1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
|
// --- BEGIN COPYRIGHT BLOCK ---
// This program is free software; you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation; version 2 of the License.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License along
// with this program; if not, write to the Free Software Foundation, Inc.,
// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
//
// (C) 2007 Red Hat, Inc.
// All rights reserved.
// --- END COPYRIGHT BLOCK ---
package com.netscape.kra;
import java.security.PublicKey;
import org.mozilla.jss.CryptoManager;
import org.mozilla.jss.crypto.CryptoToken;
import org.mozilla.jss.crypto.ObjectNotFoundException;
import org.mozilla.jss.crypto.PrivateKey;
import org.mozilla.jss.crypto.Signature;
import org.mozilla.jss.crypto.SignatureAlgorithm;
import org.mozilla.jss.crypto.TokenException;
import com.netscape.certsrv.apps.CMS;
import com.netscape.certsrv.base.EBaseException;
import com.netscape.certsrv.base.IConfigStore;
import com.netscape.certsrv.base.ISubsystem;
import com.netscape.certsrv.security.ITransportKeyUnit;
import com.netscape.cmsutil.util.Cert;
/**
* A class represents the transport key pair. This key pair
* is used to protected EE's private key in transit.
*
* @author thomask
* @version $Revision$, $Date$
*/
public class TransportKeyUnit extends EncryptionUnit implements
ISubsystem, ITransportKeyUnit {
public static final String PROP_NICKNAME = "nickName";
public static final String PROP_SIGNING_ALGORITHM = "signingAlgorithm";
// private RSAPublicKey mPublicKey = null;
// private RSAPrivateKey mPrivateKey = null;
private IConfigStore mConfig = null;
private org.mozilla.jss.crypto.X509Certificate mCert = null;
private CryptoManager mManager = null;
/**
* Constructs this token.
*/
public TransportKeyUnit() {
super();
}
/**
* Retrieves subsystem identifier.
*/
public String getId() {
return "transportKeyUnit";
}
/**
* Sets subsystem identifier.
*/
public void setId(String id) throws EBaseException {
throw new EBaseException(CMS.getUserMessage("CMS_BASE_INVALID_OPERATION"));
}
/**
* Initializes this subsystem.
*/
public void init(ISubsystem owner, IConfigStore config)
throws EBaseException {
mConfig = config;
try {
mManager = CryptoManager.getInstance();
mCert = mManager.findCertByNickname(getNickName());
String algo = config.getString("signingAlgorithm", "SHA256withRSA");
// #613795 - initialize this; otherwise JSS is not happy
CryptoToken token = getToken();
SignatureAlgorithm sigalg = Cert.mapAlgorithmToJss(algo);
Signature signer = token.getSignatureContext(sigalg);
signer.initSign(getPrivateKey());
} catch (org.mozilla.jss.CryptoManager.NotInitializedException e) {
throw new EBaseException(CMS.getUserMessage("CMS_BASE_INTERNAL_ERROR", e.toString()));
} catch (TokenException e) {
throw new EBaseException(CMS.getUserMessage("CMS_BASE_INTERNAL_ERROR", e.toString()));
} catch (ObjectNotFoundException e) {
throw new EBaseException(CMS.getUserMessage("CMS_BASE_INTERNAL_ERROR", e.toString()));
} catch (Exception e) {
throw new EBaseException(CMS.getUserMessage("CMS_BASE_INTERNAL_ERROR", e.toString()));
}
}
public CryptoToken getInternalToken() {
try {
return CryptoManager.getInstance().getInternalKeyStorageToken();
} catch (Exception e) {
return null;
}
}
public CryptoToken getToken() {
// 390148: returning the token that owns the private
// key.
return getPrivateKey().getOwningToken();
}
/**
* Starts up this subsystem.
*/
public void startup() throws EBaseException {
}
/**
* Shutdowns this subsystem.
*/
public void shutdown() {
}
/**
* Returns the configuration store of this token.
*/
public IConfigStore getConfigStore() {
return mConfig;
}
public String getNickName() throws EBaseException {
return mConfig.getString(PROP_NICKNAME);
}
public void setNickName(String str) throws EBaseException {
mConfig.putString(PROP_NICKNAME, str);
}
public String getSigningAlgorithm() throws EBaseException {
return mConfig.getString(PROP_SIGNING_ALGORITHM);
}
public void setSigningAlgorithm(String str) throws EBaseException {
mConfig.putString(PROP_SIGNING_ALGORITHM, str);
}
/**
* Logins to this token.
*/
public void login(String pin) throws EBaseException {
}
/**
* Logout from this token.
*/
public void logout() {
}
/**
* Retrieves public key.
*/
public org.mozilla.jss.crypto.X509Certificate getCertificate() {
return mCert;
}
public PublicKey getPublicKey() {
return mCert.getPublicKey();
}
public PrivateKey getPrivateKey() {
try {
return mManager.findPrivKeyByCert(mCert);
} catch (TokenException e) {
return null;
} catch (ObjectNotFoundException e) {
return null;
}
}
/**
* Verifies the integrity of the given key pair.
*/
public void verify(byte publicKey[], PrivateKey privateKey)
throws EBaseException {
// XXX
}
}
|
