mirror of
https://github.com/openjdk/jdk.git
synced 2025-08-28 15:24:43 +02:00
335 lines
12 KiB
Java
335 lines
12 KiB
Java
/*
|
|
* Copyright (c) 1997, 2017, Oracle and/or its affiliates. All rights reserved.
|
|
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
|
*
|
|
* This code is free software; you can redistribute it and/or modify it
|
|
* under the terms of the GNU General Public License version 2 only, as
|
|
* published by the Free Software Foundation. Oracle designates this
|
|
* particular file as subject to the "Classpath" exception as provided
|
|
* by Oracle in the LICENSE file that accompanied this code.
|
|
*
|
|
* This code is distributed in the hope that it will be useful, but WITHOUT
|
|
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
* version 2 for more details (a copy is included in the LICENSE file that
|
|
* accompanied this code).
|
|
*
|
|
* You should have received a copy of the GNU General Public License version
|
|
* 2 along with this work; if not, write to the Free Software Foundation,
|
|
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
*
|
|
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
|
* or visit www.oracle.com if you need additional information or have any
|
|
* questions.
|
|
*/
|
|
|
|
package sun.security.provider;
|
|
|
|
import java.io.IOException;
|
|
import java.io.UnsupportedEncodingException;
|
|
import java.security.Key;
|
|
import java.security.KeyStoreException;
|
|
import java.security.MessageDigest;
|
|
import java.security.NoSuchAlgorithmException;
|
|
import java.security.SecureRandom;
|
|
import java.security.UnrecoverableKeyException;
|
|
import java.util.*;
|
|
|
|
import jdk.internal.ref.CleanerFactory;
|
|
import sun.security.pkcs.PKCS8Key;
|
|
import sun.security.pkcs.EncryptedPrivateKeyInfo;
|
|
import sun.security.x509.AlgorithmId;
|
|
import sun.security.util.ObjectIdentifier;
|
|
import sun.security.util.DerValue;
|
|
|
|
/**
|
|
* This is an implementation of a Sun proprietary, exportable algorithm
|
|
* intended for use when protecting (or recovering the cleartext version of)
|
|
* sensitive keys.
|
|
* This algorithm is not intended as a general purpose cipher.
|
|
*
|
|
* This is how the algorithm works for key protection:
|
|
*
|
|
* p - user password
|
|
* s - random salt
|
|
* X - xor key
|
|
* P - to-be-protected key
|
|
* Y - protected key
|
|
* R - what gets stored in the keystore
|
|
*
|
|
* Step 1:
|
|
* Take the user's password, append a random salt (of fixed size) to it,
|
|
* and hash it: d1 = digest(p, s)
|
|
* Store d1 in X.
|
|
*
|
|
* Step 2:
|
|
* Take the user's password, append the digest result from the previous step,
|
|
* and hash it: dn = digest(p, dn-1).
|
|
* Store dn in X (append it to the previously stored digests).
|
|
* Repeat this step until the length of X matches the length of the private key
|
|
* P.
|
|
*
|
|
* Step 3:
|
|
* XOR X and P, and store the result in Y: Y = X XOR P.
|
|
*
|
|
* Step 4:
|
|
* Store s, Y, and digest(p, P) in the result buffer R:
|
|
* R = s + Y + digest(p, P), where "+" denotes concatenation.
|
|
* (NOTE: digest(p, P) is stored in the result buffer, so that when the key is
|
|
* recovered, we can check if the recovered key indeed matches the original
|
|
* key.) R is stored in the keystore.
|
|
*
|
|
* The protected key is recovered as follows:
|
|
*
|
|
* Step1 and Step2 are the same as above, except that the salt is not randomly
|
|
* generated, but taken from the result R of step 4 (the first length(s)
|
|
* bytes).
|
|
*
|
|
* Step 3 (XOR operation) yields the plaintext key.
|
|
*
|
|
* Then concatenate the password with the recovered key, and compare with the
|
|
* last length(digest(p, P)) bytes of R. If they match, the recovered key is
|
|
* indeed the same key as the original key.
|
|
*
|
|
* @author Jan Luehe
|
|
*
|
|
*
|
|
* @see java.security.KeyStore
|
|
* @see JavaKeyStore
|
|
* @see KeyTool
|
|
*
|
|
* @since 1.2
|
|
*/
|
|
|
|
final class KeyProtector {
|
|
|
|
private static final int SALT_LEN = 20; // the salt length
|
|
private static final String DIGEST_ALG = "SHA";
|
|
private static final int DIGEST_LEN = 20;
|
|
|
|
// defined by JavaSoft
|
|
private static final String KEY_PROTECTOR_OID = "1.3.6.1.4.1.42.2.17.1.1";
|
|
|
|
// The password used for protecting/recovering keys passed through this
|
|
// key protector. We store it as a byte array, so that we can digest it.
|
|
private byte[] passwdBytes;
|
|
|
|
private MessageDigest md;
|
|
|
|
|
|
/**
|
|
* Creates an instance of this class, and initializes it with the given
|
|
* password.
|
|
*
|
|
* <p>The password is expected to be in printable ASCII.
|
|
* Normal rules for good password selection apply: at least
|
|
* seven characters, mixed case, with punctuation encouraged.
|
|
* Phrases or words which are easily guessed, for example by
|
|
* being found in dictionaries, are bad.
|
|
*/
|
|
public KeyProtector(char[] password)
|
|
throws NoSuchAlgorithmException
|
|
{
|
|
int i, j;
|
|
|
|
if (password == null) {
|
|
throw new IllegalArgumentException("password can't be null");
|
|
}
|
|
md = MessageDigest.getInstance(DIGEST_ALG);
|
|
// Convert password to byte array, so that it can be digested
|
|
passwdBytes = new byte[password.length * 2];
|
|
for (i=0, j=0; i<password.length; i++) {
|
|
passwdBytes[j++] = (byte)(password[i] >> 8);
|
|
passwdBytes[j++] = (byte)password[i];
|
|
}
|
|
// Use the cleaner to zero the password when no longer referenced
|
|
final byte[] k = this.passwdBytes;
|
|
CleanerFactory.cleaner().register(this,
|
|
() -> java.util.Arrays.fill(k, (byte)0x00));
|
|
}
|
|
|
|
/*
|
|
* Protects the given plaintext key, using the password provided at
|
|
* construction time.
|
|
*/
|
|
public byte[] protect(Key key) throws KeyStoreException
|
|
{
|
|
int i;
|
|
int numRounds;
|
|
byte[] digest;
|
|
int xorOffset; // offset in xorKey where next digest will be stored
|
|
int encrKeyOffset = 0;
|
|
|
|
if (key == null) {
|
|
throw new IllegalArgumentException("plaintext key can't be null");
|
|
}
|
|
|
|
if (!"PKCS#8".equalsIgnoreCase(key.getFormat())) {
|
|
throw new KeyStoreException(
|
|
"Cannot get key bytes, not PKCS#8 encoded");
|
|
}
|
|
|
|
byte[] plainKey = key.getEncoded();
|
|
if (plainKey == null) {
|
|
throw new KeyStoreException(
|
|
"Cannot get key bytes, encoding not supported");
|
|
}
|
|
|
|
// Determine the number of digest rounds
|
|
numRounds = plainKey.length / DIGEST_LEN;
|
|
if ((plainKey.length % DIGEST_LEN) != 0)
|
|
numRounds++;
|
|
|
|
// Create a random salt
|
|
byte[] salt = new byte[SALT_LEN];
|
|
SecureRandom random = new SecureRandom();
|
|
random.nextBytes(salt);
|
|
|
|
// Set up the byte array which will be XORed with "plainKey"
|
|
byte[] xorKey = new byte[plainKey.length];
|
|
|
|
// Compute the digests, and store them in "xorKey"
|
|
for (i = 0, xorOffset = 0, digest = salt;
|
|
i < numRounds;
|
|
i++, xorOffset += DIGEST_LEN) {
|
|
md.update(passwdBytes);
|
|
md.update(digest);
|
|
digest = md.digest();
|
|
md.reset();
|
|
// Copy the digest into "xorKey"
|
|
if (i < numRounds - 1) {
|
|
System.arraycopy(digest, 0, xorKey, xorOffset,
|
|
digest.length);
|
|
} else {
|
|
System.arraycopy(digest, 0, xorKey, xorOffset,
|
|
xorKey.length - xorOffset);
|
|
}
|
|
}
|
|
|
|
// XOR "plainKey" with "xorKey", and store the result in "tmpKey"
|
|
byte[] tmpKey = new byte[plainKey.length];
|
|
for (i = 0; i < tmpKey.length; i++) {
|
|
tmpKey[i] = (byte)(plainKey[i] ^ xorKey[i]);
|
|
}
|
|
|
|
// Store salt and "tmpKey" in "encrKey"
|
|
byte[] encrKey = new byte[salt.length + tmpKey.length + DIGEST_LEN];
|
|
System.arraycopy(salt, 0, encrKey, encrKeyOffset, salt.length);
|
|
encrKeyOffset += salt.length;
|
|
System.arraycopy(tmpKey, 0, encrKey, encrKeyOffset, tmpKey.length);
|
|
encrKeyOffset += tmpKey.length;
|
|
|
|
// Append digest(password, plainKey) as an integrity check to "encrKey"
|
|
md.update(passwdBytes);
|
|
Arrays.fill(passwdBytes, (byte)0x00);
|
|
passwdBytes = null;
|
|
md.update(plainKey);
|
|
digest = md.digest();
|
|
md.reset();
|
|
System.arraycopy(digest, 0, encrKey, encrKeyOffset, digest.length);
|
|
|
|
// wrap the protected private key in a PKCS#8-style
|
|
// EncryptedPrivateKeyInfo, and returns its encoding
|
|
AlgorithmId encrAlg;
|
|
try {
|
|
encrAlg = new AlgorithmId(new ObjectIdentifier(KEY_PROTECTOR_OID));
|
|
return new EncryptedPrivateKeyInfo(encrAlg,encrKey).getEncoded();
|
|
} catch (IOException ioe) {
|
|
throw new KeyStoreException(ioe.getMessage());
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Recovers the plaintext version of the given key (in protected format),
|
|
* using the password provided at construction time.
|
|
*/
|
|
public Key recover(EncryptedPrivateKeyInfo encrInfo)
|
|
throws UnrecoverableKeyException
|
|
{
|
|
int i;
|
|
byte[] digest;
|
|
int numRounds;
|
|
int xorOffset; // offset in xorKey where next digest will be stored
|
|
int encrKeyLen; // the length of the encrpyted key
|
|
|
|
// do we support the algorithm?
|
|
AlgorithmId encrAlg = encrInfo.getAlgorithm();
|
|
if (!(encrAlg.getOID().toString().equals(KEY_PROTECTOR_OID))) {
|
|
throw new UnrecoverableKeyException("Unsupported key protection "
|
|
+ "algorithm");
|
|
}
|
|
|
|
byte[] protectedKey = encrInfo.getEncryptedData();
|
|
|
|
/*
|
|
* Get the salt associated with this key (the first SALT_LEN bytes of
|
|
* <code>protectedKey</code>)
|
|
*/
|
|
byte[] salt = new byte[SALT_LEN];
|
|
System.arraycopy(protectedKey, 0, salt, 0, SALT_LEN);
|
|
|
|
// Determine the number of digest rounds
|
|
encrKeyLen = protectedKey.length - SALT_LEN - DIGEST_LEN;
|
|
numRounds = encrKeyLen / DIGEST_LEN;
|
|
if ((encrKeyLen % DIGEST_LEN) != 0) numRounds++;
|
|
|
|
// Get the encrypted key portion and store it in "encrKey"
|
|
byte[] encrKey = new byte[encrKeyLen];
|
|
System.arraycopy(protectedKey, SALT_LEN, encrKey, 0, encrKeyLen);
|
|
|
|
// Set up the byte array which will be XORed with "encrKey"
|
|
byte[] xorKey = new byte[encrKey.length];
|
|
|
|
// Compute the digests, and store them in "xorKey"
|
|
for (i = 0, xorOffset = 0, digest = salt;
|
|
i < numRounds;
|
|
i++, xorOffset += DIGEST_LEN) {
|
|
md.update(passwdBytes);
|
|
md.update(digest);
|
|
digest = md.digest();
|
|
md.reset();
|
|
// Copy the digest into "xorKey"
|
|
if (i < numRounds - 1) {
|
|
System.arraycopy(digest, 0, xorKey, xorOffset,
|
|
digest.length);
|
|
} else {
|
|
System.arraycopy(digest, 0, xorKey, xorOffset,
|
|
xorKey.length - xorOffset);
|
|
}
|
|
}
|
|
|
|
// XOR "encrKey" with "xorKey", and store the result in "plainKey"
|
|
byte[] plainKey = new byte[encrKey.length];
|
|
for (i = 0; i < plainKey.length; i++) {
|
|
plainKey[i] = (byte)(encrKey[i] ^ xorKey[i]);
|
|
}
|
|
|
|
/*
|
|
* Check the integrity of the recovered key by concatenating it with
|
|
* the password, digesting the concatenation, and comparing the
|
|
* result of the digest operation with the digest provided at the end
|
|
* of <code>protectedKey</code>. If the two digest values are
|
|
* different, throw an exception.
|
|
*/
|
|
md.update(passwdBytes);
|
|
Arrays.fill(passwdBytes, (byte)0x00);
|
|
passwdBytes = null;
|
|
md.update(plainKey);
|
|
digest = md.digest();
|
|
md.reset();
|
|
for (i = 0; i < digest.length; i++) {
|
|
if (digest[i] != protectedKey[SALT_LEN + encrKeyLen + i]) {
|
|
throw new UnrecoverableKeyException("Cannot recover key");
|
|
}
|
|
}
|
|
|
|
// The parseKey() method of PKCS8Key parses the key
|
|
// algorithm and instantiates the appropriate key factory,
|
|
// which in turn parses the key material.
|
|
try {
|
|
return PKCS8Key.parseKey(new DerValue(plainKey));
|
|
} catch (IOException ioe) {
|
|
throw new UnrecoverableKeyException(ioe.getMessage());
|
|
}
|
|
}
|
|
}
|