Egothor/ZeroEcho
2
0
Fork 0
Code Issues 15 Pull Requests Actions Packages Projects 1 Releases 4 Wiki Activity

feat(pki): add extensible X.509 algorithm bindings

Browse Source 
Add an immutable X.509 binding registry for sealed standard mappings,
versioned ZeroEcho private OIDs and explicitly enabled deployer bindings.

Integrate binding commitments with profiles, issuance, verification, CRLs,
PKI sessions and typed CLI operations.
This commit is contained in:
Leo Galambos
2026-08-04 18:22:00 +02:00
parent 5c66a2b25b
commit f0dfb133f2
63 changed files with 2879 additions and 112 deletions
Download Patch File Download Diff File Expand all files Collapse all files

61
app/src/test/java/zeroecho/pki/cli/PkiCliTest.java
View File

@@ -168,6 +168,33 @@ class PkiCliTest {
System.out.println("...ok");
}
@Test
void bindingAdministrationUsesDirectAndBatchTypedExecution() throws IOException {
System.out.println("bindingAdministrationUsesDirectAndBatchTypedExecution");
Path configuration = configuration("bindings");
ByteArrayOutputStream listed = new ByteArrayOutputStream();
int listCode = PkiCli.execute(new String[] { "algorithm.binding.list", "--limit", "64", "--config",
configuration.toString(), "--output", "json" }, listed);
String bindingId = "zeroecho.private.sphincs-plus-default.certificate-signature.v1";
Path workflow = plan("binding-workflow.json", """
{"version":1,"failurePolicy":"FAIL_FAST","operations":[
{"id":"binding","operation":"algorithm.binding.inspect","arguments":{"bindingId":"%s"}},
{"id":"validate","operation":"algorithm.binding.validate","arguments":{"bindingId":"${binding.bindingId}","bindingCommitment":"${binding.bindingCommitment}"}}
]}
""".formatted(bindingId));
ByteArrayOutputStream batch = new ByteArrayOutputStream();
int batchCode = PkiCli.execute(new String[] { "run", workflow.toString(), "--config",
configuration.toString(), "--output", "json" }, batch);
String output = listed.toString(StandardCharsets.UTF_8) + batch.toString(StandardCharsets.UTF_8);
System.out.println("...outputBytes=" + output.length());
assertEquals(PkiExitCodes.SUCCESS, listCode);
assertEquals(PkiExitCodes.SUCCESS, batchCode);
assertTrue(output.contains("1.3.6.1.4.1.31424.1.1.3"));
assertTrue(output.contains("ZEROECHO_PRIVATE"));
assertFalse(output.contains("codecClass"));
System.out.println("...ok");
}
@Test
void versionTwoConfigurationKeepsCapabilitiesExplicit() throws IOException {
System.out.println("versionTwoConfigurationKeepsCapabilitiesExplicit");
@@ -393,6 +420,40 @@ class PkiCliTest {
throw new UnsupportedOperationException();
}
@Override
public zeroecho.pki.api.algorithm.X509AlgorithmBindingRegistry algorithmBindings() {
return new zeroecho.pki.api.algorithm.X509AlgorithmBindingRegistry() {
@Override
public java.util.List<zeroecho.pki.api.algorithm.X509AlgorithmBinding> bindings() {
return java.util.List.of();
}
@Override
public java.util.Optional<zeroecho.pki.api.algorithm.X509AlgorithmBinding> find(
String bindingId) {
return java.util.Optional.empty();
}
@Override
public java.util.Optional<zeroecho.pki.api.algorithm.X509AlgorithmBinding> standard(
zeroecho.core.spec.AlgorithmIdentity identity,
zeroecho.pki.api.algorithm.X509AlgorithmBinding.Role role) {
return java.util.Optional.empty();
}
@Override
public String commitment() {
return "test-registry";
}
@Override
public zeroecho.pki.api.algorithm.X509AlgorithmBinding require(String bindingId,
String expectedCommitment) {
throw new IllegalArgumentException("inactive test binding");
}
};
}
@Override
public zeroecho.pki.application.PkiOperationExecutor operations() {
return (operation, cancellation) -> outcome(operation);

2
app/src/test/resources/pki-administration-config.json
View File

@@ -1,5 +1,5 @@
{
"version": 2,
"version": 3,
"store": {
"provider": "fs",
"properties": {

15
app/src/test/resources/pki-administration-plan.json
View File

@@ -7,6 +7,21 @@
"operation": "configuration.validate",
"arguments": {}
},
{
"id": "inspect-binding",
"operation": "algorithm.binding.inspect",
"arguments": {
"bindingId": "zeroecho.private.sphincs-plus-default.certificate-signature.v1"
}
},
{
"id": "validate-binding",
"operation": "algorithm.binding.validate",
"arguments": {
"bindingId": "${inspect-binding.bindingId}",
"bindingCommitment": "${inspect-binding.bindingCommitment}"
}
},
{
"id": "list-publications",
"operation": "publication.list",

1
app/src/test/resources/pki-private-sphincs-profile.json Normal file
View File

@@ -0,0 +1 @@
{"schemaVersion":3,"certificateType":"END_ENTITY","profileId":"server-tls-sphincs","profileVersion":1,"formatId":"x509","displayName":"Server TLS SPHINCS+ private binding","maxValidity":"PT8760H","algorithmBindings":{"mode":"EXPLICIT","subjectPublicKey":{"bindingId":"zeroecho.private.sphincs-plus-default.spki.v1","semanticCommitment":"zeroecho.private.sphincs-plus-default.spki.v1|zealg:2:10:public_key8:zeroecho12:sphincs-plus16:zeroecho.builtin6:bm9uZQ|SUBJECT_PUBLIC_KEY|1.3.6.1.4.1.31424.1.1.1|1|ABSENT|NESTED_SPKI_DER|NOT_APPLICABLE|ZEROECHO_ECOSYSTEM"},"csrSignature":{"bindingId":"zeroecho.private.sphincs-plus-default.csr-signature.v1","semanticCommitment":"zeroecho.private.sphincs-plus-default.csr-signature.v1|zealg:2:9:signature8:zeroecho12:sphincs-plus16:zeroecho.builtin6:bm9uZQ|CSR_SIGNATURE|1.3.6.1.4.1.31424.1.1.2|1|ABSENT|NOT_APPLICABLE|OPAQUE|ZEROECHO_ECOSYSTEM"},"certificateSignature":{"bindingId":"zeroecho.private.sphincs-plus-default.certificate-signature.v1","semanticCommitment":"zeroecho.private.sphincs-plus-default.certificate-signature.v1|zealg:2:9:signature8:zeroecho12:sphincs-plus16:zeroecho.builtin6:bm9uZQ|CERTIFICATE_SIGNATURE|1.3.6.1.4.1.31424.1.1.3|1|ABSENT|NOT_APPLICABLE|OPAQUE|ZEROECHO_ECOSYSTEM"}},"subject":{"allowEmpty":true,"rules":[{"oid":"2.5.4.3","source":"REQUESTER","minimumOccurrences":0,"maximumOccurrences":1,"maximumUtf8Bytes":253}]},"subjectAlternativeNames":{"minimumTotal":1,"maximumTotal":64,"serviceIdentityRequired":true,"emailIdentityRequired":false,"criticalWhenSubjectNonEmpty":false,"rules":[{"type":"DNS_NAME","minimumOccurrences":0,"maximumOccurrences":64,"wildcardAllowed":false},{"type":"IP_ADDRESS","minimumOccurrences":0,"maximumOccurrences":16,"ipv4Allowed":true,"ipv6Allowed":true}]},"leafCertificate":{"basicConstraintsCritical":true,"keyUsageCritical":true,"keyUsage":["DIGITAL_SIGNATURE"],"extendedKeyUsageCritical":false,"extendedKeyUsage":["1.3.6.1.5.5.7.3.1"],"allowedKeyAlgorithms":["SPHINCS+"]}}