EvidenceRecordVerifier.cpp

Go to the documentation of this file.

//PKIF includes
#include "pkif.h"
#include "PKIFAlgorithm.h"
#include "PKIFCryptUtils.h"

//PKIFCMS includes
#include "PKIFCMS.h"

//PKIFERS includes
#include "ArchiveTimestamp.h"
#include "EvidenceRecord.h"
#include "EvidenceRecordVerifier.h"
#include "IPKIFSecuritySuitability.h"

//PKIFTSP includes
#include "PKIFTSP.h"

#include <stdexcept>
#include <cstring>
#include <iterator>

//*****************************************************************************
//  Memory Helper and Impl
//*****************************************************************************
struct PKIFEvidenceRecordVerifierImpl 
{
    //data alternatives
    CPKIFBufferPtr m_orig;
    CPKIFParallelHashPtr m_ph;

    IPKIFMediatorPtr m_currentMediator;
    CPKIFPathSettingsPtr m_currentPS;

    IPKIFSecuritySuitabilityPtr m_ssp;

    std::vector<CPKIFExMediatorPtr> m_archiveMediators;
    std::vector<CPKIFExPathSettingsPtr> m_archivePathSettings;

    CPKIFBufferPtr GetHash(PKIFCRYPTO::HASH_ALG ha, IPKIFMediatorPtr& m);

    IPKIFMediatorPtr GetMediator(CPKIFTimePtr& toi);
    CPKIFPathSettingsPtr GetPathSettings(CPKIFTimePtr& toi);

    SeqResultsPtr m_seqResults;
};
IPKIFMediatorPtr PKIFEvidenceRecordVerifierImpl::GetMediator(CPKIFTimePtr& toi)
{
    IPKIFMediatorPtr empty;
    CPKIFTimePtr highWater;

    //walk the list of ex-meds and see if the time of interest falls into any of those
    std::vector<CPKIFExMediatorPtr>::iterator pos;
    std::vector<CPKIFExMediatorPtr>::iterator end = m_archiveMediators.end();
    for(pos = m_archiveMediators.begin(); pos != end; ++pos)
    {
        CPKIFTimePtr notBefore = (*pos)->first->notBefore();
        CPKIFTimePtr notAfter = (*pos)->first->notAfter();

        if(*notBefore <= *toi && *toi <= *notAfter)
            return (*pos)->second;

        if(!highWater || *highWater < *notAfter)
            highWater = notAfter;
    }

    //if not, then either the time of interest is current enough to use current meds or we fail and
    //return NULL.
    if(m_archiveMediators.empty())
        return m_currentMediator; //only one
    else if(highWater && *toi > *highWater)
        return m_currentMediator;
    else
        return empty;
}
CPKIFPathSettingsPtr PKIFEvidenceRecordVerifierImpl::GetPathSettings(CPKIFTimePtr& toi)
{
    CPKIFPathSettingsPtr empty;
    CPKIFTimePtr highWater;

    //walk the list of ex-meds and see if the time of interest falls into any of those
    std::vector<CPKIFExPathSettingsPtr>::iterator pos;
    std::vector<CPKIFExPathSettingsPtr>::iterator end = m_archivePathSettings.end();
    for(pos = m_archivePathSettings.begin(); pos != end; ++pos)
    {
        CPKIFTimePtr notBefore = (*pos)->first->notBefore();
        CPKIFTimePtr notAfter = (*pos)->first->notAfter();

        if(*notBefore <= *toi && *toi <= *notAfter)
            return (*pos)->second;

        if(!highWater || *highWater < *notAfter)
            highWater = notAfter;
    }

    //if not, then either the time of interest is current enough to use current settings or 
    //we fail and return NULL.
    if(m_archivePathSettings.empty())
        return m_currentPS;
    else if(*toi > *highWater)
        return m_currentPS;
    else
        return empty;
}
CPKIFBufferPtr PKIFEvidenceRecordVerifierImpl::GetHash(PKIFCRYPTO::HASH_ALG ha, IPKIFMediatorPtr& m)
{
    CPKIFBufferPtr emptyBP;

    if(m_orig != (CPKIFBuffer*)NULL)
    {
        if(m != (IPKIFMediator*)NULL)
        {
            IPKIFCryptoMisc* cm = m->GetMediator<IPKIFCryptoMisc>();
            if(cm)
            {
                IPKIFHashContext* hc = cm->HashInit(ha);
                if(hc)
                {
                    CPKIFBufferPtr newBP(new CPKIFBuffer);
                    unsigned char* hashResult = newBP->AllocateBuffer(ha);
                    int resultLen = ha;
                    cm->HashUpdate(hc, (unsigned char*)m_orig->GetBuffer(), m_orig->GetLength());
                    cm->HashFinal(hc, hashResult, &resultLen);
                    delete hc;
                    return newBP;
                }
            }
        }
    }
    else if(m_ph != (CPKIFParallelHash*)NULL)
    {
        HashInfo* hi = m_ph->GetHashInfo(ha);
        if(NULL != hi)
        {
            CPKIFBufferPtr newBP(new CPKIFBuffer(hi->m_hashResult, hi->m_hashAlg));
            return newBP;
        }
    }

    return emptyBP;
}

CPKIFTimePtr GetTimeFromTimestamp(
    CPKIFContentInfoPtr& ci)
{
    CPKIFTimePtr emptyTime;

    //declare a TSTInfo object and try to parse the contents from the ContentInfo
    CPKIFTSTInfoPtr tstInfo;

    CPKIFSignedData sd;

    try
    {
        //try to parse the contents from the ContentInfo
        CPKIFBufferPtr content = ci->GetContent();
        sd.Decode(content);
    }
    catch(CPKIFException&)
    {
        return emptyTime;
    }

    CPKIFEncapsulatedContentInfoPtr ecip = sd.GetEncapsulatedContent();

    try
    {
        CPKIFTSTInfoPtr tmpTstInfo(new CPKIFTSTInfo);

        //try to parse the contents from the ContentInfo
        CPKIFBufferPtr content = ecip->GetContent();
        tmpTstInfo->Decode(content);

        tstInfo = tmpTstInfo;
    }
    catch(CPKIFException&)
    {
        return emptyTime;
    }

    return tstInfo->GetGeneralizedTime();
}
CPKIFAlgorithmIdentifierPtr GetHashAlgorithmFromTimestamp(
    CPKIFContentInfoPtr& ci)
{
    CPKIFAlgorithmIdentifierPtr emptyHashAlg;

    //declare a TSTInfo object and try to parse the contents from the ContentInfo
    CPKIFTSTInfoPtr tstInfo;

    CPKIFSignedData sd;

    try
    {
        //try to parse the contents from the ContentInfo
        CPKIFBufferPtr content = ci->GetContent();
        sd.Decode(content);
    }
    catch(CPKIFException&)
    {
        return emptyHashAlg;
    }

    CPKIFEncapsulatedContentInfoPtr ecip = sd.GetEncapsulatedContent();

    try
    {
        CPKIFTSTInfoPtr tmpTstInfo(new CPKIFTSTInfo);

        //try to parse the contents from the ContentInfo
        CPKIFBufferPtr content = ecip->GetContent();
        tmpTstInfo->Decode(content);

        tstInfo = tmpTstInfo;
    }
    catch(CPKIFException&)
    {
        return emptyHashAlg;
    }

    //get the message imprint from the timestamp
    CPKIFMessageImprintPtr mi = tstInfo->GetMessageImprint();
    if(!mi)
        return emptyHashAlg;

    //and return the hash algorithm from it
    return mi->GetHashAlgorithm();
}

CPKIFBufferPtr HashBuffer(
    CPKIFAlgorithm* ha,
    CPKIFBufferPtr& bp,
    IPKIFMediatorPtr& m)
{
    CPKIFBufferPtr rv;
    IPKIFCryptoMisc* cm = NULL;

    //first try to get interface from mediator set
    if(m)
        cm = m->GetMediator<IPKIFCryptoMisc>();

    //failing that, get default platform appropriate interface
    if(!cm)
        cm = GetPlatformCryptoMisc();

    //failing that, fail
    if(!cm)
        return rv;

    //create a buffer to return
    CPKIFBufferPtr tmpBP(new CPKIFBuffer);
    IPKIFHashContext* h = NULL;

    try
    {
        //create a hash context for the given alg
        h = cm->HashInit(ha->HashAlg());

        cm->HashUpdate(h, (unsigned char*)bp->GetBuffer(), bp->GetLength());
        
        int outBufLen = ha->DigestSize();
        unsigned char* outBuf = tmpBP->AllocateBuffer(outBufLen);

        cm->HashFinal(h, outBuf, &outBufLen);

        delete h; h = NULL;
    }
    catch(CPKIFException&)
    {
        if(h) delete h;
    }
    catch(...)
    {
        if(h) delete h;
    }

    rv = tmpBP;
    return rv;
}

//*****************************************************************************
//  CPKIFEvidenceRecordVerifier implementation
//*****************************************************************************
CPKIFEvidenceRecordVerifier::CPKIFEvidenceRecordVerifier(void) : m_impl(new PKIFEvidenceRecordVerifierImpl)
{
}
CPKIFEvidenceRecordVerifier::~CPKIFEvidenceRecordVerifier(void)
{
    if(m_impl)
        delete m_impl;
}
void CPKIFEvidenceRecordVerifier::SetCurrentMediator(
    IPKIFMediatorPtr& currentMediator)
{
    m_impl->m_currentMediator = currentMediator;
}
IPKIFMediatorPtr CPKIFEvidenceRecordVerifier::GetCurrentMediator()
{
    return m_impl->m_currentMediator;
}
void CPKIFEvidenceRecordVerifier::SetCurrentPathSettings(CPKIFPathSettingsPtr& currentPS)
{
    m_impl->m_currentPS = currentPS;
}
CPKIFPathSettingsPtr CPKIFEvidenceRecordVerifier::GetCurrentPathSettings()
{
    return m_impl->m_currentPS;
}
IPKIFMediatorPtr CPKIFEvidenceRecordVerifier::GetArchiveMediator(CPKIFTimePtr& t)
{
    std::vector<CPKIFExMediatorPtr>::iterator pos;
    std::vector<CPKIFExMediatorPtr>::iterator end = m_impl->m_archiveMediators.end();
    for(pos = m_impl->m_archiveMediators.begin(); pos != end; ++pos)
    {
        CPKIFTimePtr notBefore = (*pos)->first->notBefore();
        CPKIFTimePtr notAfter = (*pos)->first->notAfter();
        if(*t > *notBefore && *t < *notAfter)
            return (*pos)->second;
    }

    IPKIFMediatorPtr empty;
    return empty;
}
void CPKIFEvidenceRecordVerifier::AddArchiveMediator(CPKIFExMediatorPtr& archiveMediator)
{
    m_impl->m_archiveMediators.push_back(archiveMediator);
}
void CPKIFEvidenceRecordVerifier::GetArchiveMediators(
    std::vector<CPKIFExMediatorPtr>& v) const
{
    v.clear();
    copy(m_impl->m_archiveMediators.begin(),m_impl->m_archiveMediators.end(),back_inserter(v));
}
CPKIFPathSettingsPtr CPKIFEvidenceRecordVerifier::GetArchivePathSettings(CPKIFTimePtr& t)
{
    std::vector<CPKIFExPathSettingsPtr>::iterator pos;
    std::vector<CPKIFExPathSettingsPtr>::iterator end = m_impl->m_archivePathSettings.end();
    for(pos = m_impl->m_archivePathSettings.begin(); pos != end; ++pos)
    {
        CPKIFTimePtr notBefore = (*pos)->first->notBefore();
        CPKIFTimePtr notAfter = (*pos)->first->notAfter();
        if(*t > *notBefore && *t < *notAfter)
            return (*pos)->second;
    }

    CPKIFPathSettingsPtr empty;
    return empty;
}
void CPKIFEvidenceRecordVerifier::AddArchivePathSettings(
    CPKIFExPathSettingsPtr& ps)
{
    m_impl->m_archivePathSettings.push_back(ps);
}
void CPKIFEvidenceRecordVerifier::GetArchivePathSettings(
    std::vector<CPKIFExPathSettingsPtr>& v) const
{
    v.clear();
    copy(m_impl->m_archivePathSettings.begin(),m_impl->m_archivePathSettings.end(),back_inserter(v));
}
void CPKIFEvidenceRecordVerifier::SetDataComplete(CPKIFBufferPtr& origData)
{
    m_impl->m_orig = origData;
}
void CPKIFEvidenceRecordVerifier::SetDataHashSet(CPKIFParallelHashPtr& ph)
{
    m_impl->m_ph = ph;
}
CPKIFBufferPtr CPKIFEvidenceRecordVerifier::GetHash(PKIFCRYPTO::HASH_ALG ha, IPKIFMediatorPtr& m)
{
    return m_impl->GetHash(ha, m);
}
void CPKIFEvidenceRecordVerifier::SetSecuritySuitabilityPolicy(const IPKIFSecuritySuitabilityPtr& ssp)
{
    m_impl->m_ssp = ssp;
}
IPKIFSecuritySuitabilityPtr CPKIFEvidenceRecordVerifier::GetSecuritySuitabilityPolicy() const
{
    return m_impl->m_ssp;
}

SeqResultsPtr CPKIFEvidenceRecordVerifier::Verify(CPKIFEvidenceRecordPtr& er)
{
    //the first timestamp to be verified will be the one applied most recently.  this must
    //be valid using currently valid stuff at the current time.
    IPKIFMediatorPtr activeMediator = m_impl->m_currentMediator;
    CPKIFPathSettingsPtr activePathSettings = m_impl->m_currentPS;
    CPKIFTimePtr timeOfInterest = CPKIFTime::CurrentTime();

    //check for non-null inputs
    if(!er)
    {
    }

    //check the version
    if(1 != er->GetVersion())
    {
    }

    //CryptoInfo and EncryptionInfo are not supported - ignore them if present

    //prepare a parallel hash object with the indicated hash algorithms

    //iterate over the evidence record
    CPKIFArchiveTimestampSequencePtr seq = er->GetArchiveTimestampSequence();
    SeqResultsPtr seqResults(new SeqResults);

    CPKIFArchiveTimestampSequence::reverse_iterator rSeqPos = seq->rbegin();
    CPKIFArchiveTimestampSequence::reverse_iterator rSeqEnd = seq->rend();
    while(rSeqPos != rSeqEnd)
    {
        CPKIFArchiveTimestampChainPtr chain = (*rSeqPos);

        ChainResultsPtr cr(new ChainResults);
        seqResults->push_back(cr);

        CPKIFArchiveTimestampChain::reverse_iterator rChainPos = chain->rbegin();
        CPKIFArchiveTimestampChain::reverse_iterator rChainEnd = chain->rend();
        while(rChainPos != rChainEnd)
        {
            CPKIFArchiveTimestampPtr curAts = (*rChainPos);
            CPKIFContentInfoPtr curTimestamp = curAts->GetTimestamp();

            CPKIFAlgorithmIdentifierPtr curHashAlgId = GetHashAlgorithmFromTimestamp(curTimestamp);
            CPKIFAlgorithm* pHa = CPKIFAlgorithm::GetAlg(curHashAlgId->oid());
            PKIFCRYPTO::HASH_ALG curHashAlg = pHa->HashAlg();

            if(m_impl->m_ssp)
            {
                if(!m_impl->m_ssp->IsAlgorithmSuitable(curHashAlgId))
                {
                    throw std::runtime_error("Unsuitable hash algorithm in timestamp.");
                }
            }

            CPKIFTimestampVerifierPtr tv(new CPKIFTimestampVerifier);

            ++rChainPos;
            if(rChainPos == rChainEnd)
            {
                ++rSeqPos;
                if(rSeqPos == rSeqEnd)
                {
                    //this is the first initial timestamp and must be verified against the original data
                    CPKIFBufferPtr hashOfData = GetHash(curHashAlg, activeMediator);
                    tv->SetDataHash(hashOfData, curHashAlg);
                }
                else
                {
                    //this is the first timestamp in this chain and must be verified against the 
                    //preceding element in the sequence, if any, plus the original data
                    chain = *rSeqPos;

                    CPKIFBufferPtr hashOfData = GetHash(curHashAlg, activeMediator);
                    CPKIFBufferPtr hashOfChain = CalculateHashOfArchiveTimestampChain(chain, activeMediator, curHashAlg);

                    CPKIFBufferPtr tmpBuf(new CPKIFBuffer);
                    unsigned char* pTmpBuf = tmpBuf->AllocateBuffer(hashOfData->GetLength() + hashOfChain->GetLength());
                    memcpy(pTmpBuf, hashOfData->GetBuffer(), hashOfData->GetLength());
                    memcpy(pTmpBuf+hashOfData->GetLength(),hashOfChain->GetBuffer(), hashOfChain->GetLength());

                    tv->SetDataComplete(tmpBuf);
                }
            }
            else
            {
                //this is not the first timestamp in this chain and must be verified against
                //the preceding element in the chain
                CPKIFArchiveTimestampPtr prevAts = *rChainPos;

                //need to hash the timestamp field from the prevAts
                CPKIFContentInfoPtr ci = prevAts->GetTimestamp();

                CPKIFBufferPtr encodedTimestamp = ci->Encode();
                tv->SetDataComplete(encodedTimestamp);
            }           

            tv->SetComparisonTime(timeOfInterest);
            tv->SetMediator(activeMediator);
            tv->SetPathSettings(activePathSettings);
            tv->Verify(curTimestamp);

            cr->push_back(tv);

            timeOfInterest = GetTimeFromTimestamp(curTimestamp);
            activeMediator = m_impl->GetMediator(timeOfInterest);
            activePathSettings = m_impl->GetPathSettings(timeOfInterest);
        }
    }

    return seqResults;
}