src/share/classes/sun/security/pkcs11/P11KeyAgreement.java - toolchain/jdk/jdk9_jdk - Git at Google

 /*
  * Copyright (c) 2003, 2007, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License version 2 only, as
  * published by the Free Software Foundation.  Oracle designates this
  * particular file as subject to the "Classpath" exception as provided
  * by Oracle in the LICENSE file that accompanied this code.
  *
  * This code is distributed in the hope that it will be useful, but WITHOUT
  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * version 2 for more details (a copy is included in the LICENSE file that
  * accompanied this code).
  *
  * You should have received a copy of the GNU General Public License version
  * 2 along with this work; if not, write to the Free Software Foundation,
  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  *
  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  * or visit www.oracle.com if you need additional information or have any
  * questions.
  */

 package sun.security.pkcs11;

 import java.math.BigInteger;

 import java.security.*;
 import java.security.spec.*;

 import javax.crypto.*;
 import javax.crypto.interfaces.*;
 import javax.crypto.spec.*;

 import static sun.security.pkcs11.TemplateManager.*;
 import sun.security.pkcs11.wrapper.*;
 import static sun.security.pkcs11.wrapper.PKCS11Constants.*;

 /**
  * KeyAgreement implementation class. This class currently supports
  * DH.
  *
  * @author  Andreas Sterbenz
  * @since   1.5
  */
 final class P11KeyAgreement extends KeyAgreementSpi {

     // token instance
     private final Token token;

     // algorithm name
     private final String algorithm;

     // mechanism id
     private final long mechanism;

     // private key, if initialized
     private P11Key privateKey;

     // other sides public value ("y"), if doPhase() already called
     private BigInteger publicValue;

     // length of the secret to be derived
     private int secretLen;

     // KeyAgreement from SunJCE as fallback for > 2 party agreement
     private KeyAgreement multiPartyAgreement;

     P11KeyAgreement(Token token, String algorithm, long mechanism) {
         super();
         this.token = token;
         this.algorithm = algorithm;
         this.mechanism = mechanism;
     }

     // see JCE spec
     protected void engineInit(Key key, SecureRandom random)
             throws InvalidKeyException {
         if (key instanceof PrivateKey == false) {
             throw new InvalidKeyException
                         ("Key must be instance of PrivateKey");
         }
         privateKey = P11KeyFactory.convertKey(token, key, algorithm);
         publicValue = null;
         multiPartyAgreement = null;
     }

     // see JCE spec
     protected void engineInit(Key key, AlgorithmParameterSpec params,
             SecureRandom random) throws InvalidKeyException,
             InvalidAlgorithmParameterException {
         if (params != null) {
             throw new InvalidAlgorithmParameterException
                         ("Parameters not supported");
         }
         engineInit(key, random);
     }

     // see JCE spec
     protected Key engineDoPhase(Key key, boolean lastPhase)
             throws InvalidKeyException, IllegalStateException {
         if (privateKey == null) {
             throw new IllegalStateException("Not initialized");
         }
         if (publicValue != null) {
             throw new IllegalStateException("Phase already executed");
         }
         // PKCS#11 only allows key agreement between 2 parties
         // JCE allows >= 2 parties. To support that case (for compatibility
         // and to pass JCK), fall back to SunJCE in this case.
         // NOTE that we initialize using the P11Key, which will fail if it
         // is sensitive/unextractable. However, this is not an issue in the
         // compatibility configuration, which is all we are targeting here.
         if ((multiPartyAgreement != null) || (lastPhase == false)) {
             if (multiPartyAgreement == null) {
                 try {
                     multiPartyAgreement = KeyAgreement.getInstance
                         ("DH", P11Util.getSunJceProvider());
                     multiPartyAgreement.init(privateKey);
                 } catch (NoSuchAlgorithmException e) {
                     throw new InvalidKeyException
                         ("Could not initialize multi party agreement", e);
                 }
             }
             return multiPartyAgreement.doPhase(key, lastPhase);
         }
         if ((key instanceof PublicKey == false)
                 || (key.getAlgorithm().equals(algorithm) == false)) {
             throw new InvalidKeyException
                 ("Key must be a PublicKey with algorithm DH");
         }
         BigInteger p, g, y;
         if (key instanceof DHPublicKey) {
             DHPublicKey dhKey = (DHPublicKey)key;
             y = dhKey.getY();
             DHParameterSpec params = dhKey.getParams();
             p = params.getP();
             g = params.getG();
         } else {
             // normally, DH PublicKeys will always implement DHPublicKey
             // just in case not, attempt conversion
             P11DHKeyFactory kf = new P11DHKeyFactory(token, "DH");
             try {
                 DHPublicKeySpec spec = (DHPublicKeySpec)kf.engineGetKeySpec
                                                 (key, DHPublicKeySpec.class);
                 y = spec.getY();
                 p = spec.getP();
                 g = spec.getG();
             } catch (InvalidKeySpecException e) {
                 throw new InvalidKeyException("Could not obtain key values", e);
             }
         }
         // if parameters of private key are accessible, verify that
         // they match parameters of public key
         // XXX p and g should always be readable, even if the key is sensitive
         if (privateKey instanceof DHPrivateKey) {
             DHPrivateKey dhKey = (DHPrivateKey)privateKey;
             DHParameterSpec params = dhKey.getParams();
             if ((p.equals(params.getP()) == false)
                                 || (g.equals(params.getG()) == false)) {
                 throw new InvalidKeyException
                 ("PublicKey DH parameters must match PrivateKey DH parameters");
             }
         }
         publicValue = y;
         // length of the secret is length of key
         secretLen = (p.bitLength() + 7) >> 3;
         return null;
     }

     // see JCE spec
     protected byte[] engineGenerateSecret() throws IllegalStateException {
         if (multiPartyAgreement != null) {
             byte[] val = multiPartyAgreement.generateSecret();
             multiPartyAgreement = null;
             return val;
         }
         if ((privateKey == null) || (publicValue == null)) {
             throw new IllegalStateException("Not initialized correctly");
         }
         Session session = null;
         try {
             session = token.getOpSession();
             CK_ATTRIBUTE[] attributes = new CK_ATTRIBUTE[] {
                 new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY),
                 new CK_ATTRIBUTE(CKA_KEY_TYPE, CKK_GENERIC_SECRET),
             };
             attributes = token.getAttributes
                 (O_GENERATE, CKO_SECRET_KEY, CKK_GENERIC_SECRET, attributes);
             long keyID = token.p11.C_DeriveKey(session.id(),
                 new CK_MECHANISM(mechanism, publicValue), privateKey.keyID,
                 attributes);
             attributes = new CK_ATTRIBUTE[] {
                 new CK_ATTRIBUTE(CKA_VALUE)
             };
             token.p11.C_GetAttributeValue(session.id(), keyID, attributes);
             byte[] secret = attributes[0].getByteArray();
             token.p11.C_DestroyObject(session.id(), keyID);
             // trim leading 0x00 bytes per JCE convention
             return P11Util.trimZeroes(secret);
         } catch (PKCS11Exception e) {
             throw new ProviderException("Could not derive key", e);
         } finally {
             publicValue = null;
             token.releaseSession(session);
         }
     }

     // see JCE spec
     protected int engineGenerateSecret(byte[] sharedSecret, int
             offset) throws IllegalStateException, ShortBufferException {
         if (multiPartyAgreement != null) {
             int n = multiPartyAgreement.generateSecret(sharedSecret, offset);
             multiPartyAgreement = null;
             return n;
         }
         if (offset + secretLen > sharedSecret.length) {
             throw new ShortBufferException("Need " + secretLen
                 + " bytes, only " + (sharedSecret.length - offset) + " available");
         }
         byte[] secret = engineGenerateSecret();
         System.arraycopy(secret, 0, sharedSecret, offset, secret.length);
         return secret.length;
     }

     // see JCE spec
     protected SecretKey engineGenerateSecret(String algorithm)
             throws IllegalStateException, NoSuchAlgorithmException,
             InvalidKeyException {
         if (multiPartyAgreement != null) {
             SecretKey key = multiPartyAgreement.generateSecret(algorithm);
             multiPartyAgreement = null;
             return key;
         }
         if (algorithm == null) {
             throw new NoSuchAlgorithmException("Algorithm must not be null");
         }
         if (algorithm.equals("TlsPremasterSecret")) {
             // For now, only perform native derivation for TlsPremasterSecret
             // as that is required for FIPS compliance.
             // For other algorithms, there are unresolved issues regarding
             // how this should work in JCE plus a Solaris truncation bug.
             // (bug not yet filed).
             return nativeGenerateSecret(algorithm);
         }
         byte[] secret = engineGenerateSecret();
         // Maintain compatibility for SunJCE:
         // verify secret length is sensible for algorithm / truncate
         // return generated key itself if possible
         int keyLen;
         if (algorithm.equalsIgnoreCase("DES")) {
             keyLen = 8;
         } else if (algorithm.equalsIgnoreCase("DESede")) {
             keyLen = 24;
         } else if (algorithm.equalsIgnoreCase("Blowfish")) {
             keyLen = Math.min(56, secret.length);
         } else if (algorithm.equalsIgnoreCase("TlsPremasterSecret")) {
             keyLen = secret.length;
         } else {
             throw new NoSuchAlgorithmException
                 ("Unknown algorithm " + algorithm);
         }
         if (secret.length < keyLen) {
             throw new InvalidKeyException("Secret too short");
         }
         if (algorithm.equalsIgnoreCase("DES") ||
             algorithm.equalsIgnoreCase("DESede")) {
                 for (int i = 0; i < keyLen; i+=8) {
                     P11SecretKeyFactory.fixDESParity(secret, i);
                 }
         }
         return new SecretKeySpec(secret, 0, keyLen, algorithm);
     }

     private SecretKey nativeGenerateSecret(String algorithm)
             throws IllegalStateException, NoSuchAlgorithmException,
             InvalidKeyException {
         if ((privateKey == null) || (publicValue == null)) {
             throw new IllegalStateException("Not initialized correctly");
         }
         long keyType = CKK_GENERIC_SECRET;
         Session session = null;
         try {
             session = token.getObjSession();
             CK_ATTRIBUTE[] attributes = new CK_ATTRIBUTE[] {
                 new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY),
                 new CK_ATTRIBUTE(CKA_KEY_TYPE, keyType),
             };
             attributes = token.getAttributes
                 (O_GENERATE, CKO_SECRET_KEY, keyType, attributes);
             long keyID = token.p11.C_DeriveKey(session.id(),
                 new CK_MECHANISM(mechanism, publicValue), privateKey.keyID,
                 attributes);
             CK_ATTRIBUTE[] lenAttributes = new CK_ATTRIBUTE[] {
                 new CK_ATTRIBUTE(CKA_VALUE_LEN),
             };
             token.p11.C_GetAttributeValue(session.id(), keyID, lenAttributes);
             int keyLen = (int)lenAttributes[0].getLong();
             SecretKey key = P11Key.secretKey
                         (session, keyID, algorithm, keyLen << 3, attributes);
             if ("RAW".equals(key.getFormat())) {
                 // Workaround for Solaris bug 6318543.
                 // Strip leading zeroes ourselves if possible (key not sensitive).
                 // This should be removed once the Solaris fix is available
                 // as here we always retrieve the CKA_VALUE even for tokens
                 // that do not have that bug.
                 byte[] keyBytes = key.getEncoded();
                 byte[] newBytes = P11Util.trimZeroes(keyBytes);
                 if (keyBytes != newBytes) {
                     key = new SecretKeySpec(newBytes, algorithm);
                 }
             }
             return key;
         } catch (PKCS11Exception e) {
             throw new InvalidKeyException("Could not derive key", e);
         } finally {
             publicValue = null;
             token.releaseSession(session);
         }
     }

 }
	/*
	* Copyright (c) 2003, 2007, Oracle and/or its affiliates. All rights reserved.
	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	*
	* This code is free software; you can redistribute it and/or modify it
	* under the terms of the GNU General Public License version 2 only, as
	* published by the Free Software Foundation. Oracle designates this
	* particular file as subject to the "Classpath" exception as provided
	* by Oracle in the LICENSE file that accompanied this code.
	*
	* This code is distributed in the hope that it will be useful, but WITHOUT
	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	* version 2 for more details (a copy is included in the LICENSE file that
	* accompanied this code).
	*
	* You should have received a copy of the GNU General Public License version
	* 2 along with this work; if not, write to the Free Software Foundation,
	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	*
	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	* or visit www.oracle.com if you need additional information or have any
	* questions.
	*/

	package sun.security.pkcs11;

	import java.math.BigInteger;

	import java.security.*;
	import java.security.spec.*;

	import javax.crypto.*;
	import javax.crypto.interfaces.*;
	import javax.crypto.spec.*;

	import static sun.security.pkcs11.TemplateManager.*;
	import sun.security.pkcs11.wrapper.*;
	import static sun.security.pkcs11.wrapper.PKCS11Constants.*;

	/**
	* KeyAgreement implementation class. This class currently supports
	* DH.
	*
	* @author Andreas Sterbenz
	* @since 1.5
	*/
	final class P11KeyAgreement extends KeyAgreementSpi {

	// token instance
	private final Token token;

	// algorithm name
	private final String algorithm;

	// mechanism id
	private final long mechanism;

	// private key, if initialized
	private P11Key privateKey;

	// other sides public value ("y"), if doPhase() already called
	private BigInteger publicValue;

	// length of the secret to be derived
	private int secretLen;

	// KeyAgreement from SunJCE as fallback for > 2 party agreement
	private KeyAgreement multiPartyAgreement;

	P11KeyAgreement(Token token, String algorithm, long mechanism) {
	super();
	this.token = token;
	this.algorithm = algorithm;
	this.mechanism = mechanism;
	}

	// see JCE spec
	protected void engineInit(Key key, SecureRandom random)
	throws InvalidKeyException {
	if (key instanceof PrivateKey == false) {
	throw new InvalidKeyException
	("Key must be instance of PrivateKey");
	}
	privateKey = P11KeyFactory.convertKey(token, key, algorithm);
	publicValue = null;
	multiPartyAgreement = null;
	}

	// see JCE spec
	protected void engineInit(Key key, AlgorithmParameterSpec params,
	SecureRandom random) throws InvalidKeyException,
	InvalidAlgorithmParameterException {
	if (params != null) {
	throw new InvalidAlgorithmParameterException
	("Parameters not supported");
	}
	engineInit(key, random);
	}

	// see JCE spec
	protected Key engineDoPhase(Key key, boolean lastPhase)
	throws InvalidKeyException, IllegalStateException {
	if (privateKey == null) {
	throw new IllegalStateException("Not initialized");
	}
	if (publicValue != null) {
	throw new IllegalStateException("Phase already executed");
	}
	// PKCS#11 only allows key agreement between 2 parties
	// JCE allows >= 2 parties. To support that case (for compatibility
	// and to pass JCK), fall back to SunJCE in this case.
	// NOTE that we initialize using the P11Key, which will fail if it
	// is sensitive/unextractable. However, this is not an issue in the
	// compatibility configuration, which is all we are targeting here.
	if ((multiPartyAgreement != null) \|\| (lastPhase == false)) {
	if (multiPartyAgreement == null) {
	try {
	multiPartyAgreement = KeyAgreement.getInstance
	("DH", P11Util.getSunJceProvider());
	multiPartyAgreement.init(privateKey);
	} catch (NoSuchAlgorithmException e) {
	throw new InvalidKeyException
	("Could not initialize multi party agreement", e);
	}
	}
	return multiPartyAgreement.doPhase(key, lastPhase);
	}
	if ((key instanceof PublicKey == false)
	\|\| (key.getAlgorithm().equals(algorithm) == false)) {
	throw new InvalidKeyException
	("Key must be a PublicKey with algorithm DH");
	}
	BigInteger p, g, y;
	if (key instanceof DHPublicKey) {
	DHPublicKey dhKey = (DHPublicKey)key;
	y = dhKey.getY();
	DHParameterSpec params = dhKey.getParams();
	p = params.getP();
	g = params.getG();
	} else {
	// normally, DH PublicKeys will always implement DHPublicKey
	// just in case not, attempt conversion
	P11DHKeyFactory kf = new P11DHKeyFactory(token, "DH");
	try {
	DHPublicKeySpec spec = (DHPublicKeySpec)kf.engineGetKeySpec
	(key, DHPublicKeySpec.class);
	y = spec.getY();
	p = spec.getP();
	g = spec.getG();
	} catch (InvalidKeySpecException e) {
	throw new InvalidKeyException("Could not obtain key values", e);
	}
	}
	// if parameters of private key are accessible, verify that
	// they match parameters of public key
	// XXX p and g should always be readable, even if the key is sensitive
	if (privateKey instanceof DHPrivateKey) {
	DHPrivateKey dhKey = (DHPrivateKey)privateKey;
	DHParameterSpec params = dhKey.getParams();
	if ((p.equals(params.getP()) == false)
	\|\| (g.equals(params.getG()) == false)) {
	throw new InvalidKeyException
	("PublicKey DH parameters must match PrivateKey DH parameters");
	}
	}
	publicValue = y;
	// length of the secret is length of key
	secretLen = (p.bitLength() + 7) >> 3;
	return null;
	}

	// see JCE spec
	protected byte[] engineGenerateSecret() throws IllegalStateException {
	if (multiPartyAgreement != null) {
	byte[] val = multiPartyAgreement.generateSecret();
	multiPartyAgreement = null;
	return val;
	}
	if ((privateKey == null) \|\| (publicValue == null)) {
	throw new IllegalStateException("Not initialized correctly");
	}
	Session session = null;
	try {
	session = token.getOpSession();
	CK_ATTRIBUTE[] attributes = new CK_ATTRIBUTE[] {
	new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY),
	new CK_ATTRIBUTE(CKA_KEY_TYPE, CKK_GENERIC_SECRET),
	};
	attributes = token.getAttributes
	(O_GENERATE, CKO_SECRET_KEY, CKK_GENERIC_SECRET, attributes);
	long keyID = token.p11.C_DeriveKey(session.id(),
	new CK_MECHANISM(mechanism, publicValue), privateKey.keyID,
	attributes);
	attributes = new CK_ATTRIBUTE[] {
	new CK_ATTRIBUTE(CKA_VALUE)
	};
	token.p11.C_GetAttributeValue(session.id(), keyID, attributes);
	byte[] secret = attributes[0].getByteArray();
	token.p11.C_DestroyObject(session.id(), keyID);
	// trim leading 0x00 bytes per JCE convention
	return P11Util.trimZeroes(secret);
	} catch (PKCS11Exception e) {
	throw new ProviderException("Could not derive key", e);
	} finally {
	publicValue = null;
	token.releaseSession(session);
	}
	}

	// see JCE spec
	protected int engineGenerateSecret(byte[] sharedSecret, int
	offset) throws IllegalStateException, ShortBufferException {
	if (multiPartyAgreement != null) {
	int n = multiPartyAgreement.generateSecret(sharedSecret, offset);
	multiPartyAgreement = null;
	return n;
	}
	if (offset + secretLen > sharedSecret.length) {
	throw new ShortBufferException("Need " + secretLen
	+ " bytes, only " + (sharedSecret.length - offset) + " available");
	}
	byte[] secret = engineGenerateSecret();
	System.arraycopy(secret, 0, sharedSecret, offset, secret.length);
	return secret.length;
	}

	// see JCE spec
	protected SecretKey engineGenerateSecret(String algorithm)
	throws IllegalStateException, NoSuchAlgorithmException,
	InvalidKeyException {
	if (multiPartyAgreement != null) {
	SecretKey key = multiPartyAgreement.generateSecret(algorithm);
	multiPartyAgreement = null;
	return key;
	}
	if (algorithm == null) {
	throw new NoSuchAlgorithmException("Algorithm must not be null");
	}
	if (algorithm.equals("TlsPremasterSecret")) {
	// For now, only perform native derivation for TlsPremasterSecret
	// as that is required for FIPS compliance.
	// For other algorithms, there are unresolved issues regarding
	// how this should work in JCE plus a Solaris truncation bug.
	// (bug not yet filed).
	return nativeGenerateSecret(algorithm);
	}
	byte[] secret = engineGenerateSecret();
	// Maintain compatibility for SunJCE:
	// verify secret length is sensible for algorithm / truncate
	// return generated key itself if possible
	int keyLen;
	if (algorithm.equalsIgnoreCase("DES")) {
	keyLen = 8;
	} else if (algorithm.equalsIgnoreCase("DESede")) {
	keyLen = 24;
	} else if (algorithm.equalsIgnoreCase("Blowfish")) {
	keyLen = Math.min(56, secret.length);
	} else if (algorithm.equalsIgnoreCase("TlsPremasterSecret")) {
	keyLen = secret.length;
	} else {
	throw new NoSuchAlgorithmException
	("Unknown algorithm " + algorithm);
	}
	if (secret.length < keyLen) {
	throw new InvalidKeyException("Secret too short");
	}
	if (algorithm.equalsIgnoreCase("DES") \|\|
	algorithm.equalsIgnoreCase("DESede")) {
	for (int i = 0; i < keyLen; i+=8) {
	P11SecretKeyFactory.fixDESParity(secret, i);
	}
	}
	return new SecretKeySpec(secret, 0, keyLen, algorithm);
	}

	private SecretKey nativeGenerateSecret(String algorithm)
	throws IllegalStateException, NoSuchAlgorithmException,
	InvalidKeyException {
	if ((privateKey == null) \|\| (publicValue == null)) {
	throw new IllegalStateException("Not initialized correctly");
	}
	long keyType = CKK_GENERIC_SECRET;
	Session session = null;
	try {
	session = token.getObjSession();
	CK_ATTRIBUTE[] attributes = new CK_ATTRIBUTE[] {
	new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY),
	new CK_ATTRIBUTE(CKA_KEY_TYPE, keyType),
	};
	attributes = token.getAttributes
	(O_GENERATE, CKO_SECRET_KEY, keyType, attributes);
	long keyID = token.p11.C_DeriveKey(session.id(),
	new CK_MECHANISM(mechanism, publicValue), privateKey.keyID,
	attributes);
	CK_ATTRIBUTE[] lenAttributes = new CK_ATTRIBUTE[] {
	new CK_ATTRIBUTE(CKA_VALUE_LEN),
	};
	token.p11.C_GetAttributeValue(session.id(), keyID, lenAttributes);
	int keyLen = (int)lenAttributes[0].getLong();
	SecretKey key = P11Key.secretKey
	(session, keyID, algorithm, keyLen << 3, attributes);
	if ("RAW".equals(key.getFormat())) {
	// Workaround for Solaris bug 6318543.
	// Strip leading zeroes ourselves if possible (key not sensitive).
	// This should be removed once the Solaris fix is available
	// as here we always retrieve the CKA_VALUE even for tokens
	// that do not have that bug.
	byte[] keyBytes = key.getEncoded();
	byte[] newBytes = P11Util.trimZeroes(keyBytes);
	if (keyBytes != newBytes) {
	key = new SecretKeySpec(newBytes, algorithm);
	}
	}
	return key;
	} catch (PKCS11Exception e) {
	throw new InvalidKeyException("Could not derive key", e);
	} finally {
	publicValue = null;
	token.releaseSession(session);
	}
	}

	}