archive/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2025-08-26 22:34:27 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

8181692: Update storage implementations

Browse source 
Reviewed-by: weijun, igerasim
This commit is contained in:
Vinnie Ryan 2017-07-05 17:27:46 +01:00
parent e4945e6c66
commit 47efefa42f
3 changed files with 106 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

21
src/java.base/share/classes/com/sun/crypto/provider/KeyProtector.java
View file

@ -1,5 +1,5 @@
/* /*
* Copyright (c) 1998, 2013, Oracle and/or its affiliates. All rights reserved. * Copyright (c) 1998, 2017, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
* *
* This code is free software; you can redistribute it and/or modify it * This code is free software; you can redistribute it and/or modify it
@ -38,6 +38,7 @@ import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException; import java.security.NoSuchProviderException;
import java.security.UnrecoverableKeyException; import java.security.UnrecoverableKeyException;
import java.security.AlgorithmParameters; import java.security.AlgorithmParameters;
import java.security.spec.InvalidParameterSpecException;
import java.security.spec.PKCS8EncodedKeySpec; import java.security.spec.PKCS8EncodedKeySpec;
import javax.crypto.Cipher; import javax.crypto.Cipher;
@ -74,6 +75,8 @@ final class KeyProtector {
// keys in the keystore implementation that comes with JDK 1.2) // keys in the keystore implementation that comes with JDK 1.2)
private static final String KEY_PROTECTOR_OID = "1.3.6.1.4.1.42.2.17.1.1"; private static final String KEY_PROTECTOR_OID = "1.3.6.1.4.1.42.2.17.1.1";
private static final int MAX_ITERATION_COUNT = 5000000;
private static final int ITERATION_COUNT = 200000;
private static final int SALT_LEN = 20; // the salt length private static final int SALT_LEN = 20; // the salt length
private static final int DIGEST_LEN = 20; private static final int DIGEST_LEN = 20;
@ -100,7 +103,7 @@ final class KeyProtector {
SunJCE.getRandom().nextBytes(salt); SunJCE.getRandom().nextBytes(salt);
// create PBE parameters from salt and iteration count // create PBE parameters from salt and iteration count
PBEParameterSpec pbeSpec = new PBEParameterSpec(salt, 20); PBEParameterSpec pbeSpec = new PBEParameterSpec(salt, ITERATION_COUNT);
// create PBE key from password // create PBE key from password
PBEKeySpec pbeKeySpec = new PBEKeySpec(this.password); PBEKeySpec pbeKeySpec = new PBEKeySpec(this.password);
@ -155,6 +158,9 @@ final class KeyProtector {
pbeParams.init(encodedParams); pbeParams.init(encodedParams);
PBEParameterSpec pbeSpec = PBEParameterSpec pbeSpec =
pbeParams.getParameterSpec(PBEParameterSpec.class); pbeParams.getParameterSpec(PBEParameterSpec.class);
if (pbeSpec.getIterationCount() > MAX_ITERATION_COUNT) {
throw new IOException("PBE iteration count too large");
}
// create PBE key from password // create PBE key from password
PBEKeySpec pbeKeySpec = new PBEKeySpec(this.password); PBEKeySpec pbeKeySpec = new PBEKeySpec(this.password);
@ -285,7 +291,7 @@ final class KeyProtector {
SunJCE.getRandom().nextBytes(salt); SunJCE.getRandom().nextBytes(salt);
// create PBE parameters from salt and iteration count // create PBE parameters from salt and iteration count
PBEParameterSpec pbeSpec = new PBEParameterSpec(salt, 20); PBEParameterSpec pbeSpec = new PBEParameterSpec(salt, ITERATION_COUNT);
// create PBE key from password // create PBE key from password
PBEKeySpec pbeKeySpec = new PBEKeySpec(this.password); PBEKeySpec pbeKeySpec = new PBEKeySpec(this.password);
@ -326,6 +332,15 @@ final class KeyProtector {
throw new UnrecoverableKeyException("Cannot get " + throw new UnrecoverableKeyException("Cannot get " +
"algorithm parameters"); "algorithm parameters");
} }
PBEParameterSpec pbeSpec;
try {
pbeSpec = params.getParameterSpec(PBEParameterSpec.class);
} catch (InvalidParameterSpecException ipse) {
throw new IOException("Invalid PBE algorithm parameters");
}
if (pbeSpec.getIterationCount() > MAX_ITERATION_COUNT) {
throw new IOException("PBE iteration count too large");
}
PBEWithMD5AndTripleDESCipher cipherSpi; PBEWithMD5AndTripleDESCipher cipherSpi;
cipherSpi = new PBEWithMD5AndTripleDESCipher(); cipherSpi = new PBEWithMD5AndTripleDESCipher();
Cipher cipher = new CipherForKeyProtector(cipherSpi, Cipher cipher = new CipherForKeyProtector(cipherSpi,

2
src/java.base/share/classes/com/sun/crypto/provider/PBES1Core.java
View file

@ -284,7 +284,7 @@ final class PBES1Core {
for (i=0; i<2; i++) { for (i=0; i<2; i++) {
byte tmp = salt[i]; byte tmp = salt[i];
salt[i] = salt[3-i]; salt[i] = salt[3-i];
salt[3-1] = tmp; salt[3-i] = tmp;
} }
} }

115
src/java.base/share/classes/sun/security/pkcs12/PKCS12KeyStore.java
View file

@ -46,6 +46,7 @@ import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate; import java.security.cert.X509Certificate;
import java.security.cert.CertificateException; import java.security.cert.CertificateException;
import java.security.spec.AlgorithmParameterSpec; import java.security.spec.AlgorithmParameterSpec;
import java.security.spec.InvalidParameterSpecException;
import java.security.spec.KeySpec; import java.security.spec.KeySpec;
import java.security.spec.PKCS8EncodedKeySpec; import java.security.spec.PKCS8EncodedKeySpec;
import java.util.*; import java.util.*;
@ -147,6 +148,11 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
"keystore.PKCS12.keyProtectionAlgorithm" "keystore.PKCS12.keyProtectionAlgorithm"
}; };
private static final int MAX_ITERATION_COUNT = 5000000;
private static final int PBE_ITERATION_COUNT = 50000; // default
private static final int MAC_ITERATION_COUNT = 100000; // default
private static final int SALT_LEN = 20;
// friendlyName, localKeyId, trustedKeyUsage // friendlyName, localKeyId, trustedKeyUsage
private static final String[] CORE_ATTRIBUTES = { private static final String[] CORE_ATTRIBUTES = {
"1.2.840.113549.1.9.20", "1.2.840.113549.1.9.20",
@ -192,8 +198,6 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
private static ObjectIdentifier[] AnyUsage; private static ObjectIdentifier[] AnyUsage;
private int counter = 0; private int counter = 0;
private static final int iterationCount = 1024;
private static final int SALT_LEN = 20;
// private key count // private key count
// Note: This is a workaround to allow null localKeyID attribute // Note: This is a workaround to allow null localKeyID attribute
@ -327,6 +331,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
byte[] encryptedKey; byte[] encryptedKey;
AlgorithmParameters algParams; AlgorithmParameters algParams;
ObjectIdentifier algOid; ObjectIdentifier algOid;
try { try {
// get the encrypted private key // get the encrypted private key
EncryptedPrivateKeyInfo encrInfo = EncryptedPrivateKeyInfo encrInfo =
@ -348,6 +353,23 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
} }
try { try {
PBEParameterSpec pbeSpec;
int ic = 0;
if (algParams != null) {
try {
pbeSpec =
algParams.getParameterSpec(PBEParameterSpec.class);
} catch (InvalidParameterSpecException ipse) {
throw new IOException("Invalid PBE algorithm parameters");
}
ic = pbeSpec.getIterationCount();
if (ic > MAX_ITERATION_COUNT) {
throw new IOException("PBE iteration count too large");
}
}
byte[] keyInfo; byte[] keyInfo;
while (true) { while (true) {
try { try {
@ -387,9 +409,10 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
key = kfac.generatePrivate(kspec); key = kfac.generatePrivate(kspec);
if (debug != null) { if (debug != null) {
debug.println("Retrieved a protected private key (" + debug.println("Retrieved a protected private key at alias" +
key.getClass().getName() + ") at alias '" + alias + " '" + alias + "' (" +
"'"); new AlgorithmId(algOid).getName() +
" iterations: " + ic + ")");
} }
// decode secret key // decode secret key
@ -410,9 +433,10 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
} }
if (debug != null) { if (debug != null) {
debug.println("Retrieved a protected secret key (" + debug.println("Retrieved a protected secret key at alias " +
key.getClass().getName() + ") at alias '" + alias + "'" + alias + "' (" +
"'"); new AlgorithmId(algOid).getName() +
" iterations: " + ic + ")");
} }
} }
} catch (Exception e) { } catch (Exception e) {
@ -590,9 +614,9 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
(key.getFormat().equals("PKCS8"))) { (key.getFormat().equals("PKCS8"))) {
if (debug != null) { if (debug != null) {
debug.println("Setting a protected private key (" + debug.println(
key.getClass().getName() + ") at alias '" + alias + "Setting a protected private key at alias '" +
"'"); alias + "'");
} }
// Encrypt the private key // Encrypt the private key
@ -638,9 +662,8 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
encryptPrivateKey(pkcs8.toByteArray(), passwordProtection); encryptPrivateKey(pkcs8.toByteArray(), passwordProtection);
if (debug != null) { if (debug != null) {
debug.println("Setting a protected secret key (" + debug.println("Setting a protected secret key at alias '" +
key.getClass().getName() + ") at alias '" + alias + alias + "'");
"'");
} }
secretKeyCount++; secretKeyCount++;
entry = keyEntry; entry = keyEntry;
@ -761,19 +784,19 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
/* /*
* Generate PBE Algorithm Parameters * Generate PBE Algorithm Parameters
*/ */
private AlgorithmParameters getAlgorithmParameters(String algorithm) private AlgorithmParameters getPBEAlgorithmParameters(String algorithm)
throws IOException throws IOException
{ {
AlgorithmParameters algParams = null; AlgorithmParameters algParams = null;
// create PBE parameters from salt and iteration count // create PBE parameters from salt and iteration count
PBEParameterSpec paramSpec = PBEParameterSpec paramSpec =
new PBEParameterSpec(getSalt(), iterationCount); new PBEParameterSpec(getSalt(), PBE_ITERATION_COUNT);
try { try {
algParams = AlgorithmParameters.getInstance(algorithm); algParams = AlgorithmParameters.getInstance(algorithm);
algParams.init(paramSpec); algParams.init(paramSpec);
} catch (Exception e) { } catch (Exception e) {
throw new IOException("getAlgorithmParameters failed: " + throw new IOException("getPBEAlgorithmParameters failed: " +
e.getMessage(), e); e.getMessage(), e);
} }
return algParams; return algParams;
@ -859,7 +882,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
algParams = AlgorithmParameters.getInstance(algorithm); algParams = AlgorithmParameters.getInstance(algorithm);
algParams.init(algParamSpec); algParams.init(algParamSpec);
} else { } else {
algParams = getAlgorithmParameters(algorithm); algParams = getPBEAlgorithmParameters(algorithm);
} }
} else { } else {
// Check default key protection algorithm for PKCS12 keystores // Check default key protection algorithm for PKCS12 keystores
@ -879,7 +902,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
if (algorithm == null || algorithm.isEmpty()) { if (algorithm == null || algorithm.isEmpty()) {
algorithm = "PBEWithSHA1AndDESede"; algorithm = "PBEWithSHA1AndDESede";
} }
algParams = getAlgorithmParameters(algorithm); algParams = getPBEAlgorithmParameters(algorithm);
} }
ObjectIdentifier pbeOID = mapPBEAlgorithmToOID(algorithm); ObjectIdentifier pbeOID = mapPBEAlgorithmToOID(algorithm);
@ -1194,7 +1217,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
if (debug != null) { if (debug != null) {
debug.println("Storing " + (privateKeyCount + secretKeyCount) + debug.println("Storing " + (privateKeyCount + secretKeyCount) +
" protected key(s) in a PKCS#7 data content-type"); " protected key(s) in a PKCS#7 data");
} }
byte[] safeContentData = createSafeContent(); byte[] safeContentData = createSafeContent();
@ -1207,7 +1230,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
if (debug != null) { if (debug != null) {
debug.println("Storing " + certificateCount + debug.println("Storing " + certificateCount +
" certificate(s) in a PKCS#7 encryptedData content-type"); " certificate(s) in a PKCS#7 encryptedData");
} }
byte[] encrData = createEncryptedData(password); byte[] encrData = createEncryptedData(password);
@ -1478,7 +1501,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
// generate MAC (MAC key is generated within JCE) // generate MAC (MAC key is generated within JCE)
Mac m = Mac.getInstance("HmacPBESHA1"); Mac m = Mac.getInstance("HmacPBESHA1");
PBEParameterSpec params = PBEParameterSpec params =
new PBEParameterSpec(salt, iterationCount); new PBEParameterSpec(salt, MAC_ITERATION_COUNT);
SecretKey key = getPBEKey(passwd); SecretKey key = getPBEKey(passwd);
m.init(key, params); m.init(key, params);
m.update(data); m.update(data);
@ -1486,7 +1509,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
// encode as MacData // encode as MacData
MacData macData = new MacData(algName, macResult, salt, MacData macData = new MacData(algName, macResult, salt,
iterationCount); MAC_ITERATION_COUNT);
DerOutputStream bytes = new DerOutputStream(); DerOutputStream bytes = new DerOutputStream();
bytes.write(macData.getEncoded()); bytes.write(macData.getEncoded());
mData = bytes.toByteArray(); mData = bytes.toByteArray();
@ -1878,7 +1901,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
// create AlgorithmParameters // create AlgorithmParameters
AlgorithmParameters algParams = AlgorithmParameters algParams =
getAlgorithmParameters("PBEWithSHA1AndRC2_40"); getPBEAlgorithmParameters("PBEWithSHA1AndRC2_40");
DerOutputStream bytes = new DerOutputStream(); DerOutputStream bytes = new DerOutputStream();
AlgorithmId algId = AlgorithmId algId =
new AlgorithmId(pbeWithSHAAnd40BitRC2CBC_OID, algParams); new AlgorithmId(pbeWithSHAAnd40BitRC2CBC_OID, algParams);
@ -1998,7 +2021,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
if (contentType.equals(ContentInfo.DATA_OID)) { if (contentType.equals(ContentInfo.DATA_OID)) {
if (debug != null) { if (debug != null) {
debug.println("Loading PKCS#7 data content-type"); debug.println("Loading PKCS#7 data");
} }
safeContentsData = safeContents.getData(); safeContentsData = safeContents.getData();
@ -2007,15 +2030,11 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
if (debug != null) { if (debug != null) {
debug.println("Warning: skipping PKCS#7 encryptedData" + debug.println("Warning: skipping PKCS#7 encryptedData" +
" content-type - no password was supplied"); " - no password was supplied");
} }
continue; continue;
} }
if (debug != null) {
debug.println("Loading PKCS#7 encryptedData content-type");
}
DerInputStream edi = DerInputStream edi =
safeContents.getContent().toDerInputStream(); safeContents.getContent().toDerInputStream();
int edVersion = edi.getInteger(); int edVersion = edi.getInteger();
@ -2036,6 +2055,30 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
ObjectIdentifier algOid = in.getOID(); ObjectIdentifier algOid = in.getOID();
AlgorithmParameters algParams = parseAlgParameters(algOid, in); AlgorithmParameters algParams = parseAlgParameters(algOid, in);
PBEParameterSpec pbeSpec;
int ic = 0;
if (algParams != null) {
try {
pbeSpec =
algParams.getParameterSpec(PBEParameterSpec.class);
} catch (InvalidParameterSpecException ipse) {
throw new IOException(
"Invalid PBE algorithm parameters");
}
ic = pbeSpec.getIterationCount();
if (ic > MAX_ITERATION_COUNT) {
throw new IOException("PBE iteration count too large");
}
}
if (debug != null) {
debug.println("Loading PKCS#7 encryptedData " +
"(" + new AlgorithmId(algOid).getName() +
" iterations: " + ic + ")");
}
while (true) { while (true) {
try { try {
// Use JCE // Use JCE
@ -2067,7 +2110,14 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
// The MacData is optional. // The MacData is optional.
if (password != null && s.available() > 0) { if (password != null && s.available() > 0) {
MacData macData = new MacData(s); MacData macData = new MacData(s);
int ic = macData.getIterations();
try { try {
if (ic > MAX_ITERATION_COUNT) {
throw new InvalidAlgorithmParameterException(
"MAC iteration count too large: " + ic);
}
String algName = String algName =
macData.getDigestAlgName().toUpperCase(Locale.ENGLISH); macData.getDigestAlgName().toUpperCase(Locale.ENGLISH);
@ -2077,8 +2127,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
// generate MAC (MAC key is created within JCE) // generate MAC (MAC key is created within JCE)
Mac m = Mac.getInstance("HmacPBE" + algName); Mac m = Mac.getInstance("HmacPBE" + algName);
PBEParameterSpec params = PBEParameterSpec params =
new PBEParameterSpec(macData.getSalt(), new PBEParameterSpec(macData.getSalt(), ic);
macData.getIterations());
SecretKey key = getPBEKey(password); SecretKey key = getPBEKey(password);
m.init(key, params); m.init(key, params);
m.update(authSafeData); m.update(authSafeData);
@ -2086,7 +2135,7 @@ public final class PKCS12KeyStore extends KeyStoreSpi {
if (debug != null) { if (debug != null) {
debug.println("Checking keystore integrity " + debug.println("Checking keystore integrity " +
"(MAC algorithm: " + m.getAlgorithm() + ")"); "(" + m.getAlgorithm() + " iterations: " + ic + ")");
} }
if (!MessageDigest.isEqual(macData.getDigest(), macResult)) { if (!MessageDigest.isEqual(macData.getDigest(), macResult)) {