X509ChainExtensions

Namespace: WvdS.System.Security.Cryptography.X509Certificates

Drop-In Replacement proširenja za X509Chain s Post-Quantum validacijom potpisa. Proširuje standardnu validaciju lanca s PQ provjerom potpisa u sva tri kripto načina.

using var chain = new X509Chain();
var cert = new X509Certificate2("certificate.pfx");
 
// S eksplicitnim CryptoMode
bool isValid = chain.Build(cert, CryptoMode.Hybrid);
 
// S Default-Mode iz CryptoConfig
bool isValid2 = chain.Build(cert, null);

// S X509Certificate2Collection
var trustAnchors = new X509Certificate2Collection();
trustAnchors.Add(rootCa);
 
using var chain = new X509Chain();
bool isValid = chain.Build(cert, trustAnchors, CryptoMode.Hybrid);
 
// S PqTrustStore
var trustStore = PqTrustStore.LoadFromPem("truststore.pem");
bool isValid2 = chain.Build(cert, trustStore, CryptoMode.Hybrid);

using var chain = new X509Chain();
bool isValid = chain.BuildWithRevocationCheck(
    certificate,
    customTrustStore,
    X509RevocationMode.Online,  // ili Offline
    CryptoMode.Hybrid);

Za Air-Gapped okruženja ili kada preuzimanje CRL-a nije moguće:

// Učitavanje CRL-ova
var crlData = new List<byte[]>
{
    File.ReadAllBytes("root-ca.crl"),
    File.ReadAllBytes("intermediate-ca.crl")
};
 
using var chain = new X509Chain();
bool isValid = chain.BuildWithOfflineCrl(
    certificate,
    customTrustStore,
    crlData,
    CryptoMode.Hybrid);

using var chain = new X509Chain();
chain.Build(cert, CryptoMode.Hybrid);
 
if (chain.IsFullyPqProtected())
{
    Console.WriteLine("Cijeli lanac je PQ-zaštićen");
}
else
{
    // Koji certifikati nisu PQ-zaštićeni?
    var modes = chain.GetChainCryptoModes();
    for (int i = 0; i < modes.Length; i++)
    {
        if (modes[i] == CryptoMode.Classic)
        {
            Console.WriteLine($"Element {i} nema PQ zaštitu");
        }
    }
}

Stvara detaljno izvješće o validaciji lanca:

using var chain = new X509Chain();
chain.Build(cert, CryptoMode.Hybrid);
 
var report = chain.GetValidationReport();
Console.WriteLine(report.ToString());
 
// Pojedinačna svojstva:
Console.WriteLine($"Valjan: {report.IsValid}");
Console.WriteLine($"Duljina lanca: {report.ChainLength}");
Console.WriteLine($"Potpuno PQ-zaštićen: {report.IsFullyPqProtected}");
 
// Detalji po elementu:
foreach (var element in report.Elements)
{
    Console.WriteLine($"  {element.Subject}");
    Console.WriteLine($"    Način: {element.CryptoMode}");
    Console.WriteLine($"    Ima PQ ključeve: {element.HasPqKeys}");
}

• X509Certificate2Extensions
• TrustStoreExtensions
• RevocationExtensions
• Kripto načini objašnjeni

Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional