Class PeerIdentityTrustManager

java.lang.Object

javax.net.ssl.X509ExtendedTrustManager

pt.unl.fct.di.novasys.babel2.ssl.PeerIdentityTrustManager

All Implemented Interfaces:

TrustManager, X509TrustManager

public class PeerIdentityTrustManager
extends X509ExtendedTrustManager

An X509ExtendedTrustManager that validates peer certificates according to the Babel 2 / libp2p TLS identity certificate pattern.

Specifically, this trust manager verifies that:

1. The certificate dates are currently valid.
2. The certificate is self-signed by the TLS ephemeral public key.
3. The certificate contains the custom Babel 2 TLS identity extension (OID "2.25.143997576564619623049175376840488616895").
4. The extension contains a valid long-term static public key and a signature over the ephemeral key.
5. The signature is verified against the static public key.
6. If an authorization allowlist is configured, the SHA-256 hash of the static public key matches an authorized peer ID.

Upon successful authentication, the verified long-term peer public key and hex peer ID are stored in the active SSLSession attributes under "pt.unl.fct.di.novasys.babel2.ssl.PeerPublicKey" and "pt.unl.fct.di.novasys.babel2.ssl.PeerId".

Field Summary

Fields

Modifier and Type	Field	Description
static final String	PEER_IDENTITY_ID_ATTR	Session attribute key storing the authenticated peer's SHA-256 hex peer ID.
static final String	PEER_IDENTITY_KEY_ATTR	Session attribute key storing the authenticated peer's long-term PublicKey.

Constructor Summary

Constructors

Constructor	Description
PeerIdentityTrustManager()	Constructs a trust manager that accepts all valid peer certificates conforming to the Babel 2 identity certificate flow without restricting to specific peer IDs.
PeerIdentityTrustManager(@Nullable Set<String> authorizedPeerIdHashes)	Constructs a trust manager that requires the peer's SHA-256 public key hash to be in the specified allowlist.

Method Summary

Modifier and Type	Method	Description
static String	bytesToHex(byte[] bytes)	Converts a byte array to its lowercase hexadecimal representation.
void	checkClientTrusted(X509Certificate[] chain, String authType)
void	checkClientTrusted(X509Certificate[] chain, String authType, Socket socket)
void	checkClientTrusted(X509Certificate[] chain, String authType, SSLEngine engine)
void	checkServerTrusted(X509Certificate[] chain, String authType)
void	checkServerTrusted(X509Certificate[] chain, String authType, Socket socket)
void	checkServerTrusted(X509Certificate[] chain, String authType, SSLEngine engine)
static String	computePeerId(PublicKey publicKey)	Computes the hex-encoded SHA-256 peer ID for a given public key.
static byte[]	computeSha256(byte[] data)	Computes the SHA-256 digest of the given data.
X509Certificate[]	getAcceptedIssuers()
static @Nullable String	getPeerId(SSLSession session)	Extracts the authenticated peer ID string from an active SSLSession, if present.
static @Nullable PublicKey	getPeerIdentity(SSLSession session)	Extracts the authenticated peer PublicKey from an active SSLSession, if present.
static PeerIdentityTrustManager	ofAuthorizedPublicKeys(Set<PublicKey> authorizedKeys)	Creates a trust manager authorized for the specified set of long-term public keys.
TrustManagerFactory	toTrustManagerFactory()	Converts this trust manager into a TrustManagerFactory.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

PEER_IDENTITY_KEY_ATTR

public static final String PEER_IDENTITY_KEY_ATTR

Session attribute key storing the authenticated peer's long-term PublicKey.

See Also:

• Constant Field Values

PEER_IDENTITY_ID_ATTR

public static final String PEER_IDENTITY_ID_ATTR

Session attribute key storing the authenticated peer's SHA-256 hex peer ID.

See Also:

• Constant Field Values

Constructor Details

PeerIdentityTrustManager

public PeerIdentityTrustManager()

Constructs a trust manager that accepts all valid peer certificates conforming to the Babel 2 identity certificate flow without restricting to specific peer IDs.

PeerIdentityTrustManager

public PeerIdentityTrustManager(@Nullable Set<String> authorizedPeerIdHashes)

Constructs a trust manager that requires the peer's SHA-256 public key hash to be in the specified allowlist.

Parameters:

authorizedPeerIdHashes - set of authorized SHA-256 hex peer IDs, or null to allow any valid peer

Method Details

ofAuthorizedPublicKeys

public static PeerIdentityTrustManager ofAuthorizedPublicKeys(Set<PublicKey> authorizedKeys)
                                                       throws CertificateException

Creates a trust manager authorized for the specified set of long-term public keys.

Parameters:

authorizedKeys - set of authorized public keys

Returns:

a configured PeerIdentityTrustManager

Throws:

CertificateException - if hashing any public key fails

computePeerId

public static String computePeerId(PublicKey publicKey)
                            throws CertificateException

Computes the hex-encoded SHA-256 peer ID for a given public key.

Parameters:

publicKey - the public key

Returns:

the lowercase hex string of the SHA-256 hash

Throws:

CertificateException - if hashing fails

getPeerIdentity

public static @Nullable PublicKey getPeerIdentity(SSLSession session)

Extracts the authenticated peer PublicKey from an active SSLSession, if present.

Parameters:

session - the TLS session

Returns:

the authenticated peer public key, or null

getPeerId

public static @Nullable String getPeerId(SSLSession session)

Extracts the authenticated peer ID string from an active SSLSession, if present.

Parameters:

session - the TLS session

Returns:

the peer ID hex string, or null

toTrustManagerFactory

public TrustManagerFactory toTrustManagerFactory()

Converts this trust manager into a TrustManagerFactory.

Returns:

a new PeerIdentityTrustManagerFactory wrapping this trust manager

checkServerTrusted

public void checkServerTrusted(X509Certificate[] chain,
 String authType,
 SSLEngine engine)
                        throws CertificateException

Specified by:

checkServerTrusted in class X509ExtendedTrustManager

Throws:

CertificateException

checkClientTrusted

public void checkClientTrusted(X509Certificate[] chain,
 String authType,
 SSLEngine engine)
                        throws CertificateException

Specified by:

checkClientTrusted in class X509ExtendedTrustManager

Throws:

CertificateException

checkServerTrusted

public void checkServerTrusted(X509Certificate[] chain,
 String authType,
 Socket socket)
                        throws CertificateException

Specified by:

checkServerTrusted in class X509ExtendedTrustManager

Throws:

CertificateException

checkClientTrusted

public void checkClientTrusted(X509Certificate[] chain,
 String authType,
 Socket socket)
                        throws CertificateException

Specified by:

checkClientTrusted in class X509ExtendedTrustManager

Throws:

CertificateException

checkServerTrusted

public void checkServerTrusted(X509Certificate[] chain,
 String authType)
                        throws CertificateException

Throws:

CertificateException

checkClientTrusted

public void checkClientTrusted(X509Certificate[] chain,
 String authType)
                        throws CertificateException

Throws:

CertificateException

getAcceptedIssuers

public X509Certificate[] getAcceptedIssuers()

computeSha256

public static byte[] computeSha256(byte[] data)
                            throws CertificateException

Computes the SHA-256 digest of the given data.

Parameters:

data - the byte array to hash

Returns:

the 32-byte SHA-256 hash

Throws:

CertificateException - if the digest algorithm is unavailable

bytesToHex

public static String bytesToHex(byte[] bytes)

Converts a byte array to its lowercase hexadecimal representation.

Parameters:

bytes - the byte array to convert

Returns:

lowercase hex string