More general CanSign replacement

diff --git a/gyac/yacpki/cer.go b/gyac/yacpki/cer.go
index 1c83c083e13466bdd37e867264be70a85feb3e3d25564e59da4faf850060fcbb..a1c7e2edb80c3030f717f9cb0103c40f2697b1b2816ec9af38238c0a2c44fd19 100644 (file)
--- a/gyac/yacpki/cer.go
+++ b/gyac/yacpki/cer.go
@@ -13,8 +13,8 @@ import (
 )
 
 const (
-       KUCA   = "ca"
-       KUSign = "sig"
+       KUCA  = "ca"
+       KUSig = "sig"
 )
 
 type Pub struct {
@@ -98,14 +98,11 @@ func (sd *SignedData) CerParse() error {
        return nil
 }
 
-func (cer *CerLoad) CanSign() bool {
+func (cer *CerLoad) Can(ku string) bool {
        if cer.KU == nil {
                return false
        }
-       if _, ok := (*cer.KU)[KUSign]; !ok {
-               return false
-       }
-       if len(cer.Pub) != 1 {
+       if _, ok := (*cer.KU)[ku]; !ok {
                return false
        }
        return true
@@ -127,7 +124,7 @@ func (sd *SignedData) CerIssueWith(
 var ErrSigInvalid = errors.New("signature is invalid")
 
 func (cer *CerLoad) CheckSignature(signed, signature []byte) (err error) {
-       if !cer.CanSign() {
+       if !cer.Can(KUSig) || len(cer.Pub) != 1 {
                err = errors.New("cer can not sign")
                return
        }
@@ -159,7 +156,7 @@ func (sd *SignedData) CerCheckSignatureFrom(parent *CerLoad) (err error) {
                err = errors.New("can verify only single signature")
                return
        }
-       if !parent.CanSign() {
+       if !parent.Can(KUSig) || len(parent.Pub) != 1 {
                err = errors.New("parent can not sign")
                return
        }
@@ -176,6 +173,9 @@ func (sd *SignedData) CerCheckSignatureFrom(parent *CerLoad) (err error) {
 }
 
 func (sd *SignedData) CerLoad() *CerLoad {
+       if sd.Load.T != "cer" {
+               return nil
+       }
        l, ok := sd.Load.V.(CerLoad)
        if ok {
                return &l
@@ -202,11 +202,11 @@ func (sd *SignedData) CerVerify(cers []*SignedData, t time.Time) (err error) {
        idToCer := make(map[uuid.UUID]*SignedData, len(cers))
        for _, cer := range cers {
                cerLoad := cer.CerLoad()
-               if !cerLoad.CanSign() {
+               if !cerLoad.Can(KUSig) || len(cerLoad.Pub) != 1 {
                        err = errors.New("cer can not sign")
                        return
                }
-               if _, ok := (*cerLoad.KU)[KUCA]; !ok {
+               if !cerLoad.Can(KUCA) {
                        err = errors.New("cer can not ca")
                        return
                }

diff --git a/gyac/yacpki/cmd/yacsdtool/main.go b/gyac/yacpki/cmd/yacsdtool/main.go
index 6a62aeecf7773e10763db8da137ab5c3f0ee50ed3801ef876b8bb2b3d19df358..fe5bb53a7a2993b5ea7d6d6c350a3f5a463460f4f0e580f1695b4b349cbd8e91 100644 (file)
--- a/gyac/yacpki/cmd/yacsdtool/main.go
+++ b/gyac/yacpki/cmd/yacsdtool/main.go
@@ -74,7 +74,7 @@ func main() {
                        log.Fatal("hash mismatch")
                }
                signer := cer.CerLoad()
-               if !signer.CanSign() {
+               if !signer.Can(yacpki.KUSig) || len(signer.Pub) != 1 {
                        log.Fatal("cer can not sign")
                }
                if sig.Sign.A != signer.Pub[0].A {

diff --git a/gyac/yacpki/signed-data.go b/gyac/yacpki/signed-data.go
index 366340f2f59c01dc904dd660e41c18b2bf5d5ed1aee3b914b42579b9e8787b09..305c8b7e4e8e004425feefd1ddccd3b431c17720a1f8018e896c3f62e81864ee 100644 (file)
--- a/gyac/yacpki/signed-data.go
+++ b/gyac/yacpki/signed-data.go
@@ -124,7 +124,7 @@ func SignedDataParseItem(item *gyac.Item) (sd *SignedData, err error) {
 }
 
 func (sd *SignedData) SignWith(parent *CerLoad, prv crypto.Signer, sigTBS SigTBS) error {
-       if !parent.CanSign() {
+       if !parent.Can(KUSig) || len(parent.Pub) != 1 {
                return errors.New("parent can not sign")
        }
        sigTBS.SID = parent.Pub[0].Id

diff --git a/spec/format/cer.texi b/spec/format/cer.texi
index d54c80087eaf1d278fd895ccddd86548f4c0b0f28a7658d0df133d7462f1df25..2632eff8b575b59ade40af1fbf2d04bc9d8ad35f311fa096addf46b53e134ccc 100644 (file)
--- a/spec/format/cer.texi
+++ b/spec/format/cer.texi
@@ -34,8 +34,8 @@ identifier, that @strong{should} be generated as an UUIDv4 based on the
 hash of the key.
 
 @item ku
-Intended public key usage. Certificate @strong{must} be signed with the
-key having "ca" key usage, unless it is self-signed.
+Intended public key(s) usage. Certificate @strong{must} be signed with
+the certificate having "ca" key usage, unless it is self-signed.
 Application-specific example with multiple public keys is described
 above. It @strong{must} be absent if empty.