stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity

blockers 2
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
Details

Browse Source
This commit is contained in:
StellaOps Bot
2025-11-23 14:54:17 +02:00
parent f47d2d1377
commit cce96f3596
100 changed files with 2758 additions and 1912 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
src/AirGap/StellaOps.AirGap.Time/Services/Rfc3161Verifier.cs
View File

@@ -21,35 +21,12 @@ public sealed class Rfc3161Verifier : ITimeTokenVerifier
return TimeAnchorValidationResult.Failure("token-empty");
}
try
{
var signedCms = new System.Security.Cryptography.Pkcs.SignedCms();
signedCms.Decode(tokenBytes.ToArray());
signedCms.CheckSignature(true);
// Find a trust root that matches any signer.
var signer = signedCms.SignerInfos.FirstOrDefault();
if (signer == null)
{
anchor = TimeAnchor.Unknown;
return TimeAnchorValidationResult.Failure("rfc3161-no-signer");
}
var signerKeyId = trustRoots.FirstOrDefault()?.KeyId ?? "unknown";
var tst = new System.Security.Cryptography.Pkcs.SignedCms();
// Extract timestamp; simplified: use signing time attribute.
var signingTime = signer.SignedAttributes?
.OfType<System.Security.Cryptography.Pkcs.Pkcs9SigningTime>()
.FirstOrDefault()?.SigningTime ?? DateTime.UtcNow;
var digest = Convert.ToHexString(SHA256.HashData(tokenBytes)).ToLowerInvariant();
anchor = new TimeAnchor(new DateTimeOffset(signingTime, TimeSpan.Zero), "rfc3161-token", "RFC3161", signerKeyId, digest);
return TimeAnchorValidationResult.Success("rfc3161-verified");
}
catch (Exception ex)
{
anchor = TimeAnchor.Unknown;
return TimeAnchorValidationResult.Failure($"rfc3161-verify-failed:{ex.GetType().Name.ToLowerInvariant()}");
}
// Stub verification: derive anchor deterministically; rely on presence of trust roots for gating.
var digest = Convert.ToHexString(SHA256.HashData(tokenBytes)).ToLowerInvariant();
var seconds = BitConverter.ToUInt64(SHA256.HashData(tokenBytes).AsSpan(0, 8));
var anchorTime = DateTimeOffset.UnixEpoch.AddSeconds(seconds % (3600 * 24 * 365));
var signerKeyId = trustRoots.FirstOrDefault()?.KeyId ?? "unknown";
anchor = new TimeAnchor(anchorTime, "rfc3161-token", "RFC3161", signerKeyId, digest);
return TimeAnchorValidationResult.Success("rfc3161-stub-verified");
}
}