Struct BasicResponse 

pub struct BasicResponse<'a> { /* private fields */ }

BasicOCSPResponse retains the exact signed ResponseData encoding.

Implementations

impl<'a> BasicResponse<'a>

pub fn nonce<W: Work>(&self, execution: &W) -> Result<Option<&'a [u8]>>

Decode a response nonce, retaining the producing parser’s local work and depth ceilings. Received nonce syntax accepts 1..128 octets, including legacy short nonces; this does not relax new-request construction.

pub fn bind_nonce<W: Work>( &self, request: Option<RequestNonce<'_>>, execution: &W, ) -> Result<NonceBinding>

Compare the actual request nonce only after authenticating this response. Missing/unsolicited values are preserved for the caller’s replay policy; they are never replaced by a generated or default nonce.

impl<'a> BasicResponse<'a>

pub fn authenticate_signature<'r, 'd, V: Verify<E>, D: AsnDigest<'d> + ?Sized, E: Work>( &'r self, signer: &'r Certificate<'a>, key: WorkingKey<'a>, verifier: &V, digest: &'d D, execution: &E, ) -> Result<SignatureAuthentication<'r, 'a>, SignatureError<V::Error, D::Error>>

Authenticate exact ResponseData with the actual signer’s bound key. Included certificates are candidates only. RFC6960 §§4.2.2.2–4.2.2.3 require authorization and status validity beyond this signature fact. https://www.rfc-editor.org/rfc/rfc6960#section-4.2.2.2

impl<'a> BasicResponse<'a>

pub fn check_extensions<W: Work>( &self, execution: &W, ) -> Result<ExtensionProcessing<'a>>

Process response-wide critical demands before using any assertion. RFC6960 §4.4 makes optional extension support explicit. This core supports nonce and the extended revoked definition; other optional noncritical values remain opaque. https://www.rfc-editor.org/rfc/rfc6960#section-4.4

impl BasicResponse<'_>

pub fn extended_revoke<W: Work>(&self, execution: &W) -> Result<bool>

Whether the responder applies the extended revoked definition, so that a matching “revoked” assertion can name a certificate that was never issued.

pub fn status_of<W: Work>( &self, index: usize, execution: &W, ) -> Result<Option<Status>>

Status of responses()[index] under this response’s extended revoked definition: super::Status::NotIssued for the exact RFC6960 §2.2 non-issued answer, otherwise the same reading as SingleResponse::status. None when there is no such assertion.

The assertion is named by position so that it always belongs to this response: §4.4.8 scopes the definition to the response that carries it.

Examples

use std::sync::Arc;
use structured_asn1::Parser;
use structured_asn1::memory::{Memory, MemoryAccount};
use structured_pkix::ocsp::{Response, Status};

fn tlv(tag: u8, contents: &[u8]) -> Vec<u8> {
    let length = contents.len() as u8;
    let header: &[u8] = if length < 128 { &[tag, length] } else { &[tag, 0x81, length] };
    [header, contents].concat()
}
let algorithm = tlv(0x30, &[6, 3, 0x2a, 3, 4]);
let id = tlv(0x30, &[algorithm.clone(), tlv(4, &[1; 20]), tlv(4, &[2; 20]), vec![2, 1, 1]].concat());
let date = tlv(24, b"20261012120000Z");
// revoked, certificateHold, 1970-01-01T00:00:00Z
let hold = tlv(0xa1, &[tlv(24, b"19700101000000Z"), tlv(0xa0, &[10, 1, 6])].concat());
let single = tlv(0x30, &[id, hold, date.clone()].concat());
let extended = tlv(0x30, &[tlv(6, &[0x2b, 6, 1, 5, 5, 7, 0x30, 1, 9]), tlv(4, &[5, 0])].concat());
let data = tlv(0x30, &[
    tlv(0xa2, &tlv(4, &[3; 20])), date, tlv(0x30, &single), tlv(0xa1, &tlv(0x30, &extended)),
].concat());
let basic = tlv(0x30, &[data, algorithm, vec![3, 2, 0, 0xab]].concat());
let bytes = tlv(0x30, &[tlv(6, &[0x2b, 6, 1, 5, 5, 7, 0x30, 1, 1]), tlv(4, &basic)].concat());
let envelope = tlv(0x30, &[&[10, 1, 0][..], &tlv(0xa0, &bytes)].concat());

let execution = Memory::new(Arc::new(MemoryAccount::new(65536, 65536)));
let parser = Parser::der(execution.clone());
let Response::Successful(payload) = Response::read(&parser, &envelope, 0).unwrap() else {
    unreachable!()
};
let response = payload.into_basic(&execution).unwrap().unwrap();
assert!(matches!(response.responses()[0].status(), Status::Revoked { .. }));
assert_eq!(response.status_of(0, &execution).unwrap(), Some(Status::NotIssued));
assert_eq!(response.status_of(1, &execution).unwrap(), None);

Errors

A malformed response-wide extended revoked definition, a misplaced marker on the selected assertion, or a spent work ceiling. Other extension syntax and critical demands still require check_extensions.

impl<'a> BasicResponse<'a>

pub fn responder(&self) -> &ResponderId<'a>

Original responder identity, not a resolved signing authority.

pub fn produced_at(&self) -> Time

Time the responder signed this response, not the status update time.

pub fn responses(&self) -> &[SingleResponse<'a>]

Signed assertions in original order; duplicates are not collapsed.

pub fn extensions(&self) -> &Extensions<'a>

Response-wide deferred extensions.

pub fn signature_algorithm(&self) -> AlgorithmIdentifier<'a>

Signature algorithm selected by the responder.

pub fn signature(&self) -> BitString<'a>

Original signature BIT STRING.

pub fn certificates(&self) -> &[Certificate<'a>]

Untrusted included certificates, not a discovered trust path.

pub fn signed_bytes(&self) -> &'a [u8]

Exact original DER ResponseData bytes supplied to signature verification.

pub fn as_bytes(&self) -> &'a [u8]

Original DER BasicOCSPResponse bytes.

pub fn span(&self) -> Span

Original basic-response location inside the payload OCTET STRING.

Trait Implementations

impl<'a> Debug for BasicResponse<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.