hanko_xml 0.1.0 → 0.2.0

data/lib/hanko_xml/xades/augmenter.rb

@@ -0,0 +1,248 @@
+# frozen_string_literal: true
+
+module HankoXml
+  module Xades
+    # Adds unsigned properties to a XAdES signature that already exists
+    # (#167): a <xades:SignatureTimeStamp> (B to T), the validation data of
+    # XAdES-LT (T to LT), and a <xades141:ArchiveTimeStamp> (LT to LTA,
+    # #169; again later to renew it). Revocation data is best collected after the
+    # signature timestamp exists, so LT is usually added later, by the
+    # holder of the signed document rather than the signer.
+    #
+    #   augmenter = HankoXml::Xades::Augmenter.new(
+    #     validation_data: { certificates: chain, ocsp_responses: [ocsp_der] }
+    #   )
+    #   lt = augmenter.augment(signed_xml)
+    #
+    # Nothing a Reference covers changes: the new elements go into
+    # UnsignedSignatureProperties, found along the same fixed path
+    # Xades::Verifier reads (Xades::Locator), and the document is written
+    # back with HankoXml.serialize, so the existing digests and
+    # SignatureValue still verify.
+    #
+    # The Augmenter does not verify the signature it extends, and embedding
+    # material vouches for nothing: verify first, and a verifier treats the
+    # embedded values as untrusted (S-22). It never fetches: the timestamper:
+    # callable and the caller's validation data are its only inputs.
+    #
+    # Writes XAdES 1.3.2 only, and needs Nokogiri.
+    class Augmenter
+      attr_reader :timestamper, :timestamp_digest_method, :timestamp_canonicalization_method, :validation_data,
+                  :archive_timestamp, :archive_canonicalization_method, :policy
+
+      # @param timestamper [#call, nil] As for {Xades::Signer}: adds a SignatureTimeStamp.
+      # @param timestamp_digest_method [Symbol] The imprint digest.
+      # @param timestamp_canonicalization_method [Symbol] How <ds:SignatureValue> is canonicalized for the
+      #   imprint.
+      # @param validation_data [ValidationData, Hash, nil] Adds CertificateValues and RevocationValues; the
+      #   signature must have a SignatureTimeStamp, or timestamper: adds one first.
+      # @param archive_timestamp [Boolean] Adds an ArchiveTimeStamp, last, from timestamper:, over the signature
+      #   and all its validation data. timestamper: then adds a SignatureTimeStamp only when the signature has
+      #   none. The signature must carry LT values, or validation_data: adds them first.
+      # @param archive_canonicalization_method [Symbol] The ArchiveTimeStamp's CanonicalizationMethod. Inclusive
+      #   c14n by default: a Reference that leaves a node set (as Xades::Signer's enveloped one does) is
+      #   covered with xmlsec's inclusive c14n, so any other method is refused for such a signature.
+      # @param policy [Policy] Checks the imprint algorithms and limits the document size.
+      def initialize(timestamper: nil, timestamp_digest_method: :sha256, timestamp_canonicalization_method: :exc_c14n,
+                     validation_data: nil, archive_timestamp: false, archive_canonicalization_method: :c14n,
+                     policy: HankoXml::Policy.strict)
+        SignatureTimeStamper.check_timestamper!(timestamper)
+        @timestamper = timestamper
+        @timestamp_digest_method = timestamp_digest_method
+        @timestamp_canonicalization_method = timestamp_canonicalization_method
+        @validation_data = ValidationData.coerce(validation_data)
+        @policy = policy
+        @archive_timestamp = archive_timestamp ? true : false
+        @archive_canonicalization_method = archive_canonicalization_method
+        nothing = !timestamper && !@validation_data
+        raise HankoXml::ConfigurationError, "pass timestamper:, validation_data: or both" if nothing
+        if @archive_timestamp && !timestamper
+          raise HankoXml::ConfigurationError, "archive_timestamp: needs timestamper:, which obtains it"
+        end
+
+        if timestamper
+          SignatureTimeStamper.check_algorithms!(policy, digest: timestamp_digest_method,
+                                                         canonicalization: timestamp_canonicalization_method)
+        end
+        check_archive_canonicalization_method! if @archive_timestamp
+        freeze
+      end
+
+      # A copy of the document with the nth signature augmented.
+      #
+      # @param source [String, Nokogiri::XML::Document, IO, Pathname] The signed document.
+      # @param signature [Integer, nil] The document-order index of the <ds:Signature>; nil when the
+      #   document has exactly one.
+      # @return [SignedDocument]
+      # @raise [XadesError] when the signature's XAdES structure cannot take the properties.
+      # @raise [SigningError] when the TSA's answer does not hold (as for Xades::Signer).
+      def augment(source, signature: nil)
+        Dom.require!("HankoXml::Xades::Augmenter")
+        doc = HankoXml.coerce_document(source, policy: policy).dup
+        signatures = doc.xpath("//ds:Signature", "ds" => HankoXml::NS["ds"])
+        index = signature_index(signatures.size, signature)
+        node = signatures[index]
+        value = node.at_xpath("ds:SignatureValue", "ds" => HankoXml::NS["ds"])
+        if value.nil? || value.text.strip.empty?
+          raise HankoXml::ConfigurationError, "the <Signature> is not signed yet; augment a signed document"
+        end
+
+        augment_signature(doc, node, index)
+        SignedDocument.new(doc)
+      end
+
+      def inspect
+        "#<#{self.class} timestamper=#{!timestamper.nil?} validation_data=#{!validation_data.nil?}>"
+      end
+
+      private
+
+      def check_archive_canonicalization_method!
+        unless HankoXml::Algorithms.uri_for(:canonicalization, archive_canonicalization_method)
+          raise HankoXml::ConfigurationError, "archive_canonicalization_method: " \
+                                              "#{archive_canonicalization_method.inspect} is not a registered " \
+                                              "canonicalization algorithm"
+        end
+
+        policy.enforce_algorithm!(:canonicalization, archive_canonicalization_method)
+      end
+
+      def signature_index(count, signature)
+        raise HankoXml::ConfigurationError, "the document has no <ds:Signature> to augment" if count.zero?
+
+        if signature.nil?
+          return 0 if count == 1
+
+          raise HankoXml::ConfigurationError, "the document has #{count} signatures; pass signature: (an index)"
+        end
+        unless signature.is_a?(Integer) && signature.between?(-count, count - 1)
+          raise HankoXml::ConfigurationError, "signature: #{signature.inspect} not found"
+        end
+
+        signature % count
+      end
+
+      def augment_signature(doc, signature, index)
+        qualifying, ns = Locator.qualifying_properties(signature)
+        Locator.fail!("Xades::Augmenter writes only XAdES 1.3.2 QualifyingProperties") unless ns["xades"] == NS
+
+        properties = Locator.unsigned_signature_properties(qualifying, ns) || create_unsigned(qualifying)
+        timestamped = properties.at_xpath("xades:SignatureTimeStamp", ns)
+        if timestamper && !(archive_timestamp && timestamped)
+          add_signature_timestamp(doc, signature, index, qualifying, properties)
+        end
+        add_validation_data(properties, qualifying, ns) if validation_data
+        add_archive_timestamp(doc, signature, index, qualifying, properties) if archive_timestamp
+      end
+
+      def add_validation_data(properties, qualifying, ns)
+        unless properties.at_xpath("xades:SignatureTimeStamp", ns)
+          raise HankoXml::ConfigurationError,
+                "XAdES-LT builds on XAdES-T: the signature has no <xades:SignatureTimeStamp>; pass timestamper: too"
+        end
+
+        validation_data.append_to(properties, qualifying.namespace)
+      end
+
+      # The skeleton goes in first, so xmlsec reads its CanonicalizationMethod;
+      # its input (ArchiveTimeStampCheck.input) is everything before it. The
+      # References' data comes from xmlsec verifying the signature with a
+      # certificate of its own KeyInfo: that vouches for nothing, but a signature
+      # that does not hold is not archived.
+      def add_archive_timestamp(doc, signature, index, qualifying, properties)
+        if properties.xpath("xades:CertificateValues | xades:RevocationValues", "xades" => NS).empty?
+          raise HankoXml::ConfigurationError,
+                "XAdES-LTA builds on XAdES-LT: the signature has no CertificateValues or RevocationValues; " \
+                "pass validation_data: too"
+        end
+
+        position = properties.xpath("xades141:ArchiveTimeStamp", "xades141" => NS141).size
+        archive = properties.add_child(element(doc, "ArchiveTimeStamp"))
+        attach(archive, archive.add_namespace_definition("xades141", NS141))
+        archive["Id"] = unique_id(doc, "#{signature["Id"]}-ats")
+        method = attach(archive.add_child(element(doc, "CanonicalizationMethod")), signature.namespace)
+        method["Algorithm"] = HankoXml::Algorithms.uri_for(:canonicalization, archive_canonicalization_method)
+        encapsulated = attach(archive.add_child(element(doc, "EncapsulatedTimeStamp")), qualifying.namespace)
+
+        bytes = HankoXml.serialize(doc)
+        path = Locator.unsigned_path(signature, qualifying, NS)
+        method_path = [*path, [NS141, "ArchiveTimeStamp", position],
+                       [HankoXml::NS["ds"], "CanonicalizationMethod", nil]]
+        check_node_set_references!(bytes, index, method["Algorithm"])
+        input = ArchiveTimeStampCheck.input(bytes, index, reference_data(bytes, index, signature),
+                                            ArchiveTimeStampCheck.element_paths(signature, qualifying, properties,
+                                                                                archive, path),
+                                            method_path)
+        encapsulated.content = [SignatureTimeStamper.new(self).token_for(input)].pack("m0")
+      end
+
+      def check_node_set_references!(bytes, index, method)
+        info = HankoXml::SignatureInfo.from_native(Native.inspect_sig(bytes, index))
+        unless ArchiveTimeStampCheck.node_set_references?(info) && method != ArchiveTimeStampCheck::INCLUSIVE_C14N
+          return
+        end
+
+        raise HankoXml::ConfigurationError,
+              "a Reference of this signature leaves a node set, which an ArchiveTimeStamp covers with inclusive " \
+              "c14n only: pass archive_canonicalization_method: :c14n"
+      end
+
+      def reference_data(bytes, index, signature)
+        certificates = signature.xpath("ds:KeyInfo/ds:X509Data/ds:X509Certificate", "ds" => HankoXml::NS["ds"])
+                                .map { |node| OpenSSL::X509::Certificate.new(node.text.gsub(/\s/, "").unpack1("m")).to_pem }
+        Native.reference_data(bytes, certificates, %w[Id ID id], index, [], policy.allows?(:transform, :xpath_filter2))
+      rescue HankoXml::NativeError, OpenSSL::X509::CertificateError, ArgumentError
+        Locator.fail!("an ArchiveTimeStamp needs the signature to verify with a <ds:X509Certificate> of its KeyInfo")
+      end
+
+      # UnsignedProperties (last in QualifyingProperties) and its
+      # UnsignedSignatureProperties (first in UnsignedProperties).
+      def create_unsigned(qualifying)
+        doc = qualifying.document
+        namespace = qualifying.namespace
+        unsigned = qualifying.at_xpath("xades:UnsignedProperties", "xades" => NS) ||
+                   attach(qualifying.add_child(element(doc, "UnsignedProperties")), namespace)
+        properties = element(doc, "UnsignedSignatureProperties")
+        first = unsigned.children.first
+        attach(first ? first.add_previous_sibling(properties) : unsigned.add_child(properties), namespace)
+      end
+
+      # The skeleton goes in first, so xmlsec reads its CanonicalizationMethod
+      # (#161) from the bytes, as for Xades::Signer; then the token is filled in.
+      def add_signature_timestamp(doc, signature, index, qualifying, properties)
+        position = properties.xpath("xades:SignatureTimeStamp", "xades" => NS).size
+        timestamp = attach(properties.add_child(element(doc, "SignatureTimeStamp")), qualifying.namespace)
+        timestamp["Id"] = unique_id(doc, "#{signature["Id"]}-sigts")
+        method = attach(timestamp.add_child(element(doc, "CanonicalizationMethod")), signature.namespace)
+        method["Algorithm"] = HankoXml::Algorithms.uri_for(:canonicalization, timestamp_canonicalization_method)
+        encapsulated = attach(timestamp.add_child(element(doc, "EncapsulatedTimeStamp")), qualifying.namespace)
+
+        path = [*Locator.unsigned_path(signature, qualifying, NS), [NS, "SignatureTimeStamp", position],
+                [HankoXml::NS["ds"], "CanonicalizationMethod", nil]]
+        token = SignatureTimeStamper.new(self).token(HankoXml.serialize(doc), index, path)
+        encapsulated.content = [token].pack("m0")
+      end
+
+      def unique_id(doc, base)
+        taken = ->(id) { doc.at_xpath("//*[@Id=$id]", nil, id: id) }
+        return base unless taken.call(base)
+
+        (2..).each do |n|
+          candidate = "#{base}-#{n}"
+          return candidate unless taken.call(candidate)
+        end
+      end
+
+      def element(doc, name)
+        doc.create_element(name)
+      end
+
+      # The namespace is set once the node is in the tree, as
+      # QualifyingProperties#xades does, so no redundant declaration appears.
+      def attach(node, namespace)
+        node.namespace = namespace
+        node
+      end
+    end
+  end
+end

data/lib/hanko_xml/xades/locator.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+module HankoXml
+  module Xades
+    # Finds a signature's <xades:QualifyingProperties> and its unsigned
+    # containers along fixed paths from the <ds:Signature>, never by a search
+    # that a wrapped element elsewhere could satisfy (S-22). Xades::Verifier
+    # reads, and Xades::Augmenter writes, exactly the elements found here.
+    #
+    # @api private
+    module Locator
+      module_function
+
+      # This signature's single QualifyingProperties, in any XAdES namespace,
+      # and the namespaces to read it with.
+      def qualifying_properties(signature)
+        signature_id = signature["Id"].to_s
+        fail!("the <Signature> has no Id for QualifyingProperties to target") if signature_id.empty?
+
+        qualifying = signature.xpath("ds:Object/*[local-name()='QualifyingProperties']", "ds" => HankoXml::NS["ds"])
+                              .select { |node| NAMESPACES.include?(node.namespace&.href) }
+        fail!("a XAdES signature has exactly one <xades:QualifyingProperties>") unless qualifying.size == 1
+
+        qualifying = qualifying.first
+        fail!("<xades:QualifyingProperties> does not target this <Signature>") unless targets?(qualifying, signature_id)
+
+        [qualifying, { "ds" => HankoXml::NS["ds"], "xades" => qualifying.namespace.href }]
+      end
+
+      # Target is "#" + the Signature Id. The older namespaces also had
+      # signers write the bare Id (Target="Signature"). Either way the
+      # QualifyingProperties must sit in this <Signature>'s own <Object>.
+      def targets?(qualifying, signature_id)
+        target = qualifying["Target"]
+        return true if target == "##{signature_id}"
+
+        LEGACY_NAMESPACES.include?(qualifying.namespace.href) && target == signature_id
+      end
+
+      # The UnsignedSignatureProperties, or nil when there is none. More than
+      # one UnsignedProperties or UnsignedSignatureProperties is refused: which
+      # one a reader would pick is ambiguous.
+      def unsigned_signature_properties(qualifying, ns)
+        unsigned = qualifying.xpath("xades:UnsignedProperties", ns)
+        fail!("a XAdES signature has at most one <xades:UnsignedProperties>") if unsigned.size > 1
+        return nil if unsigned.empty?
+
+        properties = unsigned.first.xpath("xades:UnsignedSignatureProperties", ns)
+        fail!("a XAdES signature has at most one <xades:UnsignedSignatureProperties>") if properties.size > 1
+
+        properties.first
+      end
+
+      # The native path (Native.canonicalize) from the <ds:Signature> to its
+      # UnsignedSignatureProperties.
+      def unsigned_path(signature, qualifying, xades_ns)
+        object_index = signature.xpath("ds:Object", "ds" => HankoXml::NS["ds"]).index(qualifying.parent)
+        [[HankoXml::NS["ds"], "Object", object_index], [xades_ns, "QualifyingProperties", nil],
+         [xades_ns, "UnsignedProperties", nil], [xades_ns, "UnsignedSignatureProperties", nil]]
+      end
+
+      def fail!(message)
+        raise HankoXml::XadesError, message
+      end
+    end
+  end
+end

data/lib/hanko_xml/xades/long_term.rb

@@ -0,0 +1,252 @@
+# frozen_string_literal: true
+
+require "openssl"
+
+module HankoXml
+  module Xades
+    # The revocation evidence one certificate of the chain passed with (#168),
+    # on LongTermValidation#revocation.
+    # +source+ is :ocsp or :crl; +issued_at+ its thisUpdate; +status+ :good, or
+    # :revoked_later when it was revoked after the validation time.
+    RevocationStatus = Struct.new(:certificate, :source, :issued_at, :status, keyword_init: true) do
+      def initialize(**)
+        super
+        freeze
+      end
+    end
+
+    # A passed XAdES-LT validation (#168), on
+    # Xades::Verification#long_term_validation: the validation +time+ (the
+    # earliest verified SignatureTimeStamp), the signing +certificate_chain+
+    # (leaf first, ending at the caller's trust anchor), and the +revocation+
+    # evidence for each certificate below the anchor.
+    LongTermValidation = Struct.new(:time, :certificate_chain, :revocation, keyword_init: true) do
+      def initialize(**)
+        super
+        freeze
+      end
+    end
+
+    # The embedded <xades:CertificateValues> and <xades:RevocationValues> of
+    # one signature, parsed. Attacker-supplied until LongTermCheck uses them
+    # (S-22, S-23).
+    #
+    # @api private
+    class LongTermValues
+      attr_reader :certificates, :crls, :ocsp_responses
+
+      PATHS = {
+        certificates: "xades:CertificateValues/xades:EncapsulatedX509Certificate",
+        crls: "xades:RevocationValues/xades:CRLValues/xades:EncapsulatedCRLValue",
+        ocsp_responses: "xades:RevocationValues/xades:OCSPValues/xades:EncapsulatedOCSPValue"
+      }.freeze
+
+      # The values in +properties+ (an UnsignedSignatureProperties), or nil
+      # when it holds no CertificateValues or RevocationValues.
+      def self.read(properties, ns)
+        return nil unless properties
+        return nil if properties.xpath("xades:CertificateValues | xades:RevocationValues", ns).empty?
+
+        Locator.fail!("XAdES-LT values are verified only in the XAdES 1.3.2 namespace") unless ns["xades"] == NS
+        new(**PATHS.to_h { |kind, path| [kind, properties.xpath(path, ns).map { |node| parse(kind, node.text) }] })
+      end
+
+      def self.parse(kind, base64)
+        der = base64.gsub(/\s/, "").unpack1("m0")
+        case kind
+        when :certificates then OpenSSL::X509::Certificate.new(der)
+        when :crls then OpenSSL::X509::CRL.new(der)
+        else
+          OpenSSL::OCSP::Response.new(der).tap do |response|
+            unless response.status == OpenSSL::OCSP::RESPONSE_STATUS_SUCCESSFUL && response.basic
+              Locator.fail!("an <xades:EncapsulatedOCSPValue> is not a successful OCSP response")
+            end
+          end
+        end
+      rescue ArgumentError, OpenSSL::X509::CertificateError, OpenSSL::X509::CRLError, OpenSSL::OCSP::OCSPError
+        Locator.fail!("an embedded XAdES-LT value is not Base64 DER of its type (#{kind})")
+      end
+      private_class_method :parse
+
+      def initialize(certificates:, crls:, ocsp_responses:)
+        @certificates = certificates.freeze
+        @crls = crls.freeze
+        @ocsp_responses = ocsp_responses.freeze
+        freeze
+      end
+    end
+
+    # Validates the signing certificate chain at the time of the earliest
+    # verified SignatureTimeStamp, with the embedded revocation data (#168).
+    #
+    # The chain itself has already been built and verified at that time by
+    # {HankoXml::Verifier} (store:, StoreContext with time=). Here, each
+    # certificate below the trust anchor needs revocation evidence that:
+    #
+    # - verifies: an OCSP response through OpenSSL::OCSP::BasicResponse#verify
+    #   (the responder's signature, its chain to the same anchor, and its
+    #   authorization for that certificate), with the responder's chain then
+    #   checked at the response's producedAt; or a CRL signed by the
+    #   certificate's issuer (CRL#verify), an issuer allowed to sign CRLs;
+    # - is fresh: issued (thisUpdate) no earlier than the validation time
+    #   minus +grace+, and not in the future;
+    # - does not show the certificate revoked at or before the validation
+    #   time. Revoked later is accepted: the timestamp proves the signature
+    #   existed before.
+    #
+    # Evidence that does not verify or is stale is not used; a certificate
+    # left without usable evidence fails, and so does any usable evidence of
+    # an earlier revocation (fail closed, S-23).
+    #
+    # @api private
+    class LongTermCheck
+      CRL_SIGN_BIT = 6
+
+      def initialize(grace:, clock_skew:)
+        @grace = grace
+        @clock_skew = clock_skew
+      end
+
+      # @return [LongTermValidation]
+      # @raise [XadesError]
+      def verify(time:, chain:, values:)
+        @time = time
+        @anchor = chain.last
+        @pool = (chain + values.certificates).uniq(&:to_der)
+        @values = values
+        revocation = chain.each_cons(2).with_index.map { |(certificate, issuer), i| status(certificate, issuer, i) }
+        LongTermValidation.new(time: time, certificate_chain: chain.freeze, revocation: revocation.freeze)
+      end
+
+      private
+
+      # +position+ names the certificate in messages: its subject comes from
+      # the document, so it goes to #xmlsec_errors, not the message (S-13).
+      def status(certificate, issuer, position)
+        evidence = ocsp_evidence(certificate, issuer) + crl_evidence(certificate, issuer)
+        revoked = evidence.find { |item| item.status == :revoked }
+        if revoked
+          fail!("the embedded #{revoked.source.upcase} shows #{name(position)} revoked at or before the " \
+                "validation time", certificate)
+        end
+        found = evidence.min_by { |item| item.status == :good ? 0 : 1 }
+        fail!("no embedded revocation data verifies and is fresh for #{name(position)}", certificate) unless found
+
+        found
+      end
+
+      def name(position)
+        position.zero? ? "the signing certificate" : "chain certificate #{position}"
+      end
+
+      def ocsp_evidence(certificate, issuer)
+        @values.ocsp_responses.flat_map do |response|
+          basic = response.basic
+          singles = basic.responses.select { |single| about?(single.certid, certificate, issuer) }
+          next [] if singles.empty? || !responder_verified?(basic)
+
+          singles.filter_map { |single| ocsp_status(certificate, single) }
+        end
+      end
+
+      def about?(certid, certificate, issuer)
+        return false unless certid.serial == certificate.serial
+
+        OpenSSL::OCSP::CertificateId.new(certificate, issuer, OpenSSL::Digest.new(certid.hash_algorithm)).cmp(certid)
+      rescue OpenSSL::OCSP::OCSPError, RuntimeError
+        false
+      end
+
+      def ocsp_status(certificate, single)
+        return nil unless fresh?(single.this_update)
+
+        status = case single.cert_status
+                 when OpenSSL::OCSP::V_CERTSTATUS_GOOD then :good
+                 when OpenSSL::OCSP::V_CERTSTATUS_REVOKED then revoked_status(single.revocation_time)
+                 end
+        status && RevocationStatus.new(certificate: certificate, source: :ocsp, issued_at: single.this_update,
+                                       status: status)
+      end
+
+      def revoked_status(revoked_at)
+        revoked_at > @time ? :revoked_later : :revoked
+      end
+
+      # OpenSSL checks the signature, the responder's chain to the anchor and
+      # its authorization; it cannot take a verification time, so it runs
+      # without time checks and the responder's chain is then verified at
+      # producedAt.
+      def responder_verified?(basic)
+        response_certificates, responder_id, produced_at = ocsp_fields(basic)
+        pool = (@pool + response_certificates).uniq(&:to_der)
+        return false unless basic.verify(pool, anchor_store(OpenSSL::X509::V_FLAG_NO_CHECK_TIME))
+
+        signer = pool.find { |candidate| responder?(candidate, responder_id) }
+        return false unless signer
+
+        context = OpenSSL::X509::StoreContext.new(anchor_store, signer, pool)
+        context.time = produced_at
+        context.verify
+      end
+
+      # BasicOCSPResponse (RFC 6960 §4.2.1): its certs, ResponderID and
+      # producedAt, which OpenSSL::OCSP::BasicResponse does not expose.
+      def ocsp_fields(basic)
+        sequence = OpenSSL::ASN1.decode(basic.to_der).value
+        fields = sequence[0].value
+        fields = fields.drop(1) if fields.first.tag_class == :CONTEXT_SPECIFIC && fields.first.tag.zero?
+        certificates = sequence[3]&.value&.first&.value.to_a.map { |cert| OpenSSL::X509::Certificate.new(cert.to_der) }
+        [certificates, fields[0], fields[1].value]
+      end
+
+      # ResponderID: byName [1] or byKey [2] (SHA-1 of the public key bits).
+      def responder?(certificate, responder_id)
+        value = responder_id.value.first
+        if responder_id.tag == 1
+          certificate.subject.to_der == value.to_der
+        else
+          key_bits = OpenSSL::ASN1.decode(certificate.public_key.to_der).value[1].value
+          OpenSSL::Digest.digest("SHA1", key_bits) == value.value
+        end
+      end
+
+      def crl_evidence(certificate, issuer)
+        return [] unless crl_signer?(issuer)
+
+        @values.crls.filter_map do |crl|
+          next unless crl.issuer.to_der == issuer.subject.to_der && crl.verify(issuer.public_key)
+          next unless fresh?(crl.last_update)
+
+          entry = crl.revoked.find { |revoked| revoked.serial == certificate.serial }
+          status = entry ? revoked_status(entry.time) : :good
+          RevocationStatus.new(certificate: certificate, source: :crl, issued_at: crl.last_update, status: status)
+        end
+      end
+
+      # No KeyUsage means no restriction (RFC 5280); otherwise cRLSign.
+      def crl_signer?(issuer)
+        extension = issuer.extensions.find { |ext| ext.oid == "keyUsage" }
+        return true if extension.nil?
+
+        OpenSSL::ASN1.decode(extension.value_der).value.to_s.unpack1("B*").to_s[CRL_SIGN_BIT] == "1"
+      rescue OpenSSL::ASN1::ASN1Error
+        false
+      end
+
+      def fresh?(issued_at)
+        issued_at >= @time - @grace && issued_at <= Time.now + @clock_skew
+      end
+
+      def anchor_store(flags = nil)
+        OpenSSL::X509::Store.new.tap do |store|
+          store.add_cert(@anchor)
+          store.flags = flags if flags
+        end
+      end
+
+      def fail!(message, certificate)
+        raise HankoXml::XadesError.new(message, xmlsec_errors: ["subject: #{certificate.subject}"])
+      end
+    end
+  end
+end