diff options
Diffstat (limited to 'base/kra')
8 files changed, 26 insertions, 21 deletions
diff --git a/base/kra/src/com/netscape/kra/AsymKeyGenService.java b/base/kra/src/com/netscape/kra/AsymKeyGenService.java index 7351d50be..cfee504ef 100644 --- a/base/kra/src/com/netscape/kra/AsymKeyGenService.java +++ b/base/kra/src/com/netscape/kra/AsymKeyGenService.java @@ -20,7 +20,6 @@ package com.netscape.kra; import java.math.BigInteger; import java.security.KeyPair; -import org.mozilla.jss.crypto.CryptoToken; import org.mozilla.jss.crypto.KeyPairGeneratorSpi; import org.mozilla.jss.crypto.PrivateKey; @@ -68,7 +67,7 @@ public class AsymKeyGenService implements IService { @Override public boolean serviceRequest(IRequest request) throws EBaseException { - IConfigStore cs = CMS.getConfigStore(); + IConfigStore configStore = CMS.getConfigStore(); String clientKeyId = request.getExtDataInString(IRequest.SECURITY_DATA_CLIENT_KEY_ID); String algorithm = request.getExtDataInString(IRequest.KEY_GEN_ALGORITHM); @@ -77,7 +76,7 @@ public class AsymKeyGenService implements IService { String realm = request.getRealm(); - boolean allowEncDecrypt_archival = cs.getBoolean("kra.allowEncDecrypt.archival", false); + boolean allowEncDecrypt_archival = configStore.getBoolean("kra.allowEncDecrypt.archival", false); KeyPairGeneratorSpi.Usage[] usageList = null; String usageStr = request.getExtDataInString(IRequest.KEY_GEN_USAGES); @@ -130,9 +129,6 @@ public class AsymKeyGenService implements IService { String owner = request.getExtDataInString(IRequest.ATTR_REQUEST_OWNER); String auditSubjectID = owner; - // Get the token - CryptoToken token = kra.getKeygenToken(); - // Generating the asymmetric keys KeyPair kp = null; @@ -162,8 +158,7 @@ public class AsymKeyGenService implements IService { WrappingParams params = null; try { - // TODO(alee) What happens if key wrap algorithm is not supported? - params = storageUnit.getWrappingParams(); + params = storageUnit.getWrappingParams(allowEncDecrypt_archival); privateSecurityData = storageUnit.wrap((PrivateKey) kp.getPrivate(), params); } catch (Exception e) { CMS.debug("Failed to generate security data to archive: " + e); diff --git a/base/kra/src/com/netscape/kra/EncryptionUnit.java b/base/kra/src/com/netscape/kra/EncryptionUnit.java index 02a4ca143..b460c9e27 100644 --- a/base/kra/src/com/netscape/kra/EncryptionUnit.java +++ b/base/kra/src/com/netscape/kra/EncryptionUnit.java @@ -67,8 +67,6 @@ public abstract class EncryptionUnit implements IEncryptionUnit { public abstract PrivateKey getPrivateKey(org.mozilla.jss.crypto.X509Certificate cert); - public abstract WrappingParams getWrappingParams() throws Exception; - public WrappingParams getOldWrappingParams() { return new WrappingParams( SymmetricKey.DES3, KeyGenAlgorithm.DES3, 168, diff --git a/base/kra/src/com/netscape/kra/EnrollmentService.java b/base/kra/src/com/netscape/kra/EnrollmentService.java index a200c342f..e413a06b5 100644 --- a/base/kra/src/com/netscape/kra/EnrollmentService.java +++ b/base/kra/src/com/netscape/kra/EnrollmentService.java @@ -396,7 +396,7 @@ public class EnrollmentService implements IService { WrappingParams params = null; try { - params = mStorageUnit.getWrappingParams(); + params = mStorageUnit.getWrappingParams(allowEncDecrypt_archival); if (allowEncDecrypt_archival == true) { privateKeyData = mStorageUnit.encryptInternalPrivate(unwrapped, params); } else { diff --git a/base/kra/src/com/netscape/kra/NetkeyKeygenService.java b/base/kra/src/com/netscape/kra/NetkeyKeygenService.java index f068a4a81..636e93ed0 100644 --- a/base/kra/src/com/netscape/kra/NetkeyKeygenService.java +++ b/base/kra/src/com/netscape/kra/NetkeyKeygenService.java @@ -41,6 +41,7 @@ import org.mozilla.jss.util.Base64OutputStream; import com.netscape.certsrv.apps.CMS; import com.netscape.certsrv.base.EBaseException; +import com.netscape.certsrv.base.IConfigStore; import com.netscape.certsrv.base.MetaInfo; import com.netscape.certsrv.base.SessionContext; import com.netscape.certsrv.dbs.keydb.IKeyRecord; @@ -155,6 +156,9 @@ public class NetkeyKeygenService implements IService { IVParameterSpec algParam = new IVParameterSpec(iv); + IConfigStore configStore = CMS.getConfigStore(); + boolean allowEncDecrypt_archival = configStore.getBoolean("kra.allowEncDecrypt.archival", false); + wrapped_des_key = null; boolean archive = true; byte[] publicKeyData = null; @@ -405,8 +409,7 @@ public class NetkeyKeygenService implements IService { WrappingParams params = null; try { - // TODO(alee) What happens if key wrap algorithm is not supported? - params = mStorageUnit.getWrappingParams(); + params = mStorageUnit.getWrappingParams(allowEncDecrypt_archival); privateKeyData = mStorageUnit.wrap((org.mozilla.jss.crypto.PrivateKey) privKey, params); } catch (Exception e) { request.setExtData(IRequest.RESULT, Integer.valueOf(4)); diff --git a/base/kra/src/com/netscape/kra/SecurityDataProcessor.java b/base/kra/src/com/netscape/kra/SecurityDataProcessor.java index 701b6110b..95d07c4f4 100644 --- a/base/kra/src/com/netscape/kra/SecurityDataProcessor.java +++ b/base/kra/src/com/netscape/kra/SecurityDataProcessor.java @@ -217,7 +217,7 @@ public class SecurityDataProcessor { boolean doEncrypt = false; try { - params = storageUnit.getWrappingParams(); + params = storageUnit.getWrappingParams(allowEncDecrypt_archival); if (securitySymKey != null && unwrapped == null) { privateSecurityData = storageUnit.wrap(securitySymKey, params); } else if (unwrapped != null && allowEncDecrypt_archival == true) { diff --git a/base/kra/src/com/netscape/kra/StorageKeyUnit.java b/base/kra/src/com/netscape/kra/StorageKeyUnit.java index 3e7f1deb9..1df30f658 100644 --- a/base/kra/src/com/netscape/kra/StorageKeyUnit.java +++ b/base/kra/src/com/netscape/kra/StorageKeyUnit.java @@ -133,7 +133,7 @@ public class StorageKeyUnit extends EncryptionUnit implements throw new EBaseException(CMS.getUserMessage("CMS_INVALID_OPERATION")); } - public WrappingParams getWrappingParams() throws Exception { + public WrappingParams getWrappingParams(boolean encrypt) throws Exception { String choice = null; try { choice = mConfig.getString(PROP_WRAPPING_CHOICE); @@ -177,6 +177,16 @@ public class StorageKeyUnit extends EncryptionUnit implements KeyRecordParser.OUT_PL_WRAP_IV_LEN); if (iv != null) params.setPayloadWrappingIV(new IVParameterSpec(iv)); + if (encrypt) { + // Some HSMs have not yet implemented AES-KW. Use AES-CBC-PAD instead + if (params.getPayloadWrapAlgorithm().equals(KeyWrapAlgorithm.AES_KEY_WRAP) || + params.getPayloadWrapAlgorithm().equals(KeyWrapAlgorithm.AES_KEY_WRAP_PAD)) { + params.setPayloadWrapAlgorithm(KeyWrapAlgorithm.AES_CBC_PAD); + iv = CryptoUtil.getNonceData(16); + params.setPayloadWrappingIV(new IVParameterSpec(iv)); + } + } + return params; } diff --git a/base/kra/src/com/netscape/kra/SymKeyGenService.java b/base/kra/src/com/netscape/kra/SymKeyGenService.java index c1830ec6c..bf350d5f5 100644 --- a/base/kra/src/com/netscape/kra/SymKeyGenService.java +++ b/base/kra/src/com/netscape/kra/SymKeyGenService.java @@ -29,6 +29,7 @@ import org.mozilla.jss.crypto.SymmetricKey; import com.netscape.certsrv.apps.CMS; import com.netscape.certsrv.base.EBaseException; +import com.netscape.certsrv.base.IConfigStore; import com.netscape.certsrv.dbs.keydb.IKeyRecord; import com.netscape.certsrv.dbs.keydb.IKeyRepository; import com.netscape.certsrv.key.KeyRequestResource; @@ -107,6 +108,9 @@ public class SymKeyGenService implements IService { throw new EBaseException("Bad data in SymKeyGenService.serviceRequest"); } + IConfigStore configStore = CMS.getConfigStore(); + boolean allowEncDecrypt_archival = configStore.getBoolean("kra.allowEncDecrypt.archival", false); + CryptoToken token = mStorageUnit.getToken(); KeyGenAlgorithm kgAlg = KeyRequestDAO.SYMKEY_GEN_ALGORITHMS.get(algorithm); if (kgAlg == null) { @@ -170,8 +174,7 @@ public class SymKeyGenService implements IService { } try { - // TODO(alee) what happens if key wrap algorithm is not supported? - params = mStorageUnit.getWrappingParams(); + params = mStorageUnit.getWrappingParams(allowEncDecrypt_archival); privateSecurityData = mStorageUnit.wrap(sk, params); } catch (Exception e) { CMS.debug("Failed to generate security data to archive: " + e); diff --git a/base/kra/src/com/netscape/kra/TransportKeyUnit.java b/base/kra/src/com/netscape/kra/TransportKeyUnit.java index 513c0b252..fc66e662b 100644 --- a/base/kra/src/com/netscape/kra/TransportKeyUnit.java +++ b/base/kra/src/com/netscape/kra/TransportKeyUnit.java @@ -115,10 +115,6 @@ public class TransportKeyUnit extends EncryptionUnit implements } } - public WrappingParams getWrappingParams() { - return getOldWrappingParams(); - } - public CryptoToken getInternalToken() { try { return CryptoManager.getInstance().getInternalKeyStorageToken(); |