Note that it also contains methods for compressing and uncompressing
data: while these are not strictly cryptographic operations, there
are a lot of similarities and it is conceivable at some point that
accelerated compression may be available just as it is for
cryptographic operations.
@see "src/admin/defn/org/opends/server/admin/std\
/CryptoManagerConfiguration.xml"
@see org.opends.server.crypto.CryptoManagerSync
@see org.opends.server.crypto.GetSymmetricKeyExtendedOperation
*/
@org.opends.server.types.PublicAPI(
stability=org.opends.server.types.StabilityLevel.VOLATILE,
mayInstantiate=false,
mayExtend=false,
mayInvoke=true)
public class CryptoManager
implements ConfigurationChangeListener
* There is no need to lock the entry to make this change: The
* only valid transition for this field is from false to true,
* the change is asynchronous across the topology (i.e., a key
* might continue to be used at this instance for at least the
* replication propagation delay after being marked compromised at
* another instance), and modifying a boolean is guaranteed to be
* atomic.
*/
public void setIsCompromised() {
fIsCompromised = true;
}
/**
* Returns the length of the secret key in bits.
* @return the length of the secret key in bits.
*/
public int getKeyLengthBits() {
return fKeyLengthBits;
}
/**
* Returns the status of the key.
* @return {@code false} if the key may be used for operations on
* new data, or {@code true} if the key is being retained only for
* use in validation.
*/
public boolean isCompromised() {
return fIsCompromised;
}
// state
private final KeyEntryID fKeyID;
private final SecretKey fSecretKey;
private final int fKeyLengthBits;
private boolean fIsCompromised = false;
}
/**
* This class corresponds to the cipher key entry in ADS. It is
* used in the local cache of key entries that have been requested
* by CryptoManager clients.
*/
private static class CipherKeyEntry extends SecretKeyEntry
{
/**
* This method generates a key according to the key parameters,
* and creates a key entry and registers it in the supplied map.
*
* @param cryptoManager The CryptoManager instance for which the
* key is to be generated. Pass {@code null} as the argument to
* this parameter in order to validate a proposed cipher
* transformation and key length without publishing the key.
*
* @param transformation The cipher transformation for which the
* key is to be produced.
*
* @param keyLengthBits The cipher key length in bits.
*
* @return The key entry corresponding to the parameters.
*
* @throws CryptoManagerException If there is a problem
* instantiating a Cipher object in order to validate the supplied
* parameters when creating a new entry.
*
* @see CipherKeyEntry#getKeyEntry(CryptoManager, String, int)
*/
public static CipherKeyEntry generateKeyEntry(
final CryptoManager cryptoManager,
final String transformation,
final int keyLengthBits)
throws CryptoManagerException {
final Map
* ADS is not searched in the case a key entry meeting the
* specifications is not found. Instead, the ADS monitoring thread
* is responsible for asynchronous updates to the key map.
*
* @param cryptoManager The CryptoManager instance with which the
* key entry is associated.
*
* @param transformation The cipher transformation for which the
* key was produced.
*
* @param keyLengthBits The cipher key length in bits.
*
* @return The key entry corresponding to the parameters, or
* {@code null} if no such entry exists.
*/
public static CipherKeyEntry getKeyEntry(
final CryptoManager cryptoManager,
final String transformation,
final int keyLengthBits) {
Validator.ensureNotNull(cryptoManager, transformation);
Validator.ensureTrue(0 < keyLengthBits);
CipherKeyEntry keyEntry = null;
// search for an existing key that satisfies the request
for (Map.Entry
* Although the existence of data tagged with the requested keyID
* implies the key entry exists in the system, it is possible for
* the distribution of the key entry to lag that of the data;
* hence this routine might return null. No attempt is made to
* query the other instances in the ADS topology (presumably at
* least the instance producing the key entry will have it), due
* to the presumed infrequency of key generation and expected low
* latency of replication, compared to the complexity of finding
* the set of instances and querying them. Instead, the caller
* must retry the operation requesting the decryption.
*
* @param cryptoManager The CryptoManager instance with which the
* key entry is associated.
*
* @param keyID The key identifier.
*
* @return The key entry associated with the key identifier, or
* {@code null} if no such entry exists.
*
* @see org.opends.server.crypto.CryptoManager.MacKeyEntry
* #getKeyEntry(org.opends.server.types.CryptoManager,
* java.lang.String, int)
*/
public static CipherKeyEntry getKeyEntry(
CryptoManager cryptoManager,
final KeyEntryID keyID) {
return cryptoManager.cipherKeyEntryCache.get(keyID);
}
/**
In case a transformation is supplied instead of an algorithm:
E.g., AES/CBC/PKCS5Padding -> AES.
@param transformation The cipher transformation from which to
extract the cipher algorithm.
@return The algorithm prefix of the Cipher transformation. If
the transformation is supplied as an algorithm-only (no mode or
padding), return the transformation as-is.
*/
private static String keyAlgorithmFromTransformation(
String transformation){
final int separatorIndex = transformation.indexOf('/');
return (0 < separatorIndex)
? transformation.substring(0, separatorIndex)
: transformation;
}
/**
* Construct an instance of {@code CipherKeyEntry} using the
* specified parameters. This constructor would typically be used
* for key generation.
*
* @param transformation The name of the Cipher transformation
* for which the key entry is to be produced.
*
* @param keyLengthBits The length of the requested key in bits.
*
* @throws CryptoManagerException If there is a problem
* instantiating the key generator.
*/
private CipherKeyEntry(final String transformation,
final int keyLengthBits)
throws CryptoManagerException {
// Generate a new key.
super(keyAlgorithmFromTransformation(transformation),
keyLengthBits);
// copy arguments.
this.fType = transformation;
this.fIVLengthBits = -1; /* compute IV length */
}
/**
* Construct an instance of CipherKeyEntry using the specified
* parameters. This constructor would typically be used for key
* entries imported from ADS, for which the full set of paramters
* is known, and for a newly generated key entry, for which the
* initialization vector length might not yet be known, but which
* must be set prior to using the key.
*
* @param keyID The unique identifier of this cipher
* transformation/key pair.
*
* @param transformation The name of the secret-key cipher
* transformation for which the key entry is to be produced.
*
* @param secretKey The cipher key.
*
* @param secretKeyLengthBits The length of the secret key in
* bits.
*
* @param ivLengthBits The length in bits of a mandatory
* initialization vector or 0 if none is required. Set this
* parameter to -1 when generating a new encryption key and this
* method will attempt to compute the proper value by first using
* the cipher block size and then, if the cipher block size is
* non-zero, using 0 (i.e., no initialization vector).
*
* @param isCompromised {@code false} if the key may be used
* for encryption, or {@code true} if the key is being retained
* only for use in decrypting existing data.
*
* @throws CryptoManagerException If there is a problem
* instantiating a Cipher object in order to validate the supplied
* parameters when creating a new entry.
*/
private CipherKeyEntry(final KeyEntryID keyID,
final String transformation,
final SecretKey secretKey,
final int secretKeyLengthBits,
final int ivLengthBits,
final boolean isCompromised)
throws CryptoManagerException {
super(keyID, secretKey, secretKeyLengthBits, isCompromised);
// copy arguments
this.fType = transformation;
this.fIVLengthBits = ivLengthBits;
}
/**
* The cipher transformation for which the key entry was created.
*
* @return The cipher transformation.
*/
public String getType() {
return fType;
}
/**
* Set the algorithm/key pair's required initialization vector
* length in bits. Typically, this will be the cipher's block
* size, or 0 for a stream cipher or a block cipher mode that does
* not use an initialization vector (e.g., ECB).
*
* @param ivLengthBits The initiazliation vector length in bits.
*/
private void setIVLengthBits(int ivLengthBits) {
Validator.ensureTrue(-1 == fIVLengthBits && 0 <= ivLengthBits);
fIVLengthBits = ivLengthBits;
}
/**
* The initialization vector length in bits: 0 is a stream cipher
* or a block cipher that does not use an IV (e.g., ECB); or a
* positive integer, typically the block size of the cipher.
*
* This method returns -1 if the object initialization has not
* been completed.
*
* @return The initialization vector length.
*/
public int getIVLengthBits() {
return fIVLengthBits;
}
// state
private final String fType;
private int fIVLengthBits = -1;
}
/**
* This class corresponds to the MAC key entry in ADS. It is
* used in the local cache of key entries that have been requested
* by CryptoManager clients.
*/
private static class MacKeyEntry extends SecretKeyEntry
{
/**
* This method generates a key according to the key parameters,
* creates a key entry, and optionally registers it in the
* supplied CryptoManager context.
*
* @param cryptoManager The CryptoManager instance for which the
* key is to be generated. Pass {@code null} as the argument to
* this parameter in order to validate a proposed MAC algorithm
* and key length, but not publish the key entry.
*
* @param algorithm The MAC algorithm for which the
* key is to be produced. This argument is required.
*
* @param keyLengthBits The MAC key length in bits. The argument
* must be a positive integer evenly divisible by the value
* Byte.SIZE.
*
* @return The key entry corresponding to the parameters.
*
* @throws CryptoManagerException If there is a problem
* instantiating a Mac object in order to validate the supplied
* parameters when creating a new entry.
*
* @see MacKeyEntry#getKeyEntry(CryptoManager, String, int)
*/
public static MacKeyEntry generateKeyEntry(
final CryptoManager cryptoManager,
final String algorithm,
final int keyLengthBits)
throws CryptoManagerException {
Validator.ensureNotNull(algorithm);
final Map
* ADS is not searched in the case a key entry meeting the
* specifications is not found. Instead, the ADS monitoring thread
* is responsible for asynchronous updates to the key map.
*
* @param cryptoManager The CryptoManager instance with which the
* key entry is associated.
*
* @param algorithm The MAC algorithm for which the key was
* produced.
*
* @param keyLengthBits The MAC key length in bits.
*
* @return The key entry corresponding to the parameters, or
* {@code null} if no such entry exists.
*/
public static MacKeyEntry getKeyEntry(
final CryptoManager cryptoManager,
final String algorithm,
final int keyLengthBits) {
Validator.ensureNotNull(cryptoManager, algorithm);
Validator.ensureTrue(0 < keyLengthBits);
MacKeyEntry keyEntry = null;
// search for an existing key that satisfies the request
for (Map.Entry
* Although the existence of data tagged with the requested keyID
* implies the key entry exists in the system, it is possible for
* the distribution of the key entry to lag that of the data;
* hence this routine might return null. No attempt is made to
* query the other instances in the ADS topology (presumably at
* least the instance producing the key entry will have it), due
* to the presumed infrequency of key generation and expected low
* latency of replication, compared to the complexity of finding
* the set of instances and querying them. Instead, the caller
* must retry the operation requesting the decryption.
*
* @param cryptoManager The CryptoManager instance with which the
* key entry is associated.
*
* @param keyID The key identifier.
*
* @return The key entry associated with the key identifier, or
* {@code null} if no such entry exists.
*
* @see org.opends.server.crypto.CryptoManager.CipherKeyEntry
* #getKeyEntry(org.opends.server.types.CryptoManager,
* java.lang.String, int)
*/
public static MacKeyEntry getKeyEntry(
final CryptoManager cryptoManager,
final KeyEntryID keyID) {
return cryptoManager.macKeyEntryCache.get(keyID);
}
/**
* Construct an instance of {@code MacKeyEntry} using the
* specified parameters. This constructor would typically be used
* for key generation.
*
* @param algorithm The name of the MAC algorithm for which the
* key entry is to be produced.
*
* @param keyLengthBits The length of the requested key in bits.
*
* @throws CryptoManagerException If there is a problem
* instantiating the key generator.
*/
private MacKeyEntry(final String algorithm,
final int keyLengthBits)
throws CryptoManagerException {
// Generate a new key.
super(algorithm, keyLengthBits);
// copy arguments
this.fType = algorithm;
}
/**
* Construct an instance of MacKeyEntry using the specified
* parameters. This constructor would typically be used for key
* entries imported from ADS, for which the full set of paramters
* is known.
*
* @param keyID The unique identifier of this MAC algorithm/key
* pair.
*
* @param algorithm The name of the MAC algorithm for which the
* key entry is to be produced.
*
* @param secretKey The MAC key.
*
* @param secretKeyLengthBits The length of the secret key in
* bits.
*
* @param isCompromised {@code false} if the key may be used
* for signing, or {@code true} if the key is being retained only
* for use in signature verification.
*/
private MacKeyEntry(final KeyEntryID keyID,
final String algorithm,
final SecretKey secretKey,
final int secretKeyLengthBits,
final boolean isCompromised) {
super(keyID, secretKey, secretKeyLengthBits, isCompromised);
// copy arguments
this.fType = algorithm;
}
/**
* The algorithm for which the key entry was created.
*
* @return The algorithm.
*/
public String getType() {
return fType;
}
// state
private final String fType;
}
}
* wrappingKeyID:wrappingTransformation:wrappedKeyAlgorithm:\
* wrappedKeyType:hexWrappedKey
*
* wrappingKeyID ::= hexBytes[16]
* wrappingTransformation
* ::= e.g., RSA/ECB/OAEPWITHSHA-1ANDMGF1PADDING
* wrappedKeyAlgorithm ::= e.g., DESede
* hexifiedwrappedKey ::= 0123456789abcdef01...
*
*
* @param wrappingKeyID The key identifier of the wrapping key. This
* parameter is the first field in the encoded value and identifies
* the instance that will be able to unwrap the secret key.
*
* @param wrappingKeyCertificateData The public key certificate used
* to derive the wrapping key.
*
* @param secretKey The secret key value to be wrapped for the
* encoded value.
*
* @return The encoded representation of the ds-cfg-symmetric-key
* attribute with the secret key wrapped with the supplied public
* key.
*
* @throws CryptoManagerException If there is a problem wrapping
* the secret key.
*/
private String encodeSymmetricKeyAttribute(
final String wrappingKeyID,
final byte[] wrappingKeyCertificateData,
final SecretKey secretKey)
throws CryptoManagerException {
return encodeSymmetricKeyAttribute(
preferredKeyWrappingTransformation,
wrappingKeyID,
wrappingKeyCertificateData,
secretKey);
}
/**
* Encodes a ds-cfg-symmetric-key attribute value with a specified
* key wrapping transformation and using the supplied arguments.
*
* @param wrappingTransformationName The name of the key wrapping
* transformation.
*
* @param wrappingKeyID The key identifier of the wrapping key. This
* parameter is the first field in the encoded value and identifies
* the instance that will be able to unwrap the secret key.
*
* @param wrappingKeyCertificateData The public key certificate used
* to derive the wrapping key.
*
* @param secretKey The secret key value to be wrapped for the
* encoded value.
*
* @return The encoded representation of the ds-cfg-symmetric-key
* attribute with the secret key wrapped with the supplied public
* key.
*
* @throws CryptoManagerException If there is a problem wrapping
* the secret key.
*/
private String encodeSymmetricKeyAttribute(
final String wrappingTransformationName,
final String wrappingKeyID,
final byte[] wrappingKeyCertificateData,
final SecretKey secretKey)
throws CryptoManagerException {
// Wrap secret key.
String wrappedKeyElement;
try {
final CertificateFactory cf
= CertificateFactory.getInstance("X.509");
final Certificate certificate = cf.generateCertificate(
new ByteArrayInputStream(wrappingKeyCertificateData));
final Cipher wrapper
= Cipher.getInstance(wrappingTransformationName);
wrapper.init(Cipher.WRAP_MODE, certificate);
byte[] wrappedKey = wrapper.wrap(secretKey);
wrappedKeyElement = StaticUtils.bytesToHexNoSpace(wrappedKey);
}
catch (GeneralSecurityException ex) {
if (debugEnabled()) {
TRACER.debugCaught(DebugLogLevel.ERROR, ex);
}
throw new CryptoManagerException(
ERR_CRYPTOMGR_FAILED_TO_ENCODE_SYMMETRIC_KEY_ATTRIBUTE.get(
getExceptionMessage(ex)), ex);
}
// Compose ds-cfg-symmetric-key value.
StringBuilder symmetricKeyAttribute = new StringBuilder();
symmetricKeyAttribute.append(wrappingKeyID);
symmetricKeyAttribute.append(":");
symmetricKeyAttribute.append(wrappingTransformationName);
symmetricKeyAttribute.append(":");
symmetricKeyAttribute.append(secretKey.getAlgorithm());
symmetricKeyAttribute.append(":");
symmetricKeyAttribute.append(wrappedKeyElement);
return symmetricKeyAttribute.toString();
}
/**
* Takes an encoded ds-cfg-symmetric-key attribute value and the
* associated key algorithm name, and returns an initialized
* {@code java.security.Key} object.
* @param symmetricKeyAttribute The encoded
* ds-cfg-symmetric-key-attribute value.
* @return A SecretKey object instantiated with the key data,
* algorithm, and Ciper.SECRET_KEY type, or {@code null} if the
* supplied symmetricKeyAttribute was encoded for another instance.
* @throws CryptoManagerException If there is a problem decomposing
* the supplied attribute value or unwrapping the encoded key.
*/
private SecretKey decodeSymmetricKeyAttribute(
final String symmetricKeyAttribute)
throws CryptoManagerException {
// Initial decomposition.
String[] elements = symmetricKeyAttribute.split(":", 0);
if (4 != elements.length) {
throw new CryptoManagerException(
ERR_CRYPTOMGR_DECODE_SYMMETRIC_KEY_ATTRIBUTE_FIELD_COUNT.get(
symmetricKeyAttribute));
}
// Parse individual fields.
String wrappingKeyIDElement;
String wrappingTransformationElement;
String wrappedKeyAlgorithmElement;
byte[] wrappedKeyCipherTextElement;
String fieldName = null;
try {
fieldName = "instance key identifier";
wrappingKeyIDElement = elements[0];
fieldName = "key wrapping transformation";
wrappingTransformationElement = elements[1];
fieldName = "wrapped key algorithm";
wrappedKeyAlgorithmElement = elements[2];
fieldName = "wrapped key data";
wrappedKeyCipherTextElement
= StaticUtils.hexStringToByteArray(elements[3]);
}
catch (ParseException ex) {
if (debugEnabled()) {
TRACER.debugCaught(DebugLogLevel.ERROR, ex);
}
throw new CryptoManagerException(
ERR_CRYPTOMGR_DECODE_SYMMETRIC_KEY_ATTRIBUTE_SYNTAX.get(
symmetricKeyAttribute, fieldName,
ex.getErrorOffset()), ex);
}
// Confirm key can be unwrapped at this instance.
final String instanceKeyID = getInstanceKeyID();
if (! wrappingKeyIDElement.equals(instanceKeyID)) {
return null;
}
// Retrieve instance-key-pair private key part.
PrivateKey privateKey;
try {
privateKey = (PrivateKey)getTrustStoreBackend()
.getKey(ConfigConstants.ADS_CERTIFICATE_ALIAS);
}
catch (IdentifiedException ex) {
// ConfigException, DirectoryException
if (debugEnabled()) {
TRACER.debugCaught(DebugLogLevel.ERROR, ex);
}
throw new CryptoManagerException(
ERR_CRYPTOMGR_DECODE_SYMMETRIC_KEY_ATTRIBUTE_NO_PRIVATE.get(
getExceptionMessage(ex)), ex);
}
// Unwrap secret key.
SecretKey secretKey;
try {
final Cipher unwrapper
= Cipher.getInstance(wrappingTransformationElement);
unwrapper.init(Cipher.UNWRAP_MODE, privateKey);
secretKey = (SecretKey)unwrapper.unwrap(
wrappedKeyCipherTextElement,
wrappedKeyAlgorithmElement,
Cipher.SECRET_KEY);
} catch(GeneralSecurityException ex) {
if (debugEnabled()) {
TRACER.debugCaught(DebugLogLevel.ERROR, ex);
}
throw new CryptoManagerException(
ERR_CRYPTOMGR_DECODE_SYMMETRIC_KEY_ATTRIBUTE_DECIPHER.get(
getExceptionMessage(ex)), ex);
}
return secretKey;
}
/**
* Decodes the supplied symmetric key attribute value and re-encodes
* it with the public key referred to by the requested instance key
* identifier. The symmetric key attribute must be wrapped in this
* instance's instance-key-pair public key.
* @param symmetricKeyAttribute The symmetric key attribute value to
* unwrap and rewrap.
* @param requestedInstanceKeyID The key identifier of the public
* key to use in the re-wrapping.
* @return The symmetric key attribute value with the symmetric key
* re-wrapped in the requested public key.
* @throws CryptoManagerException If there is a problem decoding
* the supplied symmetric key attribute value, unwrapping the
* embedded secret key, or retrieving the requested public key.
*/
String reencodeSymmetricKeyAttribute(
final String symmetricKeyAttribute,
final String requestedInstanceKeyID)
throws CryptoManagerException {
final SecretKey secretKey
= decodeSymmetricKeyAttribute(symmetricKeyAttribute);
final MapMessageDigest object that may be used to
* generate digests using the preferred digest algorithm.
*
* @return A MessageDigest object that may be used to
* generate digests using the preferred digest algorithm.
*
* @throws NoSuchAlgorithmException If the requested algorithm is
* not supported or is
* unavailable.
*/
public MessageDigest getPreferredMessageDigest()
throws NoSuchAlgorithmException
{
return MessageDigest.getInstance(preferredDigestAlgorithm);
}
/**
* Retrieves a MessageDigest object that may be used to
* generate digests using the specified algorithm.
*
* @param digestAlgorithm The algorithm to use to generate the
* message digest.
*
* @return A MessageDigest object that may be used to
* generate digests using the specified algorithm.
*
* @throws NoSuchAlgorithmException If the requested algorithm is
* not supported or is
* unavailable.
*/
public MessageDigest getMessageDigest(String digestAlgorithm)
throws NoSuchAlgorithmException
{
return MessageDigest.getInstance(digestAlgorithm);
}
/**
* Retrieves a byte array containing a message digest based on the
* provided data, using the preferred digest algorithm.
*
* @param data The data to be digested.
*
* @return A byte array containing the generated message digest.
*
* @throws NoSuchAlgorithmException If the requested algorithm is
* not supported or is
* unavailable.
*/
public byte[] digest(byte[] data)
throws NoSuchAlgorithmException
{
return MessageDigest.getInstance(preferredDigestAlgorithm).
digest(data);
}
/**
* Retrieves a byte array containing a message digest based on the
* provided data, using the requested digest algorithm.
*
* @param digestAlgorithm The algorithm to use to generate the
* message digest.
* @param data The data to be digested.
*
* @return A byte array containing the generated message digest.
*
* @throws NoSuchAlgorithmException If the requested algorithm is
* not supported or is
* unavailable.
*/
public byte[] digest(String digestAlgorithm, byte[] data)
throws NoSuchAlgorithmException
{
return MessageDigest.getInstance(digestAlgorithm).digest(data);
}
/**
* Retrieves a byte array containing a message digest based on the
* data read from the provided input stream, using the preferred
* digest algorithm. Data will be read until the end of the stream
* is reached.
*
* @param inputStream The input stream from which the data is to
* be read.
*
* @return A byte array containing the generated message digest.
*
* @throws IOException If a problem occurs while reading data from
* the provided stream.
*
* @throws NoSuchAlgorithmException If the requested algorithm is
* not supported or is
* unavailable.
*/
public byte[] digest(InputStream inputStream)
throws IOException, NoSuchAlgorithmException
{
MessageDigest digest =
MessageDigest.getInstance(preferredDigestAlgorithm);
byte[] buffer = new byte[8192];
while (true)
{
int bytesRead = inputStream.read(buffer);
if (bytesRead < 0)
{
break;
}
digest.update(buffer, 0, bytesRead);
}
return digest.digest();
}
/**
* Retrieves a byte array containing a message digest based on the
* data read from the provided input stream, using the requested
* digest algorithm. Data will be read until the end of the stream
* is reached.
*
* @param digestAlgorithm The algorithm to use to generate the
* message digest.
* @param inputStream The input stream from which the data is
* to be read.
*
* @return A byte array containing the generated message digest.
*
* @throws IOException If a problem occurs while reading data from
* the provided stream.
*
* @throws NoSuchAlgorithmException If the requested algorithm is
* not supported or is
* unavailable.
*/
public byte[] digest(String digestAlgorithm,
InputStream inputStream)
throws IOException, NoSuchAlgorithmException
{
MessageDigest digest = MessageDigest.getInstance(digestAlgorithm);
byte[] buffer = new byte[8192];
while (true)
{
int bytesRead = inputStream.read(buffer);
if (bytesRead < 0)
{
break;
}
digest.update(buffer, 0, bytesRead);
}
return digest.digest();
}
/**
* For the current preferred MAC algorithm and key length, return
* the identifier of the corresponding key entry. Note: the result
* (key identifier) might change across invocations, due to either
* of the perferred parameters changing, or because the original
* key was marked compromised and a replacement key generated.
*
* @return A String representation of the identifier of a key entry
* corresponding to the preferred MAC algorithm and key length.
*
* @throws CryptoManagerException In case one or more of the key
* parameters is invalid, or there is a problem instantiating the
* key entry in case it does not already exist.
*/
public String getMacEngineKeyEntryID()
throws CryptoManagerException
{
return getMacEngineKeyEntryID(preferredMACAlgorithm,
preferredMACAlgorithmKeyLengthBits);
}
/**
* For the specified MAC algorithm and key length, return
* the identifier of the corresponding key entry. Note: the result
* (key identifier) might change across invocations, due to either
* of the perferred parameters changing, or because the original
* key was marked compromised and a replacement key generated.
*
* @param macAlgorithm The algorithm to use for the MAC engine.
*
* @param keyLengthBits The key length in bits to use with the
* specified algorithm.
*
* @return A String representation of the identifier of a key entry
* corresponding to the specified MAC algorithm and key length.
*
* @throws CryptoManagerException In case one or more of the key
* parameters is invalid, or there is a problem instantiating the
* key entry in case it does not already exist.
*/
public String getMacEngineKeyEntryID(final String macAlgorithm,
final int keyLengthBits)
throws CryptoManagerException {
Validator.ensureNotNull(macAlgorithm);
MacKeyEntry keyEntry = MacKeyEntry.getKeyEntry(this, macAlgorithm,
keyLengthBits);
if (null == keyEntry) {
keyEntry = MacKeyEntry.generateKeyEntry(this, macAlgorithm,
keyLengthBits);
}
return keyEntry.getKeyID().getStringValue();
}
/**
* For the specified key entry identifier, instantiate a MAC engine.
*
* @param keyEntryID The identifier of the key entry containing the
* desired MAC algorithm name and key length.
*
* @return The MAC engine instantiated with the parameters from the
* referenced key entry, or null if no such entry exists.
*
* @throws CryptoManagerException In case the key entry identifier
* is invalid or there is a problem instatiating the MAC engine from
* the parameters in the referenced key entry.
*/
public Mac getMacEngine(String keyEntryID)
throws CryptoManagerException
{
final MacKeyEntry keyEntry = MacKeyEntry.getKeyEntry(this,
new KeyEntryID(keyEntryID));
return (null == keyEntry) ? null : getMacEngine(keyEntry);
}
/**
* This method produces an initialized MAC engine based on the
* supplied MacKeyEntry's state.
*
* @param keyEntry The MacKeyEntry specifying the Mac properties.
*
* @return An initialized Mac object.
*
* @throws CryptoManagerException In case there was a error
* instantiating the Mac object.
*/
private static Mac getMacEngine(MacKeyEntry keyEntry)
throws CryptoManagerException
{
Mac mac;
try {
mac = Mac.getInstance(keyEntry.getType());
}
catch (NoSuchAlgorithmException ex){
if (debugEnabled()) {
TRACER.debugCaught(DebugLogLevel.ERROR, ex);
}
throw new CryptoManagerException(
ERR_CRYPTOMGR_GET_MAC_ENGINE_INVALID_MAC_ALGORITHM.get(
keyEntry.getType(), getExceptionMessage(ex)),
ex);
}
try {
mac.init(keyEntry.getSecretKey());
}
catch (InvalidKeyException ex) {
if (debugEnabled()) {
TRACER.debugCaught(DebugLogLevel.ERROR, ex);
}
throw new CryptoManagerException(
ERR_CRYPTOMGR_GET_MAC_ENGINE_CANNOT_INITIALIZE.get(
getExceptionMessage(ex)), ex);
}
return mac;
}
/**
* This method produces an initialized Cipher based on the supplied
* CipherKeyEntry's state.
*
* @param keyEntry The secret key entry containing the cipher
* transformation and secret key for which to instantiate
* the cipher.
*
* @param mode Either Cipher.ENCRYPT_MODE or Cipher.DECRYPT_MODE.
*
* @param initializationVector For Cipher.DECRYPT_MODE, supply
* any initialzation vector used in the corresponding encryption
* cipher. May be null.
*
* @return The initialized cipher object.
*
* @throws CryptoManagerException In case of a problem creating
* or initializing the requested cipher object. Possible causes
* include NoSuchAlgorithmException, NoSuchPaddingException,
* InvalidKeyException, and InvalidAlgorithmParameterException.
*/
private static Cipher getCipher(final CipherKeyEntry keyEntry,
final int mode,
final byte[] initializationVector)
throws CryptoManagerException {
Validator.ensureTrue(Cipher.ENCRYPT_MODE == mode
|| Cipher.DECRYPT_MODE == mode);
Validator.ensureTrue(Cipher.ENCRYPT_MODE != mode
|| null == initializationVector);
Validator.ensureTrue(-1 != keyEntry.getIVLengthBits()
|| Cipher.ENCRYPT_MODE == mode);
Validator.ensureTrue(null == initializationVector
|| initializationVector.length * Byte.SIZE
== keyEntry.getIVLengthBits());
Cipher cipher;
try {
cipher = Cipher.getInstance(keyEntry.getType());
}
catch (GeneralSecurityException ex) {
// NoSuchAlgorithmException, NoSuchPaddingException
if (debugEnabled()) {
TRACER.debugCaught(DebugLogLevel.ERROR, ex);
}
throw new CryptoManagerException(
ERR_CRYPTOMGR_GET_CIPHER_INVALID_CIPHER_TRANSFORMATION.get(
keyEntry.getType(), getExceptionMessage(ex)), ex);
}
try {
if (0 < keyEntry.getIVLengthBits()) {
byte[] iv;
if (Cipher.ENCRYPT_MODE == mode
&& null == initializationVector) {
iv = new byte[keyEntry.getIVLengthBits() / Byte.SIZE];
pseudoRandom.nextBytes(iv);
}
else {
iv = initializationVector;
}
cipher.init(mode, keyEntry.getSecretKey(),
new IvParameterSpec(iv));
}
else {
cipher.init(mode, keyEntry.getSecretKey());
}
}
catch (GeneralSecurityException ex) {
// InvalidKeyException, InvalidAlgorithmParameterException
if (debugEnabled()) {
TRACER.debugCaught(DebugLogLevel.ERROR, ex);
}
throw new CryptoManagerException(
ERR_CRYPTOMGR_GET_CIPHER_CANNOT_INITIALIZE.get(
getExceptionMessage(ex)), ex);
}
return cipher;
}
/**
* Encrypts the data in the provided byte array using the preferred
* cipher transformation.
*
* @param data The plain-text data to be encrypted.
*
* @return A byte array containing the encrypted representation of
* the provided data.
*
* @throws GeneralSecurityException If a problem occurs while
* encrypting the data.
*
* @throws CryptoManagerException If a problem occurs managing the
* encryption key or producing the cipher.
*/
public byte[] encrypt(byte[] data)
throws GeneralSecurityException, CryptoManagerException
{
return encrypt(preferredCipherTransformation,
preferredCipherTransformationKeyLengthBits, data);
}
/**
* Encrypts the data in the provided byte array using the requested
* cipher algorithm.
*
* @param cipherTransformation The algorithm/mode/padding to use
* for the cipher.
*
* @param keyLengthBits The length in bits of the encryption key
* this method is to use. Note the specified key length and
* transformation must be compatible.
*
* @param data The plain-text data to be encrypted.
*
* @return A byte array containing the encrypted representation of
* the provided data.
*
* @throws GeneralSecurityException If a problem occurs while
* encrypting the data.
*
* @throws CryptoManagerException If a problem occurs managing the
* encryption key or producing the cipher.
*/
public byte[] encrypt(String cipherTransformation,
int keyLengthBits,
byte[] data)
throws GeneralSecurityException, CryptoManagerException
{
Validator.ensureNotNull(cipherTransformation, data);
CipherKeyEntry keyEntry = CipherKeyEntry.getKeyEntry(
this, cipherTransformation, keyLengthBits);
if (null == keyEntry) {
keyEntry = CipherKeyEntry.generateKeyEntry(this,
cipherTransformation, keyLengthBits);
}
final Cipher cipher
= getCipher(keyEntry, Cipher.ENCRYPT_MODE, null);
final byte[] keyID = keyEntry.getKeyID().getByteValue();
final byte[] iv = cipher.getIV();
final int prologueLength
= keyID.length + ((null == iv) ? 0 : iv.length);
final int dataLength = cipher.getOutputSize(data.length);
final byte[] cipherText = new byte[prologueLength + dataLength];
System.arraycopy(keyID, 0, cipherText, 0, keyID.length);
if (null != iv) {
System.arraycopy(iv, 0, cipherText, keyID.length, iv.length);
}
System.arraycopy(cipher.doFinal(data), 0, cipherText,
prologueLength, dataLength);
return cipherText;
}
/**
* Writes encrypted data to the provided output stream using the
* preferred cipher transformation.
*
* @param outputStream The output stream to be wrapped by the
* returned cipher output stream.
*
* @return The output stream wrapped with a CipherOutputStream.
*
* @throws CryptoManagerException If a problem occurs managing the
* encryption key or producing the cipher.
*/
public CipherOutputStream getCipherOutputStream(
OutputStream outputStream) throws CryptoManagerException
{
return getCipherOutputStream(preferredCipherTransformation,
preferredCipherTransformationKeyLengthBits, outputStream);
}
/**
* Writes encrypted data to the provided output stream using the
* requested cipher transformation.
*
* @param cipherTransformation The algorithm/mode/padding to use
* for the cipher.
*
* @param keyLengthBits The length in bits of the encryption key
* this method will generate. Note the specified key length
* must be compatible with the transformation.
*
* @param outputStream The output stream to be wrapped by the
* returned cipher output stream.
*
* @return The output stream wrapped with a CipherOutputStream.
*
* @throws CryptoManagerException If a problem occurs managing the
* encryption key or producing the cipher.
*/
public CipherOutputStream getCipherOutputStream(
String cipherTransformation, int keyLengthBits,
OutputStream outputStream)
throws CryptoManagerException
{
Validator.ensureNotNull(cipherTransformation, outputStream);
CipherKeyEntry keyEntry = CipherKeyEntry.getKeyEntry(
this, cipherTransformation, keyLengthBits);
if (null == keyEntry) {
keyEntry = CipherKeyEntry.generateKeyEntry(this,
cipherTransformation, keyLengthBits);
}
final Cipher cipher
= getCipher(keyEntry, Cipher.ENCRYPT_MODE, null);
final byte[] keyID = keyEntry.getKeyID().getByteValue();
try {
outputStream.write(keyID);
if (null != cipher.getIV()) {
outputStream.write(cipher.getIV());
}
}
catch (IOException ex) {
if (debugEnabled()) {
TRACER.debugCaught(DebugLogLevel.ERROR, ex);
}
throw new CryptoManagerException(
ERR_CRYPTOMGR_GET_CIPHER_STREAM_PROLOGUE_WRITE_ERROR.get(
getExceptionMessage(ex)), ex);
}
return new CipherOutputStream(outputStream, cipher);
}
/**
* Decrypts the data in the provided byte array using cipher
* specified by the key identifier prologue to the data.
* cipher.
*
* @param data The cipher-text data to be decrypted.
*
* @return A byte array containing the clear-text representation of
* the provided data.
*
* @throws GeneralSecurityException If a problem occurs while
* encrypting the data.
*
* @throws CryptoManagerException If a problem occurs reading the
* key identifier or initialization vector from the data
* prologue, or using these values to initialize a Cipher.
*/
public byte[] decrypt(byte[] data)
throws GeneralSecurityException,
CryptoManagerException
{
KeyEntryID keyID;
try {
final byte[] keyIDBytes
= new byte[KeyEntryID.getByteValueLength()];
System.arraycopy(data, 0, keyIDBytes, 0, keyIDBytes.length);
keyID = new KeyEntryID(keyIDBytes);
}
catch (Exception ex) {
// IndexOutOfBoundsException, ArrayStoreException, ...
if (debugEnabled()) {
TRACER.debugCaught(DebugLogLevel.ERROR, ex);
}
throw new CryptoManagerException(
ERR_CRYPTOMGR_DECRYPT_FAILED_TO_READ_KEY_IDENTIFIER.get(),
ex);
}
CipherKeyEntry keyEntry = CipherKeyEntry.getKeyEntry(this, keyID);
if (null == keyEntry) {
throw new CryptoManagerException(
ERR_CRYPTOMGR_DECRYPT_UNKNOWN_KEY_IDENTIFIER.get());
}
byte[] iv = null;
if (0 < keyEntry.getIVLengthBits()) {
iv = new byte[keyEntry.getIVLengthBits()/Byte.SIZE];
try {
System.arraycopy(data, KeyEntryID.getByteValueLength(), iv, 0,
iv.length);
}
catch (Exception ex) {
// IndexOutOfBoundsException, ArrayStoreException, ...
if (debugEnabled()) {
TRACER.debugCaught(DebugLogLevel.ERROR, ex);
}
throw new CryptoManagerException(
ERR_CRYPTOMGR_DECRYPT_FAILED_TO_READ_IV.get(), ex);
}
}
final Cipher cipher = getCipher(keyEntry, Cipher.DECRYPT_MODE,
iv);
final int prologueLength = KeyEntryID.getByteValueLength()
+ ((null == iv) ? 0 : iv.length);
return cipher.doFinal(data, prologueLength,
data.length - prologueLength);
}
/**
* Returns a CipherInputStream instantiated with a cipher
* corresponding to the key identifier prologue to the data.
*
* @param inputStream The input stream be wrapped with the
* CipherInputStream.
*
* @return The CiperInputStream instantiated as specified.
*
* @throws CryptoManagerException If there is a problem reading the
* key ID or initialization vector from the input stream,
* or using these values to inititalize a Cipher.
*/
public CipherInputStream getCipherInputStream(
InputStream inputStream) throws CryptoManagerException
{
CipherKeyEntry keyEntry;
byte[] iv = null;
try {
final byte[] keyID = new byte[KeyEntryID.getByteValueLength()];
if (keyID.length != inputStream.read(keyID)){
throw new CryptoManagerException(
ERR_CRYPTOMGR_DECRYPT_FAILED_TO_READ_KEY_IDENTIFIER.get());
}
keyEntry = CipherKeyEntry.getKeyEntry(this,
new KeyEntryID(keyID));
if (null == keyEntry) {
throw new CryptoManagerException(
ERR_CRYPTOMGR_DECRYPT_UNKNOWN_KEY_IDENTIFIER.get());
}
if (0 < keyEntry.getIVLengthBits()) {
iv = new byte[keyEntry.getIVLengthBits() / Byte.SIZE];
if (iv.length != inputStream.read(iv)) {
throw new CryptoManagerException(
ERR_CRYPTOMGR_DECRYPT_FAILED_TO_READ_IV.get());
}
}
}
catch (IOException ex) {
throw new CryptoManagerException(
ERR_CRYPTOMGR_DECRYPT_CIPHER_INPUT_STREAM_ERROR.get(
getExceptionMessage(ex)), ex);
}
return new CipherInputStream(inputStream,
getCipher(keyEntry, Cipher.DECRYPT_MODE, iv));
}
/**
* Attempts to compress the data in the provided source array into
* the given destination array. If the compressed data will fit
* into the destination array, then this method will return the
* number of bytes of compressed data in the array. Otherwise, it
* will return -1 to indicate that the compression was not
* successful. Note that if -1 is returned, then the data in the
* destination array should be considered invalid.
*
* @param src The array containing the raw data to compress.
* @param dst The array into which the compressed data should be
* written.
*
* @return The number of bytes of compressed data, or -1 if it was
* not possible to actually compress the data.
*/
public int compress(byte[] src, byte[] dst)
{
Deflater deflater = new Deflater();
try
{
deflater.setInput(src);
deflater.finish();
int compressedLength = deflater.deflate(dst);
if (deflater.finished())
{
return compressedLength;
}
else
{
return -1;
}
}
finally
{
deflater.end();
}
}
/**
* Attempts to uncompress the data in the provided source array into
* the given destination array. If the uncompressed data will fit
* into the given destination array, then this method will return
* the number of bytes of uncompressed data written into the
* destination buffer. Otherwise, it will return a negative value
* to indicate that the destination buffer was not large enough.
* The absolute value of that negative return value will indicate
* the buffer size required to fully decompress the data. Note that
* if a negative value is returned, then the data in the destination
* array should be considered invalid.
*
* @param src The array containing the compressed data.
* @param dst The array into which the uncompressed data should be
* written.
*
* @return A positive value containing the number of bytes of
* uncompressed data written into the destination buffer,
* or a negative value whose absolute value is the size of
* the destination buffer required to fully decompress the
* provided data.
*
* @throws DataFormatException If a problem occurs while
* attempting to uncompress the data.
*/
public int uncompress(byte[] src, byte[] dst)
throws DataFormatException
{
Inflater inflater = new Inflater();
try
{
inflater.setInput(src);
int decompressedLength = inflater.inflate(dst);
if (inflater.finished())
{
return decompressedLength;
}
else
{
int totalLength = decompressedLength;
while (! inflater.finished())
{
totalLength += inflater.inflate(dst);
}
return -totalLength;
}
}
finally
{
inflater.end();
}
}
/**
* Retrieve the ADS trust store backend.
* @return The ADS trust store backend.
* @throws ConfigException If the ADS trust store backend is
* not configured.
*/
private TrustStoreBackend getTrustStoreBackend()
throws ConfigException
{
Backend b = DirectoryServer.getBackend(
ConfigConstants.ID_ADS_TRUST_STORE_BACKEND);
if (b == null)
{
Message msg =
ERR_CRYPTOMGR_ADS_TRUST_STORE_BACKEND_NOT_ENABLED.get(
ConfigConstants.ID_ADS_TRUST_STORE_BACKEND);
throw new ConfigException(msg);
}
if (!(b instanceof TrustStoreBackend))
{
Message msg =
ERR_CRYPTOMGR_ADS_TRUST_STORE_BACKEND_WRONG_CLASS.get(
ConfigConstants.ID_ADS_TRUST_STORE_BACKEND);
throw new ConfigException(msg);
}
return (TrustStoreBackend)b;
}
/**
* Create an SSL context that may be used for communication to
* another ADS component.
*
* @param sslCertNickname The name of the local certificate to use,
* or null if none is specified.
* @return A new SSL Context.
* @throws ConfigException If the context could not be created.
*/
public SSLContext getSslContext(String sslCertNickname)
throws ConfigException
{
SSLContext sslContext;
try
{
TrustStoreBackend trustStoreBackend = getTrustStoreBackend();
KeyManager[] keyManagers = trustStoreBackend.getKeyManagers();
TrustManager[] trustManagers =
trustStoreBackend.getTrustManagers();
sslContext = SSLContext.getInstance("TLS");
if (sslCertNickname == null)
{
sslContext.init(keyManagers, trustManagers, null);
}
else
{
X509ExtendedKeyManager[] extendedKeyManagers =
SelectableCertificateKeyManager.wrap(
keyManagers,
sslCertNickname);
sslContext.init(extendedKeyManagers, trustManagers, null);
}
}
catch (Exception e)
{
if (debugEnabled())
{
TRACER.debugCaught(DebugLogLevel.ERROR, e);
}
Message message =
ERR_CRYPTOMGR_SSL_CONTEXT_CANNOT_INITIALIZE.get(
getExceptionMessage(e));
throw new ConfigException(message, e);
}
return sslContext;
}
/**
* Get the name of the local certificate to use for SSL.
* @return The name of the local certificate to use for SSL.
*/
public String getSslCertNickname()
{
return sslCertNickname;
}
/**
* Determine whether SSL encryption is enabled.
* @return true if SSL encryption is enabled.
*/
public boolean isSslEncryption()
{
return sslEncryption;
}
/**
* Get the set of enabled SSL protocols.
* @return The set of enabled SSL protocols.
*/
public SortedSet