Diff of autodoc.git/traditional_manual/chapter_21.html (94dc8788e2caf3a6a657a4320652619190e8e9c3 » 15f34f00d26d169ea0faaf00eb45b3cad73bc18c)

autodoc.git/traditional_manual/chapter_21.html:47474: <dt class='head--doc'>Description</dt> <dd class='body--doc'>Decodes a certificate and verifies that it is structually sound. Returns a <code>TBSCertificate</code> object if ok, otherwise <code class='expr'>0</code>. </dd></dl> <hr /> <dl class='group--doc'> <dt class='head--type'>Method + get_algorithms + </dt> + <dd><code><code class='datatype'>mapping</code>(<code class='object unresolved'>Identifier</code>:<code class='object unresolved'>Crypto.Hash</code>) get_algorithms()</code></dd> + + <dt class='head--doc'>Description</dt> + <dd class='body--doc'>Returns the mapping of signature algorithm to hash algorithm + supported by <code>Verifier</code> and thus <code>verify_ca_certificate()</code>, + <code>verify_certificate()</code>, and <code>verify_certificate_chain()</code>. + </dd></dl> + + + <hr /> + <dl class='group--doc'> + <dt class='head--type'>Method load_authorities </dt> <dd><code><code class='datatype'>mapping</code>(<code class='datatype'>string</code>:<code class='datatype'>array</code>(<code class='object unresolved'>Verifier</code>)) load_authorities(<code class='datatype'>string</code>|<code class='datatype'>array</code>(<code class='datatype'>string</code>)|<code class='datatype'>void</code> <code class='argument'>root_cert_dirs</code>, <code class='datatype'>bool</code>|<code class='datatype'>void</code> <code class='argument'>cache</code>)</code></dd> <dt class='head--doc'>Description</dt> <dd class='body--doc'>Convenience function for loading known root certificates. </dd> <dt class='head--doc'>Parameter <code class='parameter'>root_cert_dirs</code></dt> <dd></dd><dd class='body--doc'>Directory/directories containing the PEM-encoded root certificates to load. Defaults to a rather long list of directories, including
autodoc.git/traditional_manual/chapter_21.html:47728: <dd class='body--doc'>Verifies that all extensions mandated for certificate signing certificates are present and valid. </dd></dl> <hr /> <dl class='group--doc'> <dt class='head--type'>Method verify_certificate </dt> - <dd><code><code class='object unresolved'>TBSCertificate</code> verify_certificate(<code class='datatype'>string</code> <code class='argument'>s</code>, <code class='datatype'>mapping</code>(<code class='datatype'>string</code>:<code class='object unresolved'>Verifier</code>|<code class='datatype'>array</code>(<code class='object unresolved'>Verifier</code>)) <code class='argument'>authorities</code>)</code></dd> + <dd><code><code class='object unresolved'>TBSCertificate</code> verify_certificate(<code class='datatype'>string</code> <code class='argument'>s</code>, <code class='datatype'>mapping</code>(<code class='datatype'>string</code>:<code class='object unresolved'>Verifier</code>|<code class='datatype'>array</code>(<code class='object unresolved'>Verifier</code>)) <code class='argument'>authorities</code>, <code class='datatype'>mapping</code>(<code class='object unresolved'>Standards.ASN1.Types.Identifier</code>:<code class='object unresolved'>Crypto.Hash</code>)|<code class='datatype'>void</code> <code class='argument'>options</code>)</code></dd> <dt class='head--doc'>Description</dt> <dd class='body--doc'>Decodes a certificate, checks the signature. Returns the TBSCertificate structure, or 0 if decoding or verification failes. The valid time range for the certificate is not checked. - Authorities is a mapping from (DER-encoded) names to a verifiers. + </dd> - + <dt class='head--doc'>Parameter <code class='parameter'>authorities</code></dt> + <dd></dd><dd class='body--doc'>A mapping from (DER-encoded) names to a verifiers. + </dd> + <dt class='head--doc'>Parameter <code class='parameter'>options</code></dt> + <dd></dd><dd class='body--doc'><table class='box'><tr><td><code><code class='key'>"verifier_algorithms"</code> : <code class='datatype'>mapping</code>(<code class='object unresolved'>Standards.ASN1.Types.Identifier</code>:<code class='object unresolved'>Crypto.Hash</code>)</code></td><td>A mapping of verifier algorithm identifier to hash algorithm + implementation. + </td></tr> + </table> + </dd> <dt class='head--doc'>Note</dt> <dd class='body--doc'>This function allows self-signed certificates, and it doesn't check that names or extensions make sense. </dd></dl> <hr /> <dl class='group--doc'> <dt class='head--type'>Method verify_certificate_chain </dt> - <dd><code><code class='datatype'>mapping</code> verify_certificate_chain(<code class='datatype'>array</code>(<code class='datatype'>string</code>|<code class='object unresolved'>.PKCS.Signature.Signed</code>) <code class='argument'>cert_chain</code>, <code class='datatype'>mapping</code>(<code class='datatype'>string</code>:<code class='object unresolved'>Verifier</code>|<code class='datatype'>array</code>(<code class='object unresolved'>Verifier</code>)) <code class='argument'>authorities</code>, <code class='datatype'>int</code>|<code class='datatype'>void</code> <code class='argument'>require_trust</code>)</code></dd> + <dd><code><code class='datatype'>mapping</code> verify_certificate_chain(<code class='datatype'>array</code>(<code class='datatype'>string</code>|<code class='object unresolved'>.PKCS.Signature.Signed</code>) <code class='argument'>cert_chain</code>, <code class='datatype'>mapping</code>(<code class='datatype'>string</code>:<code class='object unresolved'>Verifier</code>|<code class='datatype'>array</code>(<code class='object unresolved'>Verifier</code>)) <code class='argument'>authorities</code>, <code class='datatype'>int</code>|<code class='datatype'>void</code> <code class='argument'>require_trust</code>, <code class='datatype'>mapping</code>(<code class='datatype'>string</code>:<code class='datatype'>mixed</code>)|<code class='datatype'>void</code> <code class='argument'>options</code>)</code></dd> <dt class='head--doc'>Description</dt> <dd class='body--doc'>Decodes a certificate chain, ordered from leaf to root, and checks the signatures. Verifies that the chain can be decoded correctly, is unbroken, and that all certificates are in effect (time-wise.) and allowed to sign it's child certificate. No verifications are done on the leaf certificate to determine what it can and can not be used for. Returns a mapping with the following contents, depending on the verification of the certificate chain:
autodoc.git/traditional_manual/chapter_21.html:47790: <dd></dd><dd class='body--doc'>An array of certificates, with the relative-root last. Each certificate should be a DER-encoded certificate, or decoded as a <code>Standards.PKCS.Signature.Signed</code> object. </dd> <dt class='head--doc'>Parameter <code class='parameter'>authorities</code></dt> <dd></dd><dd class='body--doc'>A mapping from (DER-encoded) names to verifiers. </dd> <dt class='head--doc'>Parameter <code class='parameter'>require_trust</code></dt> <dd></dd><dd class='body--doc'>Require that the certificate be traced to an authority, even if it is self signed. + </dd> + <dt class='head--doc'>Parameter <code class='parameter'>options</code></dt> + <dd></dd><dd class='body--doc'><table class='box'><tr><td><code><code class='key'>"verifier_algorithms"</code> : <code class='datatype'>mapping</code>(<code class='object unresolved'>Standards.ASN1.Types.Identifier</code>:<code class='object unresolved'>Crypto.Hash</code>)</code></td><td>A mapping of verifier algorithm identifier to hash algorithm + implementation. + </td></tr> + </table> + </dd> + <dt class='head--doc'>See also</dt> + <dd class='body--doc'><code>get_algorithms()</code> See <code>Standards.PKCS.Certificate.get_dn_string</code> for converting the RDN to an X500 style string. </dd></dl> <dl><dt><h2 class='header'>Enum Standards.X509.CertFailure</h2> </dt><dd> <hr /> <dl class='group--doc'> <dt class='head--type'>Constant CERT_BAD_SIGNATURE
autodoc.git/traditional_manual/chapter_21.html:48306: <dd><code><code class='datatype'>void</code> Standards.X509.TBSCertificate.version</code></dd> </dl> </dd></dl><dl><dt><h2 class='header'>Class Standards.X509.Verifier</h2> </dt><dd> <hr /> <dl class='group--doc'> <dt class='head--type'>Method verify </dt> - <dd><code><code class='datatype'>bool</code> verify(<code class='object unresolved'>Sequence</code> <code class='argument'>algorithm</code>, <code class='datatype'>string(8bit)</code> <code class='argument'>msg</code>, <code class='datatype'>string(8bit)</code> <code class='argument'>signature</code>)</code></dd> + <dd><code><code class='datatype'>bool</code> verify(<code class='object unresolved'>Sequence</code> <code class='argument'>algorithm</code>, <code class='datatype'>string(8bit)</code> <code class='argument'>msg</code>, <code class='datatype'>string(8bit)</code> <code class='argument'>signature</code>, <code class='datatype'>mapping</code>(<code class='object unresolved'>Identifier</code>:<code class='object unresolved'>Crypto.Hash</code>)|<code class='datatype'>void</code> <code class='argument'>verifier_algorithms</code>)</code></dd> <dt class='head--doc'>Description</dt> <dd class='body--doc'>Verifies the <code>signature</code> of the certificate <code>msg</code> using the - indicated hash <code>algorithm</code>. + indicated hash <code>algorithm</code>, choosing from <code>verifier_algorithms</code>. + </dd> + <dt class='head--doc'>See also</dt> + <dd class='body--doc'><code>get_algorithms()</code> </dd></dl> </dd></dl></dd></dl><dl><dt><h2 class='header'>Module Standards.XML</h2> </dt><dd><dl><dt><h2 class='header'>Module Standards.XML.Wix</h2> </dt><dd><dl class='group--doc'> <dt class='head--doc'>Description</dt> <dd class='body--doc'>Helper module for generating Windows Installer XML structures. </dd> <dt class='head--doc'>See also</dt> <dd class='body--doc'><code>Parser.XML.Tree.SimpleNode</code> </dd></dl>

autodoc.git / traditional_manual / chapter_21.html