evidence_record 0.1.0

data/lib/evidence_record/hash_tree.rb

@@ -0,0 +1,110 @@
+# frozen_string_literal: true
+
+module EvidenceRecord
+  # A hash tree built from leaves, used to generate reduced hash trees
+  # (RFC 4998 §4.2). It only computes hashes; it knows nothing about ASN.1
+  # or time-stamps.
+  #
+  # Each leaf is the list of hashes of one data object (one hash) or of one
+  # data object group (the hashes of all its members). The tree is binary and
+  # built like Bouncy Castle's BinaryTreeRootCalculator (docs/design.md 4.2):
+  # the leaves are sorted by their hash, adjacent pairs are hashed together,
+  # and the last node of an odd-sized level is carried up unchanged.
+  class HashTree
+    attr_reader :digest_algorithm
+
+    def initialize(digest_algorithm: :sha256)
+      @digest_algorithm = DigestAlgorithm.fetch(digest_algorithm)
+      @leaves = []
+      @levels = nil
+    end
+
+    # Adds a leaf from the hashes of a data object ([hash]) or of the members
+    # of a data object group, and returns the index of the new leaf (in the
+    # order of addition).
+    def add(member_hashes)
+      unless member_hashes.is_a?(Array) && !member_hashes.empty?
+        raise ArgumentError, "member_hashes must be a non-empty Array"
+      end
+
+      values = member_hashes.map do |h|
+        bytes = Digest.bytes_of(h)
+        unless bytes.bytesize == @digest_algorithm.digest_size
+          raise ArgumentError,
+                "hash must be #{@digest_algorithm.digest_size} bytes for #{@digest_algorithm}, got #{bytes.bytesize}"
+        end
+        bytes
+      end.freeze
+      @leaves << values
+      @levels = nil
+      @leaves.size - 1
+    end
+
+    def size
+      @leaves.size
+    end
+
+    def empty?
+      @leaves.empty?
+    end
+
+    # The hash of the leaf at index (for a group, the hash of its members).
+    def leaf_hash(index)
+      check_index!(index)
+      Digest.new(node_hash(@leaves[index]))
+    end
+
+    def root
+      raise Error, "an empty hash tree has no root" if empty?
+
+      Digest.new(levels.last[0])
+    end
+
+    # The reduced hash tree for the leaf at index (in the order of addition).
+    def reduced_hashtree(index)
+      check_index!(index)
+      all_levels = levels # also computes @positions
+      partials = [@leaves[index]]
+      pos = @positions[index]
+      all_levels[0...-1].each do |level|
+        sibling = pos ^ 1
+        partials << [level[sibling]] if sibling < level.size
+        pos >>= 1
+      end
+      ReducedHashtree.new(partials)
+    end
+
+    def inspect
+      "#<#{self.class.name} #{@digest_algorithm} size=#{size}>"
+    end
+
+    private
+
+    def node_hash(values)
+      ReducedHashtree.node_hash(@digest_algorithm, values)
+    end
+
+    # levels[0] holds the leaf hashes sorted in binary ascending order;
+    # levels.last holds the root.
+    def levels
+      return @levels if @levels
+
+      sorted = @leaves.each_with_index.map { |values, i| [node_hash(values), i] }.sort
+      @positions = Array.new(@leaves.size)
+      sorted.each_with_index { |(_, i), pos| @positions[i] = pos }
+
+      level = sorted.map(&:first)
+      levels = [level]
+      while level.size > 1
+        level = level.each_slice(2).map { |pair| pair.size == 2 ? @digest_algorithm.digest(*pair.sort) : pair[0] }
+        levels << level
+      end
+      @levels = levels
+    end
+
+    def check_index!(index)
+      raise ArgumentError, "index must be an Integer, got #{index.class}" unless index.is_a?(Integer)
+      raise IndexError, "index #{index} out of range (size #{size})" unless index >= 0 && index < size
+    end
+  end
+end

data/lib/evidence_record/hash_tree_renewal.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module EvidenceRecord
+  # A hash-tree renewal of a Record (RFC 4998 §5.2, docs/design.md 3.5): a
+  # new chain, whose first time-stamp covers the data and all the older
+  # chains, hashed with a new algorithm. Done before the hash algorithm in
+  # use weakens.
+  #
+  #   renewal = record.hash_tree_renewal(data: "doc-a", digest_algorithm: :sha512)
+  #   req     = renewal.timestamp_request(nonce: SecureRandom.random_number(2**64))
+  #   res     = post_to_tsa(req.to_der)        # the TSA response, as a String
+  #   record2 = renewal.build(res)             # => a new Record
+  #
+  # The new time-stamp covers H(H(d) + ha) for the data object d, where ha
+  # is the hash of the ArchiveTimeStampSequence so far (both with the new
+  # algorithm). For a data object group, it covers H(H(d_i) + ha) for each
+  # member, as one group. The concatenation is in this fixed order, as
+  # Bouncy Castle does (docs/design.md 3.5).
+  #
+  # The record is first checked against the data (Record#verify_hashes!), so
+  # that a record is never renewed with the wrong data. The signatures of the
+  # time-stamps are not checked; do that with Record#verify before renewing.
+  #
+  # See Renewal for #timestamp_request and #build.
+  class HashTreeRenewal
+    include Renewal
+
+    # Internal: use Record#hash_tree_renewal.
+    def initialize(record, data:, digest_algorithm:)
+      algorithm = DigestAlgorithm.fetch(digest_algorithm)
+      source = DataSource.wrap(data)
+      Verifier.new(record, source).verify_hashes!
+      ha = algorithm.digest(record.archive_timestamp_sequence_der)
+      prepare(record, algorithm, source.member_digests(algorithm).map { algorithm.digest(_1, ha) })
+    end
+
+    private
+
+    def renewed_chains(archive_timestamp)
+      @record.chains + [Chain.build([archive_timestamp])]
+    end
+  end
+end

data/lib/evidence_record/record.rb

@@ -0,0 +1,214 @@
+# frozen_string_literal: true
+
+module EvidenceRecord
+  # An Evidence Record (RFC 4998 §3): the RFC's EvidenceRecord type.
+  #
+  #   EvidenceRecord ::= SEQUENCE {
+  #     version                   INTEGER { v1(1) },
+  #     digestAlgorithms          SEQUENCE OF AlgorithmIdentifier,
+  #     cryptoInfos               [0] CryptoInfos OPTIONAL,
+  #     encryptionInfo            [1] EncryptionInfo OPTIONAL,
+  #     archiveTimeStampSequence  ArchiveTimeStampSequence }
+  #
+  # Only DER is accepted, and the original DER is kept and returned by
+  # #to_der (docs/design.md 7.1).
+  class Record
+    VERSION = 1
+
+    attr_reader :version, :digest_algorithm_oids, :chains
+    # The cryptoInfos and encryptionInfo fields as they were read (DER,
+    # including their [0] / [1] tags), or nil. They are kept but not
+    # interpreted (docs/design.md 7.3).
+    attr_reader :crypto_infos, :encryption_info
+
+    class << self
+      # Parses a DER-encoded Evidence Record. Raises ParseError when der is not
+      # DER or does not match the structure of RFC 4998.
+      def from_der(der)
+        new(DER.parse(der, "EvidenceRecord"))
+      end
+
+      # Internal: encodes a new Evidence Record from Chains. digestAlgorithms
+      # lists the algorithms of the ArchiveTimeStamps in order of appearance.
+      def build(chains)
+        from_der(encode(digest_algorithm_ders([], chains), nil, nil, chains))
+      end
+
+      # Internal.
+      def encode(digest_algorithm_ders, crypto_infos, encryption_info, chains)
+        DER.sequence([DER.encode_integer(VERSION), DER.sequence(digest_algorithm_ders),
+                      crypto_infos, encryption_info, DER.sequence(chains.map(&:to_der))].compact)
+      end
+
+      # Internal: existing (OID, DER) pairs plus AlgorithmIdentifiers for the
+      # algorithms of chains that are not among them.
+      def digest_algorithm_ders(existing, chains)
+        oids = existing.map(&:first)
+        added = chains.flat_map(&:archive_timestamps).map(&:digest_algorithm_oid).uniq - oids
+        existing.map(&:last) + added.map { AlgorithmIdentifier.encode(DigestAlgorithm.from_oid(_1)) }
+      end
+
+      private :new
+    end
+
+    def initialize(node)
+      what = "EvidenceRecord"
+      @der = node.raw
+      version, algorithms, *optional, sequence = DER.children_of(node, what, size: 3..5)
+      @version = DER.integer(version, "#{what} version")
+      raise ParseError, "#{what}: unsupported version #{@version}" unless @version == VERSION
+
+      @digest_algorithms = DER.children_of(algorithms, "#{what} digestAlgorithms").map do |alg|
+        [AlgorithmIdentifier.parse(alg, "#{what} digestAlgorithms"), alg.raw]
+      end.freeze
+      @digest_algorithm_oids = @digest_algorithms.map(&:first).freeze
+      parse_optional(optional, what)
+      @chains = DER.children_of(sequence, "#{what} archiveTimeStampSequence").each_with_index.map do |chain, i|
+        Chain.from_node(chain, "archiveTimeStampSequence[#{i}]")
+      end.freeze
+      freeze
+    end
+
+    # The digestAlgorithms field as DigestAlgorithms. Raises
+    # UnsupportedAlgorithmError if it lists other algorithms (see
+    # #digest_algorithm_oids).
+    def digest_algorithms
+      @digest_algorithm_oids.map { DigestAlgorithm.from_oid(_1) }
+    end
+
+    # The time the data is proven to have existed: the genTime of the first
+    # ArchiveTimeStamp. nil if the record has no ArchiveTimeStamp.
+    #
+    # This is only meaningful after the record has been verified.
+    def proven_time
+      @chains.first&.archive_timestamps&.first&.timestamp&.gen_time
+    end
+
+    # Whether other was built from the same hash tree: the first time-stamps
+    # are the same. Such records can share the TSA response of a time-stamp
+    # renewal.
+    def related_to?(other)
+      raise ArgumentError, "other must be an EvidenceRecord::Record, got #{other.class}" unless other.is_a?(Record)
+
+      mine = @chains.first&.archive_timestamps&.first
+      theirs = other.chains.first&.archive_timestamps&.first
+      !mine.nil? && !theirs.nil? && mine.timestamp == theirs.timestamp
+    end
+
+    # Verifies that this record proves the existence of data (docs/design.md
+    # 3.6, 5.1): the hash chain from data to every time-stamp, the order of
+    # the time-stamps, and the validity of each time-stamp, checked with
+    # timestamp_validator (see TimestampValidator).
+    #
+    # data is a String, a PrehashedData or a DataGroup. at is the time of
+    # verification; the last time-stamp must be valid at that time.
+    #
+    # Returns true or false. Invalid arguments raise ArgumentError, and
+    # unsupported hash algorithms raise UnsupportedAlgorithmError.
+    def verify(data:, timestamp_validator:, at: Time.now)
+      verify!(data: data, timestamp_validator: timestamp_validator, at: at)
+    rescue VerificationError
+      false
+    end
+
+    # Like #verify, but raises a VerificationError telling why and where the
+    # verification failed.
+    def verify!(data:, timestamp_validator:, at: Time.now)
+      unless timestamp_validator.respond_to?(:call)
+        raise ArgumentError, "timestamp_validator must respond to call(token, at:)"
+      end
+      raise ArgumentError, "at must be a Time, got #{at.class}" unless at.is_a?(Time)
+
+      Verifier.new(self, data).verify!(timestamp_validator: timestamp_validator, at: at)
+    end
+
+    # Verifies only the structure and the hash chain from data to every
+    # time-stamp. Neither the signatures nor the times of the time-stamps are
+    # checked, so this alone does not prove anything about time.
+    def verify_hashes(data:)
+      verify_hashes!(data: data)
+    rescue VerificationError
+      false
+    end
+
+    # Like #verify_hashes, but raises a VerificationError.
+    def verify_hashes!(data:)
+      Verifier.new(self, data).verify_hashes!
+    end
+
+    # A time-stamp renewal of this record (TimestampRenewal): a new time-stamp
+    # covering the time-stamps of the last chain. Raises MalformedRecordError
+    # when the record has no ArchiveTimeStamp, and UnsupportedAlgorithmError
+    # when the last chain uses an unsupported hash algorithm.
+    def timestamp_renewal
+      TimestampRenewal.new(self)
+    end
+
+    # A hash-tree renewal of this record (HashTreeRenewal): a new chain with
+    # the hash algorithm digest_algorithm (:sha256, :sha384 or :sha512),
+    # covering data and the older chains.
+    #
+    # data is a String, a PrehashedData or a DataGroup, as for #verify; a
+    # PrehashedData needs hashes for the algorithms of the record and for
+    # digest_algorithm. The record is first checked against data with
+    # #verify_hashes!, which raises a VerificationError when they do not
+    # match.
+    def hash_tree_renewal(data:, digest_algorithm:)
+      HashTreeRenewal.new(self, data: data, digest_algorithm: digest_algorithm)
+    end
+
+    def to_der
+      @der
+    end
+
+    def ==(other)
+      other.is_a?(Record) && to_der == other.to_der
+    end
+    alias eql? ==
+
+    def hash
+      [Record, @der].hash
+    end
+
+    def inspect
+      "#<#{self.class.name} digest_algorithm_oids=#{@digest_algorithm_oids} chains=#{@chains.inspect}>"
+    end
+
+    # Internal: the DER of an ArchiveTimeStampSequence holding the first count
+    # chains, whose hash (ha) is used by a hash-tree renewal (RFC 4998 §5.2).
+    def archive_timestamp_sequence_der(count = @chains.size)
+      DER.sequence(@chains.first(count).map(&:to_der))
+    end
+
+    # Internal: a new Record with chains replaced, keeping the other fields as
+    # they are and adding the algorithms of new chains to digestAlgorithms.
+    def with_chains(chains)
+      algorithms = self.class.digest_algorithm_ders(@digest_algorithms, chains)
+      self.class.from_der(self.class.encode(algorithms, @crypto_infos, @encryption_info, chains))
+    end
+
+    private
+
+    def parse_optional(nodes, what)
+      tags = nodes.map { |n| n.tag_class == :context && n.constructed? ? n.tag : nil }
+      raise ParseError, "#{what}: unexpected elements" unless [[], [0], [1], [0, 1]].include?(tags)
+
+      nodes.each do |node|
+        if node.tag.zero?
+          # CryptoInfos ::= SEQUENCE SIZE (1..MAX) OF Attribute
+          unless !node.children.empty? && node.children.all? { _1.universal?(DER::SEQUENCE) }
+            raise ParseError, "#{what}: invalid cryptoInfos"
+          end
+
+          @crypto_infos = node.raw
+        else
+          # EncryptionInfo ::= SEQUENCE { encryptionInfoType OBJECT IDENTIFIER,
+          #   encryptionInfoValue ANY DEFINED BY encryptionInfoType }
+          type, = DER.children_of(node, "#{what} encryptionInfo", size: 2, context: 1)
+          DER.oid(type, "#{what} encryptionInfo")
+          @encryption_info = node.raw
+        end
+      end
+    end
+  end
+end

data/lib/evidence_record/reduced_hashtree.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+module EvidenceRecord
+  # A reduced hash tree (RFC 4998 §4.1): the sequence of partial hash trees
+  # needed to recompute the root from one leaf. The first partial hash tree
+  # holds the leaf itself (for a data object group, the hashes of all its
+  # members) and possibly its siblings; each following one holds the siblings
+  # at the next level.
+  #
+  # The root is computed with the generic RFC algorithm, so trees of any shape
+  # (binary or n-ary) are supported (docs/design.md 4.1, 5.2).
+  class ReducedHashtree
+    attr_reader :partial_hashtrees
+
+    class << self
+      # The hash of one node from the values that are hashed together:
+      # a single value is used as it is, several values are sorted in binary
+      # ascending order, concatenated and hashed.
+      def node_hash(algorithm, values)
+        return values[0] if values.size == 1
+
+        algorithm.digest(*values.sort)
+      end
+    end
+
+    # partial_hashtrees: an Array of non-empty Arrays of Digests (or binary
+    # Strings).
+    def initialize(partial_hashtrees)
+      unless partial_hashtrees.is_a?(Array) && !partial_hashtrees.empty?
+        raise ArgumentError, "partial_hashtrees must be a non-empty Array"
+      end
+
+      @partial_hashtrees = partial_hashtrees.each_with_index.map do |values, i|
+        unless values.is_a?(Array) && !values.empty?
+          raise ArgumentError, "partial hash tree #{i} must be a non-empty Array"
+        end
+
+        values.map { Digest.wrap(_1, "partial hash tree #{i} value") }.freeze
+      end.freeze
+      freeze
+    end
+
+    # The first partial hash tree: the leaf, or the members of a data object
+    # group, possibly with siblings.
+    def leaf_values
+      @partial_hashtrees[0]
+    end
+
+    # The root hash recomputed with algorithm (a Symbol or DigestAlgorithm).
+    #
+    # The lengths of the values are not checked here; the verifier does that.
+    def root(algorithm)
+      algorithm = DigestAlgorithm.fetch(algorithm)
+      first, *rest = @partial_hashtrees.map { |values| values.map(&:to_binary) }
+      current = self.class.node_hash(algorithm, first)
+      rest.each { |values| current = algorithm.digest(*([current] + values).sort) }
+      Digest.new(current)
+    end
+
+    def ==(other)
+      other.is_a?(ReducedHashtree) && @partial_hashtrees == other.partial_hashtrees
+    end
+    alias eql? ==
+
+    def hash
+      [ReducedHashtree, @partial_hashtrees].hash
+    end
+
+    def inspect
+      "#<#{self.class.name} #{@partial_hashtrees.map { |v| v.map { _1.to_hex[0, 8] } }.inspect}>"
+    end
+  end
+end

data/lib/evidence_record/renewal.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+module EvidenceRecord
+  # Internal: what TimestampRenewal and HashTreeRenewal share. The including
+  # class sets @record, @digest_algorithm and @values (the hashes covered by
+  # the new time-stamp, as one data object group) with #prepare, and
+  # implements #renewed_chains(archive_timestamp).
+  module Renewal
+    attr_reader :record, :digest_algorithm, :root
+
+    # An OpenSSL::Timestamp::Request for the root, to be sent to a TSA. When
+    # nonce or policy_id is given, build checks that the response has the
+    # same values.
+    def timestamp_request(nonce: nil, cert_requested: true, policy_id: nil)
+      @exchange.request(nonce: nonce, cert_requested: cert_requested, policy_id: policy_id)
+    end
+
+    # Builds the renewed Record from the TSA response (a String, or an
+    # OpenSSL::Timestamp::Response). Raises TimestampResponseError when the
+    # response is not usable, including when its time-stamp is older than
+    # the last one of the record.
+    #
+    # The signature of the time-stamp is not checked; verify the new record
+    # for that.
+    def build(response)
+      timestamp = @exchange.token(response)
+      last = @record.chains.last.archive_timestamps.last.timestamp
+      if timestamp.gen_time < last.gen_time
+        raise TimestampResponseError, "the time-stamp is older than the last time-stamp of the record"
+      end
+
+      @record.with_chains(renewed_chains(archive_timestamp(timestamp)))
+    end
+
+    def inspect
+      "#<#{self.class.name} #{@digest_algorithm} root=#{@root.to_hex}>"
+    end
+
+    private
+
+    def prepare(record, digest_algorithm, values)
+      @record = record
+      @digest_algorithm = digest_algorithm
+      @tree = HashTree.new(digest_algorithm: digest_algorithm)
+      @tree.add(values)
+      @single = values.size == 1
+      @root = @tree.root
+      @exchange = TimestampExchange.new(digest_algorithm, @root)
+    end
+
+    # With a single hash to cover, the hash is the message imprint and no
+    # reduced hash tree is needed. Otherwise the reduced hash tree is the one
+    # partial hash tree holding the hashes. Both as Bouncy Castle does
+    # (ERSArchiveTimeStampGenerator).
+    def archive_timestamp(timestamp)
+      return ArchiveTimeStamp.build(timestamp: timestamp) if @single
+
+      ArchiveTimeStamp.build(timestamp: timestamp, reduced_hashtree: @tree.reduced_hashtree(0),
+                             digest_algorithm: @digest_algorithm)
+    end
+  end
+end

data/lib/evidence_record/time_stamp_token.rb

@@ -0,0 +1,140 @@
+# frozen_string_literal: true
+
+module EvidenceRecord
+  # An RFC 3161 time-stamp token: the timeStamp field of an ArchiveTimeStamp.
+  #
+  # The fields of TSTInfo are read with this library's DER reader, not with
+  # OpenSSL::Timestamp, because Ruby's OpenSSL cannot parse tokens that carry
+  # OCSP responses in the CMS crls field (docs/design.md 7.2). The token's
+  # signature is not checked here; that is the job of a timestamp validator.
+  #
+  # The original DER is kept and returned by #to_der.
+  class TimeStampToken
+    ID_SIGNED_DATA = "1.2.840.113549.1.7.2"
+    ID_CT_TST_INFO = "1.2.840.113549.1.9.16.1.4"
+
+    attr_reader :gen_time, :message_imprint, :hash_algorithm_oid, :serial_number, :policy_id, :nonce
+
+    class << self
+      def from_der(der)
+        from_node(DER.parse(der, "time-stamp token"), "time-stamp token")
+      end
+
+      # Internal: from an already parsed element.
+      def from_node(node, what)
+        new(node, what)
+      end
+
+      private :new
+    end
+
+    def initialize(node, what)
+      @der = node.raw
+      content_type, wrapper = DER.children_of(node, "#{what} (ContentInfo)", size: 2)
+      unless DER.oid(content_type, what) == ID_SIGNED_DATA
+        raise ParseError, "#{what}: only RFC 3161 time-stamp tokens (CMS SignedData) are supported"
+      end
+
+      @signed_data = DER.children_of(wrapper, what, size: 1, context: 0)[0]
+      @certificate_ders = parse_signed_data(@signed_data, "#{what} (SignedData)")
+      freeze
+    end
+
+    # The hash algorithm of the message imprint, as a DigestAlgorithm.
+    # Raises UnsupportedAlgorithmError for other algorithms (see
+    # #hash_algorithm_oid).
+    def hash_algorithm
+      DigestAlgorithm.from_oid(@hash_algorithm_oid)
+    end
+
+    # The certificates included in the token (normally the TSA certificate and
+    # possibly its chain), as OpenSSL::X509::Certificate.
+    def certificates
+      @certificate_ders.map { OpenSSL::X509::Certificate.new(_1) }
+    end
+
+    def to_der
+      @der
+    end
+
+    # Internal: a copy of the token without the CMS crls field, which Ruby's
+    # OpenSSL cannot parse when it holds OCSP responses. The field is not
+    # signed, so removing it does not change the result of verifying the
+    # signature (docs/design.md 7.2). Never hash this copy.
+    def der_without_crls
+      kept = @signed_data.children.reject { _1.context?(1) }
+      return @der if kept.size == @signed_data.children.size
+
+      DER.sequence([DER.encode_oid(ID_SIGNED_DATA), DER.context(0, DER.sequence(kept.map(&:raw)))])
+    end
+
+    def ==(other)
+      other.is_a?(TimeStampToken) && to_der == other.to_der
+    end
+    alias eql? ==
+
+    def hash
+      [TimeStampToken, @der].hash
+    end
+
+    def inspect
+      "#<#{self.class.name} gen_time=#{@gen_time.getutc.strftime("%Y-%m-%dT%H:%M:%S.%LZ")} " \
+        "message_imprint=#{@message_imprint.to_hex} serial_number=#{@serial_number}>"
+    end
+
+    private
+
+    # SignedData ::= SEQUENCE { version, digestAlgorithms SET, encapContentInfo,
+    #   certificates [0] IMPLICIT OPTIONAL, crls [1] IMPLICIT OPTIONAL,
+    #   signerInfos SET }
+    def parse_signed_data(node, what)
+      children = DER.children_of(node, what, size: 4..6)
+      DER.integer(children[0], "#{what} version")
+      DER.expect(children[1], "#{what} digestAlgorithms", DER::SET)
+      DER.expect(children[-1], "#{what} signerInfos", DER::SET)
+      optional = children[3...-1]
+      tags = optional.map { |n| n.tag_class == :context && n.constructed? ? n.tag : nil }
+      unless [[], [0], [1], [0, 1]].include?(tags)
+        raise ParseError, "#{what}: unexpected elements before signerInfos"
+      end
+
+      parse_encap_content_info(children[2], "#{what} encapContentInfo")
+      certificates = optional.find { _1.tag.zero? }
+      (certificates&.children || []).select { _1.universal?(DER::SEQUENCE) }.map(&:raw)
+    end
+
+    def parse_encap_content_info(node, what)
+      content_type, wrapper = DER.children_of(node, what, size: 2)
+      unless DER.oid(content_type, what) == ID_CT_TST_INFO
+        raise ParseError, "#{what}: the content is not a TSTInfo"
+      end
+
+      econtent = DER.octet_string(DER.children_of(wrapper, what, size: 1, context: 0)[0], what)
+      parse_tst_info(DER.parse(econtent, "TSTInfo"), "TSTInfo")
+    end
+
+    # TSTInfo ::= SEQUENCE { version INTEGER { v1(1) }, policy, messageImprint,
+    #   serialNumber, genTime, accuracy OPTIONAL, ordering BOOLEAN DEFAULT FALSE,
+    #   nonce INTEGER OPTIONAL, tsa [0] OPTIONAL, extensions [1] OPTIONAL }
+    def parse_tst_info(node, what)
+      version, policy, imprint, serial, gen_time, *rest = DER.children_of(node, what, size: 5..10)
+      raise ParseError, "#{what}: unsupported version" unless DER.integer(version, "#{what} version") == 1
+
+      @policy_id = DER.oid(policy, "#{what} policy")
+      parse_message_imprint(imprint, "#{what} messageImprint")
+      @serial_number = DER.integer(serial, "#{what} serialNumber")
+      @gen_time = DER.generalized_time(gen_time, "#{what} genTime")
+      @nonce = rest.find { _1.universal?(DER::INTEGER) }&.then { DER.integer(_1, "#{what} nonce") }
+    end
+
+    def parse_message_imprint(node, what)
+      algorithm, hashed = DER.children_of(node, what, size: 2)
+      @hash_algorithm_oid = AlgorithmIdentifier.parse(algorithm, "#{what} hashAlgorithm")
+      @message_imprint = Digest.new(DER.octet_string(hashed, "#{what} hashedMessage"))
+      known = DigestAlgorithm::BY_OID[@hash_algorithm_oid]
+      return if known.nil? || known.digest_size == @message_imprint.bytesize
+
+      raise ParseError, "#{what}: the #{known} hash must be #{known.digest_size} bytes"
+    end
+  end
+end