Search in sources :

Example 61 with PrivateKeyInfo

use of org.bouncycastle.asn1.pkcs.PrivateKeyInfo in project midpoint by Evolveum.

the class RemoteModuleWebSecurityConfiguration method getPrivateKey.

protected static PrivateKey getPrivateKey(AbstractSimpleKeyType key, Protector protector) throws EncryptionException, IOException, PKCSException, OperatorCreationException {
    if (key == null) {
        return null;
    }
    PrivateKey pkey = null;
    String stringPrivateKey = protector.decryptString(key.getPrivateKey());
    String stringPassphrase = protector.decryptString(key.getPassphrase());
    if (hasText(stringPrivateKey)) {
        Object obj;
        PEMParser parser = new PEMParser(new CharArrayReader(stringPrivateKey.toCharArray()));
        obj = parser.readObject();
        parser.close();
        JcaPEMKeyConverter converter = new JcaPEMKeyConverter();
        if (obj == null) {
            throw new EncryptionException("Unable to decode PEM key:" + key.getPrivateKey());
        } else if (obj instanceof PEMEncryptedKeyPair) {
            // Encrypted key - we will use provided password
            PEMEncryptedKeyPair ckp = (PEMEncryptedKeyPair) obj;
            char[] passarray = (ofNullable(stringPassphrase).orElse("")).toCharArray();
            PEMDecryptorProvider decProv = new JcePEMDecryptorProviderBuilder().build(passarray);
            KeyPair kp = converter.getKeyPair(ckp.decryptKeyPair(decProv));
            pkey = kp.getPrivate();
        } else if (obj instanceof PEMKeyPair) {
            // Unencrypted key - no password needed
            PEMKeyPair ukp = (PEMKeyPair) obj;
            KeyPair kp = converter.getKeyPair(ukp);
            pkey = kp.getPrivate();
        } else if (obj instanceof PrivateKeyInfo) {
            // Encrypted key - we will use provided password
            PrivateKeyInfo pk = (PrivateKeyInfo) obj;
            pkey = converter.getPrivateKey(pk);
        } else if (obj instanceof PKCS8EncryptedPrivateKeyInfo) {
            // Encrypted key - we will use provided password
            PKCS8EncryptedPrivateKeyInfo cpk = (PKCS8EncryptedPrivateKeyInfo) obj;
            char[] passarray = (ofNullable(stringPassphrase).orElse("")).toCharArray();
            final InputDecryptorProvider provider = new JceOpenSSLPKCS8DecryptorProviderBuilder().build(passarray);
            pkey = converter.getPrivateKey(cpk.decryptPrivateKeyInfo(provider));
        } else {
            throw new EncryptionException("Unable get private key from " + obj);
        }
    }
    return pkey;
}
Also used : PEMEncryptedKeyPair(org.bouncycastle.openssl.PEMEncryptedKeyPair) PEMKeyPair(org.bouncycastle.openssl.PEMKeyPair) PEMDecryptorProvider(org.bouncycastle.openssl.PEMDecryptorProvider) JcaPEMKeyConverter(org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter) JcePEMDecryptorProviderBuilder(org.bouncycastle.openssl.jcajce.JcePEMDecryptorProviderBuilder) PKCS8EncryptedPrivateKeyInfo(org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo) PEMEncryptedKeyPair(org.bouncycastle.openssl.PEMEncryptedKeyPair) PEMParser(org.bouncycastle.openssl.PEMParser) InputDecryptorProvider(org.bouncycastle.operator.InputDecryptorProvider) EncryptionException(com.evolveum.midpoint.prism.crypto.EncryptionException) PEMKeyPair(org.bouncycastle.openssl.PEMKeyPair) JceOpenSSLPKCS8DecryptorProviderBuilder(org.bouncycastle.openssl.jcajce.JceOpenSSLPKCS8DecryptorProviderBuilder) PrivateKeyInfo(org.bouncycastle.asn1.pkcs.PrivateKeyInfo) PKCS8EncryptedPrivateKeyInfo(org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo)

Example 62 with PrivateKeyInfo

use of org.bouncycastle.asn1.pkcs.PrivateKeyInfo in project zeppelin by apache.

the class PEMImporter method createPrivateKey.

private static PrivateKey createPrivateKey(File privateKeyPem, String keyPassword) throws IOException, GeneralSecurityException, OperatorCreationException, PKCSException {
    // add provider only if it's not in the JVM
    if (Security.getProvider(BouncyCastleProvider.PROVIDER_NAME) == null) {
        Security.addProvider(new BouncyCastleProvider());
    }
    try (PEMParser parser = new PEMParser(Files.newBufferedReader(privateKeyPem.toPath()))) {
        Object privateKeyObject = parser.readObject();
        JcaPEMKeyConverter converter = new JcaPEMKeyConverter().setProvider(BouncyCastleProvider.PROVIDER_NAME);
        KeyPair kp;
        if (privateKeyObject instanceof PEMEncryptedKeyPair) {
            // Encrypted key - we will use provided password
            PEMEncryptedKeyPair ckp = (PEMEncryptedKeyPair) privateKeyObject;
            PEMDecryptorProvider decProv = new JcePEMDecryptorProviderBuilder().build(keyPassword.toCharArray());
            kp = converter.getKeyPair(ckp.decryptKeyPair(decProv));
        } else if (privateKeyObject instanceof PEMKeyPair) {
            // Unencrypted key - no password needed
            PEMKeyPair ukp = (PEMKeyPair) privateKeyObject;
            kp = converter.getKeyPair(ukp);
        } else if (privateKeyObject instanceof PrivateKeyInfo) {
            PrivateKeyInfo pki = (PrivateKeyInfo) privateKeyObject;
            return converter.getPrivateKey(pki);
        } else if (privateKeyObject instanceof PKCS8EncryptedPrivateKeyInfo) {
            PKCS8EncryptedPrivateKeyInfo ckp = (PKCS8EncryptedPrivateKeyInfo) privateKeyObject;
            InputDecryptorProvider devProv = new JceOpenSSLPKCS8DecryptorProviderBuilder().build(keyPassword.toCharArray());
            return converter.getPrivateKey(ckp.decryptPrivateKeyInfo(devProv));
        } else {
            throw new GeneralSecurityException("Unsupported key type: " + privateKeyObject.getClass());
        }
        return kp.getPrivate();
    }
}
Also used : KeyPair(java.security.KeyPair) PEMEncryptedKeyPair(org.bouncycastle.openssl.PEMEncryptedKeyPair) PEMKeyPair(org.bouncycastle.openssl.PEMKeyPair) GeneralSecurityException(java.security.GeneralSecurityException) PEMDecryptorProvider(org.bouncycastle.openssl.PEMDecryptorProvider) JcaPEMKeyConverter(org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter) JcePEMDecryptorProviderBuilder(org.bouncycastle.openssl.jcajce.JcePEMDecryptorProviderBuilder) PKCS8EncryptedPrivateKeyInfo(org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo) PEMEncryptedKeyPair(org.bouncycastle.openssl.PEMEncryptedKeyPair) PEMParser(org.bouncycastle.openssl.PEMParser) InputDecryptorProvider(org.bouncycastle.operator.InputDecryptorProvider) PemObject(org.bouncycastle.util.io.pem.PemObject) PEMKeyPair(org.bouncycastle.openssl.PEMKeyPair) JceOpenSSLPKCS8DecryptorProviderBuilder(org.bouncycastle.openssl.jcajce.JceOpenSSLPKCS8DecryptorProviderBuilder) PrivateKeyInfo(org.bouncycastle.asn1.pkcs.PrivateKeyInfo) PKCS8EncryptedPrivateKeyInfo(org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo) BouncyCastleProvider(org.bouncycastle.jce.provider.BouncyCastleProvider)

Example 63 with PrivateKeyInfo

use of org.bouncycastle.asn1.pkcs.PrivateKeyInfo in project Openfire by igniterealtime.

the class CertificateManager method parsePrivateKey.

/**
 * Parses a PrivateKey instance from a PEM representation.
 *
 * When the provided key is encrypted, the provided pass phrase is applied.
 *
 * @param pemRepresentation a PEM representation of a private key (cannot be null or empty)
 * @param passPhrase optional pass phrase (must be present if the private key is encrypted).
 * @return a PrivateKey instance (never null)
 * @throws IOException if there was a problem parsing the key
 */
public static PrivateKey parsePrivateKey(InputStream pemRepresentation, String passPhrase) throws IOException {
    if (passPhrase == null) {
        passPhrase = "";
    }
    try (// 
    Reader reader = new InputStreamReader(pemRepresentation);
        PEMParser pemParser = new PEMParser(reader)) {
        final Object object = pemParser.readObject();
        final JcaPEMKeyConverter converter = new JcaPEMKeyConverter().setProvider("BC");
        final KeyPair kp;
        if (object instanceof PEMEncryptedKeyPair) {
            // Encrypted key - we will use provided password
            final PEMDecryptorProvider decProv = new JcePEMDecryptorProviderBuilder().build(passPhrase.toCharArray());
            kp = converter.getKeyPair(((PEMEncryptedKeyPair) object).decryptKeyPair(decProv));
        } else if (object instanceof PKCS8EncryptedPrivateKeyInfo) {
            // Encrypted key - we will use provided password
            try {
                final PKCS8EncryptedPrivateKeyInfo encryptedInfo = (PKCS8EncryptedPrivateKeyInfo) object;
                final InputDecryptorProvider provider = new JceOpenSSLPKCS8DecryptorProviderBuilder().build(passPhrase.toCharArray());
                final PrivateKeyInfo privateKeyInfo = encryptedInfo.decryptPrivateKeyInfo(provider);
                return converter.getPrivateKey(privateKeyInfo);
            } catch (PKCSException | OperatorCreationException e) {
                throw new IOException("Unable to decrypt private key.", e);
            }
        } else if (object instanceof PrivateKeyInfo) {
            return converter.getPrivateKey((PrivateKeyInfo) object);
        } else {
            // Unencrypted key - no password needed
            kp = converter.getKeyPair((PEMKeyPair) object);
        }
        return kp.getPrivate();
    }
}
Also used : JcaPEMKeyConverter(org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter) JcePEMDecryptorProviderBuilder(org.bouncycastle.openssl.jcajce.JcePEMDecryptorProviderBuilder) PKCS8EncryptedPrivateKeyInfo(org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo) InputDecryptorProvider(org.bouncycastle.operator.InputDecryptorProvider) JceOpenSSLPKCS8DecryptorProviderBuilder(org.bouncycastle.openssl.jcajce.JceOpenSSLPKCS8DecryptorProviderBuilder) PrivateKeyInfo(org.bouncycastle.asn1.pkcs.PrivateKeyInfo) PKCS8EncryptedPrivateKeyInfo(org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo)

Example 64 with PrivateKeyInfo

use of org.bouncycastle.asn1.pkcs.PrivateKeyInfo in project graylog2-server by Graylog2.

the class KeyUtil method privateKeyFromFile.

/**
 * Obtain a private key from a PKS8 PEM file, which is optionally password-protected.
 * @param password password to decrypt the file - it may be null or empty in case of an unencrypted file
 * @param keyFile the key file
 * @return the corresponding private key
 */
public static PrivateKey privateKeyFromFile(String password, File keyFile) throws IOException, PKCSException, OperatorCreationException {
    PrivateKey privateKey;
    JcaPEMKeyConverter converter = new JcaPEMKeyConverter().setProvider("BC");
    // Be sure to specify charset for reader - don't use plain FileReader
    Object object;
    try (InputStream inputStream = Files.newInputStream(keyFile.toPath());
        InputStreamReader fileReader = new InputStreamReader(inputStream, StandardCharsets.UTF_8);
        PEMParser pemParser = new PEMParser(fileReader)) {
        object = pemParser.readObject();
    }
    if (object instanceof PKCS8EncryptedPrivateKeyInfo) {
        PKCS8EncryptedPrivateKeyInfo pInfo = (PKCS8EncryptedPrivateKeyInfo) object;
        JceOpenSSLPKCS8DecryptorProviderBuilder providerBuilder = new JceOpenSSLPKCS8DecryptorProviderBuilder();
        InputDecryptorProvider provider = providerBuilder.build(Strings.nullToEmpty(password).toCharArray());
        PrivateKeyInfo info = pInfo.decryptPrivateKeyInfo(provider);
        privateKey = converter.getPrivateKey(info);
    } else if (object instanceof PrivateKeyInfo) {
        privateKey = converter.getPrivateKey((PrivateKeyInfo) object);
    } else if (object instanceof PEMKeyPair) {
        privateKey = converter.getPrivateKey(((PEMKeyPair) object).getPrivateKeyInfo());
    } else {
        throw new PKCSException("Encountered unexpected object type: " + object.getClass().getName());
    }
    return privateKey;
}
Also used : PemPrivateKey(io.netty.handler.ssl.PemPrivateKey) PrivateKey(java.security.PrivateKey) InputStreamReader(java.io.InputStreamReader) PEMParser(org.bouncycastle.openssl.PEMParser) InputDecryptorProvider(org.bouncycastle.operator.InputDecryptorProvider) ByteArrayInputStream(java.io.ByteArrayInputStream) InputStream(java.io.InputStream) JcaPEMKeyConverter(org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter) PemObject(org.bouncycastle.util.io.pem.PemObject) JceOpenSSLPKCS8DecryptorProviderBuilder(org.bouncycastle.openssl.jcajce.JceOpenSSLPKCS8DecryptorProviderBuilder) PEMKeyPair(org.bouncycastle.openssl.PEMKeyPair) PKCS8EncryptedPrivateKeyInfo(org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo) PKCSException(org.bouncycastle.pkcs.PKCSException) PrivateKeyInfo(org.bouncycastle.asn1.pkcs.PrivateKeyInfo) PKCS8EncryptedPrivateKeyInfo(org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo) EncryptedPrivateKeyInfo(javax.crypto.EncryptedPrivateKeyInfo)

Example 65 with PrivateKeyInfo

use of org.bouncycastle.asn1.pkcs.PrivateKeyInfo in project graylog2-server by Graylog2.

the class PemKeyStore method generateKeySpec.

/**
 * Generates a key specification for an (encrypted) private key.
 *
 * @param password characters, if {@code null} or empty an unencrypted key is assumed
 * @param key      bytes of the DER encoded private key
 * @return a key specification
 * @throws IOException                        if parsing {@code key} fails
 * @throws PKCSException                if the decryption key based on {@code password} cannot be used to decrypt
 *                                            {@code key}
 * @throws OperatorCreationException    if the decryption algorithm parameters are somehow faulty
 */
protected static PKCS8EncodedKeySpec generateKeySpec(char[] password, byte[] key) throws IOException, PKCSException, OperatorCreationException {
    if (password == null || password.length == 0) {
        return new PKCS8EncodedKeySpec(key);
    }
    final PKCS8EncryptedPrivateKeyInfo privateKeyInfo = new PKCS8EncryptedPrivateKeyInfo(key);
    final InputDecryptorProvider decProv = new JceOpenSSLPKCS8DecryptorProviderBuilder().setProvider("BC").build(password);
    PrivateKeyInfo pkInfo = privateKeyInfo.decryptPrivateKeyInfo(decProv);
    PrivateKey privKey = new JcaPEMKeyConverter().setProvider("BC").getPrivateKey(pkInfo);
    return new PKCS8EncodedKeySpec(privKey.getEncoded());
}
Also used : PrivateKey(java.security.PrivateKey) InputDecryptorProvider(org.bouncycastle.operator.InputDecryptorProvider) PKCS8EncodedKeySpec(java.security.spec.PKCS8EncodedKeySpec) JcaPEMKeyConverter(org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter) JceOpenSSLPKCS8DecryptorProviderBuilder(org.bouncycastle.openssl.jcajce.JceOpenSSLPKCS8DecryptorProviderBuilder) PKCS8EncryptedPrivateKeyInfo(org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo) PKCS8EncryptedPrivateKeyInfo(org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo) PrivateKeyInfo(org.bouncycastle.asn1.pkcs.PrivateKeyInfo)

Aggregations

PrivateKeyInfo (org.bouncycastle.asn1.pkcs.PrivateKeyInfo)48 IOException (java.io.IOException)31 JcaPEMKeyConverter (org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter)27 PEMParser (org.bouncycastle.openssl.PEMParser)25 PrivateKey (java.security.PrivateKey)22 PEMKeyPair (org.bouncycastle.openssl.PEMKeyPair)20 PKCS8EncryptedPrivateKeyInfo (org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo)18 ByteArrayInputStream (java.io.ByteArrayInputStream)14 InputDecryptorProvider (org.bouncycastle.operator.InputDecryptorProvider)13 JceOpenSSLPKCS8DecryptorProviderBuilder (org.bouncycastle.openssl.jcajce.JceOpenSSLPKCS8DecryptorProviderBuilder)11 PKCS8EncodedKeySpec (java.security.spec.PKCS8EncodedKeySpec)10 X9ECParameters (org.bouncycastle.asn1.x9.X9ECParameters)10 AlgorithmIdentifier (org.bouncycastle.asn1.x509.AlgorithmIdentifier)9 JcePEMDecryptorProviderBuilder (org.bouncycastle.openssl.jcajce.JcePEMDecryptorProviderBuilder)9 PemObject (org.bouncycastle.util.io.pem.PemObject)9 ASN1InputStream (com.android.org.bouncycastle.asn1.ASN1InputStream)8 PrivateKeyInfo (com.android.org.bouncycastle.asn1.pkcs.PrivateKeyInfo)8 StringReader (java.io.StringReader)8 GeneralSecurityException (java.security.GeneralSecurityException)8 NoSuchAlgorithmException (java.security.NoSuchAlgorithmException)8