Extract Certificate Transparency SCTs from stapled OCSP responses

net/tools/testserver/minica.py

 # Copyright (c) 2012 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import asn1
 import hashlib
 import os
 
 
 # This file implements very minimal certificate and OCSP generation. It's
@@ skipping 148 matching lines @@
 AUTHORITY_INFORMATION_ACCESS = asn1.OID([1, 3, 6, 1, 5, 5, 7, 1, 1])
 BASIC_CONSTRAINTS = asn1.OID([2, 5, 29, 19])
 CERT_POLICIES = asn1.OID([2, 5, 29, 32])
 COMMON_NAME = asn1.OID([2, 5, 4, 3])
 COUNTRY = asn1.OID([2, 5, 4, 6])
 HASH_SHA1 = asn1.OID([1, 3, 14, 3, 2, 26])
 OCSP_TYPE_BASIC = asn1.OID([1, 3, 6, 1, 5, 5, 7, 48, 1, 1])
 ORGANIZATION = asn1.OID([2, 5, 4, 10])
 PUBLIC_KEY_RSA = asn1.OID([1, 2, 840, 113549, 1, 1, 1])
 SHA1_WITH_RSA_ENCRYPTION = asn1.OID([1, 2, 840, 113549, 1, 1, 5])
+# SignedCertificateTimestampList (RFC 6962)

[wtc, 2013/12/03 21:04:25]

Nit: the comment should mention this OID is used with an OCSP extension.

+SCT_LIST_OCSP = asn1.OID([1, 3, 6, 1, 4, 1, 11129, 2, 4, 5])
 
 
 def MakeCertificate(
     issuer_cn, subject_cn, serial, pubkey, privkey, ocsp_url = None):
   '''MakeCertificate returns a DER encoded certificate, signed by privkey.'''
   extensions = asn1.SEQUENCE([])
 
   # Default subject name fields
   c = "XX"
   o = "Testing Org"
@@ skipping 60 matching lines @@
   return asn1.ToDER(asn1.SEQUENCE([
     asn1.Raw(tbsCert),
     asn1.SEQUENCE([
       SHA1_WITH_RSA_ENCRYPTION,
       None,
     ]),
     asn1.BitString(privkey.Sign(tbsCert)),
   ]))
 
 
-def MakeOCSPResponse(issuer_cn, issuer_key, serial, ocsp_state):
+def MakeOCSPResponse(issuer_cn, issuer_key, serial, ocsp_state, sct_extension):
   # https://tools.ietf.org/html/rfc2560
   issuer_name_hash = asn1.OCTETSTRING(
       hashlib.sha1(asn1.ToDER(Name(cn = issuer_cn))).digest())
 
   issuer_key_hash = asn1.OCTETSTRING(
       hashlib.sha1(asn1.ToDER(issuer_key)).digest())
 
   cert_status = None
   if ocsp_state == OCSP_STATE_REVOKED:
     cert_status = asn1.Explicit(1, asn1.GeneralizedTime("20100101060000Z"))
   elif ocsp_state == OCSP_STATE_UNKNOWN:
     cert_status = asn1.Raw(asn1.TagAndLength(0x80 | 2, 0))
   elif ocsp_state == OCSP_STATE_GOOD:
     cert_status = asn1.Raw(asn1.TagAndLength(0x80 | 0, 0))
   else:
     raise ValueError('Bad OCSP state: ' + str(ocsp_state))
 
+  single_response_sequence = [ # SingleResponse
+    asn1.SEQUENCE([ # CertID
+      asn1.SEQUENCE([ # hashAlgorithm
+        HASH_SHA1,
+        None,
+      ]),
+      issuer_name_hash,
+      issuer_key_hash,
+      serial,
+    ]),
+    cert_status,
+    asn1.GeneralizedTime("20100101060000Z"), # thisUpdate
+    asn1.Explicit(0, asn1.GeneralizedTime("20300101060000Z")), # nextUpdate
+  ]
+
+  if sct_extension:
+    single_extension = asn1.SEQUENCE([
+      SCT_LIST_OCSP,  # exntID
+      False,  # critical
+      asn1.OCTETSTRING(asn1.ToDER(asn1.OCTETSTRING(sct_extension)))
+    ])
+
+    single_extensions = asn1.SEQUENCE([single_extension])
+    single_response_sequence.append(asn1.Explicit(1, single_extensions))
+
+  single_response = asn1.SEQUENCE(single_response_sequence)
+
   basic_resp_data_der = asn1.ToDER(asn1.SEQUENCE([
     asn1.Explicit(2, issuer_key_hash),
     asn1.GeneralizedTime("20100101060000Z"), # producedAt
-    asn1.SEQUENCE([
-      asn1.SEQUENCE([ # SingleResponse
-        asn1.SEQUENCE([ # CertID
-          asn1.SEQUENCE([ # hashAlgorithm
-            HASH_SHA1,
-            None,
-          ]),
-          issuer_name_hash,
-          issuer_key_hash,
-          serial,
-        ]),
-        cert_status,
-        asn1.GeneralizedTime("20100101060000Z"), # thisUpdate
-        asn1.Explicit(0, asn1.GeneralizedTime("20300101060000Z")), # nextUpdate
-      ]),
-    ]),
-  ]))
+    asn1.SEQUENCE([single_response]),
+    ]))

[wtc, 2013/12/03 21:04:25]

Nit: the original code indents this line with two fewer spaces.

 
   basic_resp = asn1.SEQUENCE([
     asn1.Raw(basic_resp_data_der),
     asn1.SEQUENCE([
       SHA1_WITH_RSA_ENCRYPTION,
       None,
     ]),
     asn1.BitString(issuer_key.Sign(basic_resp_data_der)),
   ])
 
@@ skipping 20 matching lines @@
 OCSP_STATE_UNAUTHORIZED = 4
 OCSP_STATE_UNKNOWN = 5
 
 # unauthorizedDER is an OCSPResponse with a status of 6:
 # SEQUENCE { ENUM(6) }
 unauthorizedDER = '30030a0106'.decode('hex')
 
 def GenerateCertKeyAndOCSP(subject = "127.0.0.1",
                            ocsp_url = "http://127.0.0.1",
                            ocsp_state = OCSP_STATE_GOOD,
-                           serial = 0):
+                           serial = 0,
+                           sct_extension = None):
   '''GenerateCertKeyAndOCSP returns a (cert_and_key_pem, ocsp_der) where:
        * cert_and_key_pem contains a certificate and private key in PEM format
          with the given subject common name and OCSP URL.
        * ocsp_der contains a DER encoded OCSP response or None if ocsp_url is
          None'''
 
   if serial == 0:
     serial = RandomNumber(16)
   cert_der = MakeCertificate(ISSUER_CN, bytes(subject), serial, KEY, KEY,
                              bytes(ocsp_url))
   cert_pem = DERToPEM(cert_der)
 
   ocsp_der = None
   if ocsp_url is not None:
     if ocsp_state == OCSP_STATE_UNAUTHORIZED:
       ocsp_der = unauthorizedDER
     elif ocsp_state == OCSP_STATE_INVALID:
       ocsp_der = '3'
     else:
-      ocsp_der = MakeOCSPResponse(ISSUER_CN, KEY, serial, ocsp_state)
+      ocsp_der = MakeOCSPResponse(ISSUER_CN, KEY, serial, ocsp_state,
+                                  sct_extension)
 
   return (cert_pem + KEY_PEM, ocsp_der)