TimestampVerifier.cpp

Go to the documentation of this file.

#include "AlgorithmIdentifier.h"
#include "Buffer.h"
#include "CRLEntry.h"
#include "Certificate.h"
#include "ContentInfo.h"
#include "Duration.h"
#include "EncapsulatedContentInfo.h"
#include "ExtendedKeyUsage.h"
#include "GottaMatch.h"
#include "IPKIFCryptoMisc.h"
#include "IPKIFHashContext.h"
#include "IPKIFPathValidate.h"
#include "MessageImprint.h"
#include "OCSP.h"
#include "OCSPResponse.h"
#include "OID.h"
#include "PKIFCRLInfo.h"
#include "PKIFCertStatus.h"
#include "PKIFFuncStorage.h"
#include "PKIFMediators.h"
#include "PKIFOCSPInfo.h"
#include "PKIFTSP.h"
#include "PKIFTime.h"
#include "ParallelHash.h"
#include "PathResults.h"
#include "Period.h"
#include "RevocationSource.h"
#include "SignedData.h"
#include "SingleResponse.h"
#include "TSPException.h"
#include "TSTInfo.h"
#include "TimestampVerifier.h"
#include "ToolkitUtils.h"
#include "Validity.h"
#include "pkiftsperrors.h"
#include "SignerInfo.h"
#include "SigningCertificateAttribute.h"
#include "ESSCertId.h"
#include "GeneralName.h"
#include "Name.h"

#include <vector>



struct CPKIFTimestampVerifierImpl
{
    CPKIFTimestampVerifier *m_parent;

    //inputs
    IPKIFMediatorPtr m_externalMediator;                    //use if set by caller
    IPKIFMediatorPtr m_internalMediator;                    //allocated if external is not set
    CMSPathValidationStatus m_verificationStatusMinumum;
    CPKIFPathSettingsPtr m_pathSettings;
    int m_skew;
    CPKIFTimePtr m_time;

    //data-related members
    CPKIFBufferPtr m_orig;
    CPKIFBufferPtr m_hash; 
    PKIFCRYPTO::HASH_ALG m_ha;
    CPKIFParallelHashPtr m_ph;
    CPKIFBufferPtr GetHash(PKIFCRYPTO::HASH_ALG ha);
    CPKIFBufferPtr GetHash(PKIFCRYPTO::HASH_ALG ha, CPKIFBufferPtr buffToHash);

    //outputs
    CMSVerificationStatus m_verificationStatusResult;
    CPKIFCertificatePathPtr m_path;
    CPKIFPathValidationResultsPtr m_pvResults;
    CPKIFCertificatePtr m_tsaCert;
    CPKIFTimePtr m_dateTime;

    void MakeInternalMediator();
};

CPKIFBufferPtr CPKIFTimestampVerifierImpl::GetHash(
    PKIFCRYPTO::HASH_ALG ha)
{
    LOG_STRING_DEBUG("CPKIFTimestampVerifier::GetHash(HASH_ALG ha)", TOOLKIT_TSP_TIMESTAMP_VERIFIER, 0, this);

    CPKIFBufferPtr emptyBP;

    if(m_hash != (CPKIFBuffer*)NULL)
    {
        if(ha == m_ha)
            return m_hash;
        else
            return emptyBP;
    }

    if(m_orig != (CPKIFBuffer*)NULL)
    {
        IPKIFMediatorPtr activeMediator;
        if(m_externalMediator)
            activeMediator = m_externalMediator;
        else
            activeMediator = m_internalMediator;

        if(activeMediator != (IPKIFMediator*)NULL)
        {
            IPKIFCryptoMisc* cm = activeMediator->GetMediator<IPKIFCryptoMisc>();
            if(cm)
            {
                IPKIFHashContext* hc = cm->HashInit(ha);
                if(hc)
                {
                    CPKIFBufferPtr newBP(new CPKIFBuffer);
                    unsigned char* hashResult = newBP->AllocateBuffer(ha);
                    int resultLen = ha;
                    cm->HashUpdate(hc, (unsigned char*)m_orig->GetBuffer(), m_orig->GetLength());
                    cm->HashFinal(hc, hashResult, &resultLen);
                    delete hc;
                    return newBP;
                }
            }
        }
    }

    if(m_ph != (CPKIFParallelHash*)NULL)
    {
        HashInfo* hi = m_ph->GetHashInfo(ha);
        if(NULL != hi)
        {
            CPKIFBufferPtr newBP(new CPKIFBuffer(hi->m_hashResult, hi->m_hashAlg));
            return newBP;
        }
    }

    return emptyBP;
}

CPKIFBufferPtr CPKIFTimestampVerifierImpl::GetHash(
    PKIFCRYPTO::HASH_ALG ha,
    CPKIFBufferPtr buffToHash)
{
    LOG_STRING_DEBUG("CPKIFTimestampVerifier::GetHash(HASH_ALG ha)", TOOLKIT_TSP_TIMESTAMP_VERIFIER, 0, this);

    CPKIFBufferPtr emptyBP;

    if(m_hash != (CPKIFBuffer*)NULL)
    {
        if(ha == m_ha)
            return m_hash;
        else
            return emptyBP;
    }

    if(m_orig != (CPKIFBuffer*)NULL)
    {
        IPKIFMediatorPtr activeMediator;
        if(m_externalMediator)
            activeMediator = m_externalMediator;
        else
            activeMediator = m_internalMediator;

        if(activeMediator != (IPKIFMediator*)NULL)
        {
            IPKIFCryptoMisc* cm = activeMediator->GetMediator<IPKIFCryptoMisc>();
            if(cm)
            {
                IPKIFHashContext* hc = cm->HashInit(ha);
                if(hc)
                {
                    CPKIFBufferPtr newBP(new CPKIFBuffer);
                    unsigned char* hashResult = newBP->AllocateBuffer(ha);
                    int resultLen = ha;
                    cm->HashUpdate(hc, (unsigned char*)buffToHash->GetBuffer(), buffToHash->GetLength());
                    cm->HashFinal(hc, hashResult, &resultLen);
                    delete hc;
                    return newBP;
                }
            }
        }
    }

    if(m_ph != (CPKIFParallelHash*)NULL)
    {
        HashInfo* hi = m_ph->GetHashInfo(ha);
        if(NULL != hi)
        {
            CPKIFBufferPtr newBP(new CPKIFBuffer(hi->m_hashResult, hi->m_hashAlg));
            return newBP;
        }
    }

    return emptyBP;
}

void CPKIFTimestampVerifierImpl::MakeInternalMediator()
{
    LOG_STRING_DEBUG("CPKIFTimestampVerifier::MakeInternalMediator()", TOOLKIT_TSP_TIMESTAMP_VERIFIER, 0, this);
}


void EKUChecker_TimestampTSP(const CPKIFCertificateNodeEntryPtr& certNode, CPKIFPathValidationResults& results, CertificateType type);
CPKIFTimestampVerifier::CPKIFTimestampVerifier()
  :m_impl(new CPKIFTimestampVerifierImpl)
{
    LOG_STRING_DEBUG("CPKIFTimestampVerifier::CPKIFTimestampVerifier()", TOOLKIT_TSP_TIMESTAMP_VERIFIER, 0, this);

    m_impl->m_parent = this;
    m_impl->m_verificationStatusMinumum = PVS_REV_STATUS_VERIFIED;
    m_impl->m_verificationStatusResult = NOT_VERIFIED;
    //m_impl->m_skew = 3600; //# of seconds in 1 hour
    m_impl->m_skew = -1; //<0 skew not used
}
CPKIFTimestampVerifier::~CPKIFTimestampVerifier()
{
    LOG_STRING_DEBUG("CPKIFTimestampVerifier::~CPKIFTimestampVerifier()", TOOLKIT_TSP_TIMESTAMP_VERIFIER, 0, this);

    if (m_impl)
    {
        delete m_impl;
    }
}

//INPUTS
void CPKIFTimestampVerifier::SetMediator(
    IPKIFMediatorPtr& m)
{
    m_impl->m_externalMediator = m;
}
void CPKIFTimestampVerifier::SetMinimumVerificationStatus(
    CMSPathValidationStatus v)
{
    m_impl->m_verificationStatusMinumum = v;
}
void CPKIFTimestampVerifier::SetPathSettings(
    CPKIFPathSettingsPtr& p)
{
    m_impl->m_pathSettings = p;
}
void CPKIFTimestampVerifier::SetSkew(
    int seconds)
{
    m_impl->m_skew = seconds;
}
void CPKIFTimestampVerifier::SetComparisonTime(
    CPKIFTimePtr& time)
{
    m_impl->m_time = time;
}

//OUTPUTS
CMSVerificationStatus CPKIFTimestampVerifier::GetVerificationStatus() const
{
    return m_impl->m_verificationStatusResult;
}
CPKIFCertificatePathPtr CPKIFTimestampVerifier::GetCertificatePath() const
{
    return m_impl->m_path;
}
CPKIFPathValidationResultsPtr CPKIFTimestampVerifier::GetPathValidationResults() const
{
    return m_impl->m_pvResults;
}
CPKIFCertificatePtr CPKIFTimestampVerifier::GetTSACertificate() const
{
    return m_impl->m_tsaCert;
}
CPKIFTimePtr CPKIFTimestampVerifier::GetTSADateTime() const
{
    return m_impl->m_dateTime;
}
void CPKIFTimestampVerifier::SetDataComplete(
    CPKIFBufferPtr& origData)
{
    LOG_STRING_DEBUG("CPKIFTimestampVerifier::SetDataComplete(CPKIFBufferPtr& origData)", TOOLKIT_TSP_TIMESTAMP_VERIFIER, 0, this);

    CPKIFBufferPtr emptyBP;
    CPKIFParallelHashPtr emptyPH;
    m_impl->m_hash = emptyBP;
    m_impl->m_ph = emptyPH;

    m_impl->m_orig = origData;
}
void CPKIFTimestampVerifier::SetDataHash(
    CPKIFBufferPtr& hash, 
    PKIFCRYPTO::HASH_ALG ha)
{
    LOG_STRING_DEBUG("CPKIFTimestampVerifier::SetDataHash(CPKIFBufferPtr& hash, HASH_ALG ha)", TOOLKIT_TSP_TIMESTAMP_VERIFIER, 0, this);

    CPKIFBufferPtr emptyBP;
    CPKIFParallelHashPtr emptyPH;
    m_impl->m_orig = emptyBP;
    m_impl->m_ph = emptyPH;

    m_impl->m_hash = hash;
    m_impl->m_ha = ha;
}
void CPKIFTimestampVerifier::SetDataHashSet(
    CPKIFParallelHashPtr& ph)
{
    LOG_STRING_DEBUG("CPKIFTimestampVerifier::SetDataHashSet(CPKIFParallelHashPtr& ph)", TOOLKIT_TSP_TIMESTAMP_VERIFIER, 0, this);

    CPKIFBufferPtr emptyBP;
    m_impl->m_hash = emptyBP;
    m_impl->m_orig = emptyBP;

    m_impl->m_ph = ph;
}

//ACTIONS
void CPKIFTimestampVerifier::Verify(
    CPKIFContentInfoPtr& timestamp)
{
    LOG_STRING_DEBUG("CPKIFTimestampVerifier::Verify(CPKIFContentInfoPtr& timestamp)", TOOLKIT_TSP_TIMESTAMP_VERIFIER, 0, this);

    CPKIFSignedData sd;

    CPKIFFuncStoragePtr ekuFunctor(new CPKIFFuncStorage(EKUChecker_TimestampTSP));

    if(NULL != m_impl->m_externalMediator)
        sd.AddMediator(m_impl->m_externalMediator);
    else 
    {
        if(NULL == m_impl->m_internalMediator)
            m_impl->MakeInternalMediator();

        if(NULL != m_impl->m_internalMediator)
            sd.AddMediator(m_impl->m_internalMediator);
        else
            throw CPKIFTSPException(thisComponent, COMMON_UNKNOWN_ERROR, "Failed to create a mediator for timestamp verification.");
    }

    sd.SetPathSettings(m_impl->m_pathSettings);

    IPKIFPathValidate* cValidate = sd.GetMediator()->GetMediator<IPKIFPathValidate>();
    if(NULL != cValidate)
    {
        cValidate->SetAdditionalCertificateChecks(ekuFunctor);//replace any higher level additional checks
    }

    //Extract the signed data portion from the content info
    //sd.Decode(timestamp->GetContent());
    CPKIFBufferPtr timestampContent = timestamp->GetContent();
    sd.Decode(timestampContent);

    m_impl->m_verificationStatusResult = NOT_VERIFIED;
    bool minStatusMet = false;
    CPKIFCertificatePtr signersCert;
    try
    {

        //Get SignerInfos
        CPKIFSignerInfos tsaSIS;
        sd.GetSignerInfos(tsaSIS);

        if(tsaSIS.size() > 1)
        {
            throw CPKIFTSPException(thisComponent, TSP_MORE_THEN_ONE_SIGNER, "Timestamp contains more then one signer.");
        }

        CPKIFSigningCertificateAttributePtr sc = tsaSIS[0]->GetSignedAttribute<CPKIFSigningCertificateAttribute>();

        if(sc != (CPKIFSigningCertificateAttribute*)NULL)
        {
            CPKIFESSCertIdListPtr certIds = sc->GetCerts();
            CPKIFESSCertIdList::iterator pos = certIds->begin();
        
            //get the cert of the first (and per 3161 - only) signer
            //set it as the TSA regardless of the outcome of path validation
            sd.GetSignersCert(0, signersCert);

            if(pos != certIds->end())
            {
                CPKIFBufferPtr hashedB(new CPKIFBuffer);
                int hashResultLen = 20;
                unsigned char* hashResult = hashedB->AllocateBuffer(hashResultLen);

                IPKIFHashContext* hash = NULL;
                try
                {
                    IPKIFMediatorPtr m = GetMediator();
                    IPKIFCryptoMisc* cryptoMisc = m->GetMediator<IPKIFCryptoMisc>();
                    CPKIFBufferPtr encCert = signersCert->Encoded();

                    //create a hash object, pass the buffer and length we calculated and obtain the result
                    hash = cryptoMisc->HashInit(PKIFCRYPTO::SHA1);
                    cryptoMisc->HashUpdate(hash, (unsigned char*)encCert->GetBuffer(), encCert->GetLength());
                    cryptoMisc->HashFinal(hash, (unsigned char*)hashResult, &hashResultLen);
                }
                catch(CPKIFException& e)
                {
                    if(NULL != hash)
                        delete hash;

                    throw e;
                }

                //clean up the hash
                if(NULL != hash)
                    delete hash; 
                
                CPKIFBufferPtr hashedA = (*pos)->GetCertHash();

                if(*hashedA != *hashedB)
                {
                    throw CPKIFTSPException(thisComponent, TSP_SIGNER_ID_MISMATCH, "Timestamp signer mismatch.");
                }

                const char * serialA = (*pos)->GetSerialNumber();
                CPKIFGeneralNameListPtr issuerNames;
                (*pos)->GetIssuerName(issuerNames);

                if(serialA != NULL && issuerNames != (CPKIFGeneralNameList*)NULL)
                {
                    CPKIFGeneralNameList::iterator posName = issuerNames->begin();

                    if(posName != issuerNames->end())
                    {
                        CPKIFNamePtr a = (*posName)->directoryName();
                        CPKIFNamePtr b = signersCert->Issuer();
                        const char * serialB = signersCert->SerialNumber();

                        if(*a == *b && strcmp(serialA,serialB) == 0 )
                        {
                            //good
                        }
                        else
                        {
                            throw CPKIFTSPException(thisComponent, TSP_SIGNER_ID_MISMATCH, "Timestamp signer mismatch.");
                        }
                    }
                }
            }
            else
            {
                throw CPKIFTSPException(thisComponent, TSP_MISSING_REQUIRED_FIELD, "Missing ESSCertId in timestamp response.");
            }
        }
        else
        {
            throw CPKIFTSPException(thisComponent, TSP_MISSING_REQUIRED_FIELD, "Missing Signer Certificate Attribute in timestamp response.");
        }

        m_impl->m_tsaCert = signersCert;

        //The call to Verify on the SignedData object will take care of most
        //of the following three verification steps identified in RFC3161.
        //B-1)  The time-stamp token itself MUST be verified and it MUST be
        //      verified that it applies to the signature of the signer(i.e.
        //      inspect the message imprint, which is done below).
        //B-3)  The certificate used by the signer MUST be identified and
        //      retrieved.
        //B-5)  The revocation information about that certificate, at the
        //      date/time of the Time-Stamping operation, MUST be retrieved.
        minStatusMet = sd.Verify(0, m_impl->m_verificationStatusResult, m_impl->m_verificationStatusMinumum);

        //unset the extra check
        if(NULL != cValidate)
        {
            CPKIFFuncStoragePtr empty;
            cValidate->SetAdditionalCertificateChecks(empty);
        }
    }
    catch(CPKIFException& e)
    {
        //unset the extra check
        if(NULL != cValidate)
        {
            CPKIFFuncStoragePtr empty;
            cValidate->SetAdditionalCertificateChecks(empty);
        }

        CPKIFTSPException te(thisComponent, COMMON_UNKNOWN_ERROR, "Unexpected exception during timestamp verification.");
        te.push_info(e);
        throw te;
    }

    //if(m_impl->m_verificationStatusResult > CMS_SIGNATURE_VERIFIED)
    //{
        //always get the path and results from the SignedData object, empty though they may be
        m_impl->m_path = sd.GetPath();
        m_impl->m_pvResults = sd.GetValidationResults();
    //}
    //else
    //{
    //  CPKIFCertificatePathPtr emptyPath;
    //  m_impl->m_path = emptyPath;

    //  CPKIFPathValidationResultsPtr emptyResults;
    //  m_impl->m_pvResults = emptyResults;
    //}

    //check to see if min status was met.  if not fail unless the status was REV_STATUS_INVALID.
    //if revoked cert is present it's OK as long as the revocation time is after timestamp time
    //XXX***this needs testing after TSA is developed
    if(!minStatusMet && REV_STATUS_INVALID != m_impl->m_verificationStatusResult)
        throw CPKIFTSPException(thisComponent, TSP_VERIFICATION_FAILED, "Minimum verification status not met.");

    //just to make sure EKU was present
    CPKIFExtendedKeyUsagePtr eku = signersCert->GetExtension<CPKIFExtendedKeyUsage>();
    if(eku != (CPKIFExtendedKeyUsage*)NULL)
    {
        std::vector<CPKIFOIDPtr> keyPurposeIDs;
        eku->KeyPurposeIDs(keyPurposeIDs);

        GottaMatch<CPKIFOIDPtr> gm;
        gm.SetRHS(g_timestampingEKU);

        std::vector<CPKIFOIDPtr>::iterator end = keyPurposeIDs.end();
        if(end == find_if(keyPurposeIDs.begin(), keyPurposeIDs.end(), gm))
        {
            gm.SetRHS(g_anyEKU);
            if(end == find_if(keyPurposeIDs.begin(), keyPurposeIDs.end(), gm))
            {
                throw CPKIFTSPException(thisComponent, TSP_MISSING_REQUIRED_EKU);
            }
        }
    }

    //next, extract the TSTInfo object from the SignedData structure
    CPKIFEncapsulatedContentInfoPtr ecip = sd.GetEncapsulatedContent();
    if(ecip == (CPKIFEncapsulatedContentInfo*)NULL)
        throw CPKIFTSPException(thisComponent, TSP_MISSING_REQUIRED_FIELD, "Timestamp has no encapsulated content info field.");

    CPKIFBufferPtr encodedTSTInfo = ecip->GetContent();
    if(encodedTSTInfo == (CPKIFBuffer*)NULL)
        throw CPKIFTSPException(thisComponent, TSP_MISSING_REQUIRED_FIELD, "Timestamp has no encapsulated content.");

    CPKIFTSTInfo tstInfo;
    tstInfo.Decode(encodedTSTInfo);

    if (tstInfo.GetVersion() != 1)
        throw CPKIFTSPException(thisComponent, COMMON_UNSUPPORTED_VERSION, "PKIF only supports version 1 TSP structures.");

    //B-1)  (continued) inspect the message imprint
    CPKIFMessageImprintPtr mi = tstInfo.GetMessageImprint();
    CPKIFBufferPtr hashFromTimestamp = mi->GetHashedMessage();

    CPKIFAlgorithmIdentifierPtr hashAlg = mi->GetHashAlgorithm();
    PKIFCRYPTO::HASH_ALG ha = PKIFCRYPTO::SHA1;
    GetCACHashAlg(hashAlg->oid(), &ha);

    CPKIFBufferPtr hashedMessage = m_impl->GetHash(ha);

    if(hashedMessage == (CPKIFBuffer*)NULL || !(*hashFromTimestamp == *hashedMessage))
        throw CPKIFTSPException(thisComponent, TSP_HASH_MISMATCH, "Timestamp hash does not match expected hash value.");

    //B-2)  The date/time indicated by the TSA in the TimeStampToken
    //      MUST be retrieved.
    CPKIFTimePtr time = tstInfo.GetGeneralizedTime();
    m_impl->m_dateTime = time;
    CPKIFTimePtr comparisonTime = m_impl->m_time;

    if(comparisonTime == (CPKIFTime*)NULL)
        comparisonTime = CPKIFTime::CurrentTime();

    if(m_impl->m_skew > 0)
    {
        CPKIFDurationPtr d(new CPKIFDuration);
        d->setSeconds(m_impl->m_skew/2);

        *time -= *d;
        d->setSeconds(m_impl->m_skew);

        CPKIFPeriod p(time, d);
        bool b = p.contains(comparisonTime);
        d->setSeconds(m_impl->m_skew/2);
        *time += *d;
        if(!b)
            throw CPKIFTSPException(thisComponent, TSP_NOT_WITHIN_SKEW, "Timestamp time is not within the specified acceptable time period.");
    }

    //B-4)  The date/time indicated by the TSA MUST be within the
    //      validity period of the signer's certificate.
    CPKIFValidityPtr valPer = signersCert->Validity();
    CPKIFTimePtr notBefore = valPer->notBefore();
    CPKIFTimePtr notAfter = valPer->notAfter();

    CPKIFPeriod p2(notBefore, notAfter);
    bool b2 = p2.contains(time);
    if(!b2)
        throw CPKIFTSPException(thisComponent, TSP_NOT_WITHIN_VALIDITY_PERIOD, "Timestamp time not within TSA validity period.");

    //B-6)  Should the certificate be revoked, then the date/time of
    //      revocation shall be later than the date/time indicated by
    //      the TSA.
    //revocation sources
    CPKIFPathValidationResultsPtr pvr = sd.GetValidationResults();
    if(pvr == (CPKIFPathValidationResults*)NULL)
    {
        if(!minStatusMet)
            throw CPKIFTSPException(thisComponent, TSP_VERIFICATION_FAILED, "Minimum verification status not met.");
        else
            return;
    }

    CPKIFCertStatusPtr certStatus = pvr->GetCertStatus();
    if(certStatus == (CPKIFCertStatus*)NULL)
    {
        if(!minStatusMet)
            throw CPKIFTSPException(thisComponent, TSP_VERIFICATION_FAILED, "Minimum verification status not met.");
        else
            return;
    }

    RevocationSourceList rsl;
    certStatus->GetRevocationSources(rsl);

    RevocationSourceList::iterator rslPos;
    RevocationSourceList::iterator rslEnd = rsl.end();
    int count = 0;
    bool foundRevoked = false, revocationTimeOK = false;
    for(rslPos = rsl.begin(), count = 1; rslPos != rslEnd; ++rslPos, ++count)
    {
        if(REVOKED == (*rslPos)->m_status)
        {
            foundRevoked = true;

            IPKIFRevSourceInfoPtr rsip = (*rslPos)->m_sourceInfo;
            switch((*rslPos)->m_sourceType)
            {
            case REVSOURCE_CRL:
                {
                    CPKIFCRLInfoPtr crlInfo = RevInfoCast<CPKIFCRLInfo>(rsip);
                    if(crlInfo == (CPKIFCRLInfo*)NULL)
                        continue;

                    CPKIFCRLEntryPtr crlEntry = crlInfo->GetCRLEntry();
                    if(crlEntry == (CPKIFCRLEntry*)NULL)
                        continue;

                    CPKIFTimePtr revTime = crlEntry->RevocationDate();
                    if(revTime == (CPKIFTime*)NULL)
                        continue;
                    
                    if(time < revTime)
                        revocationTimeOK = true;
                }
                break;
            case REVSOURCE_OCSP:
                {
                    CPKIFOCSPInfoPtr ocspInfo = RevInfoCast<CPKIFOCSPInfo>(rsip);

                    if(ocspInfo != (CPKIFOCSPInfo*)NULL)
                    {
                        //*******************************************************
                        //  general response information
                        //*******************************************************
                        CPKIFOCSPResponsePtr ocspResponse = ocspInfo->GetOCSPResponse();
                        if(ocspResponse == (CPKIFOCSPResponse*)NULL)
                            continue;

                        OCSPResponseStatus ors = ocspResponse->GetResponseStatus();
                        if(successful != ors)
                            continue;

                        //*******************************************************
                        //  single response information pertaining to target cert
                        //*******************************************************
                        CPKIFSingleResponsePtr singleResponse = ocspInfo->GetSingleResponse();
                        if(singleResponse == (CPKIFSingleResponse*)NULL)
                            continue;

                        CPKIFTimePtr revTime = singleResponse->GetThisUpdate();
                        if(time < revTime)
                            revocationTimeOK = true;
                    }
                }
                break;
            }
        }
    }

    if(foundRevoked && !revocationTimeOK)
        throw CPKIFTSPException(thisComponent, TSP_REVOCATION_DATE_PRECEDES_TIME, "TSA revoked before timestamp time.");
}

IPKIFMediatorPtr CPKIFTimestampVerifier::GetMediator() const
{
    IPKIFMediatorPtr activeMediator;
    if(m_impl->m_externalMediator)
        activeMediator = m_impl->m_externalMediator;
    else
        activeMediator = m_impl->m_internalMediator;

    return activeMediator;
}
CMSPathValidationStatus CPKIFTimestampVerifier::GetMinimumVerificationStatus() const
{
    return m_impl->m_verificationStatusMinumum;
}
CPKIFPathSettingsPtr CPKIFTimestampVerifier::GetPathSettings() const
{
    return m_impl->m_pathSettings;
}
int CPKIFTimestampVerifier::GetSkew() const
{
    return m_impl->m_skew;
}
CPKIFTimePtr CPKIFTimestampVerifier::GetComparisonTime() const
{
    return m_impl->m_time;
}

CPKIFBufferPtr CPKIFTimestampVerifier::GetDataComplete() const
{
    return m_impl->m_orig;
}
CPKIFBufferPtr CPKIFTimestampVerifier::GetDataHash(
    PKIFCRYPTO::HASH_ALG& ha) const
{
    ha = m_impl->m_ha;
    return m_impl->m_hash;
}
CPKIFParallelHashPtr CPKIFTimestampVerifier::GetDataHashSet() const
{
    return m_impl->m_ph;
}