Stop using hardcoded IV in CMC

Bugzilla #BZ 1458055

Change-Id: I229d7f18c46f0b55ec83f051614de1b59e125b82

3 files changed, 17 insertions, 17 deletions

diff --git a/base/java-tools/src/com/netscape/cmstools/CMCRequest.java b/base/java-tools/src/com/netscape/cmstools/CMCRequest.java
index 8d49b209b..4adf22ba3 100644
--- a/base/java-tools/src/com/netscape/cmstools/CMCRequest.java
+++ b/base/java-tools/src/com/netscape/cmstools/CMCRequest.java
@@ -40,6 +40,7 @@ import java.util.StringTokenizer;
 import org.mozilla.jss.CryptoManager;
 import org.mozilla.jss.asn1.ANY;
 import org.mozilla.jss.asn1.ASN1Util;
+import org.mozilla.jss.asn1.ASN1Value;
 import org.mozilla.jss.asn1.BIT_STRING;
 import org.mozilla.jss.asn1.ENUMERATED;
 import org.mozilla.jss.asn1.GeneralizedTime;
@@ -1708,6 +1709,12 @@ public class CMCRequest {
         try {
             TaggedRequest request = encryptedPop.getRequest();
             AlgorithmIdentifier thePOPAlgID = encryptedPop.getThePOPAlgID();
+
+            ASN1Value v = thePOPAlgID.getParameters();
+            v = ((ANY) v).decodeWith(new OCTET_STRING.Template());
+            byte iv[] = ((OCTET_STRING) v).toByteArray();
+            IVParameterSpec ivps = new IVParameterSpec(iv);
+
             AlgorithmIdentifier witnessAlgID = encryptedPop.getWitnessAlgID();
             OCTET_STRING witness = encryptedPop.getWitness();
             ContentInfo cms = encryptedPop.getContentInfo();
@@ -1734,13 +1741,9 @@ public class CMCRequest {
             }
             System.out.println(method + "symKey unwrapped.");
 
-            // TODO(alee) The code below should be replaced by code that generates a random IV
-            byte[] iv = { 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1 };
-            IVParameterSpec default_iv = new IVParameterSpec(iv);
-
             byte challenge[] = CryptoUtil.decryptUsingSymmetricKey(
                     token,
-                    default_iv,
+                    ivps,
                     encCI.getEncryptedContent().toByteArray(),
                     symKey,
                     EncryptionAlgorithm.AES_128_CBC);
diff --git a/base/server/cms/src/com/netscape/cms/profile/common/EnrollProfile.java b/base/server/cms/src/com/netscape/cms/profile/common/EnrollProfile.java
index 12fb73694..2591acefa 100644
--- a/base/server/cms/src/com/netscape/cms/profile/common/EnrollProfile.java
+++ b/base/server/cms/src/com/netscape/cms/profile/common/EnrollProfile.java
@@ -403,8 +403,7 @@ public abstract class EnrollProfile extends BasicProfile
                 String tokenName = CMS.getConfigStore().getString("cmc.token", CryptoUtil.INTERNAL_TOKEN_NAME);
                 token = CryptoUtil.getCryptoToken(tokenName);
 
-                // TODO(alee) Replace the IV definition with a call that generates a random IV of  the correct length
-                byte[] iv = { 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1 };
+                byte[] iv = CryptoUtil.getNonceData(EncryptionAlgorithm.AES_128_CBC.getIVLength());
                 IVParameterSpec ivps = new IVParameterSpec(iv);
 
                 PublicKey userPubKey = X509Key.parsePublicKey(new DerValue(req_key_data));
@@ -466,6 +465,8 @@ public abstract class EnrollProfile extends BasicProfile
 
                 req.setExtData("pop_userPubEncryptedSession", pop_userPubEncryptedSession);
 
+                req.setExtData("pop_encryptedDataIV", iv);
+
                 // now compute and set witness
                 CMS.debug(method + "now compute and set witness");
                 String hashName = CryptoUtil.getDefaultHashAlgName();
@@ -1123,14 +1124,12 @@ public abstract class EnrollProfile extends BasicProfile
                 return null;
             }
 
-            // TODO(alee) The code below should be replaced by code that gets the IV from the Pop request
-            // This IV is supposed to be random
-            byte[] iv = { 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1 };
-            IVParameterSpec default_iv = new IVParameterSpec(iv);
+            byte[] iv = req.getExtDataInByteArray("pop_encryptedDataIV");
+            IVParameterSpec ivps = new IVParameterSpec(iv);
 
             byte[] challenge_b = CryptoUtil.decryptUsingSymmetricKey(
                     token,
-                    default_iv,
+                    ivps,
                     pop_encryptedData,
                     symKey,
                     EncryptionAlgorithm.AES_128_CBC);
diff --git a/base/server/cms/src/com/netscape/cms/servlet/common/CMCOutputTemplate.java b/base/server/cms/src/com/netscape/cms/servlet/common/CMCOutputTemplate.java
index 8e472985e..8d6c37f2c 100644
--- a/base/server/cms/src/com/netscape/cms/servlet/common/CMCOutputTemplate.java
+++ b/base/server/cms/src/com/netscape/cms/servlet/common/CMCOutputTemplate.java
@@ -491,6 +491,7 @@ public class CMCOutputTemplate {
         //don't need this for encryptedPOP, but need to check for existence anyway
         byte[] pop_sysPubEncryptedSession = req.getExtDataInByteArray("pop_sysPubEncryptedSession");
         byte[] pop_userPubEncryptedSession = req.getExtDataInByteArray("pop_userPubEncryptedSession");
+        byte[] iv = req.getExtDataInByteArray("pop_encryptedDataIV");
         if ((pop_encryptedData != null) &&
                 (pop_sysPubEncryptedSession != null) &&
                 (pop_userPubEncryptedSession != null)) {
@@ -517,11 +518,8 @@ public class CMCOutputTemplate {
                     throw new EBaseException(method + msg);
                 }
 
-                // TODO(alee) The code below should be replaced by code that generates a random IV
-                byte[] default_iv = { 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1 };
-
                 OBJECT_IDENTIFIER oid = EncryptionAlgorithm.AES_128_CBC.toOID();
-                AlgorithmIdentifier aid = new AlgorithmIdentifier(oid, new OCTET_STRING(default_iv));
+                AlgorithmIdentifier aid = new AlgorithmIdentifier(oid, new OCTET_STRING(iv));
 
                 encPop = new EncryptedPOP(
                         tReq,
@@ -532,7 +530,7 @@ public class CMCOutputTemplate {
 
             } catch (Exception e) {
                 CMS.debug(method + " excepton:" + e);
-                throw new EBaseException(method + " excepton:" + e);
+                throw new EBaseException(method + " exception:" + e);
             }
 
         } else {