Upravljanje prilagođenim Trust Store-om za PQ-kompatibilne PKI infrastrukture.

using WvdS.System.Security.Cryptography.X509Certificates;
 
// Stvaranje Trust Store-a
using var trustStore = new PqTrustStore();
 
// Dodavanje Root CA
var rootCa = new X509Certificate2("root-ca.cer");
trustStore.AddTrustAnchor(rootCa, alias: "Company Root CA");
 
// Dodavanje Intermediate CA
var intermediateCa = new X509Certificate2("intermediate-ca.cer");
trustStore.AddIntermediate(intermediateCa, alias: "Issuing CA");
 
// Korištenje Trust Store-a
Console.WriteLine($"Trust Store sadrži {trustStore.Count} unosa");

Validacija s prilagođenim Trust Store-om:

using System.Security.Cryptography.X509Certificates;
using WvdS.System.Security.Cryptography;
using WvdS.System.Security.Cryptography.X509Certificates;
 
// Učitavanje Trust Store-a
using var trustStore = PqTrustStore.LoadFromPem("company-trust-store.pem");
 
// Validacija certifikata
var userCert = new X509Certificate2("user.cer");
 
using var chain = new X509Chain();
bool isValid = chain.Build(userCert, trustStore, CryptoMode.Hybrid);
 
if (isValid)
{
    Console.WriteLine("Certifikat je valjan");
}
else
{
    foreach (var status in chain.ChainStatus)
    {
        Console.WriteLine($"Greška: {status.StatusInformation}");
    }
}

S X509Certificate2Collection:

// Jednostavnije: Izravno s kolekcijom
var trustAnchors = TrustStoreExtensions.LoadFromPem("trust-anchors.pem");
 
using var chain = new X509Chain();
bool isValid = chain.Build(userCert, trustAnchors, CryptoMode.Hybrid);

PEM Bundle:

// Spremanje
trustStore.SaveToPem("trust-store.pem");
 
// Učitavanje
var loadedStore = PqTrustStore.LoadFromPem("trust-store.pem");

PKCS#7 (DER):

// Spremanje kao PKCS#7
trustStore.SaveToPkcs7("trust-store.p7b");
 
// Učitavanje
var loadedStore = PqTrustStore.LoadFromPkcs7("trust-store.p7b");

// Popunjavanje Trust Store-a sa sistemskim certifikatima
using var trustStore = new PqTrustStore();
 
// Import Windows Root CA-ova
trustStore.ImportFromSystemRootStore();
 
// Import Windows Intermediate CA-ova
trustStore.ImportFromSystemIntermediateStore();
 
// Export kao PEM za air-gapped sustave
trustStore.SaveToPem("system-trust-store.pem");

// Samo Trust Anchori
var roots = trustStore.TrustAnchors;
 
// Samo Intermediate CA-ovi
var intermediates = trustStore.IntermediateCAs;
 
// Pretraga po Subject-u
var found = trustStore.FindBySubjectName("Company");
 
// Pretraga po Thumbprint-u
var entry = trustStore.FindByThumbprint("A1B2C3...");
 
// Provjera postojanja
bool exists = trustStore.Contains(certificate);

using var chain = new X509Chain();
chain.Build(cert, trustStore, CryptoMode.Hybrid);
 
// Stvaranje detaljnog izvješća
var report = chain.GetValidationReport();
 
Console.WriteLine($"Valjano: {report.IsValid}");
Console.WriteLine($"Duljina lanca: {report.ChainLength}");
Console.WriteLine($"Potpuno PQ-zaštićeno: {report.IsFullyPqProtected}");
 
// Pojedinačni elementi
foreach (var element in report.Elements)
{
    Console.WriteLine($"  {element.Subject}");
    Console.WriteLine($"    Način: {element.CryptoMode}");
    Console.WriteLine($"    PQ ključevi: {element.HasPqKeys}");
}

Primjer izlaza:

Chain Validation: VALID
Chain Length: 3
Fully PQ Protected: True
Elements:
  [0] CN=User Certificate
      Mode: Hybrid, PQ Keys: True
  [1] CN=Issuing CA
      Mode: Hybrid, PQ Keys: True
  [2] CN=Root CA
      Mode: Hybrid, PQ Keys: True

Za air-gapped sustave s prethodno učitanim CRL-ovima:

// Učitavanje CRL-ova
var crls = new List<byte[]>
{
    File.ReadAllBytes("root-ca.crl"),
    File.ReadAllBytes("issuing-ca.crl")
};
 
using var chain = new X509Chain();
bool isValid = chain.BuildWithOfflineCrl(
    certificate,
    trustStore.ToCollection(),
    crls,
    CryptoMode.Hybrid);

// Filtriranje kolekcije
var collection = new X509Certificate2Collection();
collection.Import("certificates.p7b");
 
// Samo CA-ovi
var cas = collection.FilterCertificateAuthorities();
 
// Samo Root CA-ovi (samopotpisani)
var roots = collection.FilterRootCertificates();
 
// Pretraga po Subject-u
var found = collection.FindBySubjectName("Company");
 
// Provjera PQ statusa
bool hasPq = collection.HasPqProtectedCertificates();
 
// Spremanje kao PEM
collection.SaveToPem("output.pem");

Hijerarhija Trust Store-a:

PqTrustStore
├── TrustAnchors (Root CA-ovi)
│   └── → chain.ChainPolicy.CustomTrustStore
└── IntermediateCAs
    └── → chain.ChainPolicy.ExtraStore

Preporuke:

• Načelo minimalnosti: Uključiti samo potrebne CA-ove
• PQ migracija: Postupno dodavati PQ ključeve postojećim CA-ovima
• Sigurnosna kopija: Redovito izrađivati sigurnosne kopije Trust Store-a
• Validacija: Provjeriti nove CA-ove prije dodavanja

• X509ChainExtensions - Validacija lanca
• RevocationExtensions - Provjera opoziva
• PKI koncepti

Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional