31 import java.security.AlgorithmParametersSpi; |
31 import java.security.AlgorithmParametersSpi; |
32 import java.security.spec.AlgorithmParameterSpec; |
32 import java.security.spec.AlgorithmParameterSpec; |
33 import java.security.spec.InvalidParameterSpecException; |
33 import java.security.spec.InvalidParameterSpecException; |
34 import javax.crypto.spec.IvParameterSpec; |
34 import javax.crypto.spec.IvParameterSpec; |
35 import javax.crypto.spec.PBEParameterSpec; |
35 import javax.crypto.spec.PBEParameterSpec; |
36 import sun.security.util.HexDumpEncoder; |
|
37 import sun.security.util.*; |
36 import sun.security.util.*; |
38 |
37 |
39 /** |
38 /** |
40 * This class implements the parameter set used with password-based |
39 * This class implements the parameter set used with password-based |
41 * encryption scheme 2 (PBES2), which is defined in PKCS#5 as follows: |
40 * encryption scheme 2 (PBES2), which is defined in PKCS#5 as follows: |
258 throws IOException |
257 throws IOException |
259 { |
258 { |
260 String kdfAlgo = null; |
259 String kdfAlgo = null; |
261 String cipherAlgo = null; |
260 String cipherAlgo = null; |
262 |
261 |
263 DerValue pBES2Algorithms = new DerValue(encoded); |
262 DerValue pBES2_params = new DerValue(encoded); |
264 if (pBES2Algorithms.tag != DerValue.tag_Sequence) { |
|
265 throw new IOException("PBE parameter parsing error: " |
|
266 + "not an ASN.1 SEQUENCE tag"); |
|
267 } |
|
268 if (!pkcs5PBES2_OID.equals(pBES2Algorithms.data.getOID())) { |
|
269 throw new IOException("PBE parameter parsing error: " |
|
270 + "expecting the object identifier for PBES2"); |
|
271 } |
|
272 if (pBES2Algorithms.tag != DerValue.tag_Sequence) { |
|
273 throw new IOException("PBE parameter parsing error: " |
|
274 + "not an ASN.1 SEQUENCE tag"); |
|
275 } |
|
276 |
|
277 DerValue pBES2_params = pBES2Algorithms.data.getDerValue(); |
|
278 if (pBES2_params.tag != DerValue.tag_Sequence) { |
263 if (pBES2_params.tag != DerValue.tag_Sequence) { |
279 throw new IOException("PBE parameter parsing error: " |
264 throw new IOException("PBE parameter parsing error: " |
280 + "not an ASN.1 SEQUENCE tag"); |
265 + "not an ASN.1 SEQUENCE tag"); |
281 } |
266 } |
282 kdfAlgo = parseKDF(pBES2_params.data.getDerValue()); |
267 kdfAlgo = parseKDF(pBES2_params.data.getDerValue()); |
291 .append(kdfAlgo).append("And").append(cipherAlgo).toString(); |
276 .append(kdfAlgo).append("And").append(cipherAlgo).toString(); |
292 } |
277 } |
293 |
278 |
294 @SuppressWarnings("deprecation") |
279 @SuppressWarnings("deprecation") |
295 private String parseKDF(DerValue keyDerivationFunc) throws IOException { |
280 private String parseKDF(DerValue keyDerivationFunc) throws IOException { |
296 String kdfAlgo = null; |
|
297 |
281 |
298 if (!pkcs5PBKDF2_OID.equals(keyDerivationFunc.data.getOID())) { |
282 if (!pkcs5PBKDF2_OID.equals(keyDerivationFunc.data.getOID())) { |
299 throw new IOException("PBE parameter parsing error: " |
283 throw new IOException("PBE parameter parsing error: " |
300 + "expecting the object identifier for PBKDF2"); |
284 + "expecting the object identifier for PBKDF2"); |
301 } |
285 } |
316 // the 'otherSource' ASN.1 CHOICE for 'salt' is not supported |
300 // the 'otherSource' ASN.1 CHOICE for 'salt' is not supported |
317 throw new IOException("PBE parameter parsing error: " |
301 throw new IOException("PBE parameter parsing error: " |
318 + "not an ASN.1 OCTET STRING tag"); |
302 + "not an ASN.1 OCTET STRING tag"); |
319 } |
303 } |
320 iCount = pBKDF2_params.data.getInteger(); |
304 iCount = pBKDF2_params.data.getInteger(); |
321 DerValue keyLength = pBKDF2_params.data.getDerValue(); |
305 // keyLength INTEGER (1..MAX) OPTIONAL, |
322 if (keyLength.tag == DerValue.tag_Integer) { |
306 if (pBKDF2_params.data.available() > 0) { |
323 keysize = keyLength.getInteger() * 8; // keysize (in bits) |
307 DerValue keyLength = pBKDF2_params.data.getDerValue(); |
324 } |
308 if (keyLength.tag == DerValue.tag_Integer) { |
325 if (pBKDF2_params.tag == DerValue.tag_Sequence) { |
309 keysize = keyLength.getInteger() * 8; // keysize (in bits) |
326 DerValue prf = pBKDF2_params.data.getDerValue(); |
|
327 kdfAlgo_OID = prf.data.getOID(); |
|
328 if (hmacWithSHA1_OID.equals(kdfAlgo_OID)) { |
|
329 kdfAlgo = "HmacSHA1"; |
|
330 } else if (hmacWithSHA224_OID.equals(kdfAlgo_OID)) { |
|
331 kdfAlgo = "HmacSHA224"; |
|
332 } else if (hmacWithSHA256_OID.equals(kdfAlgo_OID)) { |
|
333 kdfAlgo = "HmacSHA256"; |
|
334 } else if (hmacWithSHA384_OID.equals(kdfAlgo_OID)) { |
|
335 kdfAlgo = "HmacSHA384"; |
|
336 } else if (hmacWithSHA512_OID.equals(kdfAlgo_OID)) { |
|
337 kdfAlgo = "HmacSHA512"; |
|
338 } else { |
|
339 throw new IOException("PBE parameter parsing error: " |
|
340 + "expecting the object identifier for a HmacSHA key " |
|
341 + "derivation function"); |
|
342 } |
310 } |
343 if (prf.data.available() != 0) { |
311 } |
344 // parameter is 'NULL' for all HmacSHA KDFs |
312 // prf AlgorithmIdentifier {{PBKDF2-PRFs}} DEFAULT algid-hmacWithSHA1 |
345 DerValue parameter = prf.data.getDerValue(); |
313 String kdfAlgo = "HmacSHA1"; |
346 if (parameter.tag != DerValue.tag_Null) { |
314 if (pBKDF2_params.data.available() > 0) { |
|
315 if (pBKDF2_params.tag == DerValue.tag_Sequence) { |
|
316 DerValue prf = pBKDF2_params.data.getDerValue(); |
|
317 kdfAlgo_OID = prf.data.getOID(); |
|
318 if (hmacWithSHA1_OID.equals(kdfAlgo_OID)) { |
|
319 kdfAlgo = "HmacSHA1"; |
|
320 } else if (hmacWithSHA224_OID.equals(kdfAlgo_OID)) { |
|
321 kdfAlgo = "HmacSHA224"; |
|
322 } else if (hmacWithSHA256_OID.equals(kdfAlgo_OID)) { |
|
323 kdfAlgo = "HmacSHA256"; |
|
324 } else if (hmacWithSHA384_OID.equals(kdfAlgo_OID)) { |
|
325 kdfAlgo = "HmacSHA384"; |
|
326 } else if (hmacWithSHA512_OID.equals(kdfAlgo_OID)) { |
|
327 kdfAlgo = "HmacSHA512"; |
|
328 } else { |
347 throw new IOException("PBE parameter parsing error: " |
329 throw new IOException("PBE parameter parsing error: " |
348 + "not an ASN.1 NULL tag"); |
330 + "expecting the object identifier for a HmacSHA key " |
|
331 + "derivation function"); |
|
332 } |
|
333 if (prf.data.available() != 0) { |
|
334 // parameter is 'NULL' for all HmacSHA KDFs |
|
335 DerValue parameter = prf.data.getDerValue(); |
|
336 if (parameter.tag != DerValue.tag_Null) { |
|
337 throw new IOException("PBE parameter parsing error: " |
|
338 + "not an ASN.1 NULL tag"); |
|
339 } |
349 } |
340 } |
350 } |
341 } |
351 } |
342 } |
352 |
343 |
353 return kdfAlgo; |
344 return kdfAlgo; |
397 } |
388 } |
398 } |
389 } |
399 |
390 |
400 protected byte[] engineGetEncoded() throws IOException { |
391 protected byte[] engineGetEncoded() throws IOException { |
401 DerOutputStream out = new DerOutputStream(); |
392 DerOutputStream out = new DerOutputStream(); |
402 DerOutputStream pBES2Algorithms = new DerOutputStream(); |
|
403 pBES2Algorithms.putOID(pkcs5PBES2_OID); |
|
404 |
393 |
405 DerOutputStream pBES2_params = new DerOutputStream(); |
394 DerOutputStream pBES2_params = new DerOutputStream(); |
406 |
395 |
407 DerOutputStream keyDerivationFunc = new DerOutputStream(); |
396 DerOutputStream keyDerivationFunc = new DerOutputStream(); |
408 keyDerivationFunc.putOID(pkcs5PBKDF2_OID); |
397 keyDerivationFunc.putOID(pkcs5PBKDF2_OID); |
409 |
398 |
410 DerOutputStream pBKDF2_params = new DerOutputStream(); |
399 DerOutputStream pBKDF2_params = new DerOutputStream(); |
411 pBKDF2_params.putOctetString(salt); // choice: 'specified OCTET STRING' |
400 pBKDF2_params.putOctetString(salt); // choice: 'specified OCTET STRING' |
412 pBKDF2_params.putInteger(iCount); |
401 pBKDF2_params.putInteger(iCount); |
413 pBKDF2_params.putInteger(keysize / 8); // derived key length (in octets) |
402 |
|
403 if (keysize > 0) { |
|
404 pBKDF2_params.putInteger(keysize / 8); // derived key length (in octets) |
|
405 } |
414 |
406 |
415 DerOutputStream prf = new DerOutputStream(); |
407 DerOutputStream prf = new DerOutputStream(); |
416 // algorithm is id-hmacWithSHA1/SHA224/SHA256/SHA384/SHA512 |
408 // algorithm is id-hmacWithSHA1/SHA224/SHA256/SHA384/SHA512 |
417 prf.putOID(kdfAlgo_OID); |
409 prf.putOID(kdfAlgo_OID); |
418 // parameters is 'NULL' |
410 // parameters is 'NULL' |
432 } else { |
424 } else { |
433 throw new IOException("Wrong parameter type: IV expected"); |
425 throw new IOException("Wrong parameter type: IV expected"); |
434 } |
426 } |
435 pBES2_params.write(DerValue.tag_Sequence, encryptionScheme); |
427 pBES2_params.write(DerValue.tag_Sequence, encryptionScheme); |
436 |
428 |
437 pBES2Algorithms.write(DerValue.tag_Sequence, pBES2_params); |
429 out.write(DerValue.tag_Sequence, pBES2_params); |
438 out.write(DerValue.tag_Sequence, pBES2Algorithms); |
|
439 |
430 |
440 return out.toByteArray(); |
431 return out.toByteArray(); |
441 } |
432 } |
442 |
433 |
443 protected byte[] engineGetEncoded(String encodingMethod) |
434 protected byte[] engineGetEncoded(String encodingMethod) |