Examples with ObjectIdentifier sun.security.util.ObjectIdentifier used on opensource projects

Example 26 with ObjectIdentifier

use of sun.security.util.ObjectIdentifier in project Bytecoder by mirkosertic.

the class PKCS12KeyStore method getAttributes.

/*
     * Assemble the entry attributes
     */
private Set<KeyStore.Entry.Attribute> getAttributes(Entry entry) {
    if (entry.attributes == null) {
        entry.attributes = new HashSet<>();
    }
    // friendlyName
    entry.attributes.add(new PKCS12Attribute(PKCS9FriendlyName_OID.toString(), entry.alias));
    // localKeyID
    byte[] keyIdValue = entry.keyId;
    if (keyIdValue != null) {
        entry.attributes.add(new PKCS12Attribute(PKCS9LocalKeyId_OID.toString(), Debug.toString(keyIdValue)));
    }
    // trustedKeyUsage
    if (entry instanceof CertEntry) {
        ObjectIdentifier[] trustedKeyUsageValue = ((CertEntry) entry).trustedKeyUsage;
        if (trustedKeyUsageValue != null) {
            if (trustedKeyUsageValue.length == 1) {
                // omit brackets
                entry.attributes.add(new PKCS12Attribute(TrustedKeyUsage_OID.toString(), trustedKeyUsageValue[0].toString()));
            } else {
                // multi-valued
                entry.attributes.add(new PKCS12Attribute(TrustedKeyUsage_OID.toString(), Arrays.toString(trustedKeyUsageValue)));
            }
        }
    }
    return entry.attributes;
}

Example 27 with ObjectIdentifier

use of sun.security.util.ObjectIdentifier in project Bytecoder by mirkosertic.

the class PKCS12KeyStore method engineLoad.

/**
 * Loads the keystore from the given input stream.
 *
 * <p>If a password is given, it is used to check the integrity of the
 * keystore data. Otherwise, the integrity of the keystore is not checked.
 *
 * @param stream the input stream from which the keystore is loaded
 * @param password the (optional) password used to check the integrity of
 * the keystore.
 *
 * @exception IOException if there is an I/O or format problem with the
 * keystore data
 * @exception NoSuchAlgorithmException if the algorithm used to check
 * the integrity of the keystore cannot be found
 * @exception CertificateException if any of the certificates in the
 * keystore could not be loaded
 */
public synchronized void engineLoad(InputStream stream, char[] password) throws IOException, NoSuchAlgorithmException, CertificateException {
    DataInputStream dis;
    CertificateFactory cf = null;
    ByteArrayInputStream bais = null;
    byte[] encoded = null;
    if (stream == null)
        return;
    // reset the counter
    counter = 0;
    DerValue val = new DerValue(stream);
    DerInputStream s = val.toDerInputStream();
    int version = s.getInteger();
    if (version != VERSION_3) {
        throw new IOException("PKCS12 keystore not in version 3 format");
    }
    entries.clear();
    /*
         * Read the authSafe.
         */
    byte[] authSafeData;
    ContentInfo authSafe = new ContentInfo(s);
    ObjectIdentifier contentType = authSafe.getContentType();
    if (contentType.equals(ContentInfo.DATA_OID)) {
        authSafeData = authSafe.getData();
    } else /* signed data */
    {
        throw new IOException("public key protected PKCS12 not supported");
    }
    DerInputStream as = new DerInputStream(authSafeData);
    DerValue[] safeContentsArray = as.getSequence(2);
    int count = safeContentsArray.length;
    // reset the counters at the start
    privateKeyCount = 0;
    secretKeyCount = 0;
    certificateCount = 0;
    /*
         * Spin over the ContentInfos.
         */
    for (int i = 0; i < count; i++) {
        byte[] safeContentsData;
        ContentInfo safeContents;
        DerInputStream sci;
        byte[] eAlgId = null;
        sci = new DerInputStream(safeContentsArray[i].toByteArray());
        safeContents = new ContentInfo(sci);
        contentType = safeContents.getContentType();
        safeContentsData = null;
        if (contentType.equals(ContentInfo.DATA_OID)) {
            if (debug != null) {
                debug.println("Loading PKCS#7 data content-type");
            }
            safeContentsData = safeContents.getData();
        } else if (contentType.equals(ContentInfo.ENCRYPTED_DATA_OID)) {
            if (password == null) {
                if (debug != null) {
                    debug.println("Warning: skipping PKCS#7 encryptedData" + " content-type - no password was supplied");
                }
                continue;
            }
            if (debug != null) {
                debug.println("Loading PKCS#7 encryptedData content-type");
            }
            DerInputStream edi = safeContents.getContent().toDerInputStream();
            int edVersion = edi.getInteger();
            DerValue[] seq = edi.getSequence(2);
            ObjectIdentifier edContentType = seq[0].getOID();
            eAlgId = seq[1].toByteArray();
            if (!seq[2].isContextSpecific((byte) 0)) {
                throw new IOException("encrypted content not present!");
            }
            byte newTag = DerValue.tag_OctetString;
            if (seq[2].isConstructed())
                newTag |= 0x20;
            seq[2].resetTag(newTag);
            safeContentsData = seq[2].getOctetString();
            // parse Algorithm parameters
            DerInputStream in = seq[1].toDerInputStream();
            ObjectIdentifier algOid = in.getOID();
            AlgorithmParameters algParams = parseAlgParameters(algOid, in);
            while (true) {
                try {
                    // Use JCE
                    SecretKey skey = getPBEKey(password);
                    Cipher cipher = Cipher.getInstance(algOid.toString());
                    cipher.init(Cipher.DECRYPT_MODE, skey, algParams);
                    safeContentsData = cipher.doFinal(safeContentsData);
                    break;
                } catch (Exception e) {
                    if (password.length == 0) {
                        // Retry using an empty password
                        // without a NULL terminator.
                        password = new char[1];
                        continue;
                    }
                    throw new IOException("keystore password was incorrect", new UnrecoverableKeyException("failed to decrypt safe contents entry: " + e));
                }
            }
        } else {
            throw new IOException("public key protected PKCS12" + " not supported");
        }
        DerInputStream sc = new DerInputStream(safeContentsData);
        loadSafeContents(sc, password);
    }
    // The MacData is optional.
    if (password != null && s.available() > 0) {
        MacData macData = new MacData(s);
        try {
            String algName = macData.getDigestAlgName().toUpperCase(Locale.ENGLISH);
            // Change SHA-1 to SHA1
            algName = algName.replace("-", "");
            // generate MAC (MAC key is created within JCE)
            Mac m = Mac.getInstance("HmacPBE" + algName);
            PBEParameterSpec params = new PBEParameterSpec(macData.getSalt(), macData.getIterations());
            SecretKey key = getPBEKey(password);
            m.init(key, params);
            m.update(authSafeData);
            byte[] macResult = m.doFinal();
            if (debug != null) {
                debug.println("Checking keystore integrity " + "(MAC algorithm: " + m.getAlgorithm() + ")");
            }
            if (!MessageDigest.isEqual(macData.getDigest(), macResult)) {
                throw new UnrecoverableKeyException("Failed PKCS12" + " integrity checking");
            }
        } catch (Exception e) {
            throw new IOException("Integrity check failed: " + e, e);
        }
    }
    /*
         * Match up private keys with certificate chains.
         */
    PrivateKeyEntry[] list = keyList.toArray(new PrivateKeyEntry[keyList.size()]);
    for (int m = 0; m < list.length; m++) {
        PrivateKeyEntry entry = list[m];
        if (entry.keyId != null) {
            ArrayList<X509Certificate> chain = new ArrayList<X509Certificate>();
            X509Certificate cert = findMatchedCertificate(entry);
            mainloop: while (cert != null) {
                // Check for loops in the certificate chain
                if (!chain.isEmpty()) {
                    for (X509Certificate chainCert : chain) {
                        if (cert.equals(chainCert)) {
                            if (debug != null) {
                                debug.println("Loop detected in " + "certificate chain. Skip adding " + "repeated cert to chain. Subject: " + cert.getSubjectX500Principal().toString());
                            }
                            break mainloop;
                        }
                    }
                }
                chain.add(cert);
                X500Principal issuerDN = cert.getIssuerX500Principal();
                if (issuerDN.equals(cert.getSubjectX500Principal())) {
                    break;
                }
                cert = certsMap.get(issuerDN);
            }
            /* Update existing KeyEntry in entries table */
            if (chain.size() > 0)
                entry.chain = chain.toArray(new Certificate[chain.size()]);
        }
    }
    if (debug != null) {
        if (privateKeyCount > 0) {
            debug.println("Loaded " + privateKeyCount + " protected private key(s)");
        }
        if (secretKeyCount > 0) {
            debug.println("Loaded " + secretKeyCount + " protected secret key(s)");
        }
        if (certificateCount > 0) {
            debug.println("Loaded " + certificateCount + " certificate(s)");
        }
    }
    certEntries.clear();
    certsMap.clear();
    keyList.clear();
}

Example 28 with ObjectIdentifier

use of sun.security.util.ObjectIdentifier in project Bytecoder by mirkosertic.

the class KeyProtector method protect.

/*
     * Protects the given plaintext key, using the password provided at
     * construction time.
     */
public byte[] protect(Key key) throws KeyStoreException {
    int i;
    int numRounds;
    byte[] digest;
    // offset in xorKey where next digest will be stored
    int xorOffset;
    int encrKeyOffset = 0;
    if (key == null) {
        throw new IllegalArgumentException("plaintext key can't be null");
    }
    if (!"PKCS#8".equalsIgnoreCase(key.getFormat())) {
        throw new KeyStoreException("Cannot get key bytes, not PKCS#8 encoded");
    }
    byte[] plainKey = key.getEncoded();
    if (plainKey == null) {
        throw new KeyStoreException("Cannot get key bytes, encoding not supported");
    }
    // Determine the number of digest rounds
    numRounds = plainKey.length / DIGEST_LEN;
    if ((plainKey.length % DIGEST_LEN) != 0)
        numRounds++;
    // Create a random salt
    byte[] salt = new byte[SALT_LEN];
    SecureRandom random = new SecureRandom();
    random.nextBytes(salt);
    // Set up the byte array which will be XORed with "plainKey"
    byte[] xorKey = new byte[plainKey.length];
    // Compute the digests, and store them in "xorKey"
    for (i = 0, xorOffset = 0, digest = salt; i < numRounds; i++, xorOffset += DIGEST_LEN) {
        md.update(passwdBytes);
        md.update(digest);
        digest = md.digest();
        md.reset();
        // Copy the digest into "xorKey"
        if (i < numRounds - 1) {
            System.arraycopy(digest, 0, xorKey, xorOffset, digest.length);
        } else {
            System.arraycopy(digest, 0, xorKey, xorOffset, xorKey.length - xorOffset);
        }
    }
    // XOR "plainKey" with "xorKey", and store the result in "tmpKey"
    byte[] tmpKey = new byte[plainKey.length];
    for (i = 0; i < tmpKey.length; i++) {
        tmpKey[i] = (byte) (plainKey[i] ^ xorKey[i]);
    }
    // Store salt and "tmpKey" in "encrKey"
    byte[] encrKey = new byte[salt.length + tmpKey.length + DIGEST_LEN];
    System.arraycopy(salt, 0, encrKey, encrKeyOffset, salt.length);
    encrKeyOffset += salt.length;
    System.arraycopy(tmpKey, 0, encrKey, encrKeyOffset, tmpKey.length);
    encrKeyOffset += tmpKey.length;
    // Append digest(password, plainKey) as an integrity check to "encrKey"
    md.update(passwdBytes);
    Arrays.fill(passwdBytes, (byte) 0x00);
    passwdBytes = null;
    md.update(plainKey);
    digest = md.digest();
    md.reset();
    System.arraycopy(digest, 0, encrKey, encrKeyOffset, digest.length);
    // wrap the protected private key in a PKCS#8-style
    // EncryptedPrivateKeyInfo, and returns its encoding
    AlgorithmId encrAlg;
    try {
        encrAlg = new AlgorithmId(new ObjectIdentifier(KEY_PROTECTOR_OID));
        return new EncryptedPrivateKeyInfo(encrAlg, encrKey).getEncoded();
    } catch (IOException ioe) {
        throw new KeyStoreException(ioe.getMessage());
    }
}

Example 29 with ObjectIdentifier

use of sun.security.util.ObjectIdentifier in project Bytecoder by mirkosertic.

the class PKCS9Attribute method derEncode.

/**
 * Write the DER encoding of this attribute to an output stream.
 *
 * <P> N.B.: This method always encodes values of
 * ChallengePassword and UnstructuredAddress attributes as ASN.1
 * <code>PrintableString</code>s, without checking whether they
 * should be encoded as <code>T61String</code>s.
 */
public void derEncode(OutputStream out) throws IOException {
    DerOutputStream temp = new DerOutputStream();
    temp.putOID(oid);
    switch(index) {
        case // Unknown
        -1:
            temp.write((byte[]) value);
            break;
        // email address
        case 1:
        case // unstructured name
        2:
            {
                // open scope
                String[] values = (String[]) value;
                DerOutputStream[] temps = new DerOutputStream[values.length];
                for (int i = 0; i < values.length; i++) {
                    temps[i] = new DerOutputStream();
                    temps[i].putIA5String(values[i]);
                }
                temp.putOrderedSetOf(DerValue.tag_Set, temps);
            }
            // close scope
            break;
        case // content type
        3:
            {
                DerOutputStream temp2 = new DerOutputStream();
                temp2.putOID((ObjectIdentifier) value);
                temp.write(DerValue.tag_Set, temp2.toByteArray());
            }
            break;
        case // message digest
        4:
            {
                DerOutputStream temp2 = new DerOutputStream();
                temp2.putOctetString((byte[]) value);
                temp.write(DerValue.tag_Set, temp2.toByteArray());
            }
            break;
        case // signing time
        5:
            {
                DerOutputStream temp2 = new DerOutputStream();
                temp2.putUTCTime((Date) value);
                temp.write(DerValue.tag_Set, temp2.toByteArray());
            }
            break;
        case // countersignature
        6:
            temp.putOrderedSetOf(DerValue.tag_Set, (DerEncoder[]) value);
            break;
        case // challenge password
        7:
            {
                DerOutputStream temp2 = new DerOutputStream();
                temp2.putPrintableString((String) value);
                temp.write(DerValue.tag_Set, temp2.toByteArray());
            }
            break;
        case // unstructured address
        8:
            {
                // open scope
                String[] values = (String[]) value;
                DerOutputStream[] temps = new DerOutputStream[values.length];
                for (int i = 0; i < values.length; i++) {
                    temps[i] = new DerOutputStream();
                    temps[i].putPrintableString(values[i]);
                }
                temp.putOrderedSetOf(DerValue.tag_Set, temps);
            }
            // close scope
            break;
        case // extended-certificate attribute -- not supported
        9:
            throw new IOException("PKCS9 extended-certificate " + "attribute not supported.");
        // break unnecessary
        case // issuerAndserialNumber attribute -- not supported
        10:
            throw new IOException("PKCS9 IssuerAndSerialNumber" + "attribute not supported.");
        // RSA DSI proprietary
        case 11:
        case // RSA DSI proprietary
        12:
            throw new IOException("PKCS9 RSA DSI attributes" + "11 and 12, not supported.");
        // break unnecessary
        case // S/MIME unused attribute
        13:
            throw new IOException("PKCS9 attribute #13 not supported.");
        case // ExtensionRequest
        14:
            {
                DerOutputStream temp2 = new DerOutputStream();
                CertificateExtensions exts = (CertificateExtensions) value;
                try {
                    exts.encode(temp2, true);
                } catch (CertificateException ex) {
                    throw new IOException(ex.toString());
                }
                temp.write(DerValue.tag_Set, temp2.toByteArray());
            }
            break;
        case // SMIMECapability
        15:
            throw new IOException("PKCS9 attribute #15 not supported.");
        case // SigningCertificate
        16:
            throw new IOException("PKCS9 SigningCertificate attribute not supported.");
        case // SignatureTimestampToken
        17:
            temp.write(DerValue.tag_Set, (byte[]) value);
            break;
        // can't happen
        default:
    }
    DerOutputStream derOut = new DerOutputStream();
    derOut.write(DerValue.tag_Sequence, temp.toByteArray());
    out.write(derOut.toByteArray());
}

Example 30 with ObjectIdentifier

use of sun.security.util.ObjectIdentifier in project Bytecoder by mirkosertic.

the class ExtendedKeyUsageExtension method toString.

/**
 * Return the extension as user readable string.
 */
public String toString() {
    if (keyUsages == null)
        return "";
    String usage = "  ";
    boolean first = true;
    for (ObjectIdentifier oid : keyUsages) {
        if (!first) {
            usage += "\n  ";
        }
        String result = map.get(oid);
        if (result != null) {
            usage += result;
        } else {
            usage += oid.toString();
        }
        first = false;
    }
    return super.toString() + "ExtendedKeyUsages [\n" + usage + "\n]\n";
}