jdk-sandbox: comparison src/java.base/share/classes/com/sun/crypto/provider/PBES2Core.java

equal deleted inserted replaced

-:0265a70ea2a5
+:c9a3e3cac9c7
 package com.sun.crypto.provider;
 import java.security.*;
 import java.security.spec.*;
+import java.util.Arrays;
 import javax.crypto.*;
 import javax.crypto.spec.*;
 /**
 * This class represents password-based encryption as defined by the PKCS #5
 protected void engineInit(int opmode, Key key,
 AlgorithmParameterSpec params,
 SecureRandom random)
 throws InvalidKeyException, InvalidAlgorithmParameterException {
-if ((key == null) ||
+if (key == null) {
-(key.getEncoded() == null) ||
+throw new InvalidKeyException("Null key");
-!(key.getAlgorithm().regionMatches(true, 0, "PBE", 0, 3))) {
+}
-throw new InvalidKeyException("Missing password");
-}
+byte[] passwdBytes = key.getEncoded();
+char[] passwdChars = null;
-// TBD: consolidate the salt, ic and IV parameter checks below
+PBEKeySpec pbeSpec;
+try {
-// Extract salt and iteration count from the key, if present
+if ((passwdBytes == null) ||
-if (key instanceof javax.crypto.interfaces.PBEKey) {
+!(key.getAlgorithm().regionMatches(true, 0, "PBE", 0, 3))) {
-salt = ((javax.crypto.interfaces.PBEKey)key).getSalt();
+throw new InvalidKeyException("Missing password");
-if (salt != null && salt.length < 8) {
-throw new InvalidAlgorithmParameterException(
-"Salt must be at least 8 bytes long");
 }
-iCount = ((javax.crypto.interfaces.PBEKey)key).getIterationCount();
-if (iCount == 0) {
+// TBD: consolidate the salt, ic and IV parameter checks below
-iCount = DEFAULT_COUNT;
-} else if (iCount < 0) {
+// Extract salt and iteration count from the key, if present
-throw new InvalidAlgorithmParameterException(
+if (key instanceof javax.crypto.interfaces.PBEKey) {
-"Iteration count must be a positive number");
+salt = ((javax.crypto.interfaces.PBEKey)key).getSalt();
+if (salt != null && salt.length < 8) {
+throw new InvalidAlgorithmParameterException(
+"Salt must be at least 8 bytes long");
+}
+iCount = ((javax.crypto.interfaces.PBEKey)key).getIterationCount();
+if (iCount == 0) {
+iCount = DEFAULT_COUNT;
+} else if (iCount < 0) {
+throw new InvalidAlgorithmParameterException(
+"Iteration count must be a positive number");
+}
 }
-}
+// Extract salt, iteration count and IV from the params, if present
-// Extract salt, iteration count and IV from the params, if present
+if (params == null) {
-if (params == null) {
+if (salt == null) {
-if (salt == null) {
+// generate random salt and use default iteration count
-// generate random salt and use default iteration count
+salt = new byte[DEFAULT_SALT_LENGTH];
-salt = new byte[DEFAULT_SALT_LENGTH];
+random.nextBytes(salt);
-random.nextBytes(salt);
+iCount = DEFAULT_COUNT;
-iCount = DEFAULT_COUNT;
+}
-}
+if ((opmode == Cipher.ENCRYPT_MODE) ||
-if ((opmode == Cipher.ENCRYPT_MODE) ||
 (opmode == Cipher.WRAP_MODE)) {
 // generate random IV
 byte[] ivBytes = new byte[blkSize];
 random.nextBytes(ivBytes);
 ivSpec = new IvParameterSpec(ivBytes);
 }
 } else {
 if (!(params instanceof PBEParameterSpec)) {
 throw new InvalidAlgorithmParameterException
 ("Wrong parameter type: PBE expected");
 }
 // salt and iteration count from the params take precedence
 byte[] specSalt = ((PBEParameterSpec) params).getSalt();
 if (specSalt != null && specSalt.length < 8) {
 throw new InvalidAlgorithmParameterException(
 "Salt must be at least 8 bytes long");
 }
 salt = specSalt;
 int specICount = ((PBEParameterSpec) params).getIterationCount();
 if (specICount == 0) {
 specICount = DEFAULT_COUNT;
 } else if (specICount < 0) {
 throw new InvalidAlgorithmParameterException(
 "Iteration count must be a positive number");
 }
 iCount = specICount;
 AlgorithmParameterSpec specParams =
 ((PBEParameterSpec) params).getParameterSpec();
 if (specParams != null) {
 if (specParams instanceof IvParameterSpec) {
 ivSpec = (IvParameterSpec)specParams;
+} else {
+throw new InvalidAlgorithmParameterException(
+"Wrong parameter type: IV expected");
+}
+} else if ((opmode == Cipher.ENCRYPT_MODE) ||
+(opmode == Cipher.WRAP_MODE)) {
+// generate random IV
+byte[] ivBytes = new byte[blkSize];
+random.nextBytes(ivBytes);
+ivSpec = new IvParameterSpec(ivBytes);
 } else {
 throw new InvalidAlgorithmParameterException(
-"Wrong parameter type: IV expected");
+"Missing parameter type: IV expected");
 }
-} else if ((opmode == Cipher.ENCRYPT_MODE) ||
-(opmode == Cipher.WRAP_MODE)) {
-// generate random IV
-byte[] ivBytes = new byte[blkSize];
-random.nextBytes(ivBytes);
-ivSpec = new IvParameterSpec(ivBytes);
-} else {
-throw new InvalidAlgorithmParameterException(
-"Missing parameter type: IV expected");
 }
-}
+passwdChars = new char[passwdBytes.length];
-SecretKeySpec cipherKey = null;
+for (int i = 0; i < passwdChars.length; i++)
-byte[] derivedKey = null;
+passwdChars[i] = (char) (passwdBytes[i] & 0x7f);
-byte[] passwdBytes = key.getEncoded();
-char[] passwdChars = new char[passwdBytes.length];
+pbeSpec = new PBEKeySpec(passwdChars, salt, iCount, keyLength);
-for (int i=0; i<passwdChars.length; i++)
-passwdChars[i] = (char) (passwdBytes[i] & 0x7f);
-PBEKeySpec pbeSpec =
-new PBEKeySpec(passwdChars, salt, iCount, keyLength);
 // password char[] was cloned in PBEKeySpec constructor,
 // so we can zero it out here
-java.util.Arrays.fill(passwdChars, ' ');
+} finally {
-java.util.Arrays.fill(passwdBytes, (byte)0x00);
+if (passwdChars != null) Arrays.fill(passwdChars, '\0');
+if (passwdBytes != null) Arrays.fill(passwdBytes, (byte)0x00);
+}
 SecretKey s = null;
 try {
 s = kdf.engineGenerateSecret(pbeSpec);
 InvalidKeyException ike =
 new InvalidKeyException("Cannot construct PBE key");
 ike.initCause(ikse);
 throw ike;
 }
-derivedKey = s.getEncoded();
+byte[] derivedKey = s.getEncoded();
-cipherKey = new SecretKeySpec(derivedKey, cipherAlgo);
+SecretKeySpec cipherKey = new SecretKeySpec(derivedKey, cipherAlgo);
 // initialize the underlying cipher
 cipher.init(opmode, cipherKey, ivSpec, random);
 }

changeset 51504	c9a3e3cac9c7
parent 47216	71c04702a3d5