author | xuelei |
Tue, 12 Feb 2019 13:36:15 -0800 | |
changeset 53734 | cb1642ccc732 |
parent 50768 | 68fa3d4026ea |
permissions | -rw-r--r-- |
2 | 1 |
/* |
53734
cb1642ccc732
8217835: Remove the experimental SunJSSE FIPS compliant mode
xuelei
parents:
50768
diff
changeset
|
2 |
* Copyright (c) 1996, 2019, Oracle and/or its affiliates. All rights reserved. |
2 | 3 |
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
4 |
* |
|
5 |
* This code is free software; you can redistribute it and/or modify it |
|
6 |
* under the terms of the GNU General Public License version 2 only, as |
|
5506 | 7 |
* published by the Free Software Foundation. Oracle designates this |
2 | 8 |
* particular file as subject to the "Classpath" exception as provided |
5506 | 9 |
* by Oracle in the LICENSE file that accompanied this code. |
2 | 10 |
* |
11 |
* This code is distributed in the hope that it will be useful, but WITHOUT |
|
12 |
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
|
13 |
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
|
14 |
* version 2 for more details (a copy is included in the LICENSE file that |
|
15 |
* accompanied this code). |
|
16 |
* |
|
17 |
* You should have received a copy of the GNU General Public License version |
|
18 |
* 2 along with this work; if not, write to the Free Software Foundation, |
|
19 |
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
|
20 |
* |
|
5506 | 21 |
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
22 |
* or visit www.oracle.com if you need additional information or have any |
|
23 |
* questions. |
|
2 | 24 |
*/ |
25 |
||
26 |
package sun.security.ssl; |
|
27 |
||
28 |
import java.security.*; |
|
50204
3195a713e24d
8146293: Add support for RSASSA-PSS Signature algorithm
valeriep
parents:
47216
diff
changeset
|
29 |
import java.security.spec.AlgorithmParameterSpec; |
2 | 30 |
|
31 |
/** |
|
32 |
* Signature implementation for the SSL/TLS RSA Signature variant with both |
|
33 |
* MD5 and SHA-1 MessageDigests. Used for explicit RSA server authentication |
|
34 |
* (RSA signed server key exchange for RSA_EXPORT and DHE_RSA) and RSA client |
|
35 |
* authentication (RSA signed certificate verify message). |
|
36 |
* |
|
37 |
* It conforms to the standard JCA Signature API. It is registered in the |
|
38 |
* SunJSSE provider to avoid more complicated getInstance() code and |
|
39 |
* negative interaction with the JCA mechanisms for hardware providers. |
|
40 |
* |
|
41 |
* The class should be instantiated via the getInstance() method in this class, |
|
21278 | 42 |
* which returns the implementation from the preferred provider. The internal |
2 | 43 |
* implementation allows the hashes to be explicitly set, which is required |
44 |
* for RSA client authentication. It can be obtained via the |
|
45 |
* getInternalInstance() method. |
|
46 |
* |
|
47 |
* This class is not thread safe. |
|
48 |
*/ |
|
49 |
public final class RSASignature extends SignatureSpi { |
|
50 |
private final Signature rawRsa; |
|
50768 | 51 |
private final MessageDigest mdMD5; |
52 |
private final MessageDigest mdSHA; |
|
2 | 53 |
|
54 |
public RSASignature() throws NoSuchAlgorithmException { |
|
55 |
super(); |
|
53734
cb1642ccc732
8217835: Remove the experimental SunJSSE FIPS compliant mode
xuelei
parents:
50768
diff
changeset
|
56 |
rawRsa = Signature.getInstance(JsseJce.SIGNATURE_RAWRSA); |
cb1642ccc732
8217835: Remove the experimental SunJSSE FIPS compliant mode
xuelei
parents:
50768
diff
changeset
|
57 |
this.mdMD5 = MessageDigest.getInstance("MD5"); |
cb1642ccc732
8217835: Remove the experimental SunJSSE FIPS compliant mode
xuelei
parents:
50768
diff
changeset
|
58 |
this.mdSHA = MessageDigest.getInstance("SHA"); |
2 | 59 |
} |
60 |
||
61 |
/** |
|
50768 | 62 |
* Get an implementation for the RSA signature. |
63 |
* |
|
64 |
* Follows the standard JCA getInstance() model, so it return the |
|
65 |
* implementation from the provider with the highest precedence, |
|
66 |
* which may be this class. |
|
2 | 67 |
*/ |
68 |
static Signature getInstance() throws NoSuchAlgorithmException { |
|
53734
cb1642ccc732
8217835: Remove the experimental SunJSSE FIPS compliant mode
xuelei
parents:
50768
diff
changeset
|
69 |
return Signature.getInstance(JsseJce.SIGNATURE_SSLRSA); |
2 | 70 |
} |
71 |
||
14664
e71aa0962e70
8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents:
5506
diff
changeset
|
72 |
@Override |
2 | 73 |
protected void engineInitVerify(PublicKey publicKey) |
74 |
throws InvalidKeyException { |
|
50768 | 75 |
if (publicKey == null) { |
76 |
throw new InvalidKeyException("Public key must not be null"); |
|
77 |
} |
|
78 |
mdMD5.reset(); |
|
79 |
mdSHA.reset(); |
|
2 | 80 |
rawRsa.initVerify(publicKey); |
81 |
} |
|
82 |
||
14664
e71aa0962e70
8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents:
5506
diff
changeset
|
83 |
@Override |
2 | 84 |
protected void engineInitSign(PrivateKey privateKey) |
85 |
throws InvalidKeyException { |
|
86 |
engineInitSign(privateKey, null); |
|
87 |
} |
|
88 |
||
14664
e71aa0962e70
8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents:
5506
diff
changeset
|
89 |
@Override |
2 | 90 |
protected void engineInitSign(PrivateKey privateKey, SecureRandom random) |
91 |
throws InvalidKeyException { |
|
50768 | 92 |
if (privateKey == null) { |
93 |
throw new InvalidKeyException("Private key must not be null"); |
|
94 |
} |
|
95 |
mdMD5.reset(); |
|
96 |
mdSHA.reset(); |
|
2 | 97 |
rawRsa.initSign(privateKey, random); |
98 |
} |
|
99 |
||
14664
e71aa0962e70
8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents:
5506
diff
changeset
|
100 |
@Override |
2 | 101 |
protected void engineUpdate(byte b) { |
50768 | 102 |
mdMD5.update(b); |
103 |
mdSHA.update(b); |
|
2 | 104 |
} |
105 |
||
14664
e71aa0962e70
8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents:
5506
diff
changeset
|
106 |
@Override |
2 | 107 |
protected void engineUpdate(byte[] b, int off, int len) { |
50768 | 108 |
mdMD5.update(b, off, len); |
109 |
mdSHA.update(b, off, len); |
|
2 | 110 |
} |
111 |
||
112 |
private byte[] getDigest() throws SignatureException { |
|
113 |
try { |
|
114 |
byte[] data = new byte[36]; |
|
50768 | 115 |
mdMD5.digest(data, 0, 16); |
116 |
mdSHA.digest(data, 16, 20); |
|
2 | 117 |
return data; |
118 |
} catch (DigestException e) { |
|
119 |
// should never occur |
|
120 |
throw new SignatureException(e); |
|
121 |
} |
|
122 |
} |
|
123 |
||
14664
e71aa0962e70
8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents:
5506
diff
changeset
|
124 |
@Override |
2 | 125 |
protected byte[] engineSign() throws SignatureException { |
126 |
rawRsa.update(getDigest()); |
|
127 |
return rawRsa.sign(); |
|
128 |
} |
|
129 |
||
14664
e71aa0962e70
8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents:
5506
diff
changeset
|
130 |
@Override |
2 | 131 |
protected boolean engineVerify(byte[] sigBytes) throws SignatureException { |
132 |
return engineVerify(sigBytes, 0, sigBytes.length); |
|
133 |
} |
|
134 |
||
14664
e71aa0962e70
8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents:
5506
diff
changeset
|
135 |
@Override |
2 | 136 |
protected boolean engineVerify(byte[] sigBytes, int offset, int length) |
137 |
throws SignatureException { |
|
138 |
rawRsa.update(getDigest()); |
|
139 |
return rawRsa.verify(sigBytes, offset, length); |
|
140 |
} |
|
141 |
||
14664
e71aa0962e70
8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents:
5506
diff
changeset
|
142 |
@Override |
27804
4659e70271c4
8066617: Suppress deprecation warnings in java.base module
darcy
parents:
25859
diff
changeset
|
143 |
@SuppressWarnings("deprecation") |
50768 | 144 |
protected void engineSetParameter(String param, |
145 |
Object value) throws InvalidParameterException { |
|
146 |
throw new InvalidParameterException("Parameters not supported"); |
|
2 | 147 |
} |
148 |
||
14664
e71aa0962e70
8003950: Adds missing Override annotations and removes unnecessary imports in sun.security.ssl
xuelei
parents:
5506
diff
changeset
|
149 |
@Override |
50204
3195a713e24d
8146293: Add support for RSASSA-PSS Signature algorithm
valeriep
parents:
47216
diff
changeset
|
150 |
protected void engineSetParameter(AlgorithmParameterSpec params) |
3195a713e24d
8146293: Add support for RSASSA-PSS Signature algorithm
valeriep
parents:
47216
diff
changeset
|
151 |
throws InvalidAlgorithmParameterException { |
3195a713e24d
8146293: Add support for RSASSA-PSS Signature algorithm
valeriep
parents:
47216
diff
changeset
|
152 |
if (params != null) { |
3195a713e24d
8146293: Add support for RSASSA-PSS Signature algorithm
valeriep
parents:
47216
diff
changeset
|
153 |
throw new InvalidAlgorithmParameterException("No parameters accepted"); |
3195a713e24d
8146293: Add support for RSASSA-PSS Signature algorithm
valeriep
parents:
47216
diff
changeset
|
154 |
} |
3195a713e24d
8146293: Add support for RSASSA-PSS Signature algorithm
valeriep
parents:
47216
diff
changeset
|
155 |
} |
3195a713e24d
8146293: Add support for RSASSA-PSS Signature algorithm
valeriep
parents:
47216
diff
changeset
|
156 |
|
3195a713e24d
8146293: Add support for RSASSA-PSS Signature algorithm
valeriep
parents:
47216
diff
changeset
|
157 |
@Override |
27804
4659e70271c4
8066617: Suppress deprecation warnings in java.base module
darcy
parents:
25859
diff
changeset
|
158 |
@SuppressWarnings("deprecation") |
50768 | 159 |
protected Object engineGetParameter( |
160 |
String param) throws InvalidParameterException { |
|
2 | 161 |
throw new InvalidParameterException("Parameters not supported"); |
162 |
} |
|
163 |
||
50204
3195a713e24d
8146293: Add support for RSASSA-PSS Signature algorithm
valeriep
parents:
47216
diff
changeset
|
164 |
@Override |
3195a713e24d
8146293: Add support for RSASSA-PSS Signature algorithm
valeriep
parents:
47216
diff
changeset
|
165 |
protected AlgorithmParameters engineGetParameters() { |
3195a713e24d
8146293: Add support for RSASSA-PSS Signature algorithm
valeriep
parents:
47216
diff
changeset
|
166 |
return null; |
3195a713e24d
8146293: Add support for RSASSA-PSS Signature algorithm
valeriep
parents:
47216
diff
changeset
|
167 |
} |
2 | 168 |
} |