tech.pisoft.teagent.X509Context
The X509Context class is the abstract base for certificate-based authentication contexts, which answer a server challenge by signing – with the private key of a certificate – a message bound to the TLS connection the exchange runs over.
FileX509Context is the only concrete form.
The construction. The client presents its certificate, the Key Service returns a 32-byte challenge, and the client signs M = "TE-AM08-CHANNEL-BOUND-v1" || 0x00 || SHA-256("tls-exporter:" || exporter) || challenge where exporter is THIS connection's RFC 9266 channel binding (TEAgentConnection#getChannelBinding). The Key Service verifies against its own copy of the exporter, so a signature made for one connection is refused on every other and a relay that terminates TLS cannot forward a login. M carries the SHA-256 of the typed value and never the value itself. The scheme follows the key type – RSASSA-PSS (SHA-256, MGF1-SHA-256, salt length 32) for RSA, ECDSA over SHA-256 for EC – and is applied by the concrete context's calculateResponse; nothing is negotiated and nothing else is accepted.
Since: 1.0
© Pi Soft, 2018-2026 · Tricryption Engine 8.1
Inheritance
- Inherits tech.pisoft.teagent.AuthenticationContext
- Inherited by tech.pisoft.teagent.FileX509Context
Public Member Functions
| Member | Description |
|---|---|
void setSecret(Object objSec) | The setSecret method sets secret authentication information. |
abstract byte[] getCertificate() | |
abstract byte[] calculateResponse(byte[] message) | The calculateResponse method signs the channel-bound message M with the certificate's private key under the key's scheme and returns the signature. |
Member Function Documentation
void setSecret(Object objSec)
The setSecret method sets secret authentication information.
Deprecated
Parameters
| Parameter | Description |
|---|---|
objSec | A secret property object; both a username and a password object are needed. |
Exceptions
| Exception | Description |
|---|---|
TEAgentException | if the request cannot be completed on the connection, or the Key Service returns an error for it (delivered as a TEServerException). |
abstract byte[] calculateResponse(byte[] message)
The calculateResponse method signs the channel-bound message M with the certificate's private key under the key's scheme and returns the signature.
Parameters
| Parameter | Description |
|---|---|
message | M, 89 bytes, built by channelBoundMessage; the challenge is its last 32 bytes. The implementer does not build M and does not read the exporter. |
Returns: the signature: RSASSA-PSS (SHA-256, MGF1-SHA-256, salt 32) for an RSA key, DER-encoded ECDSA over SHA-256 for an EC key.