Examples with EncryptedObjectStoreData com.github.zhenwei.core.asn1.bc.EncryptedObjectStoreData used on opensource projects

Example 1 with EncryptedObjectStoreData

use of com.github.zhenwei.core.asn1.bc.EncryptedObjectStoreData in project LinLong-Java by zhenwei1108.

the class BcFKSKeyStoreSpi method engineLoad.

public void engineLoad(InputStream inputStream, char[] password) throws IOException, NoSuchAlgorithmException, CertificateException {
    // reset any current values
    entries.clear();
    privateKeyCache.clear();
    lastModifiedDate = creationDate = null;
    hmacAlgorithm = null;
    if (inputStream == null) {
        // initialise defaults
        lastModifiedDate = creationDate = new Date();
        verificationKey = null;
        validator = null;
        // basic initialisation
        hmacAlgorithm = new AlgorithmIdentifier(PKCSObjectIdentifiers.id_hmacWithSHA512, DERNull.INSTANCE);
        hmacPkbdAlgorithm = generatePkbdAlgorithmIdentifier(PKCSObjectIdentifiers.id_PBKDF2, 512 / 8);
        return;
    }
    ASN1InputStream aIn = new ASN1InputStream(inputStream);
    ObjectStore store;
    try {
        store = ObjectStore.getInstance(aIn.readObject());
    } catch (Exception e) {
        throw new IOException(e.getMessage());
    }
    ObjectStoreIntegrityCheck integrityCheck = store.getIntegrityCheck();
    AlgorithmIdentifier integrityAlg;
    if (integrityCheck.getType() == ObjectStoreIntegrityCheck.PBKD_MAC_CHECK) {
        PbkdMacIntegrityCheck pbkdMacIntegrityCheck = PbkdMacIntegrityCheck.getInstance(integrityCheck.getIntegrityCheck());
        hmacAlgorithm = pbkdMacIntegrityCheck.getMacAlgorithm();
        hmacPkbdAlgorithm = pbkdMacIntegrityCheck.getPbkdAlgorithm();
        integrityAlg = hmacAlgorithm;
        try {
            verifyMac(store.getStoreData().toASN1Primitive().getEncoded(), pbkdMacIntegrityCheck, password);
        } catch (NoSuchProviderException e) {
            throw new IOException(e.getMessage());
        }
    } else if (integrityCheck.getType() == ObjectStoreIntegrityCheck.SIG_CHECK) {
        SignatureCheck sigCheck = SignatureCheck.getInstance(integrityCheck.getIntegrityCheck());
        integrityAlg = sigCheck.getSignatureAlgorithm();
        try {
            com.github.zhenwei.core.asn1.x509.Certificate[] certificates = sigCheck.getCertificates();
            if (validator != null) {
                if (certificates == null) {
                    throw new IOException("validator specified but no certifcates in store");
                }
                CertificateFactory certFact = helper.createCertificateFactory("X.509");
                X509Certificate[] certs = new X509Certificate[certificates.length];
                for (int i = 0; i != certs.length; i++) {
                    certs[i] = (X509Certificate) certFact.generateCertificate(new ByteArrayInputStream(certificates[i].getEncoded()));
                }
                if (validator.isValid(certs)) {
                    verifySig(store.getStoreData(), sigCheck, certs[0].getPublicKey());
                } else {
                    throw new IOException("certificate chain in key store signature not valid");
                }
            } else {
                verifySig(store.getStoreData(), sigCheck, verificationKey);
            }
        } catch (GeneralSecurityException e) {
            throw new IOException("error verifying signature: " + e.getMessage(), e);
        }
    } else {
        throw new IOException("BCFKS KeyStore unable to recognize integrity check.");
    }
    ASN1Encodable sData = store.getStoreData();
    ObjectStoreData storeData;
    if (sData instanceof EncryptedObjectStoreData) {
        EncryptedObjectStoreData encryptedStoreData = (EncryptedObjectStoreData) sData;
        AlgorithmIdentifier protectAlgId = encryptedStoreData.getEncryptionAlgorithm();
        storeData = ObjectStoreData.getInstance(decryptData("STORE_ENCRYPTION", protectAlgId, password, encryptedStoreData.getEncryptedContent().getOctets()));
    } else {
        storeData = ObjectStoreData.getInstance(sData);
    }
    try {
        creationDate = storeData.getCreationDate().getDate();
        lastModifiedDate = storeData.getLastModifiedDate().getDate();
    } catch (ParseException e) {
        throw new IOException("BCFKS KeyStore unable to parse store data information.");
    }
    if (!storeData.getIntegrityAlgorithm().equals(integrityAlg)) {
        throw new IOException("BCFKS KeyStore storeData integrity algorithm does not match store integrity algorithm.");
    }
    for (Iterator it = storeData.getObjectDataSequence().iterator(); it.hasNext(); ) {
        ObjectData objData = ObjectData.getInstance(it.next());
        entries.put(objData.getIdentifier(), objData);
    }
}

Example 2 with EncryptedObjectStoreData

use of com.github.zhenwei.core.asn1.bc.EncryptedObjectStoreData in project LinLong-Java by zhenwei1108.

the class BcFKSKeyStoreSpi method engineStore.

public void engineStore(OutputStream outputStream, char[] password) throws IOException, NoSuchAlgorithmException, CertificateException {
    if (creationDate == null) {
        throw new IOException("KeyStore not initialized");
    }
    EncryptedObjectStoreData encStoreData = getEncryptedObjectStoreData(hmacAlgorithm, password);
    // update the salt
    if (MiscObjectIdentifiers.id_scrypt.equals(hmacPkbdAlgorithm.getAlgorithm())) {
        ScryptParams sParams = ScryptParams.getInstance(hmacPkbdAlgorithm.getParameters());
        hmacPkbdAlgorithm = generatePkbdAlgorithmIdentifier(hmacPkbdAlgorithm, sParams.getKeyLength().intValue());
    } else {
        PBKDF2Params pbkdf2Params = PBKDF2Params.getInstance(hmacPkbdAlgorithm.getParameters());
        hmacPkbdAlgorithm = generatePkbdAlgorithmIdentifier(hmacPkbdAlgorithm, pbkdf2Params.getKeyLength().intValue());
    }
    byte[] mac;
    try {
        mac = calculateMac(encStoreData.getEncoded(), hmacAlgorithm, hmacPkbdAlgorithm, password);
    } catch (NoSuchProviderException e) {
        throw new IOException("cannot calculate mac: " + e.getMessage());
    }
    ObjectStore store = new ObjectStore(encStoreData, new ObjectStoreIntegrityCheck(new PbkdMacIntegrityCheck(hmacAlgorithm, hmacPkbdAlgorithm, mac)));
    outputStream.write(store.getEncoded());
    outputStream.flush();
}

Example 3 with EncryptedObjectStoreData

use of com.github.zhenwei.core.asn1.bc.EncryptedObjectStoreData in project LinLong-Java by zhenwei1108.

the class BcFKSKeyStoreSpi method getEncryptedObjectStoreData.

private EncryptedObjectStoreData getEncryptedObjectStoreData(AlgorithmIdentifier integrityAlgorithm, char[] password) throws IOException, NoSuchAlgorithmException {
    ObjectData[] dataArray = (ObjectData[]) entries.values().toArray(new ObjectData[entries.size()]);
    KeyDerivationFunc pbkdAlgId = generatePkbdAlgorithmIdentifier(hmacPkbdAlgorithm, 256 / 8);
    byte[] keyBytes = generateKey(pbkdAlgId, "STORE_ENCRYPTION", ((password != null) ? password : new char[0]), 256 / 8);
    ObjectStoreData storeData = new ObjectStoreData(integrityAlgorithm, creationDate, lastModifiedDate, new ObjectDataSequence(dataArray), null);
    EncryptedObjectStoreData encStoreData;
    try {
        if (storeEncryptionAlgorithm.equals(NISTObjectIdentifiers.id_aes256_CCM)) {
            Cipher c = createCipher("AES/CCM/NoPadding", keyBytes);
            byte[] encOut = c.doFinal(storeData.getEncoded());
            AlgorithmParameters algorithmParameters = c.getParameters();
            PBES2Parameters pbeParams = new PBES2Parameters(pbkdAlgId, new EncryptionScheme(NISTObjectIdentifiers.id_aes256_CCM, CCMParameters.getInstance(algorithmParameters.getEncoded())));
            encStoreData = new EncryptedObjectStoreData(new AlgorithmIdentifier(PKCSObjectIdentifiers.id_PBES2, pbeParams), encOut);
        } else {
            Cipher c = createCipher("AESKWP", keyBytes);
            byte[] encOut = c.doFinal(storeData.getEncoded());
            PBES2Parameters pbeParams = new PBES2Parameters(pbkdAlgId, new EncryptionScheme(NISTObjectIdentifiers.id_aes256_wrap_pad));
            encStoreData = new EncryptedObjectStoreData(new AlgorithmIdentifier(PKCSObjectIdentifiers.id_PBES2, pbeParams), encOut);
        }
    } catch (NoSuchPaddingException e) {
        throw new NoSuchAlgorithmException(e.toString());
    } catch (BadPaddingException e) {
        throw new IOException(e.toString());
    } catch (IllegalBlockSizeException e) {
        throw new IOException(e.toString());
    } catch (InvalidKeyException e) {
        throw new IOException(e.toString());
    } catch (NoSuchProviderException e) {
        throw new IOException(e.toString());
    }
    return encStoreData;
}

Example 4 with EncryptedObjectStoreData

use of com.github.zhenwei.core.asn1.bc.EncryptedObjectStoreData in project LinLong-Java by zhenwei1108.

the class BcFKSKeyStoreSpi method engineStore.

public void engineStore(KeyStore.LoadStoreParameter parameter) throws CertificateException, NoSuchAlgorithmException, IOException {
    if (parameter == null) {
        throw new IllegalArgumentException("'parameter' arg cannot be null");
    }
    if (parameter instanceof BCFKSStoreParameter) {
        BCFKSStoreParameter bcParam = (BCFKSStoreParameter) parameter;
        char[] password = ParameterUtil.extractPassword(parameter);
        hmacPkbdAlgorithm = generatePkbdAlgorithmIdentifier(bcParam.getStorePBKDFConfig(), 512 / 8);
        engineStore(bcParam.getOutputStream(), password);
    } else if (parameter instanceof BCFKSLoadStoreParameter) {
        BCFKSLoadStoreParameter bcParam = (BCFKSLoadStoreParameter) parameter;
        if (bcParam.getStoreSignatureKey() != null) {
            signatureAlgorithm = generateSignatureAlgId(bcParam.getStoreSignatureKey(), bcParam.getStoreSignatureAlgorithm());
            hmacPkbdAlgorithm = generatePkbdAlgorithmIdentifier(bcParam.getStorePBKDFConfig(), 512 / 8);
            if (bcParam.getStoreEncryptionAlgorithm() == BCFKSLoadStoreParameter.EncryptionAlgorithm.AES256_CCM) {
                storeEncryptionAlgorithm = NISTObjectIdentifiers.id_aes256_CCM;
            } else {
                storeEncryptionAlgorithm = NISTObjectIdentifiers.id_aes256_wrap_pad;
            }
            if (bcParam.getStoreMacAlgorithm() == BCFKSLoadStoreParameter.MacAlgorithm.HmacSHA512) {
                hmacAlgorithm = new AlgorithmIdentifier(PKCSObjectIdentifiers.id_hmacWithSHA512, DERNull.INSTANCE);
            } else {
                hmacAlgorithm = new AlgorithmIdentifier(NISTObjectIdentifiers.id_hmacWithSHA3_512, DERNull.INSTANCE);
            }
            char[] password = ParameterUtil.extractPassword(bcParam);
            EncryptedObjectStoreData encStoreData = getEncryptedObjectStoreData(signatureAlgorithm, password);
            try {
                Signature sig = helper.createSignature(signatureAlgorithm.getAlgorithm().getId());
                sig.initSign((PrivateKey) bcParam.getStoreSignatureKey());
                sig.update(encStoreData.getEncoded());
                SignatureCheck signatureCheck;
                X509Certificate[] certs = bcParam.getStoreCertificates();
                if (certs != null) {
                    com.github.zhenwei.core.asn1.x509.Certificate[] certificates = new com.github.zhenwei.core.asn1.x509.Certificate[certs.length];
                    for (int i = 0; i != certificates.length; i++) {
                        certificates[i] = com.github.zhenwei.core.asn1.x509.Certificate.getInstance(certs[i].getEncoded());
                    }
                    signatureCheck = new SignatureCheck(signatureAlgorithm, certificates, sig.sign());
                } else {
                    signatureCheck = new SignatureCheck(signatureAlgorithm, sig.sign());
                }
                ObjectStore store = new ObjectStore(encStoreData, new ObjectStoreIntegrityCheck(signatureCheck));
                bcParam.getOutputStream().write(store.getEncoded());
                bcParam.getOutputStream().flush();
            } catch (GeneralSecurityException e) {
                throw new IOException("error creating signature: " + e.getMessage(), e);
            }
        } else {
            char[] password = ParameterUtil.extractPassword(bcParam);
            hmacPkbdAlgorithm = generatePkbdAlgorithmIdentifier(bcParam.getStorePBKDFConfig(), 512 / 8);
            if (bcParam.getStoreEncryptionAlgorithm() == BCFKSLoadStoreParameter.EncryptionAlgorithm.AES256_CCM) {
                storeEncryptionAlgorithm = NISTObjectIdentifiers.id_aes256_CCM;
            } else {
                storeEncryptionAlgorithm = NISTObjectIdentifiers.id_aes256_wrap_pad;
            }
            if (bcParam.getStoreMacAlgorithm() == BCFKSLoadStoreParameter.MacAlgorithm.HmacSHA512) {
                hmacAlgorithm = new AlgorithmIdentifier(PKCSObjectIdentifiers.id_hmacWithSHA512, DERNull.INSTANCE);
            } else {
                hmacAlgorithm = new AlgorithmIdentifier(NISTObjectIdentifiers.id_hmacWithSHA3_512, DERNull.INSTANCE);
            }
            engineStore(bcParam.getOutputStream(), password);
        }
    } else if (parameter instanceof BCLoadStoreParameter) {
        BCLoadStoreParameter bcParam = (BCLoadStoreParameter) parameter;
        engineStore(bcParam.getOutputStream(), ParameterUtil.extractPassword(parameter));
    } else {
        throw new IllegalArgumentException("no support for 'parameter' of type " + parameter.getClass().getName());
    }
}