Examples with PrivateKey java.security.PrivateKey used on opensource projects

Example 91 with PrivateKey

use of java.security.PrivateKey in project wycheproof by google.

the class DhiesTest method testDhiesCorrupt.

/**
   * WARNING: This test uses weak crypto (i.e. DHIESWithAES). DHIES should be secure against chosen
   * ciphertexts. Checks that a modification of the ciphertext is dectected.
   */
@SlowTest(providers = { ProviderType.BOUNCY_CASTLE, ProviderType.SPONGY_CASTLE })
@SuppressWarnings("InsecureCryptoUsage")
public void testDhiesCorrupt() throws Exception {
    KeyPairGenerator kf = KeyPairGenerator.getInstance("DH");
    kf.initialize(ike2048());
    KeyPair keyPair = kf.generateKeyPair();
    PrivateKey priv = keyPair.getPrivate();
    PublicKey pub = keyPair.getPublic();
    byte[] message = new byte[32];
    Cipher dhies;
    try {
        dhies = Cipher.getInstance("DHIESwithAES");
    } catch (NoSuchAlgorithmException ex) {
        // The algorithm isn't supported - even better!
        return;
    }
    dhies.init(Cipher.ENCRYPT_MODE, pub);
    byte[] ciphertext = dhies.doFinal(message);
    for (int i = 0; i < ciphertext.length; i++) {
        byte[] corrupt = Arrays.copyOf(ciphertext, ciphertext.length);
        corrupt[i] ^= (byte) 1;
        try {
            dhies.init(Cipher.DECRYPT_MODE, priv);
            dhies.doFinal(corrupt);
            fail("Corrupt ciphertext accepted:" + i);
        } catch (GeneralSecurityException ex) {
        // This is expected
        }
    }
}

Example 92 with PrivateKey

use of java.security.PrivateKey in project gitblit by gitblit.

the class X509UtilsTest method testCertificateUserMapping.

@Test
public void testCertificateUserMapping() throws Exception {
    File storeFile = new File(folder, X509Utils.CA_KEY_STORE);
    PrivateKey caPrivateKey = X509Utils.getPrivateKey(X509Utils.CA_ALIAS, storeFile, caPassword);
    X509Certificate caCert = X509Utils.getCertificate(X509Utils.CA_ALIAS, storeFile, caPassword);
    X509Metadata userMetadata = new X509Metadata("james", "james");
    userMetadata.serverHostname = "www.myserver.com";
    userMetadata.userDisplayname = "James Moger";
    userMetadata.passwordHint = "your name";
    userMetadata.oids.put("C", "US");
    X509Certificate cert1 = X509Utils.newClientCertificate(userMetadata, caPrivateKey, caCert, storeFile.getParentFile());
    UserModel userModel1 = HttpUtils.getUserModelFromCertificate(cert1);
    assertEquals(userMetadata.commonName, userModel1.username);
    assertEquals(userMetadata.emailAddress, userModel1.emailAddress);
    assertEquals("C=US,O=Gitblit,OU=Gitblit,CN=james", cert1.getSubjectDN().getName());
    X509Certificate cert2 = X509Utils.newClientCertificate(userMetadata, caPrivateKey, caCert, storeFile.getParentFile());
    UserModel userModel2 = HttpUtils.getUserModelFromCertificate(cert2);
    assertEquals(userMetadata.commonName, userModel2.username);
    assertEquals(userMetadata.emailAddress, userModel2.emailAddress);
    assertEquals("C=US,O=Gitblit,OU=Gitblit,CN=james", cert2.getSubjectDN().getName());
    assertNotSame("Serial numbers are the same!", cert1.getSerialNumber().longValue(), cert2.getSerialNumber().longValue());
}

Example 93 with PrivateKey

use of java.security.PrivateKey in project gitblit by gitblit.

the class X509UtilsTest method testCertificateRevocation.

@Test
public void testCertificateRevocation() throws Exception {
    File storeFile = new File(folder, X509Utils.CA_KEY_STORE);
    PrivateKey caPrivateKey = X509Utils.getPrivateKey(X509Utils.CA_ALIAS, storeFile, caPassword);
    X509Certificate caCert = X509Utils.getCertificate(X509Utils.CA_ALIAS, storeFile, caPassword);
    X509Metadata userMetadata = new X509Metadata("james", "james");
    userMetadata.serverHostname = "www.myserver.com";
    userMetadata.userDisplayname = "James Moger";
    userMetadata.passwordHint = "your name";
    // generate a new client certificate
    X509Certificate cert1 = X509Utils.newClientCertificate(userMetadata, caPrivateKey, caCert, storeFile.getParentFile());
    // confirm this certificate IS NOT revoked
    File caRevocationList = new File(folder, X509Utils.CA_REVOCATION_LIST);
    assertFalse(X509Utils.isRevoked(cert1, caRevocationList));
    // revoke certificate and then confirm it IS revoked
    X509Utils.revoke(cert1, RevocationReason.ACompromise, caRevocationList, storeFile, caPassword, log);
    assertTrue(X509Utils.isRevoked(cert1, caRevocationList));
    // generate a second certificate
    X509Certificate cert2 = X509Utils.newClientCertificate(userMetadata, caPrivateKey, caCert, storeFile.getParentFile());
    // confirm second certificate IS NOT revoked
    assertTrue(X509Utils.isRevoked(cert1, caRevocationList));
    assertFalse(X509Utils.isRevoked(cert2, caRevocationList));
    // revoke second certificate and then confirm it IS revoked
    X509Utils.revoke(cert2, RevocationReason.ACompromise, caRevocationList, caPrivateKey, log);
    assertTrue(X509Utils.isRevoked(cert1, caRevocationList));
    assertTrue(X509Utils.isRevoked(cert2, caRevocationList));
    // generate a third certificate
    X509Certificate cert3 = X509Utils.newClientCertificate(userMetadata, caPrivateKey, caCert, storeFile.getParentFile());
    // confirm third certificate IS NOT revoked
    assertTrue(X509Utils.isRevoked(cert1, caRevocationList));
    assertTrue(X509Utils.isRevoked(cert2, caRevocationList));
    assertFalse(X509Utils.isRevoked(cert3, caRevocationList));
    // revoke third certificate and then confirm it IS revoked
    X509Utils.revoke(cert3, RevocationReason.ACompromise, caRevocationList, caPrivateKey, log);
    assertTrue(X509Utils.isRevoked(cert1, caRevocationList));
    assertTrue(X509Utils.isRevoked(cert2, caRevocationList));
    assertTrue(X509Utils.isRevoked(cert3, caRevocationList));
}

Example 94 with PrivateKey

use of java.security.PrivateKey in project gocd by gocd.

the class RegistrationJSONizer method fromJson.

public static Registration fromJson(String json) {
    Map map = GSON.fromJson(json, Map.class);
    if (map.isEmpty()) {
        return Registration.createNullPrivateKeyEntry();
    }
    List<Certificate> chain = new ArrayList<>();
    try {
        PemReader reader = new PemReader(new StringReader((String) map.get("agentPrivateKey")));
        KeyFactory kf = KeyFactory.getInstance("RSA");
        PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(reader.readPemObject().getContent());
        PrivateKey privateKey = kf.generatePrivate(spec);
        String agentCertificate = (String) map.get("agentCertificate");
        PemReader certReader = new PemReader(new StringReader(agentCertificate));
        while (true) {
            PemObject obj = certReader.readPemObject();
            if (obj == null) {
                break;
            }
            chain.add(CertificateFactory.getInstance("X.509").generateCertificate(new ByteArrayInputStream(obj.getContent())));
        }
        return new Registration(privateKey, chain.toArray(new Certificate[chain.size()]));
    } catch (IOException | NoSuchAlgorithmException | CertificateException | InvalidKeySpecException e) {
        throw bomb(e);
    }
}

Example 95 with PrivateKey

use of java.security.PrivateKey in project gitblit by gitblit.

the class X509Utils method newCertificateRevocationList.

/**
	 * Creates a new certificate revocation list (CRL).  This function will
	 * destroy any existing CRL file.
	 *
	 * @param caRevocationList
	 * @param storeFile
	 * @param keystorePassword
	 * @return
	 */
public static void newCertificateRevocationList(File caRevocationList, File caKeystoreFile, String caKeystorePassword) {
    try {
        // read the Gitblit CA key and certificate
        KeyStore store = openKeyStore(caKeystoreFile, caKeystorePassword);
        PrivateKey caPrivateKey = (PrivateKey) store.getKey(CA_ALIAS, caKeystorePassword.toCharArray());
        X509Certificate caCert = (X509Certificate) store.getCertificate(CA_ALIAS);
        X500Name issuerDN = new X500Name(PrincipalUtil.getIssuerX509Principal(caCert).getName());
        X509v2CRLBuilder crlBuilder = new X509v2CRLBuilder(issuerDN, new Date());
        // build and sign CRL with CA private key
        ContentSigner signer = new JcaContentSignerBuilder(SIGNING_ALGORITHM).setProvider(BC).build(caPrivateKey);
        X509CRLHolder crl = crlBuilder.build(signer);
        File tmpFile = new File(caRevocationList.getParentFile(), Long.toHexString(System.currentTimeMillis()) + ".tmp");
        FileOutputStream fos = null;
        try {
            fos = new FileOutputStream(tmpFile);
            fos.write(crl.getEncoded());
            fos.flush();
            fos.close();
            if (caRevocationList.exists()) {
                caRevocationList.delete();
            }
            tmpFile.renameTo(caRevocationList);
        } finally {
            if (fos != null) {
                fos.close();
            }
            if (tmpFile.exists()) {
                tmpFile.delete();
            }
        }
    } catch (Exception e) {
        throw new RuntimeException("Failed to create new certificate revocation list " + caRevocationList, e);
    }
}