8248268: Support KWP in addition to KW

Reviewed-by: xuelei

src/java.base/share/classes/com/sun/crypto/provider/AESKeyWrapPadded.java

@@ -0,0 +1,260 @@
+/*
+ * Copyright (c) 2021, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package com.sun.crypto.provider;
+
+import java.util.Arrays;
+import java.security.*;
+import java.security.spec.*;
+import javax.crypto.*;
+import javax.crypto.spec.*;
+import static com.sun.crypto.provider.KWUtil.*;
+
+/**
+ * This class implement the AES KeyWrap With Padding mode of operation as
+ * defined in
+ * <a href=https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf>
+ * "Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping"</a>
+ * and represents AES cipher in KWP mode.
+ */
+class AESKeyWrapPadded extends FeedbackCipher {
+
+    // default integrity check value (icv) if iv is not supplied
+    private static final byte[] ICV2 = { // SEMI_BLKSIZE/2 long
+        (byte) 0xA6, (byte) 0x59, (byte) 0x59, (byte) 0xA6,
+    };
+
+    private static final byte[] PAD_BLK = new byte[SEMI_BLKSIZE - 1];
+
+    // set the first semiblock of dest with iv and inLen
+    private static void setIvAndLen(byte[] dest, byte[] iv, int inLen) {
+        assert(dest.length >= SEMI_BLKSIZE) : "buffer needs at least 8 bytes";
+
+        System.arraycopy(iv, 0, dest, 0, iv.length);
+        dest[4] = (byte) ((inLen >>> 24) & 0xFF);
+        dest[5] = (byte) ((inLen >>> 16) & 0xFF);
+        dest[6] = (byte) ((inLen >>> 8) & 0xFF);
+        dest[7] = (byte) (inLen & 0xFF);
+    }
+
+    // validate the recovered internal ivAndLen semiblock against iv and
+    // return the recovered input length
+    private static int validateIV(byte[] ivAndLen, byte[] iv)
+            throws IllegalBlockSizeException {
+        // check against iv and fail if not match
+        int match = 0;
+        for (int i = 0; i < ICV2.length; i++) {
+            match |= (ivAndLen[i] ^ iv[i]);
+        }
+        if (match != 0) {
+            throw new IllegalBlockSizeException("Integrity check failed");
+        }
+        int outLen = ivAndLen[4];
+
+        for (int k = 5; k < SEMI_BLKSIZE; k++) {
+            if (outLen != 0) {
+                outLen <<= 8;
+            }
+            outLen |= ivAndLen[k] & 0xFF;
+        }
+        return outLen;
+    }
+
+    AESKeyWrapPadded() {
+        super(new AESCrypt());
+    }
+
+    /**
+     * Gets the name of this feedback mode.
+     *
+     * @return the string <code>KW</code>
+     */
+    @Override
+    String getFeedback() {
+        return "KWP";
+    }
+
+    /**
+     * Save the current content of this cipher.
+     */
+    @Override
+    void save() {
+        throw new UnsupportedOperationException("save not supported");
+    };
+
+    /**
+     * Restores the content of this cipher to the previous saved one.
+     */
+    @Override
+    void restore() {
+        throw new UnsupportedOperationException("restore not supported");
+    };
+
+    /**
+     * Initializes the cipher in the specified mode with the given key
+     * and iv.
+     *
+     * @param decrypting flag indicating encryption or decryption
+     * @param algorithm the algorithm name
+     * @param key the key
+     * @param iv the iv
+     *
+     * @exception InvalidKeyException if the given key is inappropriate for
+     * initializing this cipher
+     * @exception InvalidAlgorithmParameterException if the given iv is
+     * non-null and not the right length
+     */
+    @Override
+    void init(boolean decrypting, String algorithm, byte[] key, byte[] iv)
+            throws InvalidKeyException, InvalidAlgorithmParameterException {
+        if (key == null) {
+            throw new InvalidKeyException("Invalid null key");
+        }
+        if (iv != null && iv.length != ICV2.length) {
+            throw new InvalidAlgorithmParameterException("Invalid IV length");
+        }
+        embeddedCipher.init(decrypting, algorithm, key);
+        // iv is retrieved from IvParameterSpec.getIV() which is already cloned
+        this.iv = (iv == null? ICV2 : iv);
+    }
+
+    /**
+     * Resets the iv to its original value.
+     * This is used when doFinal is called in the Cipher class, so that the
+     * cipher can be reused (with its original iv).
+     */
+    @Override
+    void reset() {
+        throw new UnsupportedOperationException("reset not supported");
+    };
+
+    // no support for multi-part encryption
+    @Override
+    int encrypt(byte[] pt, int ptOfs, int ptLen, byte[] ct, int ctOfs) {
+        throw new UnsupportedOperationException("multi-part not supported");
+    };
+
+    // no support for multi-part decryption
+    @Override
+    int decrypt(byte[] ct, int ctOfs, int ctLen, byte[] pt, int ptOfs) {
+        throw new UnsupportedOperationException("multi-part not supported");
+    };
+
+    /**
+     * Performs single-part encryption operation.
+     *
+     * <p>The input <code>pt</code>, starting at <code>0</code>
+     * and ending at <code>ptLen-1</code>, is encrypted.
+     * The result is stored in place into <code>pt</code>, starting at
+     * <code>0</code>.
+     *
+     * <p>The subclass that implements Cipher should ensure that
+     * <code>init</code> has been called before this method is called.
+     *
+     * @param pt the input buffer with the data to be encrypted
+     * @param dummy1 the offset in <code>pt</code> which is always 0
+     * @param ptLen the length of the input data
+     * @param dummy2 the output buffer for the encryption which is always pt
+     * @param dummy3 the offset in the output buffer which is always 0
+     * @return the number of bytes placed into <code>pt</code>
+     */
+    @Override
+    int encryptFinal(byte[] pt, int dummy1, int ptLen, byte[] dummy2,
+            int dummy3) throws IllegalBlockSizeException {
+        int actualLen = ptLen - SEMI_BLKSIZE;
+        if (actualLen < 1) {
+            throw new IllegalBlockSizeException
+                ("data should have at least 1 byte");
+        }
+
+        if (ptLen % SEMI_BLKSIZE != 0) {
+            int rem = SEMI_BLKSIZE - (ptLen % SEMI_BLKSIZE);
+            System.arraycopy(PAD_BLK, 0, pt, ptLen, rem);
+            ptLen += rem;
+        }
+
+        if (ptLen <= BLKSIZE) {
+            // overwrite the first semiblock with iv and input length
+            setIvAndLen(pt, iv, actualLen);
+            embeddedCipher.encryptBlock(pt, 0, pt, 0);
+        } else {
+            byte[] ivAndLen = new byte[SEMI_BLKSIZE];
+            setIvAndLen(ivAndLen, iv, actualLen);
+            ptLen = W(ivAndLen, pt, ptLen, embeddedCipher);
+        }
+        return ptLen;
+    }
+
+    /**
+     * Performs single-part decryption operation.
+     *
+     * <p>The input <code>ct</code>, starting at <code>0</code>
+     * and ending at <code>ctLen-1</code>, is decrypted.
+     * The result is stored in place into <code>ct</code>, starting at
+     * <code>0</code>.
+     *
+     * <p>The subclass that implements Cipher should ensure that
+     * <code>init</code> has been called before this method is called.
+     *
+     * @param ct the input buffer with the data to be decrypted
+     * @param dummy1 the offset in <code>ct</code> which is always 0
+     * @param ctLen the length of the input data
+     * @param dummy2 the output buffer for the decryption which is always ct
+     * @param dummy3 the offset in the output buffer which is always 0
+     * @return the number of bytes placed into <code>ct</code>
+     */
+    @Override
+    int decryptFinal(byte[] ct, int dummy1, int ctLen, byte[] dummy2,
+            int dummy3) throws IllegalBlockSizeException {
+        if (ctLen < BLKSIZE || ctLen % SEMI_BLKSIZE != 0) {
+            throw new IllegalBlockSizeException
+                ("data should be at least 16 bytes and multiples of 8");
+        }
+
+        byte[] ivAndLen = new byte[SEMI_BLKSIZE];
+        if (ctLen == BLKSIZE) {
+            embeddedCipher.decryptBlock(ct, 0, ct, 0);
+            System.arraycopy(ct, 0, ivAndLen, 0, SEMI_BLKSIZE);
+            System.arraycopy(ct, SEMI_BLKSIZE, ct, 0, SEMI_BLKSIZE);
+            ctLen -= SEMI_BLKSIZE;
+        } else {
+            ctLen = W_INV(ct, ctLen, ivAndLen, embeddedCipher);
+        }
+
+        int outLen = validateIV(ivAndLen, this.iv);
+        // check padding bytes
+        int padLen = ctLen - outLen;
+        if (padLen < 0 || padLen >= SEMI_BLKSIZE) {
+            throw new IllegalBlockSizeException("Invalid KWP pad length " +
+                    padLen);
+        }
+        for (int k = padLen; k > 0; k--) {
+            if (ct[ctLen - k] != 0) {
+                throw new IllegalBlockSizeException("Invalid KWP pad value");
+            }
+        }
+        return outLen;
+    }
+}