CertificateList.cs

using System;
using System.Diagnostics.CodeAnalysis;
using System.Runtime.ConstrainedExecution;
using System.Text;
using System.Threading.Tasks;
using NeuroAccess.Nfc.TravelDocuments.Certificates;
using NeuroAccess.Nfc.TravelDocuments.Security;
using NeuroAccess.Nfc.TravelDocuments.Security.SignatureAlgorithms;
using Waher.Content;
using Waher.Networking;
 
namespace NeuroAccess.Nfc.TravelDocuments.RevocationLists
{
    public class CertificateList
    {
        private CertificateList(Vector Asn1Vector, ToBeSignedCertificateList ToBeSignedCertificateList,
            ISignatureAlgorithm SignatureAlgorithm, byte[] Signature)
        {
            this.Asn1Vector = Asn1Vector;
            this.ToBeSignedCertificateList = ToBeSignedCertificateList;
            this.SignatureAlgorithm = SignatureAlgorithm;
            this.Signature = Signature;
        }
 
        public static bool TryParse(byte[] RawCertificateList, [NotNullWhen(true)] out CertificateList? Parsed)
        {
            Parsed = null;
 
            if (!ASN1.TryDecodeDer(RawCertificateList, out object? Content))
                return false;
 
            if (Content is not Vector CertificateListVector)
                return false;
 
            return TryParse(CertificateListVector, out Parsed);
        }
 
        public static bool TryParse(Vector CertificateListVector, [NotNullWhen(true)] out CertificateList? Parsed)
        {
            Parsed = null;
 
            if (CertificateListVector.Length != 3)
                return false;
 
            if (CertificateListVector.FirstElement is not Vector TbsCertList)
                return false;
 
            ISignatureAlgorithm? SignatureAlgorithm;
 
            if (CertificateListVector[1] is ISignatureAlgorithm Algorithm)
                SignatureAlgorithm = Algorithm;
            else if (CertificateListVector[1] is Vector AlgorithmIdentifier)
                SignatureAlgorithm = Security.SignatureAlgorithms.SignatureAlgorithm.TryDecode(AlgorithmIdentifier);
            else
                return false;
 
            if (SignatureAlgorithm is null)
                return false;
 
            if (CertificateListVector[2] is not byte[] Signature)
                return false;
 
            if (!ToBeSignedCertificateList.TryParse(TbsCertList, out ToBeSignedCertificateList? ToBeSigned))
                return false;
 
            Parsed = new CertificateList(CertificateListVector, ToBeSigned, SignatureAlgorithm, Signature);
 
            return true;
        }
 
        public ToBeSignedCertificateList ToBeSignedCertificateList { get; }
 
        public ISignatureAlgorithm SignatureAlgorithm { get; }
 
        public byte[] Signature { get; }
 
        public Vector Asn1Vector { get; }
 
        public int? Version => this.ToBeSignedCertificateList.Version;
 
        public Vector Issuer => this.ToBeSignedCertificateList.Issuer;
 
        public DateTimeOffset ThisUpdate => this.ToBeSignedCertificateList.ThisUpdate;
 
        public DateTimeOffset NextUpdate => this.ToBeSignedCertificateList.NextUpdate;
 
        public RevokedCertificate[] RevokedCertificates => this.ToBeSignedCertificateList.RevokedCertificates;
 
        public byte[]? AuthorityKeyIdentifier => this.ToBeSignedCertificateList.AuthorityKeyIdentifier;
 
        public Vector? Extensions => this.ToBeSignedCertificateList.Extensions;
 
        public bool HasBeenRevoked(Certificate Certificate, out RevokedReason Reason)
        {
            return this.ToBeSignedCertificateList.HasBeenRevoked(Certificate, out Reason);
        }
 
        public Task<bool> VerifySignature(string IdDomain, string CountryCode)
        {
            return this.VerifySignature(IdDomain, CountryCode, null);
        }
 
        public async Task<bool> VerifySignature(string IdDomain, string CountryCode,
            ICommunicationLayer? Client)
        {
            if (this.Signature is null)
            {
                Client?.Error("No signature in CRL.");
                return false;
            }
 
            if (this.AuthorityKeyIdentifier is null)
            {
                Client?.Error("No AKI in CRL.");
                return false;
            }
 
            Certificate? SignerCertificate = await CertificateStore.TryLoadCertificate(
                IdDomain, CountryCode, this.AuthorityKeyIdentifier, Client);
 
            if (SignerCertificate is null)
            {
                Client?.Error("Unable to load issuer certificate from the AKI: " +
                    Waher.Security.Hashes.BinaryToString(this.AuthorityKeyIdentifier));
                return false;
            }
 
            if (SignerCertificate.PublicKey is null)
            {
                Client?.Error("Unable to decode public key from issuer certificate.\r\n\r\n" +
                    Convert.ToBase64String(SignerCertificate.Binary, Base64FormattingOptions.InsertLineBreaks));
                return false;
            }
 
            if (this.SignatureAlgorithm.VerifySignature(this.ToBeSignedCertificateList.Binary,
                this.Signature, SignerCertificate.PublicKey, Client))
            {
                return true;
            }
 
            if (Client?.HasSniffers ?? false)
            {
                StringBuilder sb = new();
 
                sb.AppendLine("CRL signature verification failed.");
                sb.AppendLine();
                sb.AppendLine("Data to be signed:");
                sb.AppendLine(Convert.ToBase64String(this.ToBeSignedCertificateList.Binary,
                    Base64FormattingOptions.InsertLineBreaks));
                sb.AppendLine();
                sb.AppendLine("Signature:");
                sb.AppendLine(Convert.ToBase64String(this.Signature,
                    Base64FormattingOptions.InsertLineBreaks));
                sb.AppendLine();
                sb.AppendLine("Authority Key Identifier:");
                sb.AppendLine(Waher.Security.Hashes.BinaryToString(this.AuthorityKeyIdentifier));
                sb.AppendLine();
                sb.AppendLine("Public Key to verify signature:");
                sb.AppendLine(JSON.Encode(SignerCertificate.PublicKey, true));
 
                Client.Warning(sb.ToString());
            }
 
            return false;
        }
 
    }
}