@ohos-ports/react-native-quick-crypto 0.0.0-stage → 1.1.8-beta.0

package/cpp/utils/QuickCryptoUtils.hpp

@@ -0,0 +1,186 @@
+#pragma once
+
+#include <algorithm>
+#include <cctype>
+#include <cmath>
+#include <cstddef>
+#include <cstdint>
+#include <limits>
+#include <openssl/bn.h>
+#include <openssl/crypto.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <string>
+#include <type_traits>
+#include <vector>
+
+#include "Macros.hpp"
+#include <NitroModules/ArrayBuffer.hpp>
+
+namespace margelo::nitro::crypto {
+
+// Function to get the last OpenSSL error message and clear the error stack
+inline std::string getOpenSSLError() {
+  unsigned long errCode = ERR_get_error();
+  if (errCode == 0) {
+    return "";
+  }
+  char errStr[256];
+  ERR_error_string_n(errCode, errStr, sizeof(errStr));
+  // Clear any remaining errors from the error stack to prevent pollution
+  ERR_clear_error();
+  return std::string(errStr);
+}
+
+// Function to clear OpenSSL error stack without getting error message
+inline void clearOpenSSLErrors() {
+  ERR_clear_error();
+}
+
+// copy a JSArrayBuffer that we do not own into a NativeArrayBuffer that we do own
+inline std::shared_ptr<margelo::nitro::NativeArrayBuffer> ToNativeArrayBuffer(const std::shared_ptr<margelo::nitro::ArrayBuffer>& buffer) {
+  size_t bufferSize = buffer.get()->size();
+  uint8_t* data = new uint8_t[bufferSize];
+  memcpy(data, buffer.get()->data(), bufferSize);
+  return std::make_shared<margelo::nitro::NativeArrayBuffer>(data, bufferSize, [=]() { delete[] data; });
+}
+
+inline std::shared_ptr<margelo::nitro::NativeArrayBuffer> ToNativeArrayBuffer(std::string str) {
+  size_t size = str.size();
+  uint8_t* data = new uint8_t[size];
+  memcpy(data, str.data(), size);
+  return std::make_shared<margelo::nitro::NativeArrayBuffer>(data, size, [=]() { delete[] data; });
+}
+
+inline std::shared_ptr<margelo::nitro::NativeArrayBuffer> ToNativeArrayBuffer(const std::vector<uint8_t>& vec) {
+  size_t size = vec.size();
+  uint8_t* data = new uint8_t[size];
+  memcpy(data, vec.data(), size);
+  return std::make_shared<margelo::nitro::NativeArrayBuffer>(data, size, [=]() { delete[] data; });
+}
+
+inline std::shared_ptr<margelo::nitro::NativeArrayBuffer> ToNativeArrayBuffer(const uint8_t* ptr, size_t size) {
+  uint8_t* data = new uint8_t[size];
+  memcpy(data, ptr, size);
+  return std::make_shared<margelo::nitro::NativeArrayBuffer>(data, size, [=]() { delete[] data; });
+}
+
+inline bool CheckIsUint32(double value) {
+  return (value >= std::numeric_limits<uint32_t>::lowest() && value <= std::numeric_limits<uint32_t>::max());
+}
+
+inline bool CheckIsInt32(double value) {
+  return (value >= std::numeric_limits<int32_t>::lowest() && value <= std::numeric_limits<int32_t>::max());
+}
+
+// Validate a JS-side `double` intended to be an unsigned integer in
+// [minValue, maxValue], then cast it to T. Rejects NaN, +/-Infinity, negative
+// values, and fractional values BEFORE the cast — `static_cast<uint32_t>(NaN)`
+// and friends are undefined behavior in C++, and the audit found ~20 sites
+// that did the cast naked. Throws `std::runtime_error` carrying `paramName`
+// on any failure so JS callers see a descriptive, actionable message.
+//
+// The helper is templated so callers pick the destination type
+// (uint32_t, uint64_t, size_t, ...). T must be an unsigned integer type.
+template <typename T>
+T validateUInt(double value, const char* paramName, T minValue = 0, T maxValue = std::numeric_limits<T>::max()) {
+  static_assert(std::is_integral_v<T> && std::is_unsigned_v<T>, "validateUInt: T must be an unsigned integer type");
+
+  if (std::isnan(value)) {
+    throw std::runtime_error(std::string(paramName) + " must be a finite number, got NaN");
+  }
+  if (std::isinf(value)) {
+    throw std::runtime_error(std::string(paramName) + std::string(" must be a finite number, got ") +
+                             (value > 0 ? "+Infinity" : "-Infinity"));
+  }
+  if (value < 0) {
+    throw std::runtime_error(std::string(paramName) + " must be non-negative, got " + std::to_string(value));
+  }
+  if (value != std::floor(value)) {
+    throw std::runtime_error(std::string(paramName) + " must be an integer, got " + std::to_string(value));
+  }
+  if (value < static_cast<double>(minValue) || value > static_cast<double>(maxValue)) {
+    throw std::runtime_error(std::string(paramName) + " out of range [" + std::to_string(minValue) + ", " + std::to_string(maxValue) +
+                             "], got " + std::to_string(value));
+  }
+  return static_cast<T>(value);
+}
+
+// Securely zero a memory range using OPENSSL_cleanse, which the compiler is
+// guaranteed not to optimize away even when the buffer is about to leave
+// scope. Use this for any memory that held secrets — keys, derived bits,
+// shared secrets, plaintext, PEM/DER private-key strings, IV/nonce material.
+//
+// Plain std::memset is unsafe for this purpose: under -O2 the compiler will
+// see that the memset writes are dead (the memory is freed or going out of
+// scope right after) and elide them, leaving the secret on the heap.
+//
+// Overloads cover the common shapes: raw pointer + size, vector, string,
+// fixed-size array. The audit found ~30 sites that need this — XSalsa20,
+// XChaCha20-Poly1305, all KDFs, DH/ECDH shared secrets, RSA/EC/Ed/DSA DER
+// private-key strings — and they get swept in Phase 2.
+inline void secureZero(void* ptr, std::size_t size) {
+  if (ptr != nullptr && size > 0) {
+    OPENSSL_cleanse(ptr, size);
+  }
+}
+
+inline void secureZero(std::vector<uint8_t>& vec) {
+  secureZero(vec.data(), vec.size());
+}
+
+inline void secureZero(std::string& s) {
+  if (!s.empty()) {
+    secureZero(s.data(), s.size());
+  }
+}
+
+template <std::size_t N>
+inline void secureZero(uint8_t (&arr)[N]) {
+  secureZero(static_cast<void*>(arr), N);
+}
+
+// Function to convert a string to lowercase
+inline std::string toLower(std::string s) {
+  std::transform(s.begin(), s.end(), s.begin(), [](unsigned char c) { return static_cast<char>(std::tolower(c)); });
+  return s;
+}
+
+inline const EVP_MD* getDigestByName(const std::string& algorithm) {
+  std::string algo = toLower(algorithm);
+
+  // Strip legacy RSA- prefix (e.g. rsa-sha256 -> sha256) for Node.js compat
+  if (algo.size() > 4 && algo.compare(0, 4, "rsa-") == 0) {
+    algo = algo.substr(4);
+  }
+
+  if (algo == "sha1" || algo == "sha-1") {
+    return EVP_sha1();
+  } else if (algo == "sha224" || algo == "sha-224") {
+    return EVP_sha224();
+  } else if (algo == "sha256" || algo == "sha-256") {
+    return EVP_sha256();
+  } else if (algo == "sha384" || algo == "sha-384") {
+    return EVP_sha384();
+  } else if (algo == "sha512" || algo == "sha-512") {
+    return EVP_sha512();
+  } else if (algo == "sha3-224") {
+    return EVP_sha3_224();
+  } else if (algo == "sha3-256") {
+    return EVP_sha3_256();
+  } else if (algo == "sha3-384") {
+    return EVP_sha3_384();
+  } else if (algo == "sha3-512") {
+    return EVP_sha3_512();
+  } else if (algo == "ripemd160" || algo == "ripemd-160") {
+    return EVP_ripemd160();
+  }
+  throw std::runtime_error("Unsupported hash algorithm: " + algorithm);
+}
+
+// Build an EVP_PKEY from EC curve name + public key octets + optional private key BIGNUM.
+// Uses OSSL_PARAM_BLD + EVP_PKEY_fromdata (OpenSSL 3.x, no deprecated EC_KEY APIs).
+// Caller owns the returned EVP_PKEY*.
+EVP_PKEY* createEcEvpPkey(const char* group_name, const uint8_t* pub_oct, size_t pub_len, const BIGNUM* priv_bn = nullptr);
+
+} // namespace margelo::nitro::crypto

package/cpp/utils/base64.h

@@ -0,0 +1,309 @@
+/*
+   base64.h
+
+   base64 encoding and decoding with C++.
+   More information at
+     https://renenyffenegger.ch/notes/development/Base64/Encoding-and-decoding-base-64-with-cpp
+
+   Version: 2.rc.09 (release candidate)
+
+   Copyright (C) 2004-2017, 2020-2022 René Nyffenegger
+
+   This source code is provided 'as-is', without any express or implied
+   warranty. In no event will the author be held liable for any damages
+   arising from the use of this software.
+
+   Permission is granted to anyone to use this software for any purpose,
+   including commercial applications, and to alter it and redistribute it
+   freely, subject to the following restrictions:
+
+   1. The origin of this source code must not be misrepresented; you must not
+      claim that you wrote the original source code. If you use this source code
+      in a product, an acknowledgment in the product documentation would be
+      appreciated but is not required.
+
+   2. Altered source versions must be plainly marked as such, and must not be
+      misrepresented as being the original source code.
+
+   3. This notice may not be removed or altered from any source distribution.
+
+   René Nyffenegger rene.nyffenegger@adp-gmbh.ch
+*/
+/**
+ * Copyright (C) 2023 Kevin Heifner
+ *
+ * Modified to be header only.
+ * Templated for std::string, std::string_view, std::vector<char> and other char containers.
+ */
+
+#pragma once
+
+#include <algorithm>
+#include <stdexcept>
+#include <string>
+#include <string_view>
+
+// Interface:
+// Defaults allow for use:
+//   std::string s = "foobar";
+//   std::string encoded = base64_encode(s);
+//   std::string_view sv = "foobar";
+//   std::string encoded = base64_encode(sv);
+//   std::vector<char> vc = {'f', 'o', 'o'};
+//   std::string encoded = base64_encode(vc);
+//
+// Also allows for user provided char containers and specified return types:
+//   std::string s = "foobar";
+//   std::vector<char> encoded = base64_encode<std::vector<char>>(s);
+
+template <typename RetString = std::string, typename String = std::string>
+RetString base64_encode(const String& s, bool url = false);
+
+template <typename RetString = std::string, typename String = std::string>
+RetString base64_encode_pem(const String& s);
+
+template <typename RetString = std::string, typename String = std::string>
+RetString base64_encode_mime(const String& s);
+
+template <typename RetString = std::string, typename String = std::string>
+RetString base64_decode(const String& s, bool remove_linebreaks = false);
+
+template <typename RetString = std::string>
+RetString base64_encode(const unsigned char* s, size_t len, bool url = false);
+
+namespace detail {
+//
+// Depending on the url parameter in base64_chars, one of
+// two sets of base64 characters needs to be chosen.
+// They differ in their last two characters.
+//
+constexpr const char* to_base64_chars[2] = {"ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+                                            "abcdefghijklmnopqrstuvwxyz"
+                                            "0123456789"
+                                            "+/",
+
+                                            "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
+                                            "abcdefghijklmnopqrstuvwxyz"
+                                            "0123456789"
+                                            "-_"};
+
+constexpr unsigned char from_base64_chars[256] = {
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 62, 64, 62, 64, 63, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 64, 64, 64, 64, 64, 64,
+    64, 0,  1,  2,  3,  4,  5,  6,  7,  8,  9,  10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 64, 64, 64, 64, 63,
+    64, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 64, 64, 64, 64, 64,
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
+    64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64};
+
+inline unsigned int pos_of_char(const unsigned char chr) {
+  //
+  // Return the position of chr within base64_encode()
+  //
+
+  if (from_base64_chars[chr] != 64)
+    return from_base64_chars[chr];
+
+  //
+  // 2020-10-23: Throw std::exception rather than const char*
+  //(Pablo Martin-Gomez, https://github.com/Bouska)
+  //
+  throw std::runtime_error("Input is not valid base64-encoded data.");
+}
+
+template <typename RetString, typename String>
+inline RetString insert_linebreaks(const String& str, size_t distance) {
+  //
+  // Provided by https://github.com/JomaCorpFX, adapted by Rene & Kevin
+  //
+  if (!str.size()) {
+    return RetString{};
+  }
+
+  if (distance < str.size()) {
+    size_t pos = distance;
+    String s{str};
+    while (pos < s.size()) {
+      s.insert(pos, "\n");
+      pos += distance + 1;
+    }
+    return s;
+  } else {
+    return str;
+  }
+}
+
+template <typename RetString, typename String, unsigned int line_length>
+inline RetString encode_with_line_breaks(String s) {
+  return insert_linebreaks<RetString, String>(base64_encode(s, false), line_length);
+}
+
+template <typename RetString, typename String>
+inline RetString encode_pem(String s) {
+  return encode_with_line_breaks<RetString, String, 64>(s);
+}
+
+template <typename RetString, typename String>
+inline RetString encode_mime(String s) {
+  return encode_with_line_breaks<RetString, String, 76>(s);
+}
+
+template <typename RetString, typename String>
+inline RetString encode(String s, bool url) {
+  return base64_encode<RetString>(reinterpret_cast<const unsigned char*>(s.data()), s.size(), url);
+}
+
+} // namespace detail
+
+template <typename RetString>
+inline RetString base64_encode(const unsigned char* bytes_to_encode, size_t in_len, bool url) {
+  size_t len_encoded = (in_len + 2) / 3 * 4;
+
+  const unsigned char trailing_char = '=';
+
+  //
+  // Choose set of base64 characters. They differ
+  // for the last two positions, depending on the url
+  // parameter.
+  // A bool (as is the parameter url) is guaranteed
+  // to evaluate to either 0 or 1 in C++ therefore,
+  // the correct character set is chosen by subscripting
+  // base64_chars with url.
+  //
+  const char* base64_chars_ = detail::to_base64_chars[url];
+
+  RetString ret;
+  ret.reserve(len_encoded);
+
+  unsigned int pos = 0;
+
+  while (pos < in_len) {
+    ret.push_back(base64_chars_[(bytes_to_encode[pos + 0] & 0xfc) >> 2]);
+
+    if (pos + 1 < in_len) {
+      ret.push_back(base64_chars_[((bytes_to_encode[pos + 0] & 0x03) << 4) + ((bytes_to_encode[pos + 1] & 0xf0) >> 4)]);
+
+      if (pos + 2 < in_len) {
+        ret.push_back(base64_chars_[((bytes_to_encode[pos + 1] & 0x0f) << 2) + ((bytes_to_encode[pos + 2] & 0xc0) >> 6)]);
+        ret.push_back(base64_chars_[bytes_to_encode[pos + 2] & 0x3f]);
+      } else {
+        ret.push_back(base64_chars_[(bytes_to_encode[pos + 1] & 0x0f) << 2]);
+        if (!url)
+          ret.push_back(trailing_char);
+      }
+    } else {
+      ret.push_back(base64_chars_[(bytes_to_encode[pos + 0] & 0x03) << 4]);
+      if (!url)
+        ret.push_back(trailing_char);
+      if (!url)
+        ret.push_back(trailing_char);
+    }
+
+    pos += 3;
+  }
+
+  return ret;
+}
+
+namespace detail {
+
+template <typename RetString, typename String>
+inline RetString decode(const String& encoded_string, bool remove_linebreaks) {
+  static_assert(!std::is_same<RetString, std::string_view>::value, "RetString should not be std::string_view");
+
+  //
+  // decode(…) is templated so that it can be used with String = const std::string&
+  // or std::string_view (requires at least C++17)
+  //
+
+  if (encoded_string.empty())
+    return RetString{};
+
+  if (remove_linebreaks) {
+    String copy{encoded_string};
+
+    copy.erase(std::remove(copy.begin(), copy.end(), '\n'), copy.end());
+
+    return base64_decode<RetString, String>(copy, false);
+  }
+
+  size_t length_of_string = encoded_string.size();
+  size_t pos = 0;
+
+  //
+  // The approximate length (bytes) of the decoded string might be one or
+  // two bytes smaller, depending on the amount of trailing equal signs
+  // in the encoded string. This approximation is needed to reserve
+  // enough space in the string to be returned.
+  //
+  size_t approx_length_of_decoded_string = length_of_string / 4 * 3;
+  RetString ret;
+  ret.reserve(approx_length_of_decoded_string);
+
+  while (pos < length_of_string && encoded_string.at(pos) != '=') {
+    //
+    // Iterate over encoded input string in chunks. The size of all
+    // chunks except the last one is 4 bytes.
+    //
+    // The last chunk might be padded with equal signs
+    // in order to make it 4 bytes in size as well, but this
+    // is not required as per RFC 2045.
+    //
+    // All chunks except the last one produce three output bytes.
+    //
+    // The last chunk produces at least one and up to three bytes.
+    //
+
+    size_t pos_of_char_1 = pos_of_char(encoded_string.at(pos + 1));
+
+    //
+    // Emit the first output byte that is produced in each chunk:
+    //
+    ret.push_back(
+        static_cast<typename RetString::value_type>(((pos_of_char(encoded_string.at(pos + 0))) << 2) + ((pos_of_char_1 & 0x30) >> 4)));
+
+    if ((pos + 2 < length_of_string) &&
+        // Check for data that is not padded with equal signs (which is allowed by RFC 2045)
+        encoded_string.at(pos + 2) != '=') {
+      //
+      // Emit a chunk's second byte (which might not be produced in the last chunk).
+      //
+      unsigned int pos_of_char_2 = pos_of_char(encoded_string.at(pos + 2));
+      ret.push_back(static_cast<typename RetString::value_type>(((pos_of_char_1 & 0x0f) << 4) + ((pos_of_char_2 & 0x3c) >> 2)));
+
+      if ((pos + 3 < length_of_string) && encoded_string.at(pos + 3) != '=') {
+        //
+        // Emit a chunk's third byte (which might not be produced in the last chunk).
+        //
+        ret.push_back(static_cast<typename RetString::value_type>(((pos_of_char_2 & 0x03) << 6) + pos_of_char(encoded_string.at(pos + 3))));
+      }
+    }
+
+    pos += 4;
+  }
+
+  return ret;
+}
+
+} // namespace detail
+
+template <typename RetString, typename String>
+inline RetString base64_decode(const String& s, bool remove_linebreaks) {
+  return detail::decode<RetString, String>(s, remove_linebreaks);
+}
+
+template <typename RetString, typename String>
+inline RetString base64_encode(const String& s, bool url) {
+  return detail::encode<RetString, String>(s, url);
+}
+
+template <typename RetString, typename String>
+inline RetString base64_encode_pem(const String& s) {
+  return detail::encode_pem<RetString, String>(s);
+}
+
+template <typename RetString, typename String>
+inline RetString base64_encode_mime(const String& s) {
+  return detail::encode_mime<RetString, String>(s);
+}

package/cpp/x509/HybridX509Certificate.cpp

@@ -0,0 +1,174 @@
+#include "HybridX509Certificate.hpp"
+#include "../keys/HybridKeyObjectHandle.hpp"
+#include "../keys/KeyObjectData.hpp"
+#include "QuickCryptoUtils.hpp"
+#include <ncrypto.h>
+
+namespace margelo::nitro::crypto {
+
+std::string HybridX509Certificate::bioToString(ncrypto::BIOPointer bio) const {
+  if (!bio)
+    return "";
+  BUF_MEM* mem = bio;
+  if (!mem || mem->length == 0)
+    return "";
+  return std::string(mem->data, mem->length);
+}
+
+void HybridX509Certificate::init(const std::shared_ptr<ArrayBuffer>& buffer) {
+  ncrypto::Buffer<const unsigned char> buf{.data = reinterpret_cast<const unsigned char*>(buffer->data()), .len = buffer->size()};
+  auto result = ncrypto::X509Pointer::Parse(buf);
+  if (!result) {
+    throw std::runtime_error("Failed to parse X509 certificate");
+  }
+  cert_ = std::move(result.value);
+}
+
+std::string HybridX509Certificate::subject() {
+  return bioToString(cert_.view().getSubject());
+}
+
+std::string HybridX509Certificate::subjectAltName() {
+  return bioToString(cert_.view().getSubjectAltName());
+}
+
+std::string HybridX509Certificate::issuer() {
+  return bioToString(cert_.view().getIssuer());
+}
+
+std::string HybridX509Certificate::infoAccess() {
+  return bioToString(cert_.view().getInfoAccess());
+}
+
+std::string HybridX509Certificate::validFrom() {
+  return bioToString(cert_.view().getValidFrom());
+}
+
+std::string HybridX509Certificate::validTo() {
+  return bioToString(cert_.view().getValidTo());
+}
+
+double HybridX509Certificate::validFromDate() {
+  return static_cast<double>(cert_.view().getValidFromTime()) * 1000.0;
+}
+
+double HybridX509Certificate::validToDate() {
+  return static_cast<double>(cert_.view().getValidToTime()) * 1000.0;
+}
+
+std::string HybridX509Certificate::signatureAlgorithm() {
+  auto algo = cert_.view().getSignatureAlgorithm();
+  if (!algo.has_value())
+    return "";
+  return std::string(algo.value());
+}
+
+std::string HybridX509Certificate::signatureAlgorithmOid() {
+  return cert_.view().getSignatureAlgorithmOID().value_or("");
+}
+
+std::string HybridX509Certificate::serialNumber() {
+  auto serial = cert_.view().getSerialNumber();
+  if (!serial)
+    return "";
+  return std::string(static_cast<const char*>(serial.get()), serial.size());
+}
+
+std::string HybridX509Certificate::fingerprint() {
+  return cert_.view().getFingerprint(ncrypto::Digest::SHA1).value_or("");
+}
+
+std::string HybridX509Certificate::fingerprint256() {
+  return cert_.view().getFingerprint(ncrypto::Digest::SHA256).value_or("");
+}
+
+std::string HybridX509Certificate::fingerprint512() {
+  return cert_.view().getFingerprint(ncrypto::Digest::SHA512).value_or("");
+}
+
+std::shared_ptr<ArrayBuffer> HybridX509Certificate::raw() {
+  auto bio = cert_.view().toDER();
+  if (!bio) {
+    throw std::runtime_error("Failed to export certificate as DER");
+  }
+  BUF_MEM* mem = bio;
+  return ToNativeArrayBuffer(reinterpret_cast<const uint8_t*>(mem->data), mem->length);
+}
+
+std::string HybridX509Certificate::pem() {
+  return bioToString(cert_.view().toPEM());
+}
+
+std::shared_ptr<HybridKeyObjectHandleSpec> HybridX509Certificate::publicKey() {
+  auto result = cert_.view().getPublicKey();
+  if (!result) {
+    throw std::runtime_error("Failed to extract public key from certificate");
+  }
+  auto handle = std::make_shared<HybridKeyObjectHandle>();
+  handle->setKeyObjectData(KeyObjectData::CreateAsymmetric(KeyType::PUBLIC, std::move(result.value)));
+  return handle;
+}
+
+std::vector<std::string> HybridX509Certificate::keyUsage() {
+  std::vector<std::string> usages;
+  cert_.view().enumUsages([&](const char* usage) { usages.emplace_back(usage); });
+  return usages;
+}
+
+bool HybridX509Certificate::ca() {
+  return cert_.view().isCA();
+}
+
+bool HybridX509Certificate::checkIssued(const std::shared_ptr<HybridX509CertificateHandleSpec>& other) {
+  auto otherCert = std::dynamic_pointer_cast<HybridX509Certificate>(other);
+  if (!otherCert) {
+    throw std::runtime_error("Invalid X509Certificate");
+  }
+  return cert_.view().isIssuedBy(otherCert->cert_.view());
+}
+
+bool HybridX509Certificate::checkPrivateKey(const std::shared_ptr<HybridKeyObjectHandleSpec>& key) {
+  auto handle = std::dynamic_pointer_cast<HybridKeyObjectHandle>(key);
+  if (!handle) {
+    throw std::runtime_error("Invalid key object");
+  }
+  return cert_.view().checkPrivateKey(handle->getKeyObjectData().GetAsymmetricKey());
+}
+
+bool HybridX509Certificate::verify(const std::shared_ptr<HybridKeyObjectHandleSpec>& key) {
+  auto handle = std::dynamic_pointer_cast<HybridKeyObjectHandle>(key);
+  if (!handle) {
+    throw std::runtime_error("Invalid key object");
+  }
+  return cert_.view().checkPublicKey(handle->getKeyObjectData().GetAsymmetricKey());
+}
+
+std::optional<std::string> HybridX509Certificate::checkHost(const std::string& name, double flags) {
+  ncrypto::DataPointer peername;
+  auto match = cert_.view().checkHost(name, static_cast<int>(flags), &peername);
+  if (match == ncrypto::X509View::CheckMatch::MATCH) {
+    if (peername) {
+      return std::string(static_cast<const char*>(peername.get()), peername.size());
+    }
+    return name;
+  }
+  return std::nullopt;
+}
+
+std::optional<std::string> HybridX509Certificate::checkEmail(const std::string& email, double flags) {
+  auto match = cert_.view().checkEmail(email, static_cast<int>(flags));
+  if (match == ncrypto::X509View::CheckMatch::MATCH) {
+    return email;
+  }
+  return std::nullopt;
+}
+
+std::optional<std::string> HybridX509Certificate::checkIP(const std::string& ip) {
+  auto match = cert_.view().checkIp(ip, 0);
+  if (match == ncrypto::X509View::CheckMatch::MATCH) {
+    return ip;
+  }
+  return std::nullopt;
+}
+
+} // namespace margelo::nitro::crypto