crypto/default/eku_verifier.h

// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//    https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

#ifndef THIRD_PARTY_CREDENTIO_CRYPTO_DEFAULT_EKU_VERIFIER_H_
#define THIRD_PARTY_CREDENTIO_CRYPTO_DEFAULT_EKU_VERIFIER_H_

#include "absl/strings/string_view.h"

namespace credentio {

class EkuVerifier {
 public:
  EkuVerifier() = default;
  ~EkuVerifier() = default;

  // Performs the EKU checks described in
  // https://spec.c2pa.org/specifications/specifications/2.2/specs/C2PA_Specification.html#_general_requirements
  // for claim signing certificates. Returns true if the leaf certificate
  // asserts the `digitalSignature` key usage bit, it has the C2PA claim signing
  // EKU and the `anyExtendedKeyUsage` EKU is not present. Returns false
  // otherwise (including for parsing errors). If the certificate is malformed,
  // the verification that will later be performed by BoringSSL will fail to
  // handle the malformed certificate.

  // This additional check is needed because the corresponding BoringSSL
  // verification option
  // (`bssl::CertificateVerifyOptions::KeyPurpose::C2PA_MANIFEST`) used by the
  // `DefaultParsedCertificates:VerifyClaimSignerTrust` does not check the
  // requirements of the most recent version of the spec (2.2). BoringSSL can
  // only be used to check the requirements of the version 2.1.
  static bool CheckLeafCertEku(absl::string_view leaf_cert_der);
};

}  // namespace credentio

#endif  // THIRD_PARTY_CREDENTIO_CRYPTO_DEFAULT_EKU_VERIFIER_H_