diff options
Diffstat (limited to 'base')
7 files changed, 206 insertions, 129 deletions
diff --git a/base/common/src/org/dogtagpki/common/CAInfo.java b/base/common/src/org/dogtagpki/common/CAInfo.java index f21dcd0d7..0f68c7ab7 100644 --- a/base/common/src/org/dogtagpki/common/CAInfo.java +++ b/base/common/src/org/dogtagpki/common/CAInfo.java @@ -54,7 +54,8 @@ public class CAInfo extends ResourceMessage { } String archivalMechanism; - String wrappingKeySet; + String encryptAlgorithm; + String keyWrapAlgorithm; @XmlElement(name="ArchivalMechanism") public String getArchivalMechanism() { @@ -65,13 +66,20 @@ public class CAInfo extends ResourceMessage { this.archivalMechanism = archivalMechanism; } - @XmlElement(name="WrappingKeySet") - public String getWrappingKeySet() { - return wrappingKeySet; + public String getEncryptAlgorithm() { + return encryptAlgorithm; } - public void setWrappingKeySet(String wrappingKeySet) { - this.wrappingKeySet = wrappingKeySet; + public void setEncryptAlgorithm(String encryptAlgorithm) { + this.encryptAlgorithm = encryptAlgorithm; + } + + public String getKeyWrapAlgorithm() { + return keyWrapAlgorithm; + } + + public void setKeyWrapAlgorithm(String keyWrapAlgorithm) { + this.keyWrapAlgorithm = keyWrapAlgorithm; } @Override @@ -79,7 +87,8 @@ public class CAInfo extends ResourceMessage { final int prime = 31; int result = super.hashCode(); result = prime * result + ((archivalMechanism == null) ? 0 : archivalMechanism.hashCode()); - result = prime * result + ((wrappingKeySet == null) ? 0 : wrappingKeySet.hashCode()); + result = prime * result + ((encryptAlgorithm == null) ? 0 : encryptAlgorithm.hashCode()); + result = prime * result + ((keyWrapAlgorithm == null) ? 0 : keyWrapAlgorithm.hashCode()); return result; } @@ -97,10 +106,15 @@ public class CAInfo extends ResourceMessage { return false; } else if (!archivalMechanism.equals(other.archivalMechanism)) return false; - if (wrappingKeySet == null) { - if (other.wrappingKeySet != null) + if (encryptAlgorithm == null) { + if (other.encryptAlgorithm != null) + return false; + } else if (!encryptAlgorithm.equals(other.encryptAlgorithm)) + return false; + if (keyWrapAlgorithm == null) { + if (other.keyWrapAlgorithm != null) return false; - } else if (!wrappingKeySet.equals(other.wrappingKeySet)) + } else if (!keyWrapAlgorithm.equals(other.keyWrapAlgorithm)) return false; return true; } diff --git a/base/common/src/org/dogtagpki/common/KRAInfo.java b/base/common/src/org/dogtagpki/common/KRAInfo.java index e17bd642d..66fb99246 100644 --- a/base/common/src/org/dogtagpki/common/KRAInfo.java +++ b/base/common/src/org/dogtagpki/common/KRAInfo.java @@ -55,6 +55,8 @@ public class KRAInfo extends ResourceMessage { String archivalMechanism; String recoveryMechanism; + String encryptAlgorithm; + String wrapAlgorithm; @XmlElement(name="ArchivalMechanism") public String getArchivalMechanism() { @@ -74,12 +76,32 @@ public class KRAInfo extends ResourceMessage { this.recoveryMechanism = recoveryMechanism; } + @XmlElement(name="EncryptAlgorithm") + public String getEncryptAlgorithm() { + return encryptAlgorithm; + } + + public void setEncryptAlgorithm(String encryptAlgorithm) { + this.encryptAlgorithm = encryptAlgorithm; + } + + @XmlElement(name="WrapAlgorithm") + public String getWrapAlgorithm() { + return wrapAlgorithm; + } + + public void setWrapAlgorithm(String wrapAlgorithm) { + this.wrapAlgorithm = wrapAlgorithm; + } + @Override public int hashCode() { final int prime = 31; int result = super.hashCode(); result = prime * result + ((archivalMechanism == null) ? 0 : archivalMechanism.hashCode()); + result = prime * result + ((encryptAlgorithm == null) ? 0 : encryptAlgorithm.hashCode()); result = prime * result + ((recoveryMechanism == null) ? 0 : recoveryMechanism.hashCode()); + result = prime * result + ((wrapAlgorithm == null) ? 0 : wrapAlgorithm.hashCode()); return result; } @@ -97,11 +119,21 @@ public class KRAInfo extends ResourceMessage { return false; } else if (!archivalMechanism.equals(other.archivalMechanism)) return false; + if (encryptAlgorithm == null) { + if (other.encryptAlgorithm != null) + return false; + } else if (!encryptAlgorithm.equals(other.encryptAlgorithm)) + return false; if (recoveryMechanism == null) { if (other.recoveryMechanism != null) return false; } else if (!recoveryMechanism.equals(other.recoveryMechanism)) return false; + if (wrapAlgorithm == null) { + if (other.wrapAlgorithm != null) + return false; + } else if (!wrapAlgorithm.equals(other.wrapAlgorithm)) + return false; return true; } @@ -125,6 +157,8 @@ public class KRAInfo extends ResourceMessage { KRAInfo before = new KRAInfo(); before.setArchivalMechanism("encrypt"); before.setRecoveryMechanism("keywrap"); + before.setEncryptAlgorithm("AES/CBC/Pad"); + before.setWrapAlgorithm("AES KeyWrap/Padding"); String string = before.toString(); System.out.println(string); diff --git a/base/java-tools/src/com/netscape/cmstools/CRMFPopClient.java b/base/java-tools/src/com/netscape/cmstools/CRMFPopClient.java index 0057a1d52..b06faa6be 100644 --- a/base/java-tools/src/com/netscape/cmstools/CRMFPopClient.java +++ b/base/java-tools/src/com/netscape/cmstools/CRMFPopClient.java @@ -190,11 +190,7 @@ public class CRMFPopClient { option.setArgName("extractable"); options.addOption(option); - option = new Option("g", true, "KeyWrap"); - option.setArgName("keyWrap"); - options.addOption(option); - - option = new Option("w", true, "Wrapping Keyset"); + option = new Option("w", true, "Algorithm to be used for key wrapping"); option.setArgName("keySet"); options.addOption(option); @@ -231,10 +227,7 @@ public class CRMFPopClient { System.out.println(" - POP_NONE: without POP"); System.out.println(" - POP_SUCCESS: with valid POP"); System.out.println(" - POP_FAIL: with invalid POP (for testing)"); - System.out.println(" -g <true|false> Use KeyWrapping to wrap private key (default: true)"); - System.out.println(" - true: use a key wrapping algorithm"); - System.out.println(" - false: use an encryption algorithm"); - System.out.println(" -w <keyset_id> Key set ID to use when wrapping the private key"); + System.out.println(" -w <keywrap algorithm> Algorithm to use for key wrapping"); System.out.println(" -b <transport cert> PEM transport certificate (default: transport.txt)"); System.out.println(" -v, --verbose Run in verbose mode."); System.out.println(" --help Show help message."); @@ -329,20 +322,17 @@ public class CRMFPopClient { boolean self_sign = cmd.hasOption("y"); - // get the key wrapping mechanism - boolean keyWrap = true; - if (cmd.hasOption("g")) { - keyWrap = Boolean.parseBoolean(cmd.getOptionValue("g")); + // get the keywrap algorithm + KeyWrapAlgorithm keyWrapAlgorithm = null; + String kwAlg = KeyWrapAlgorithm.AES_KEY_WRAP_PAD.toString(); + if (cmd.hasOption("w")) { + kwAlg = cmd.getOptionValue("w"); } else { - String useKeyWrap = System.getenv("KEY_ARCHIVAL_USE_KEY_WRAPPING"); - if (useKeyWrap != null) { - keyWrap = Boolean.parseBoolean(useKeyWrap); + String alg = System.getenv("KEY_ARCHIVAL_KEYWRAP_ALGORITHM"); + if (alg != null) { + kwAlg = alg; } } - String archivalMechanism = keyWrap ? KRAInfoResource.KEYWRAP_MECHANISM : - KRAInfoResource.ENCRYPT_MECHANISM; - - String wrappingKeySet = cmd.getOptionValue("w"); String output = cmd.getOptionValue("o"); @@ -351,12 +341,11 @@ public class CRMFPopClient { String requestor = cmd.getOptionValue("r"); if (hostPort != null) { - if (cmd.hasOption("g") || cmd.hasOption("w")) { - printError("Wrapping Key Set (-g) and keywrap (-w) options should " + - "not be specified when hostport is specified. " + - "CRMFPopClient will contact the server to " + - "determine the correct values for these parameters"); - System.exit(1); + if (cmd.hasOption("w")) { + printError("Any value specified for the key wrap parameter (-w) " + + "will be overriden. CRMFPopClient will contact the " + + "CA to determine the supported algorithm when " + + "hostport is specified"); } } @@ -493,9 +482,9 @@ public class CRMFPopClient { System.out.println("Keypair private key id: " + kid); if (hostPort != null) { - // check the CA for the required keyset and archival mechanism + // check the CA for the required key wrap algorithm // if found, override whatever has been set by the command line - // options or environment for archivalMechanism and wrappingKeySet + // options for the key wrap algorithm ClientConfig config = new ClientConfig(); String host = hostPort.substring(0, hostPort.indexOf(':')); @@ -503,31 +492,17 @@ public class CRMFPopClient { config.setServerURL("http", host, port); PKIClient pkiclient = new PKIClient(config); - - // get archival mechanism - CAInfoClient infoClient = new CAInfoClient(pkiclient, "ca"); - try { - CAInfo info = infoClient.getInfo(); - archivalMechanism = info.getArchivalMechanism(); - wrappingKeySet = info.getWrappingKeySet(); - } catch (PKIException e) { - if (e.getCode() == 404) { - // assume this is an older server, - archivalMechanism = KRAInfoResource.KEYWRAP_MECHANISM; - wrappingKeySet = "0"; - } else { - throw new Exception("Failed to retrieve archive wrapping information from the CA: " + e, e); - } - } catch (Exception e) { - throw new Exception("Failed to retrieve archive wrapping information from the CA: " + e, e); - } + kwAlg = getKeyWrapAlgotihm(pkiclient); } + if (verbose) System.out.println("Using key wrap algorithm: " + kwAlg); + keyWrapAlgorithm = KeyWrapAlgorithm.fromString(kwAlg); + if (verbose) System.out.println("Creating certificate request"); CertRequest certRequest = client.createCertRequest( self_sign, token, transportCert, algorithm, keyPair, - subject, archivalMechanism, wrappingKeySet); + subject, keyWrapAlgorithm); ProofOfPossession pop = null; @@ -592,6 +567,36 @@ public class CRMFPopClient { } } + public static String getKeyWrapAlgotihm(PKIClient pkiclient) + throws Exception { + String kwAlg = null; + CAInfoClient infoClient = new CAInfoClient(pkiclient, "ca"); + String archivalMechanism = KRAInfoResource.KEYWRAP_MECHANISM; + + try { + CAInfo info = infoClient.getInfo(); + archivalMechanism = info.getArchivalMechanism(); + kwAlg = info.getKeyWrapAlgorithm(); + } catch (PKIException e) { + if (e.getCode() == 404) { + // assume this is an older server, + archivalMechanism = KRAInfoResource.KEYWRAP_MECHANISM; + kwAlg = KeyWrapAlgorithm.DES3_CBC_PAD.toString(); + } else { + throw new Exception("Failed to retrieve archive wrapping information from the CA: " + e, e); + } + } catch (Exception e) { + throw new Exception("Failed to retrieve archive wrapping information from the CA: " + e, e); + } + + if (!archivalMechanism.equals(KRAInfoResource.KEYWRAP_MECHANISM)) { + // new server with encryption set. Use something we know will + // work. AES-128-CBC + kwAlg = KeyWrapAlgorithm.AES_CBC_PAD.toString(); + } + return kwAlg; + } + public void setVerbose(boolean verbose) { this.verbose = verbose; } @@ -637,10 +642,9 @@ public class CRMFPopClient { String algorithm, KeyPair keyPair, Name subject, - String archivalMechanism, - String wrappingKeySet) throws Exception { + KeyWrapAlgorithm keyWrapAlgorithm) throws Exception { return createCertRequest(false, token, transportCert, algorithm, keyPair, - subject, archivalMechanism, wrappingKeySet); + subject, keyWrapAlgorithm); } public CertRequest createCertRequest( @@ -650,24 +654,15 @@ public class CRMFPopClient { String algorithm, KeyPair keyPair, Name subject, - String archivalMechanism, - String wrappingKeySet) throws Exception { - EncryptionAlgorithm encryptAlg = null; - - if (wrappingKeySet == null) { - wrappingKeySet = System.getenv("KEY_WRAP_PARAMETER_SET"); + KeyWrapAlgorithm keyWrapAlgorithm) throws Exception { + byte[] iv = null; + if (keyWrapAlgorithm.getParameterClasses() != null) { + iv = CryptoUtil.getNonceData(keyWrapAlgorithm.getBlockSize()); } + OBJECT_IDENTIFIER kwOID = CryptoUtil.getOID(keyWrapAlgorithm); - if (wrappingKeySet != null && wrappingKeySet.equalsIgnoreCase("0")) { - // talking to an old server? - encryptAlg = EncryptionAlgorithm.DES3_CBC; - } else { - encryptAlg = EncryptionAlgorithm.AES_128_CBC; - } - - byte[] iv = CryptoUtil.getNonceData(encryptAlg.getIVLength()); - AlgorithmIdentifier aid = new AlgorithmIdentifier(encryptAlg.toOID(), new OCTET_STRING(iv)); - WrappingParams params = getWrappingParams(encryptAlg, iv, archivalMechanism); + AlgorithmIdentifier aid = new AlgorithmIdentifier(kwOID, new OCTET_STRING(iv)); + WrappingParams params = getWrappingParams(keyWrapAlgorithm, iv); PKIArchiveOptions opts = CryptoUtil.createPKIArchiveOptions( token, @@ -698,29 +693,21 @@ public class CRMFPopClient { return new CertRequest(new INTEGER(1), certTemplate, seq); } - private WrappingParams getWrappingParams(EncryptionAlgorithm encryptAlg, byte[] wrapIV, - String archivalMechanism) throws Exception { - if (encryptAlg.getAlg().toString().equalsIgnoreCase("AES")) { - KeyWrapAlgorithm wrapAlg = null; - IVParameterSpec wrapIVS = null; - if (archivalMechanism.equals(KRAInfoResource.ENCRYPT_MECHANISM)) { - // We will use AES_CBC_PAD as the a key wrap mechanism. This - // can be decrypted using the same mechanism on the server. - wrapAlg = KeyWrapAlgorithm.AES_CBC_PAD; - wrapIVS = new IVParameterSpec(wrapIV); - } else { - wrapAlg = KeyWrapAlgorithm.AES_KEY_WRAP_PAD; - } + private WrappingParams getWrappingParams(KeyWrapAlgorithm kwAlg, byte[] iv) throws Exception { + IVParameterSpec ivps = iv != null ? new IVParameterSpec(iv): null; + + if (kwAlg == KeyWrapAlgorithm.AES_KEY_WRAP_PAD || + kwAlg == KeyWrapAlgorithm.AES_CBC_PAD) { return new WrappingParams( SymmetricKey.AES, KeyGenAlgorithm.AES, 128, - KeyWrapAlgorithm.RSA, encryptAlg, - wrapAlg, wrapIVS, wrapIVS); - } else if (encryptAlg.getAlg().toString().equalsIgnoreCase("DESede")) { + KeyWrapAlgorithm.RSA, EncryptionAlgorithm.AES_128_CBC_PAD, + kwAlg, ivps, ivps); + } else if (kwAlg == KeyWrapAlgorithm.DES3_CBC_PAD) { return new WrappingParams( SymmetricKey.DES3, KeyGenAlgorithm.DES3, 168, KeyWrapAlgorithm.RSA, EncryptionAlgorithm.DES3_CBC_PAD, KeyWrapAlgorithm.DES3_CBC_PAD, - new IVParameterSpec(wrapIV), new IVParameterSpec(wrapIV)); + ivps, ivps); } else { throw new Exception("Invalid encryption algorithm"); } diff --git a/base/java-tools/src/com/netscape/cmstools/client/ClientCertRequestCLI.java b/base/java-tools/src/com/netscape/cmstools/client/ClientCertRequestCLI.java index a14bb242d..9a0cfcc4b 100644 --- a/base/java-tools/src/com/netscape/cmstools/client/ClientCertRequestCLI.java +++ b/base/java-tools/src/com/netscape/cmstools/client/ClientCertRequestCLI.java @@ -29,18 +29,15 @@ import java.util.Vector; import org.apache.commons.cli.CommandLine; import org.apache.commons.cli.Option; import org.apache.commons.io.FileUtils; -import org.dogtagpki.common.CAInfo; -import org.dogtagpki.common.CAInfoClient; -import org.dogtagpki.common.KRAInfoResource; import org.mozilla.jss.CryptoManager; import org.mozilla.jss.crypto.CryptoToken; +import org.mozilla.jss.crypto.KeyWrapAlgorithm; import org.mozilla.jss.crypto.Signature; import org.mozilla.jss.crypto.X509Certificate; import org.mozilla.jss.pkix.crmf.CertRequest; import org.mozilla.jss.pkix.crmf.ProofOfPossession; import org.mozilla.jss.pkix.primitive.Name; -import com.netscape.certsrv.base.PKIException; import com.netscape.certsrv.cert.CertClient; import com.netscape.certsrv.cert.CertEnrollmentRequest; import com.netscape.certsrv.cert.CertRequestInfos; @@ -249,29 +246,13 @@ public class ClientCertRequestCLI extends CLI { CryptoManager manager = CryptoManager.getInstance(); X509Certificate transportCert = manager.importCACertPackage(transportCertData); - // get archival mechanism - CAInfoClient infoClient = new CAInfoClient(client, "ca"); - String archivalMechanism = KRAInfoResource.KEYWRAP_MECHANISM; - String wrappingKeySet = "1"; - try { - CAInfo info = infoClient.getInfo(); - archivalMechanism = info.getArchivalMechanism(); - wrappingKeySet = info.getWrappingKeySet(); - } catch (PKIException e) { - if (e.getCode() == 404) { - // assume this is an older server, - archivalMechanism = KRAInfoResource.KEYWRAP_MECHANISM; - wrappingKeySet = "0"; - } else { - throw new Exception("Failed to retrieve archive wrapping information from the CA: " + e, e); - } - } catch (Exception e) { - throw new Exception("Failed to retrieve archive wrapping information from the CA: " + e, e); - } + // get archival and key wrap mechanisms from CA + String kwAlg = CRMFPopClient.getKeyWrapAlgotihm(client); + KeyWrapAlgorithm keyWrapAlgorithm = KeyWrapAlgorithm.fromString(kwAlg); csr = generateCrmfRequest(transportCert, subjectDN, attributeEncoding, algorithm, length, curve, sslECDH, temporary, sensitive, extractable, withPop, - archivalMechanism, wrappingKeySet); + keyWrapAlgorithm); } else { throw new Exception("Unknown request type: " + requestType); @@ -411,8 +392,7 @@ public class ClientCertRequestCLI extends CLI { int sensitive, int extractable, boolean withPop, - String archivalMechanism, - String wrappingKeySet + KeyWrapAlgorithm keyWrapAlgorithm ) throws Exception { CryptoManager manager = CryptoManager.getInstance(); @@ -434,7 +414,7 @@ public class ClientCertRequestCLI extends CLI { } CertRequest certRequest = client.createCertRequest( - token, transportCert, algorithm, keyPair, subject, archivalMechanism, wrappingKeySet); + token, transportCert, algorithm, keyPair, subject, keyWrapAlgorithm); ProofOfPossession pop = null; if (withPop) { diff --git a/base/server/cms/src/org/dogtagpki/server/rest/CAInfoService.java b/base/server/cms/src/org/dogtagpki/server/rest/CAInfoService.java index 398f49982..52c9ca00f 100644 --- a/base/server/cms/src/org/dogtagpki/server/rest/CAInfoService.java +++ b/base/server/cms/src/org/dogtagpki/server/rest/CAInfoService.java @@ -28,6 +28,8 @@ import org.dogtagpki.common.CAInfo; import org.dogtagpki.common.CAInfoResource; import org.dogtagpki.common.KRAInfo; import org.dogtagpki.common.KRAInfoClient; +import org.mozilla.jss.crypto.EncryptionAlgorithm; +import org.mozilla.jss.crypto.KeyWrapAlgorithm; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -73,7 +75,8 @@ public class CAInfoService extends PKIService implements CAInfoResource { // KRA-related fields (the initial values are only used if we // did not yet receive authoritative info from KRA) private static String archivalMechanism = KRAInfoService.KEYWRAP_MECHANISM; - private static String wrappingKeySet = "0"; + private static String encryptAlgorithm; + private static String keyWrapAlgorithm; @Override public Response getInfo() throws Exception { @@ -116,7 +119,8 @@ public class CAInfoService extends PKIService implements CAInfoResource { } info.setArchivalMechanism(archivalMechanism); - info.setWrappingKeySet(wrappingKeySet); + info.setEncryptAlgorithm(encryptAlgorithm); + info.setKeyWrapAlgorithm(keyWrapAlgorithm); } } @@ -125,10 +129,8 @@ public class CAInfoService extends PKIService implements CAInfoResource { KRAInfo kraInfo = getKRAInfoClient(connInfo).getInfo(); archivalMechanism = kraInfo.getArchivalMechanism(); - - // request succeeded; the KRA is 10.4 or higher, - // therefore supports key set v1 - wrappingKeySet = "1"; + encryptAlgorithm = kraInfo.getEncryptAlgorithm(); + keyWrapAlgorithm = kraInfo.getWrapAlgorithm(); // mark info as authoritative kraInfoAuthoritative = true; @@ -137,8 +139,8 @@ public class CAInfoService extends PKIService implements CAInfoResource { // The KRAInfoResource was added in 10.4, // so we are talking to a pre-10.4 KRA - // pre-10.4 only supports key set v0 - wrappingKeySet = "0"; + encryptAlgorithm = EncryptionAlgorithm.DES3_CBC_PAD.toString(); + keyWrapAlgorithm = KeyWrapAlgorithm.DES3_CBC_PAD.toString(); // pre-10.4 KRA does not advertise the archival // mechanism; look for the old knob in CA's config diff --git a/base/server/cms/src/org/dogtagpki/server/rest/KRAInfoService.java b/base/server/cms/src/org/dogtagpki/server/rest/KRAInfoService.java index c4b3252b2..a9c3cdfc1 100644 --- a/base/server/cms/src/org/dogtagpki/server/rest/KRAInfoService.java +++ b/base/server/cms/src/org/dogtagpki/server/rest/KRAInfoService.java @@ -29,14 +29,25 @@ import org.slf4j.LoggerFactory; import com.netscape.certsrv.apps.CMS; import com.netscape.certsrv.base.EBaseException; import com.netscape.certsrv.base.IConfigStore; +import com.netscape.certsrv.kra.IKeyRecoveryAuthority; +import com.netscape.certsrv.security.IStorageKeyUnit; import com.netscape.cms.servlet.base.PKIService; +import netscape.security.util.WrappingParams; + /** * @author Ade Lee */ public class KRAInfoService extends PKIService implements KRAInfoResource { private static Logger logger = LoggerFactory.getLogger(InfoService.class); + private IKeyRecoveryAuthority kra; + private IStorageKeyUnit storageUnit; + + public KRAInfoService() { + kra = (IKeyRecoveryAuthority) CMS.getSubsystem("kra"); + storageUnit = kra.getStorageKeyUnit(); + } @Override public Response getInfo() throws Exception { @@ -47,7 +58,8 @@ public class KRAInfoService extends PKIService implements KRAInfoResource { KRAInfo info = new KRAInfo(); info.setArchivalMechanism(getArchivalMechanism()); info.setRecoveryMechanism(getRecoveryMechanism()); - + info.setEncryptAlgorithm(getEncryptAlgorithm()); + info.setArchivalMechanism(getWrapAlgorithm()); return createOKResponse(info); } @@ -63,5 +75,31 @@ public class KRAInfoService extends PKIService implements KRAInfoResource { boolean encrypt_recovery = cs.getBoolean("kra.allowEncDecrypt.recovery", false); return encrypt_recovery ? KRAInfoResource.ENCRYPT_MECHANISM : KRAInfoResource.KEYWRAP_MECHANISM; } + + String getWrapAlgorithm() throws EBaseException { + IConfigStore cs = CMS.getConfigStore(); + boolean encrypt_archival = cs.getBoolean("kra.allowEncDecrypt.archival", false); + WrappingParams params = null; + try { + params = storageUnit.getWrappingParams(encrypt_archival); + } catch (Exception e) { + // return something that should always work + return "AES/CBC/Padding"; + } + return params.getPayloadWrapAlgorithm().toString(); + } + + String getEncryptAlgorithm() throws EBaseException { + IConfigStore cs = CMS.getConfigStore(); + boolean encrypt_archival = cs.getBoolean("kra.allowEncDecrypt.archival", false); + WrappingParams params = null; + try { + params = storageUnit.getWrappingParams(encrypt_archival); + } catch (Exception e) { + // return something that should always work + return "AES/CBC/Padding"; + } + return params.getPayloadEncryptionAlgorithm().toString(); + } } diff --git a/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java b/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java index 95b8f815b..84e4a650d 100644 --- a/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java +++ b/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java @@ -2713,6 +2713,28 @@ public class CryptoUtil { throw new NoSuchAlgorithmException(); } + /* + * Useful method to map KeyWrap algorithms to an OID. + * This is not yet defined within JSS, although it will be valuable to do + * so. The hard thing though is that the KeyWrapAlgorithms in JSS do not take + * KEK key size into account for algorithms like AES. We assume 128 bits in + * this case. + * + * This is used in the generation of CRMF requests, and will be correlated to + * the subsequent reverse mapping method below. + */ + public static OBJECT_IDENTIFIER getOID(KeyWrapAlgorithm kwAlg) throws NoSuchAlgorithmException { + if (kwAlg == KeyWrapAlgorithm.AES_KEY_WRAP_PAD) + return new OBJECT_IDENTIFIER("2.16.840.1.101.3.4.1.8"); + if (kwAlg == KeyWrapAlgorithm.AES_CBC_PAD) + return new OBJECT_IDENTIFIER("2.16.840.1.101.3.4.1.2"); + if ((kwAlg == KeyWrapAlgorithm.DES3_CBC_PAD) || + (kwAlg == KeyWrapAlgorithm.DES_CBC_PAD)) + return new OBJECT_IDENTIFIER("1.2.840.113549.3.7"); + + throw new NoSuchAlgorithmException(); + } + } // START ENABLE_ECC |