Class SecomSignatureVerifier

Namespace

EncDotNet.S100.Collections.Secom

Assembly

EncDotNet.S100.Collections.dll

Checks the data signature of a SECOM data object (exchangeMetadata.digitalSignatureValue): a hex-encoded signature over the decoded data, made with the key of the first certificate in publicCertificate.

public static class SecomSignatureVerifier

Inheritance

object

SecomSignatureVerifier

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Remarks

Signer trust is checked against SecomTrustAnchors: SECOM signers hold Maritime Connectivity Platform (MCP) certificates, whose roots are not in operating-system trust stores. Without anchors the result says only whether the data matches the stated certificate (SignerTrusted is null). Revocation is checked for a trusted signer when a SecomRevocation is given (SignerRevocation).

Methods

LoadCertificate(string)

Loads a certificate sent as base64 DER or as (possibly single-line) PEM, the "minified" form SECOM services use.

public static X509Certificate2 LoadCertificate(string text)

Parameters

text string

Returns

X509Certificate2

Exceptions

FormatException

The text is not base64.

CryptographicException

The bytes are not a certificate.

Recheck(SecomSignatureCheck, IReadOnlyList<string>, string?, SecomTrustAnchors?, DateTimeOffset?, SecomRevocation?)

Judges the signer of an earlier check again: its expiry now and, for a valid signature, its trust against trust and its revocation with revocation. A recorded download is re-judged this way each time it is read, so trust follows the current anchors without re-downloading.

public static SecomSignatureCheck Recheck(SecomSignatureCheck check, IReadOnlyList<string> publicCertificates, string? statedThumbprint, SecomTrustAnchors? trust, DateTimeOffset? now = null, SecomRevocation? revocation = null)

Parameters

check SecomSignatureCheck

The earlier check.

publicCertificates IReadOnlyList<string>

The certificates the object carried, signer first (base64 DER or PEM).

statedThumbprint string

The object's publicRootCertificateThumbprint, if any.

trust SecomTrustAnchors

The anchors to judge trust against, or null to skip the trust check.

now DateTimeOffset?

The time expiry is judged at; defaults to now.

revocation SecomRevocation

Checks a trusted signer's chain for revocation, or null to skip the check. On read paths pass CacheOnly.

Returns

SecomSignatureCheck

The check with its trust, revocation and expiry updated, or unchanged when the certificates cannot be read.

Verify(byte[], SecomExchangeMetadata?, SecomTrustAnchors?, DateTimeOffset?, SecomRevocation?)

Checks the signature of data.

public static SecomSignatureCheck Verify(byte[] data, SecomExchangeMetadata? metadata, SecomTrustAnchors? trust = null, DateTimeOffset? now = null, SecomRevocation? revocation = null)

Parameters

data byte[]

The decoded data the signature covers.

metadata SecomExchangeMetadata

The object's exchange metadata; null means unsigned.

trust SecomTrustAnchors

The anchors the signer must chain to (e.g. BuiltIn), or null to skip the trust check.

now DateTimeOffset?

The time expiry is judged at; defaults to now.

revocation SecomRevocation

Checks a trusted signer's chain for revocation, or null to skip the check.

Returns

SecomSignatureCheck