1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17 package org.opensaml.xml.security;
18
19 import java.io.ByteArrayInputStream;
20 import java.io.File;
21 import java.io.IOException;
22 import java.math.BigInteger;
23 import java.security.GeneralSecurityException;
24 import java.security.Key;
25 import java.security.KeyException;
26 import java.security.KeyFactory;
27 import java.security.KeyPair;
28 import java.security.KeyPairGenerator;
29 import java.security.NoSuchAlgorithmException;
30 import java.security.NoSuchProviderException;
31 import java.security.PrivateKey;
32 import java.security.PublicKey;
33 import java.security.cert.CRLException;
34 import java.security.cert.CertificateException;
35 import java.security.cert.CertificateFactory;
36 import java.security.cert.X509Certificate;
37 import java.security.interfaces.DSAParams;
38 import java.security.interfaces.DSAPrivateKey;
39 import java.security.interfaces.DSAPublicKey;
40 import java.security.interfaces.ECPublicKey;
41 import java.security.interfaces.RSAPrivateCrtKey;
42 import java.security.interfaces.RSAPrivateKey;
43 import java.security.interfaces.RSAPublicKey;
44 import java.security.spec.DSAPublicKeySpec;
45 import java.security.spec.InvalidKeySpecException;
46 import java.security.spec.KeySpec;
47 import java.security.spec.RSAPublicKeySpec;
48 import java.security.spec.X509EncodedKeySpec;
49 import java.util.ArrayList;
50 import java.util.HashSet;
51 import java.util.List;
52 import java.util.Set;
53
54 import javax.crypto.KeyGenerator;
55 import javax.crypto.SecretKey;
56
57 import org.apache.commons.ssl.PKCS8Key;
58 import org.apache.xml.security.Init;
59 import org.apache.xml.security.algorithms.JCEMapper;
60 import org.opensaml.xml.Configuration;
61 import org.opensaml.xml.encryption.EncryptionParameters;
62 import org.opensaml.xml.encryption.KeyEncryptionParameters;
63 import org.opensaml.xml.security.credential.BasicCredential;
64 import org.opensaml.xml.security.credential.Credential;
65 import org.opensaml.xml.security.keyinfo.BasicProviderKeyInfoCredentialResolver;
66 import org.opensaml.xml.security.keyinfo.KeyInfoCredentialResolver;
67 import org.opensaml.xml.security.keyinfo.KeyInfoGenerator;
68 import org.opensaml.xml.security.keyinfo.KeyInfoGeneratorFactory;
69 import org.opensaml.xml.security.keyinfo.KeyInfoProvider;
70 import org.opensaml.xml.security.keyinfo.NamedKeyInfoGeneratorManager;
71 import org.opensaml.xml.security.keyinfo.provider.DSAKeyValueProvider;
72 import org.opensaml.xml.security.keyinfo.provider.InlineX509DataProvider;
73 import org.opensaml.xml.security.keyinfo.provider.RSAKeyValueProvider;
74 import org.opensaml.xml.security.x509.BasicX509Credential;
75 import org.opensaml.xml.signature.KeyInfo;
76 import org.opensaml.xml.signature.Signature;
77 import org.opensaml.xml.signature.SignatureConstants;
78 import org.opensaml.xml.util.Base64;
79 import org.opensaml.xml.util.DatatypeHelper;
80 import org.opensaml.xml.util.LazySet;
81 import org.slf4j.Logger;
82 import org.slf4j.LoggerFactory;
83
84
85
86
87 public final class SecurityHelper {
88
89
90 private static Set<String> rsaAlgorithmURIs;
91
92
93 private static Set<String> dsaAlgorithmURIs;
94
95
96 private static Set<String> ecdsaAlgorithmURIs;
97
98
99 private SecurityHelper() {
100 }
101
102
103
104
105
106
107
108 public static String getAlgorithmIDFromURI(String algorithmURI) {
109 return DatatypeHelper.safeTrimOrNullString(JCEMapper.translateURItoJCEID(algorithmURI));
110 }
111
112
113
114
115
116
117
118 public static boolean isHMAC(String signatureAlgorithm) {
119 String algoClass = DatatypeHelper.safeTrimOrNullString(JCEMapper.getAlgorithmClassFromURI(signatureAlgorithm));
120 return ApacheXMLSecurityConstants.ALGO_CLASS_MAC.equals(algoClass);
121 }
122
123
124
125
126
127
128
129 public static String getKeyAlgorithmFromURI(String algorithmURI) {
130
131
132 String apacheValue = DatatypeHelper.safeTrimOrNullString(JCEMapper.getJCEKeyAlgorithmFromURI(algorithmURI));
133 if (apacheValue != null) {
134 return apacheValue;
135 }
136
137
138 if (isHMAC(algorithmURI)) {
139 return null;
140 }
141
142
143 if (rsaAlgorithmURIs.contains(algorithmURI)) {
144 return "RSA";
145 }
146 if (dsaAlgorithmURIs.contains(algorithmURI)) {
147 return "DSA";
148 }
149 if (ecdsaAlgorithmURIs.contains(algorithmURI)) {
150 return "ECDSA";
151 }
152
153 return null;
154 }
155
156
157
158
159
160
161
162
163 public static Integer getKeyLengthFromURI(String algorithmURI) {
164 Logger log = getLogger();
165 String algoClass = DatatypeHelper.safeTrimOrNullString(JCEMapper.getAlgorithmClassFromURI(algorithmURI));
166
167 if (ApacheXMLSecurityConstants.ALGO_CLASS_BLOCK_ENCRYPTION.equals(algoClass)
168 || ApacheXMLSecurityConstants.ALGO_CLASS_SYMMETRIC_KEY_WRAP.equals(algoClass)) {
169
170 try {
171 int keyLength = JCEMapper.getKeyLengthFromURI(algorithmURI);
172 return new Integer(keyLength);
173 } catch (NumberFormatException e) {
174 log.warn("XML Security config contained invalid key length value for algorithm URI: " + algorithmURI);
175 }
176 }
177
178 log.info("Mapping from algorithm URI {} to key length not available", algorithmURI);
179 return null;
180 }
181
182
183
184
185
186
187
188
189
190 public static SecretKey generateSymmetricKey(String algoURI) throws NoSuchAlgorithmException, KeyException {
191 Logger log = getLogger();
192 String jceAlgorithmName = getKeyAlgorithmFromURI(algoURI);
193 if (DatatypeHelper.isEmpty(jceAlgorithmName)) {
194 log.error("Mapping from algorithm URI '" + algoURI
195 + "' to key algorithm not available, key generation failed");
196 throw new NoSuchAlgorithmException("Algorithm URI'" + algoURI + "' is invalid for key generation");
197 }
198 Integer keyLength = getKeyLengthFromURI(algoURI);
199 if (keyLength == null) {
200 log.error("Key length could not be determined from algorithm URI, can't generate key");
201 throw new KeyException("Key length not determinable from algorithm URI, could not generate new key");
202 }
203 KeyGenerator keyGenerator = KeyGenerator.getInstance(jceAlgorithmName);
204 keyGenerator.init(keyLength);
205 return keyGenerator.generateKey();
206 }
207
208
209
210
211
212
213
214 public static Key extractEncryptionKey(Credential credential) {
215 if (credential == null) {
216 return null;
217 }
218 if (credential.getPublicKey() != null) {
219 return credential.getPublicKey();
220 } else {
221 return credential.getSecretKey();
222 }
223 }
224
225
226
227
228
229
230
231 public static Key extractDecryptionKey(Credential credential) {
232 if (credential == null) {
233 return null;
234 }
235 if (credential.getPrivateKey() != null) {
236 return credential.getPrivateKey();
237 } else {
238 return credential.getSecretKey();
239 }
240 }
241
242
243
244
245
246
247
248 public static Key extractSigningKey(Credential credential) {
249 if (credential == null) {
250 return null;
251 }
252 if (credential.getPrivateKey() != null) {
253 return credential.getPrivateKey();
254 } else {
255 return credential.getSecretKey();
256 }
257 }
258
259
260
261
262
263
264
265 public static Key extractVerificationKey(Credential credential) {
266 if (credential == null) {
267 return null;
268 }
269 if (credential.getPublicKey() != null) {
270 return credential.getPublicKey();
271 } else {
272 return credential.getSecretKey();
273 }
274 }
275
276
277
278
279
280
281
282 public static Integer getKeyLength(Key key) {
283 Logger log = getLogger();
284
285
286 if (key instanceof SecretKey && "RAW".equals(key.getFormat())) {
287 return key.getEncoded().length * 8;
288 }
289 log.debug("Unable to determine length in bits of specified Key instance");
290 return null;
291 }
292
293
294
295
296
297
298
299 public static BasicCredential getSimpleCredential(SecretKey secretKey) {
300 if (secretKey == null) {
301 throw new IllegalArgumentException("A secret key is required");
302 }
303 BasicCredential cred = new BasicCredential();
304 cred.setSecretKey(secretKey);
305 return cred;
306 }
307
308
309
310
311
312
313
314
315 public static BasicCredential getSimpleCredential(PublicKey publicKey, PrivateKey privateKey) {
316 if (publicKey == null) {
317 throw new IllegalArgumentException("A public key is required");
318 }
319 BasicCredential cred = new BasicCredential();
320 cred.setPublicKey(publicKey);
321 cred.setPrivateKey(privateKey);
322 return cred;
323 }
324
325
326
327
328
329
330
331
332 public static BasicX509Credential getSimpleCredential(X509Certificate cert, PrivateKey privateKey) {
333 if (cert == null) {
334 throw new IllegalArgumentException("A certificate is required");
335 }
336 BasicX509Credential cred = new BasicX509Credential();
337 cred.setEntityCertificate(cert);
338 cred.setPrivateKey(privateKey);
339 return cred;
340 }
341
342
343
344
345
346
347
348
349
350
351
352
353
354 public static SecretKey decodeSecretKey(byte[] key, char[] password) throws KeyException {
355
356 throw new UnsupportedOperationException("This method is not yet supported");
357 }
358
359
360
361
362
363
364
365
366
367
368
369 public static PublicKey decodePublicKey(byte[] key, char[] password) throws KeyException {
370 X509EncodedKeySpec keySpec = new X509EncodedKeySpec(key);
371 try {
372 return buildKey(keySpec, "RSA");
373 }
374 catch (KeyException ex) {
375 }
376 try {
377 return buildKey(keySpec, "DSA");
378 }
379 catch (KeyException ex) {
380 }
381 try {
382 return buildKey(keySpec, "EC");
383 }
384 catch (KeyException ex) {
385 }
386 throw new KeyException("Unsupported key type.");
387 }
388
389
390
391
392
393
394
395
396
397
398
399 public static PublicKey derivePublicKey(PrivateKey key) throws KeyException {
400 KeyFactory factory;
401 if (key instanceof DSAPrivateKey) {
402 DSAPrivateKey dsaKey = (DSAPrivateKey) key;
403 DSAParams keyParams = dsaKey.getParams();
404 BigInteger y = keyParams.getQ().modPow(dsaKey.getX(), keyParams.getP());
405 DSAPublicKeySpec pubKeySpec = new DSAPublicKeySpec(y, keyParams.getP(), keyParams.getQ(), keyParams.getG());
406
407 try {
408 factory = KeyFactory.getInstance("DSA");
409 return factory.generatePublic(pubKeySpec);
410 } catch (GeneralSecurityException e) {
411 throw new KeyException("Unable to derive public key from DSA private key", e);
412 }
413 } else if (key instanceof RSAPrivateCrtKey) {
414 RSAPrivateCrtKey rsaKey = (RSAPrivateCrtKey) key;
415 RSAPublicKeySpec pubKeySpec = new RSAPublicKeySpec(rsaKey.getModulus(), rsaKey.getPublicExponent());
416
417 try {
418 factory = KeyFactory.getInstance("RSA");
419 return factory.generatePublic(pubKeySpec);
420 } catch (GeneralSecurityException e) {
421 throw new KeyException("Unable to derive public key from RSA private key", e);
422 }
423 } else {
424 throw new KeyException("Private key was not a DSA or RSA key");
425 }
426 }
427
428
429
430
431
432
433
434
435
436
437
438 public static PrivateKey decodePrivateKey(File key, char[] password) throws KeyException {
439 if (!key.exists()) {
440 throw new KeyException("Key file " + key.getAbsolutePath() + " does not exist");
441 }
442
443 if (!key.canRead()) {
444 throw new KeyException("Key file " + key.getAbsolutePath() + " is not readable");
445 }
446
447 try {
448 return decodePrivateKey(DatatypeHelper.fileToByteArray(key), password);
449 } catch (IOException e) {
450 throw new KeyException("Error reading Key file " + key.getAbsolutePath(), e);
451 }
452 }
453
454
455
456
457
458
459
460
461
462
463
464 public static PrivateKey decodePrivateKey(byte[] key, char[] password) throws KeyException {
465 try {
466 PKCS8Key deocodedKey = new PKCS8Key(key, password);
467 return deocodedKey.getPrivateKey();
468 } catch (GeneralSecurityException e) {
469 throw new KeyException("Unable to decode private key", e);
470 }
471 }
472
473
474
475
476
477
478
479
480 public static java.security.cert.X509Certificate buildJavaX509Cert(String base64Cert) throws CertificateException {
481 CertificateFactory cf = CertificateFactory.getInstance("X.509");
482 ByteArrayInputStream input = new ByteArrayInputStream(Base64.decode(base64Cert));
483 return (java.security.cert.X509Certificate) cf.generateCertificate(input);
484 }
485
486
487
488
489
490
491
492
493
494 public static java.security.cert.X509CRL buildJavaX509CRL(String base64CRL)
495 throws CertificateException, CRLException {
496 CertificateFactory cf = CertificateFactory.getInstance("X.509");
497 ByteArrayInputStream input = new ByteArrayInputStream(Base64.decode(base64CRL));
498 return (java.security.cert.X509CRL) cf.generateCRL(input);
499 }
500
501
502
503
504
505
506
507
508 public static DSAPublicKey buildJavaDSAPublicKey(String base64EncodedKey) throws KeyException {
509 X509EncodedKeySpec keySpec = new X509EncodedKeySpec(Base64.decode(base64EncodedKey));
510 return (DSAPublicKey) buildKey(keySpec, "DSA");
511 }
512
513
514
515
516
517
518
519
520 public static RSAPublicKey buildJavaRSAPublicKey(String base64EncodedKey) throws KeyException {
521 X509EncodedKeySpec keySpec = new X509EncodedKeySpec(Base64.decode(base64EncodedKey));
522 return (RSAPublicKey) buildKey(keySpec, "RSA");
523 }
524
525
526
527
528
529
530
531
532 public static ECPublicKey buildJavaECPublicKey(String base64EncodedKey) throws KeyException {
533 X509EncodedKeySpec keySpec = new X509EncodedKeySpec(Base64.decode(base64EncodedKey));
534 return (ECPublicKey) buildKey(keySpec, "EC");
535 }
536
537
538
539
540
541
542
543
544 public static RSAPrivateKey buildJavaRSAPrivateKey(String base64EncodedKey) throws KeyException {
545 PrivateKey key = buildJavaPrivateKey(base64EncodedKey);
546 if (! (key instanceof RSAPrivateKey)) {
547 throw new KeyException("Generated key was not an RSAPrivateKey instance");
548 }
549 return (RSAPrivateKey) key;
550 }
551
552
553
554
555
556
557
558
559 public static DSAPrivateKey buildJavaDSAPrivateKey(String base64EncodedKey) throws KeyException {
560 PrivateKey key = buildJavaPrivateKey(base64EncodedKey);
561 if (! (key instanceof DSAPrivateKey)) {
562 throw new KeyException("Generated key was not a DSAPrivateKey instance");
563 }
564 return (DSAPrivateKey) key;
565 }
566
567
568
569
570
571
572
573
574 public static PrivateKey buildJavaPrivateKey(String base64EncodedKey) throws KeyException {
575 return SecurityHelper.decodePrivateKey(Base64.decode(base64EncodedKey), null);
576 }
577
578
579
580
581
582
583
584
585
586
587
588
589 public static PublicKey buildKey(KeySpec keySpec, String keyAlgorithm) throws KeyException {
590 try {
591 KeyFactory keyFactory = KeyFactory.getInstance(keyAlgorithm);
592 return keyFactory.generatePublic(keySpec);
593 } catch (NoSuchAlgorithmException e) {
594 throw new KeyException(keyAlgorithm + "algorithm is not supported by the JCE", e);
595 } catch (InvalidKeySpecException e) {
596 throw new KeyException("Invalid key information", e);
597 }
598 }
599
600
601
602
603
604
605
606
607
608 public static SecretKey generateKeyFromURI(String algoURI)
609 throws NoSuchAlgorithmException, NoSuchProviderException {
610 String jceAlgorithmName = JCEMapper.getJCEKeyAlgorithmFromURI(algoURI);
611 int keyLength = JCEMapper.getKeyLengthFromURI(algoURI);
612 return generateKey(jceAlgorithmName, keyLength, null);
613 }
614
615
616
617
618
619
620
621
622
623
624 public static KeyPair generateKeyPairFromURI(String algoURI, int keyLength)
625 throws NoSuchAlgorithmException, NoSuchProviderException {
626 String jceAlgorithmName = JCEMapper.getJCEKeyAlgorithmFromURI(algoURI);
627 return generateKeyPair(jceAlgorithmName, keyLength, null);
628 }
629
630
631
632
633
634
635
636
637
638
639
640 public static SecretKey generateKey(String algo, int keyLength, String provider)
641 throws NoSuchAlgorithmException, NoSuchProviderException {
642 SecretKey key = null;
643 KeyGenerator keyGenerator = null;
644 if (provider != null) {
645 keyGenerator = KeyGenerator.getInstance(algo, provider);
646 } else {
647 keyGenerator = KeyGenerator.getInstance(algo);
648 }
649 keyGenerator.init(keyLength);
650 key = keyGenerator.generateKey();
651 return key;
652 }
653
654
655
656
657
658
659
660
661
662
663
664 public static KeyPair generateKeyPair(String algo, int keyLength, String provider)
665 throws NoSuchAlgorithmException, NoSuchProviderException {
666 KeyPairGenerator keyGenerator = null;
667 if (provider != null) {
668 keyGenerator = KeyPairGenerator.getInstance(algo, provider);
669 } else {
670 keyGenerator = KeyPairGenerator.getInstance(algo);
671 }
672 keyGenerator.initialize(keyLength);
673 return keyGenerator.generateKeyPair();
674 }
675
676
677
678
679
680
681
682
683
684 public static Credential generateKeyAndCredential(String algorithmURI)
685 throws NoSuchAlgorithmException, NoSuchProviderException {
686 SecretKey key = generateKeyFromURI(algorithmURI);
687 BasicCredential credential = new BasicCredential();
688 credential.setSecretKey(key);
689 return credential;
690 }
691
692
693
694
695
696
697
698
699
700
701
702 public static Credential generateKeyPairAndCredential(String algorithmURI, int keyLength, boolean includePrivate)
703 throws NoSuchAlgorithmException, NoSuchProviderException {
704 KeyPair keyPair = generateKeyPairFromURI(algorithmURI, keyLength);
705 BasicCredential credential = new BasicCredential();
706 credential.setPublicKey(keyPair.getPublic());
707 if (includePrivate) {
708 credential.setPrivateKey(keyPair.getPrivate());
709 }
710 return credential;
711 }
712
713
714
715
716
717
718
719 public static KeyInfoCredentialResolver buildBasicInlineKeyInfoResolver() {
720 List<KeyInfoProvider> providers = new ArrayList<KeyInfoProvider>();
721 providers.add( new RSAKeyValueProvider() );
722 providers.add( new DSAKeyValueProvider() );
723 providers.add( new InlineX509DataProvider() );
724 return new BasicProviderKeyInfoCredentialResolver(providers);
725 }
726
727
728
729
730
731
732
733
734
735 public static boolean matchKeyPair(PublicKey pubKey, PrivateKey privKey) throws SecurityException {
736 Logger log = getLogger();
737
738
739 if (pubKey == null || privKey == null) {
740 throw new SecurityException("Either public or private key was null");
741 }
742
743
744
745
746 SecurityConfiguration secConfig = Configuration.getGlobalSecurityConfiguration();
747 if (secConfig == null) {
748 throw new SecurityException("Global security configuration was null, could not resolve signing algorithm");
749 }
750 String algoURI = secConfig.getSignatureAlgorithmURI(privKey.getAlgorithm());
751 if (algoURI == null) {
752 throw new SecurityException("Can't determine algorithm URI from key algorithm: " + privKey.getAlgorithm());
753 }
754 String jcaAlgoID = getAlgorithmIDFromURI(algoURI);
755 if (jcaAlgoID == null) {
756 throw new SecurityException("Can't determine JCA algorithm ID from algorithm URI: " + algoURI);
757 }
758
759 if (log.isDebugEnabled()) {
760 log.debug("Attempting to match key pair containing key algorithms public '{}' private '{}', "
761 + "using JCA signature algorithm '{}'", new Object[] { pubKey.getAlgorithm(),
762 privKey.getAlgorithm(), jcaAlgoID, });
763 }
764
765 byte[] data = "This is the data to sign".getBytes();
766 byte[] signature = SigningUtil.sign(privKey, jcaAlgoID, data);
767 return SigningUtil.verify(pubKey, jcaAlgoID, signature, data);
768 }
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816 public static void prepareSignatureParams(Signature signature, Credential signingCredential,
817 SecurityConfiguration config, String keyInfoGenName) throws SecurityException {
818 Logger log = getLogger();
819
820 SecurityConfiguration secConfig;
821 if (config != null) {
822 secConfig = config;
823 } else {
824 secConfig = Configuration.getGlobalSecurityConfiguration();
825 }
826
827
828 String signAlgo = signature.getSignatureAlgorithm();
829 if (signAlgo == null) {
830 signAlgo = secConfig.getSignatureAlgorithmURI(signingCredential);
831 signature.setSignatureAlgorithm(signAlgo);
832 }
833
834
835 if (SecurityHelper.isHMAC(signAlgo)) {
836 if (signature.getHMACOutputLength() == null) {
837 signature.setHMACOutputLength(secConfig.getSignatureHMACOutputLength());
838 }
839 }
840
841 if (signature.getCanonicalizationAlgorithm() == null) {
842 signature.setCanonicalizationAlgorithm(secConfig.getSignatureCanonicalizationAlgorithm());
843 }
844
845 if (signature.getKeyInfo() == null) {
846 KeyInfoGenerator kiGenerator = getKeyInfoGenerator(signingCredential, secConfig, keyInfoGenName);
847 if (kiGenerator != null) {
848 try {
849 KeyInfo keyInfo = kiGenerator.generate(signingCredential);
850 signature.setKeyInfo(keyInfo);
851 } catch (SecurityException e) {
852 log.error("Error generating KeyInfo from credential", e);
853 throw e;
854 }
855 } else {
856 log.info("No factory for named KeyInfoGenerator {} was found for credential type {}", keyInfoGenName,
857 signingCredential.getCredentialType().getName());
858 log.info("No KeyInfo will be generated for Signature");
859 }
860 }
861 }
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900 public static EncryptionParameters buildDataEncryptionParams(Credential encryptionCredential,
901 SecurityConfiguration config, String keyInfoGenName) {
902 Logger log = getLogger();
903
904 SecurityConfiguration secConfig;
905 if (config != null) {
906 secConfig = config;
907 } else {
908 secConfig = Configuration.getGlobalSecurityConfiguration();
909 }
910
911 EncryptionParameters encParams = new EncryptionParameters();
912 encParams.setEncryptionCredential(encryptionCredential);
913
914 if (encryptionCredential == null) {
915 encParams.setAlgorithm(secConfig.getAutoGeneratedDataEncryptionKeyAlgorithmURI());
916 } else {
917 encParams.setAlgorithm(secConfig.getDataEncryptionAlgorithmURI(encryptionCredential));
918
919 KeyInfoGenerator kiGenerator = getKeyInfoGenerator(encryptionCredential, secConfig, keyInfoGenName);
920 if (kiGenerator != null) {
921 encParams.setKeyInfoGenerator(kiGenerator);
922 } else {
923 log.info("No factory for named KeyInfoGenerator {} was found for credential type{}", keyInfoGenName,
924 encryptionCredential.getCredentialType().getName());
925 log.info("No KeyInfo will be generated for EncryptedData");
926 }
927 }
928
929 return encParams;
930 }
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975 public static KeyEncryptionParameters buildKeyEncryptionParams(Credential encryptionCredential,
976 String wrappedKeyAlgorithm, SecurityConfiguration config, String keyInfoGenName, String recipient)
977 throws SecurityException {
978 Logger log = getLogger();
979
980 SecurityConfiguration secConfig;
981 if (config != null) {
982 secConfig = config;
983 } else {
984 secConfig = Configuration.getGlobalSecurityConfiguration();
985 }
986
987 KeyEncryptionParameters kekParams = new KeyEncryptionParameters();
988 kekParams.setEncryptionCredential(encryptionCredential);
989
990 if (encryptionCredential == null) {
991 throw new SecurityException("Key encryption credential may not be null");
992 }
993
994 kekParams.setAlgorithm(secConfig.getKeyTransportEncryptionAlgorithmURI(encryptionCredential,
995 wrappedKeyAlgorithm));
996
997 KeyInfoGenerator kiGenerator = getKeyInfoGenerator(encryptionCredential, secConfig, keyInfoGenName);
998 if (kiGenerator != null) {
999 kekParams.setKeyInfoGenerator(kiGenerator);
1000 } else {
1001 log.info("No factory for named KeyInfoGenerator {} was found for credential type {}", keyInfoGenName,
1002 encryptionCredential.getCredentialType().getName());
1003 log.info("No KeyInfo will be generated for EncryptedKey");
1004 }
1005
1006 kekParams.setRecipient(recipient);
1007
1008 return kekParams;
1009 }
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033 public static KeyInfoGenerator getKeyInfoGenerator(Credential credential, SecurityConfiguration config,
1034 String keyInfoGenName) {
1035
1036 SecurityConfiguration secConfig;
1037 if (config != null) {
1038 secConfig = config;
1039 } else {
1040 secConfig = Configuration.getGlobalSecurityConfiguration();
1041 }
1042
1043 NamedKeyInfoGeneratorManager kiMgr = secConfig.getKeyInfoGeneratorManager();
1044 if (kiMgr != null) {
1045 KeyInfoGeneratorFactory kiFactory = null;
1046 if (DatatypeHelper.isEmpty(keyInfoGenName)) {
1047 kiFactory = kiMgr.getDefaultManager().getFactory(credential);
1048 } else {
1049 kiFactory = kiMgr.getFactory(keyInfoGenName, credential);
1050 }
1051 if (kiFactory != null) {
1052 return kiFactory.newInstance();
1053 }
1054 }
1055 return null;
1056 }
1057
1058
1059
1060
1061
1062
1063 private static Logger getLogger() {
1064 return LoggerFactory.getLogger(SecurityHelper.class);
1065 }
1066
1067 static {
1068
1069
1070 if (!Init.isInitialized()) {
1071 Init.init();
1072 }
1073
1074
1075
1076 dsaAlgorithmURIs = new LazySet<String>();
1077 dsaAlgorithmURIs.add(SignatureConstants.ALGO_ID_SIGNATURE_DSA);
1078
1079 ecdsaAlgorithmURIs = new LazySet<String>();
1080 ecdsaAlgorithmURIs.add(SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA1);
1081
1082 rsaAlgorithmURIs = new HashSet<String>(10);
1083 rsaAlgorithmURIs.add(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA1);
1084 rsaAlgorithmURIs.add(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256);
1085 rsaAlgorithmURIs.add(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA384);
1086 rsaAlgorithmURIs.add(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA512);
1087 rsaAlgorithmURIs.add(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA512);
1088 rsaAlgorithmURIs.add(SignatureConstants.ALGO_ID_SIGNATURE_RSA_RIPEMD160);
1089 rsaAlgorithmURIs.add(SignatureConstants.ALGO_ID_SIGNATURE_NOT_RECOMMENDED_RSA_MD5);
1090 }
1091 }