that appends to the given buffer. Like cryptobyte.Builder, the slice will be reallocated if its capacity is exceeded. Use Bytes to get the final buffer.
func (*BundleBuilder) Add ¶
func (b *BundleBuilder) Add(mtcLogEntry *MTCLogEntry)
Add appends a single MTCLogEntry, with its length prefix, to the builder.
func (*BundleBuilder) Bytes ¶
func (b *BundleBuilder) Bytes() ([]byte, error)
Bytes returns the bundle's bytes.
type BundleReader ¶
type BundleReader struct {
// contains filtered or unexported fields
}
BundleReader reads records of MTCLogEntry from the underlying buffer in the entry bundle format.
func NewBundleReader ¶
func NewBundleReader(buf []byte) *BundleReader
NewBundleReader returns a new BundleReader.
func (*BundleReader) ReadEntry ¶
func (br *BundleReader) ReadEntry() (*MTCLogEntry, []byte, error)
ReadEntry reads the bytes of a single entry.
Returns the parsed MTCLogEntry as well as its bytes, both of which reference the same memory as the original buffer.
Returns MTCLogEntry{}, nil, io.EOF when there is no more to read.
type MTCLogEntry ¶
type MTCLogEntry struct {
// contains filtered or unexported fields
}
MTCLogEntry implements the corresponding structure from https://ietf-plants-wg.github.io/merkle-tree-certs/draft-ietf-plants-merkle-tree-certs.html#name-log-entries
struct {
MTCLogEntryExtension extensions<0..2^16-1>;
MTCLogEntryType type;
select (type) {
case null_entry: Empty;
case tbs_cert_entry: opaque tbs_cert_entry_data[N];
/* May be extended with future types. */
}
} MTCLogEntry;
The zero value represents a null_entry.
func FromX509 ¶
func FromX509(in []byte, hash crypto.Hash) (*MTCLogEntry, error)
FromX509 takes a DER-encoded X.509 certificate and transforms it into a TBSCertificateLogEntry, then returns a MTCLogEntry wrapping that TBSCertificateLogEntry.
func (*MTCLogEntry) Marshal ¶
func (mtcle *MTCLogEntry) Marshal() ([]byte, error)
Marshal returns the encoding of its receiver.
Rejects unknown MTCLogEntryTypes. Rejects non-empty MTCLogEntry.extensions.
func (*MTCLogEntry) TBS ¶
func (mtcle *MTCLogEntry) TBS() []byte
TBS returns the TBSCertificateLogEntry bytes if Type is tbs_cert_entry, or nil otherwise.
func (*MTCLogEntry) ToTBSCertificate ¶ added in v0.20260729.0
func (mtcle *MTCLogEntry) ToTBSCertificate( serial uint64, subjectPublicKeyInfo []byte, hash crypto.Hash, ) ([]byte, error)
ToTBSCertificate generates a TBSCertificate corresponding to a TBSCertificateLogEntry.
`serial` must be the entry index combined with log number: (log_number << 48) | index. `subjectPublicKeyInfo` must be a DER-encoded subjectPublicKeyInfo (including tag and length). `hash` must be the CA's hash function.
If the MTCLogEntry does not contain a TBSCertificateLogEntry, error.
Checks `subjectPublicKeyInfo` against `subjectPublicKeyInfoHash` and `subjectPublicKeyAlgorithm` from the TBSCertificateLogEntry.
Source Files