Examples with EciesEncryptionContext io.getlime.security.powerauth.rest.api.spring.encryption.EciesEncryptionContext used on opensource projects

Example 1 with EciesEncryptionContext

use of io.getlime.security.powerauth.rest.api.spring.encryption.EciesEncryptionContext in project powerauth-restful-integration by lime-company.

the class PowerAuthEncryptionProviderBase method extractEciesEncryptionContext.

/**
 * Extract context required for ECIES encryption from either encryption or signature HTTP header.
 *
 * @param request HTTP servlet request.
 * @return Context for ECIES encryption.
 * @throws PowerAuthEncryptionException Thrown when HTTP header with ECIES data is invalid.
 */
private EciesEncryptionContext extractEciesEncryptionContext(HttpServletRequest request) throws PowerAuthEncryptionException {
    final String encryptionHttpHeader = request.getHeader(PowerAuthEncryptionHttpHeader.HEADER_NAME);
    final String signatureHttpHeader = request.getHeader(PowerAuthSignatureHttpHeader.HEADER_NAME);
    // Check that at least one PowerAuth HTTP header with parameters for ECIES is present
    if (encryptionHttpHeader == null && signatureHttpHeader == null) {
        logger.warn("Neither signature nor encryption HTTP header is present");
        throw new PowerAuthEncryptionException();
    }
    // In case the PowerAuth signature HTTP header is present, use it for ECIES
    if (signatureHttpHeader != null) {
        // Parse signature HTTP header
        final PowerAuthSignatureHttpHeader header = new PowerAuthSignatureHttpHeader().fromValue(signatureHttpHeader);
        // Validate the signature HTTP header
        try {
            PowerAuthSignatureHttpHeaderValidator.validate(header);
        } catch (InvalidPowerAuthHttpHeaderException ex) {
            logger.warn("Signature HTTP header validation failed, error: {}", ex.getMessage());
            logger.debug(ex.getMessage(), ex);
            throw new PowerAuthEncryptionException();
        }
        // Construct encryption parameters object
        final String applicationKey = header.getApplicationKey();
        final String activationId = header.getActivationId();
        final String version = header.getVersion();
        return new EciesEncryptionContext(applicationKey, activationId, version, header);
    } else {
        // Parse encryption HTTP header
        final PowerAuthEncryptionHttpHeader header = new PowerAuthEncryptionHttpHeader().fromValue(encryptionHttpHeader);
        // Validate the encryption HTTP header
        try {
            PowerAuthEncryptionHttpHeaderValidator.validate(header);
        } catch (InvalidPowerAuthHttpHeaderException ex) {
            logger.warn("Encryption validation failed, error: {}", ex.getMessage());
            logger.debug(ex.getMessage(), ex);
            throw new PowerAuthEncryptionException();
        }
        // Construct encryption parameters object
        final String applicationKey = header.getApplicationKey();
        final String activationId = header.getActivationId();
        final String version = header.getVersion();
        return new EciesEncryptionContext(applicationKey, activationId, version, header);
    }
}

Example 2 with EciesEncryptionContext

use of io.getlime.security.powerauth.rest.api.spring.encryption.EciesEncryptionContext in project powerauth-restful-integration by lime-company.

the class PowerAuthEncryptionProviderBase method decryptRequest.

/**
 * Decrypt HTTP request body and construct object with ECIES data. Use the requestType parameter to specify
 * the type of decrypted object.
 *
 * @param request HTTP request.
 * @param requestType Class of request object.
 * @param eciesScope ECIES scope.
 * @return Object with ECIES data.
 * @throws PowerAuthEncryptionException In case request decryption fails.
 */
@Nonnull
public PowerAuthEciesEncryption decryptRequest(@Nonnull HttpServletRequest request, @Nonnull Type requestType, @Nonnull EciesScope eciesScope) throws PowerAuthEncryptionException {
    // Only POST HTTP method is supported for ECIES
    if (!"POST".equals(request.getMethod())) {
        logger.warn("Invalid HTTP method: {}", request.getMethod());
        throw new PowerAuthEncryptionException();
    }
    // Resolve either signature or encryption HTTP header for ECIES
    final EciesEncryptionContext encryptionContext = extractEciesEncryptionContext(request);
    // Construct ECIES encryption object from HTTP header
    final PowerAuthEciesEncryption eciesEncryption = new PowerAuthEciesEncryption(encryptionContext);
    // Save ECIES scope in context
    eciesEncryption.getContext().setEciesScope(eciesScope);
    try {
        // Parse ECIES cryptogram from request body
        final PowerAuthRequestBody requestBody = ((PowerAuthRequestBody) request.getAttribute(PowerAuthRequestObjects.REQUEST_BODY));
        if (requestBody == null) {
            logger.warn("The X-PowerAuth-Request-Body request attribute is missing. Register the PowerAuthRequestFilter to fix this error.");
            throw new PowerAuthEncryptionException();
        }
        final byte[] requestBodyBytes = requestBody.getRequestBytes();
        if (requestBodyBytes == null || requestBodyBytes.length == 0) {
            logger.warn("Invalid HTTP request");
            throw new PowerAuthEncryptionException();
        }
        final EciesEncryptedRequest eciesRequest = objectMapper.readValue(requestBodyBytes, EciesEncryptedRequest.class);
        if (eciesRequest == null) {
            logger.warn("Invalid ECIES request data");
            throw new PowerAuthEncryptionException();
        }
        // Prepare ephemeral public key
        final String ephemeralPublicKey = eciesRequest.getEphemeralPublicKey();
        final String encryptedData = eciesRequest.getEncryptedData();
        final String mac = eciesRequest.getMac();
        final String nonce = eciesRequest.getNonce();
        // Verify ECIES request data. Nonce is required for protocol 3.1+
        if (ephemeralPublicKey == null || encryptedData == null || mac == null) {
            logger.warn("Invalid ECIES request data");
            throw new PowerAuthEncryptionException();
        }
        if (nonce == null && !"3.0".equals(encryptionContext.getVersion())) {
            logger.warn("Missing nonce in ECIES request data");
            throw new PowerAuthEncryptionException();
        }
        final byte[] ephemeralPublicKeyBytes = BaseEncoding.base64().decode(ephemeralPublicKey);
        final byte[] encryptedDataBytes = BaseEncoding.base64().decode(encryptedData);
        final byte[] macBytes = BaseEncoding.base64().decode(mac);
        final byte[] nonceBytes = nonce != null ? BaseEncoding.base64().decode(nonce) : null;
        final String applicationKey = eciesEncryption.getContext().getApplicationKey();
        final PowerAuthEciesDecryptorParameters decryptorParameters;
        // Obtain ECIES decryptor parameters from PowerAuth server
        switch(eciesScope) {
            case ACTIVATION_SCOPE:
                final String activationId = eciesEncryption.getContext().getActivationId();
                if (activationId == null) {
                    logger.warn("Activation ID is required in ECIES activation scope");
                    throw new PowerAuthEncryptionException();
                }
                decryptorParameters = getEciesDecryptorParameters(activationId, applicationKey, ephemeralPublicKey);
                break;
            case APPLICATION_SCOPE:
                decryptorParameters = getEciesDecryptorParameters(null, applicationKey, ephemeralPublicKey);
                break;
            default:
                logger.warn("Unsupported ECIES scope: {}", eciesScope);
                throw new PowerAuthEncryptionException();
        }
        // Prepare envelope key and sharedInfo2 parameter for decryptor
        final byte[] secretKey = BaseEncoding.base64().decode(decryptorParameters.getSecretKey());
        final EciesEnvelopeKey envelopeKey = new EciesEnvelopeKey(secretKey, ephemeralPublicKeyBytes);
        final byte[] sharedInfo2 = BaseEncoding.base64().decode(decryptorParameters.getSharedInfo2());
        // Construct decryptor and set it to the request for later encryption of response
        final EciesDecryptor eciesDecryptor = eciesFactory.getEciesDecryptor(envelopeKey, sharedInfo2);
        eciesEncryption.setEciesDecryptor(eciesDecryptor);
        // Decrypt request data
        final EciesCryptogram cryptogram = new EciesCryptogram(ephemeralPublicKeyBytes, macBytes, encryptedDataBytes, nonceBytes);
        final byte[] decryptedData = eciesDecryptor.decryptRequest(cryptogram);
        eciesEncryption.setEncryptedRequest(encryptedDataBytes);
        eciesEncryption.setDecryptedRequest(decryptedData);
        // Set the request object only in case when request data is sent
        if (decryptedData.length != 0) {
            eciesEncryption.setRequestObject(deserializeRequestData(decryptedData, requestType));
        }
        // Set encryption object in HTTP servlet request
        request.setAttribute(PowerAuthRequestObjects.ENCRYPTION_OBJECT, eciesEncryption);
    } catch (Exception ex) {
        logger.debug("Request decryption failed, error: " + ex.getMessage(), ex);
        throw new PowerAuthEncryptionException();
    }
    return eciesEncryption;
}

Example 3 with EciesEncryptionContext

use of io.getlime.security.powerauth.rest.api.spring.encryption.EciesEncryptionContext in project powerauth-restful-integration by lime-company.

the class PowerAuthEncryptionArgumentResolver method resolveArgument.

@Override
public Object resolveArgument(@NonNull MethodParameter parameter, ModelAndViewContainer mavContainer, @NonNull NativeWebRequest webRequest, WebDataBinderFactory binderFactory) {
    final HttpServletRequest request = (HttpServletRequest) webRequest.getNativeRequest();
    final PowerAuthEciesEncryption eciesObject = (PowerAuthEciesEncryption) request.getAttribute(PowerAuthRequestObjects.ENCRYPTION_OBJECT);
    // Decrypted object is inserted into parameter annotated by @EncryptedRequestBody annotation
    if (parameter.hasParameterAnnotation(EncryptedRequestBody.class) && eciesObject != null && eciesObject.getDecryptedRequest() != null) {
        final Type requestType = parameter.getGenericParameterType();
        if (requestType.equals(byte[].class)) {
            return eciesObject.getDecryptedRequest();
        } else {
            try {
                // Object is deserialized from JSON based on request type
                final TypeFactory typeFactory = objectMapper.getTypeFactory();
                final JavaType requestJavaType = typeFactory.constructType(requestType);
                return objectMapper.readValue(eciesObject.getDecryptedRequest(), requestJavaType);
            } catch (IOException ex) {
                logger.warn("Invalid request, error: {}", ex.getMessage());
                logger.debug("Error details", ex);
                return null;
            }
        }
    }
    // Ecies encryption object is inserted into parameter which is of type PowerAuthEciesEncryption
    if (eciesObject != null && EciesEncryptionContext.class.isAssignableFrom(parameter.getParameterType())) {
        // Set ECIES scope in case it is specified by the @PowerAuthEncryption annotation
        PowerAuthEncryption powerAuthEncryption = parameter.getMethodAnnotation(PowerAuthEncryption.class);
        if (powerAuthEncryption != null) {
            EciesEncryptionContext eciesContext = eciesObject.getContext();
            boolean validScope = validateEciesScope(eciesContext);
            if (validScope) {
                return eciesContext;
            }
        }
    }
    return null;
}