Class MdocReaderKey

Namespace

Tessio.Verifier.Core.Mdoc

Assembly

Tessio.Verifier.Core.Mdoc.dll

The key a reader signs an mdoc request's readerAuth with, and the certificate path that names it to the wallet: the reader (access) certificate first, then any intermediates, never the trust anchor. Checked once, here, so a request is never signed by a key its own certificate does not hold, as long as the caller leaves the key as it was.

public sealed class MdocReaderKey

Inheritance

object

MdocReaderKey

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

What is checked, in this order: the path is non-empty and holds no null entry, none of its certificates is self-issued, each names the next as its issuer, the reader certificate is not a CA, the key is on a curve with a COSE algorithm, and the reader certificate holds the key's public half. A path that breaks two rules is refused for the first. Names are compared by their encoded bytes, which is stricter than RFC 5280's name matching: a path whose names differ only in case, spacing or string type is refused as unlinked, and a root whose own subject and issuer are encoded differently is not recognised as self-issued. Nothing else is checked here, among others validity periods, revocation, the signatures along the path, key usage and extended key usage, and whether the intermediates are CAs: judging the path is the wallet's, against its own trust list.

The caller keeps ownership of the key and the certificates, and must neither dispose them nor import other parameters into the key while this is in use; this disposes neither. The path itself is copied, so adding to the caller's list afterwards cannot slip an unchecked certificate past the checks.

Constructors

MdocReaderKey(ECDsa, IReadOnlyList<X509Certificate2>)

Checks and holds a reader key and its certificate path.

public MdocReaderKey(ECDsa key, IReadOnlyList<X509Certificate2> certificatePath)

Parameters

key ECDsa

The private key of the reader certificate. Must be on P-256, P-384 or P-521.

certificatePath IReadOnlyList<X509Certificate2>

The reader certificate first, then any intermediates up to but excluding the trust anchor.

Exceptions

ArgumentException

Any check in the remarks fails, or the key or a certificate in the path cannot be read.