1 files changed, 63 insertions, 0 deletions
diff --git a/libraries/spongycastle/pkix/src/main/java/org/spongycastle/cert/path/validations/KeyUsageValidation.java b/libraries/spongycastle/pkix/src/main/java/org/spongycastle/cert/path/validations/KeyUsageValidation.java
new file mode 100644
index 000000000..7211b7cd9
--- /dev/null
+++ b/libraries/spongycastle/pkix/src/main/java/org/spongycastle/cert/path/validations/KeyUsageValidation.java
@@ -0,0 +1,63 @@
+package org.spongycastle.cert.path.validations;
+
+import org.spongycastle.asn1.x509.Extension;
+import org.spongycastle.asn1.x509.KeyUsage;
+import org.spongycastle.cert.X509CertificateHolder;
+import org.spongycastle.cert.path.CertPathValidation;
+import org.spongycastle.cert.path.CertPathValidationContext;
+import org.spongycastle.cert.path.CertPathValidationException;
+import org.spongycastle.util.Memoable;
+
+public class KeyUsageValidation
+    implements CertPathValidation
+{
+    private boolean          isMandatory;
+
+    public KeyUsageValidation()
+    {
+        this(true);
+    }
+
+    public KeyUsageValidation(boolean isMandatory)
+    {
+        this.isMandatory = isMandatory;
+    }
+
+    public void validate(CertPathValidationContext context, X509CertificateHolder certificate)
+        throws CertPathValidationException
+    {
+        context.addHandledExtension(Extension.keyUsage);
+
+        if (!context.isEndEntity())
+        {
+            KeyUsage usage = KeyUsage.fromExtensions(certificate.getExtensions());
+
+            if (usage != null)
+            {
+                if (!usage.hasUsages(KeyUsage.keyCertSign))
+                {
+                    throw new CertPathValidationException("Issuer certificate KeyUsage extension does not permit key signing");
+                }
+            }
+            else
+            {
+                if (isMandatory)
+                {
+                    throw new CertPathValidationException("KeyUsage extension not present in CA certificate");
+                }
+            }
+        }
+    }
+
+    public Memoable copy()
+    {
+        return new KeyUsageValidation(isMandatory);
+    }
+
+    public void reset(Memoable other)
+    {
+        KeyUsageValidation v = (KeyUsageValidation)other;
+
+        this.isMandatory = v.isMandatory;
+    }
+}