Razširitvene metode za CertificateRevocationListBuilder s post-kvantno podporo.

namespace WvdS.System.Security.Cryptography.X509Certificates;
 
public static class CertificateRevocationListExtensions

Hibridni način (priporočeno):

// Nalaganje CA-certifikata
var caCert = new X509Certificate2("ca.pfx", "password");
 
// Ustvarjanje CRL
var builder = new CertificateRevocationListBuilder();
builder.AddEntry(revokedCertificate.SerialNumberBytes.ToArray());
 
// Gradnja CRL s hibridnim podpisom
byte[] crlData = builder.Build(
    caCert,
    crlNumber: BigInteger.One,
    nextUpdate: DateTimeOffset.UtcNow.AddDays(7),
    HashAlgorithmName.SHA256,
    CryptoMode.Hybrid);

byte[] crlData = File.ReadAllBytes("ca.crl");
var caCert = new X509Certificate2("ca.cer");
 
bool isValid = CertificateRevocationListExtensions.VerifySignature(
    crlData,
    caCert,
    CryptoMode.Hybrid);

• RFC 5280¹⁾ - X.509 PKI CRL profil
• NIST FIPS 204²⁾ - ML-DSA

• RevocationExtensions
• X509ChainExtensions

Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional