Examples with PEMDecryptorProvider org.bouncycastle.openssl.PEMDecryptorProvider used on opensource projects

Example 1 with PEMDecryptorProvider

use of org.bouncycastle.openssl.PEMDecryptorProvider in project camel by apache.

the class ResourceHelperKeyPairProvider method loadKeys.

@Override
public Iterable<KeyPair> loadKeys() {
    if (!SecurityUtils.isBouncyCastleRegistered()) {
        throw new IllegalStateException("BouncyCastle must be registered as a JCE provider");
    }
    final List<KeyPair> keys = new ArrayList<KeyPair>(this.resources.length);
    for (String resource : resources) {
        PEMParser r = null;
        InputStreamReader isr = null;
        InputStream is = null;
        try {
            is = ResourceHelper.resolveMandatoryResourceAsInputStream(classResolver, resource);
            isr = new InputStreamReader(is);
            r = new PEMParser(isr);
            Object o = r.readObject();
            JcaPEMKeyConverter pemConverter = new JcaPEMKeyConverter();
            pemConverter.setProvider("BC");
            if (passwordFinder != null && o instanceof PEMEncryptedKeyPair) {
                JcePEMDecryptorProviderBuilder decryptorBuilder = new JcePEMDecryptorProviderBuilder();
                PEMDecryptorProvider pemDecryptor = decryptorBuilder.build(passwordFinder.getPassword());
                o = pemConverter.getKeyPair(((PEMEncryptedKeyPair) o).decryptKeyPair(pemDecryptor));
            }
            if (o instanceof PEMKeyPair) {
                o = pemConverter.getKeyPair((PEMKeyPair) o);
                keys.add((KeyPair) o);
            } else if (o instanceof KeyPair) {
                keys.add((KeyPair) o);
            }
        } catch (Exception e) {
            log.warn("Unable to read key", e);
        } finally {
            IoUtils.closeQuietly(r, is, isr);
        }
    }
    return keys;
}

Example 2 with PEMDecryptorProvider

use of org.bouncycastle.openssl.PEMDecryptorProvider in project cas by apereo.

the class WsFederationHelper method getEncryptionCredential.

private static Credential getEncryptionCredential(final WsFederationConfiguration config) {
    try {
        // This will need to contain the private keypair in PEM format
        LOGGER.debug("Locating encryption credential private key [{}]", config.getEncryptionPrivateKey());
        final BufferedReader br = new BufferedReader(new InputStreamReader(config.getEncryptionPrivateKey().getInputStream(), StandardCharsets.UTF_8));
        Security.addProvider(new BouncyCastleProvider());
        LOGGER.debug("Parsing credential private key");
        final PEMParser pemParser = new PEMParser(br);
        final Object privateKeyPemObject = pemParser.readObject();
        final JcaPEMKeyConverter converter = new JcaPEMKeyConverter().setProvider(new BouncyCastleProvider());
        final KeyPair kp;
        if (privateKeyPemObject instanceof PEMEncryptedKeyPair) {
            LOGGER.debug("Encryption private key is an encrypted keypair");
            final PEMEncryptedKeyPair ckp = (PEMEncryptedKeyPair) privateKeyPemObject;
            final PEMDecryptorProvider decProv = new JcePEMDecryptorProviderBuilder().build(config.getEncryptionPrivateKeyPassword().toCharArray());
            LOGGER.debug("Attempting to decrypt the encrypted keypair based on the provided encryption private key password");
            kp = converter.getKeyPair(ckp.decryptKeyPair(decProv));
        } else {
            LOGGER.debug("Extracting a keypair from the private key");
            kp = converter.getKeyPair((PEMKeyPair) privateKeyPemObject);
        }
        final X509CertParser certParser = new X509CertParser();
        // This is the certificate shared with ADFS in DER format, i.e certificate.crt
        LOGGER.debug("Locating encryption certificate [{}]", config.getEncryptionCertificate());
        certParser.engineInit(config.getEncryptionCertificate().getInputStream());
        LOGGER.debug("Invoking certificate engine to parse the certificate [{}]", config.getEncryptionCertificate());
        final X509CertificateObject cert = (X509CertificateObject) certParser.engineRead();
        LOGGER.debug("Creating final credential based on the certificate [{}] and the private key", cert.getIssuerDN());
        return new BasicX509Credential(cert, kp.getPrivate());
    } catch (final Exception e) {
        throw Throwables.propagate(e);
    }
}

Example 3 with PEMDecryptorProvider

use of org.bouncycastle.openssl.PEMDecryptorProvider in project gitblit by gitblit.

the class FileKeyPairProvider method doLoadKey.

protected KeyPair doLoadKey(String file) {
    try {
        PEMParser r = new PEMParser(new InputStreamReader(new FileInputStream(file)));
        try {
            Object o = r.readObject();
            JcaPEMKeyConverter pemConverter = new JcaPEMKeyConverter();
            pemConverter.setProvider("BC");
            if (passwordFinder != null && o instanceof PEMEncryptedKeyPair) {
                JcePEMDecryptorProviderBuilder decryptorBuilder = new JcePEMDecryptorProviderBuilder();
                PEMDecryptorProvider pemDecryptor = decryptorBuilder.build(passwordFinder.getPassword());
                o = pemConverter.getKeyPair(((PEMEncryptedKeyPair) o).decryptKeyPair(pemDecryptor));
            }
            if (o instanceof PEMKeyPair) {
                o = pemConverter.getKeyPair((PEMKeyPair) o);
                return (KeyPair) o;
            } else if (o instanceof KeyPair) {
                return (KeyPair) o;
            }
        } finally {
            r.close();
        }
    } catch (Exception e) {
        log.warn("Unable to read key " + file, e);
    }
    return null;
}

Example 4 with PEMDecryptorProvider

use of org.bouncycastle.openssl.PEMDecryptorProvider in project Openfire by igniterealtime.

the class CertificateManager method parsePrivateKey.

/**
     * Parses a PrivateKey instance from a PEM representation.
     *
     * When the provided key is encrypted, the provided pass phrase is applied.
     *
     * @param pemRepresentation a PEM representation of a private key (cannot be null or empty)
     * @param passPhrase optional pass phrase (must be present if the private key is encrypted).
     * @return a PrivateKey instance (never null)
     */
public static PrivateKey parsePrivateKey(InputStream pemRepresentation, String passPhrase) throws IOException {
    if (passPhrase == null) {
        passPhrase = "";
    }
    try (//
    Reader reader = new InputStreamReader(pemRepresentation);
        PEMParser pemParser = new PEMParser(reader)) {
        final Object object = pemParser.readObject();
        final JcaPEMKeyConverter converter = new JcaPEMKeyConverter().setProvider("BC");
        final KeyPair kp;
        if (object instanceof PEMEncryptedKeyPair) {
            // Encrypted key - we will use provided password
            final PEMDecryptorProvider decProv = new JcePEMDecryptorProviderBuilder().build(passPhrase.toCharArray());
            kp = converter.getKeyPair(((PEMEncryptedKeyPair) object).decryptKeyPair(decProv));
        } else if (object instanceof PKCS8EncryptedPrivateKeyInfo) {
            // Encrypted key - we will use provided password
            try {
                final PKCS8EncryptedPrivateKeyInfo encryptedInfo = (PKCS8EncryptedPrivateKeyInfo) object;
                final InputDecryptorProvider provider = new JceOpenSSLPKCS8DecryptorProviderBuilder().build(passPhrase.toCharArray());
                final PrivateKeyInfo privateKeyInfo = encryptedInfo.decryptPrivateKeyInfo(provider);
                return converter.getPrivateKey(privateKeyInfo);
            } catch (PKCSException | OperatorCreationException e) {
                throw new IOException("Unable to decrypt private key.", e);
            }
        } else if (object instanceof PrivateKeyInfo) {
            return converter.getPrivateKey((PrivateKeyInfo) object);
        } else {
            // Unencrypted key - no password needed
            kp = converter.getKeyPair((PEMKeyPair) object);
        }
        return kp.getPrivate();
    }
}