Tspex.Verified (tspex v0.1.0)

Copy Markdown View Source

The result of Tspex.verify/3: a token that passed every check.

Fields:

  • :info - the Tspex.TSTInfo, now that the signature and the certificate vouch for it. info.gen_time is the time the TSA says.
  • :token - the verified ContentInfo, to keep: it is the time-stamp proper, and verify/3 takes it back months later.
  • :status - :granted or :granted_with_mods when a whole response was verified, nil for a token that came alone.

  • :signer - %{certificate: der, path: [der] | nil, signer_info: Cmsex.SignerInfo.t()}: the certificate of the TSA, the certificate path from the root to it (root first, nil with trust: :none) and the signer of the token.

  • :certificates - the certificates that came in the token, in DER.
  • :trust - :validated when the path leads to one of the :trust roots, :none with trust: :none, which proves only that a key signed this imprint.
  • :revocation - :checked when the :revocation function accepted the path, :not_checked otherwise: nothing has said the certificate of the TSA was not revoked.
  • :deviations - what was tolerated against the RFC: :gen_time_encoding (a genTime that is not in DER), :unrequested_certificates (the request had cert_req: false and the token carries certificates), :cert_req_not_honored (the request asked for the certificate and the token has none), and what the CMS layer tolerated.

inspect/1 shows the size of the token, not its bytes.

Summary

Types

signer()

The certificate of the TSA, its path from the root and the signer of the token.

t()

What Tspex.verify/3 proves; the fields are described above.

Types

signer()

@type signer() :: %{
  certificate: binary(),
  path: [binary()] | nil,
  signer_info: Cmsex.SignerInfo.t()
}

The certificate of the TSA, its path from the root and the signer of the token.

t()

@type t() :: %Tspex.Verified{
  certificates: [binary()],
  deviations: [atom()],
  info: Tspex.TSTInfo.t(),
  revocation: :checked | :not_checked,
  signer: signer(),
  status: :granted | :granted_with_mods | nil,
  token: binary(),
  trust: :validated | :none
}

What Tspex.verify/3 proves; the fields are described above.