Scenarij 5.2: Validacija verige

Ta scenarij opisuje popolno validacijo verige certifikatov po RFC 5280. Validacija preverja:

• Veljavnost podpisa - Vsak certifikat podpisan od izdajatelja
• Časovno veljavnost - Vsi certifikati znotraj obdobja veljavnosti
• Key Usage - Dovoljeni nameni uporabe
• Path Length - BasicConstraints pathLenConstraint
• Policy Constraints - Omejitve politik certifikatov
• Name Constraints - Dovoljena/prepovedana imena

using WvdS.Security.Cryptography.X509Certificates.Extensions.PQ;
using System.Security.Cryptography.X509Certificates;
 
using var ctx = PqCryptoContext.Initialize();
 
// Nalaganje certifikata
var serverCert = ctx.LoadCertificate("server.crt.pem");
 
// Popolna validacija verige
var chain = new X509Chain();
chain.ChainPolicy.RevocationMode = X509RevocationMode.Online;
chain.ChainPolicy.RevocationFlag = X509RevocationFlag.EntireChain;
chain.ChainPolicy.UrlRetrievalTimeout = TimeSpan.FromSeconds(30);
chain.ChainPolicy.VerificationTime = DateTime.UtcNow;
 
// Dodatni vmesni certifikati
chain.ChainPolicy.ExtraStore.Add(ctx.LoadCertificate("intermediate-ca.crt.pem"));
 
// Gradnja in validacija verige
bool isValid = chain.Build(serverCert);
 
// Ovrednotenje rezultata
Console.WriteLine($"Validacija verige: {(isValid ? "VELJAVNA" : "NEVELJAVNA")}");
 
if (!isValid)
{
    foreach (var element in chain.ChainElements)
    {
        foreach (var status in element.ChainElementStatus)
        {
            Console.WriteLine($"  {element.Certificate.Subject}");
            Console.WriteLine($"    Napaka: {status.Status}");
            Console.WriteLine($"    Podrobnosti: {status.StatusInformation}");
        }
    }
}

public class ChainValidator
{
    public ValidationResult ValidateChain(X509Certificate2 certificate, ValidationOptions options)
    {
        var result = new ValidationResult { IsValid = true };
 
        using var chain = new X509Chain();
        ConfigureChainPolicy(chain.ChainPolicy, options);
 
        if (!chain.Build(certificate))
        {
            result.IsValid = false;
            result.Errors = ExtractErrors(chain);
        }
 
        // Dodatna PQ preverjanja
        if (options.RequirePostQuantum)
        {
            ValidatePqRequirements(chain, result);
        }
 
        return result;
    }
 
    private void ConfigureChainPolicy(X509ChainPolicy policy, ValidationOptions options)
    {
        policy.RevocationMode = options.CheckRevocation
            ? X509RevocationMode.Online
            : X509RevocationMode.NoCheck;
 
        policy.RevocationFlag = X509RevocationFlag.EntireChain;
        policy.VerificationTime = options.ValidationTime ?? DateTime.UtcNow;
 
        // Application Policies (Extended Key Usage)
        if (options.RequiredEku != null)
        {
            policy.ApplicationPolicy.Add(options.RequiredEku);
        }
 
        // Certificate Policies
        if (options.RequiredPolicies != null)
        {
            foreach (var policyOid in options.RequiredPolicies)
            {
                policy.CertificatePolicy.Add(policyOid);
            }
        }
 
        // Prilagojena shramba zaupanja
        if (options.CustomTrustStore != null)
        {
            policy.CustomTrustStore.AddRange(options.CustomTrustStore);
            policy.TrustMode = X509ChainTrustMode.CustomRootTrust;
        }
    }
 
    private void ValidatePqRequirements(X509Chain chain, ValidationResult result)
    {
        foreach (var element in chain.ChainElements)
        {
            var cert = element.Certificate;
            var algorithm = cert.PublicKey.Oid.Value;
 
            // Preverjanje ali se uporablja PQ algoritem
            if (!IsPqAlgorithm(algorithm))
            {
                result.Warnings.Add($"{cert.Subject}: Ni PQ algoritem ({algorithm})");
            }
        }
    }
 
    private bool IsPqAlgorithm(string oid)
    {
        return oid switch
        {
            "2.16.840.1.101.3.4.3.17" => true,  // ML-DSA-44
            "2.16.840.1.101.3.4.3.18" => true,  // ML-DSA-65
            "2.16.840.1.101.3.4.3.19" => true,  // ML-DSA-87
            _ => false
        };
    }
}

public class ValidationOptions
{
    // Čas validacije
    public DateTime? ValidationTime { get; set; }
 
    // Preverjanje preklica
    public bool CheckRevocation { get; set; } = true;
 
    // Extended Key Usage
    public Oid? RequiredEku { get; set; }
 
    // Certificate Policies
    public List<Oid>? RequiredPolicies { get; set; }
 
    // Prilagojena shramba zaupanja
    public X509Certificate2Collection? CustomTrustStore { get; set; }
 
    // PQ zahteve
    public bool RequirePostQuantum { get; set; }
 
    // Časovna omejitev za spletna preverjanja
    public TimeSpan UrlTimeout { get; set; } = TimeSpan.FromSeconds(30);
}
 
// Primer: Validacija TLS strežnika
var tlsOptions = new ValidationOptions
{
    RequiredEku = new Oid("1.3.6.1.5.5.7.3.1"),  // serverAuth
    CheckRevocation = true,
    RequirePostQuantum = true
};
 
// Primer: Validacija podpisovanja kode
var codeSigningOptions = new ValidationOptions
{
    RequiredEku = new Oid("1.3.6.1.5.5.7.3.3"),  // codeSigning
    CheckRevocation = true,
    ValidationTime = signatureTimestamp  // Čas podpisa
};

« ← 5.1 Gradnja verige | ↑ Pregled validacije | 5.3 Preverjanje preklica → »

Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional