src/share/classes/sun/security/pkcs11/P11KeyGenerator.java - toolchain/jdk/jdk9_jdk - Git at Google

 /*
  * Copyright (c) 2003, 2008, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License version 2 only, as
  * published by the Free Software Foundation.  Oracle designates this
  * particular file as subject to the "Classpath" exception as provided
  * by Oracle in the LICENSE file that accompanied this code.
  *
  * This code is distributed in the hope that it will be useful, but WITHOUT
  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * version 2 for more details (a copy is included in the LICENSE file that
  * accompanied this code).
  *
  * You should have received a copy of the GNU General Public License version
  * 2 along with this work; if not, write to the Free Software Foundation,
  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  *
  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  * or visit www.oracle.com if you need additional information or have any
  * questions.
  */

 package sun.security.pkcs11;

 import java.security.*;
 import java.security.spec.AlgorithmParameterSpec;

 import javax.crypto.*;

 import static sun.security.pkcs11.TemplateManager.*;
 import sun.security.pkcs11.wrapper.*;
 import static sun.security.pkcs11.wrapper.PKCS11Constants.*;

 /**
  * KeyGenerator implementation class. This class currently supports
  * DES, DESede, AES, ARCFOUR, and Blowfish.
  *
  * @author  Andreas Sterbenz
  * @since   1.5
  */
 final class P11KeyGenerator extends KeyGeneratorSpi {

     // token instance
     private final Token token;

     // algorithm name
     private final String algorithm;

     // mechanism id
     private long mechanism;

     // raw key size in bits, e.g. 64 for DES. Always valid.
     private int keySize;

     // bits of entropy in the key, e.g. 56 for DES. Always valid.
     private int significantKeySize;

     // keyType (CKK_*), needed for TemplateManager call only.
     private long keyType;

     // for determining if both 112 and 168 bits of DESede key lengths
     // are supported.
     private boolean supportBothKeySizes;

     /**
      * Utility method for checking if the specified key size is valid
      * and within the supported range. Return the significant key size
      * upon successful validation.
      * @param keyGenMech the PKCS#11 key generation mechanism.
      * @param keySize the to-be-checked key size for this mechanism.
      * @param token token which provides this mechanism.
      * @return the significant key size (in bits) corresponding to the
      * specified key size.
      * @throws InvalidParameterException if the specified key size is invalid.
      * @throws ProviderException if this mechanism isn't supported by SunPKCS11
      * or underlying native impl.
      */
     static int checkKeySize(long keyGenMech, int keySize, Token token)
         throws InvalidAlgorithmParameterException, ProviderException {
         int sigKeySize;
         switch ((int)keyGenMech) {
             case (int)CKM_DES_KEY_GEN:
                 if ((keySize != 64) && (keySize != 56)) {
                     throw new InvalidAlgorithmParameterException
                             ("DES key length must be 56 bits");
                 }
                 sigKeySize = 56;
                 break;
             case (int)CKM_DES2_KEY_GEN:
             case (int)CKM_DES3_KEY_GEN:
                 if ((keySize == 112) || (keySize == 128)) {
                     sigKeySize = 112;
                 } else if ((keySize == 168) || (keySize == 192)) {
                     sigKeySize = 168;
                 } else {
                     throw new InvalidAlgorithmParameterException
                             ("DESede key length must be 112, or 168 bits");
                 }
                 break;
             default:
                 // Handle all variable-key-length algorithms here
                 CK_MECHANISM_INFO info = null;
                 try {
                     info = token.getMechanismInfo(keyGenMech);
                 } catch (PKCS11Exception p11e) {
                     // Should never happen
                     throw new ProviderException
                             ("Cannot retrieve mechanism info", p11e);
                 }
                 if (info == null) {
                     // XXX Unable to retrieve the supported key length from
                     // the underlying native impl. Skip the checking for now.
                     return keySize;
                 }
                 // PKCS#11 defines these to be in number of bytes except for
                 // RC4 which is in bits. However, some PKCS#11 impls still use
                 // bytes for all mechs, e.g. NSS. We try to detect this
                 // inconsistency if the minKeySize seems unreasonably small.
                 int minKeySize = (int)info.ulMinKeySize;
                 int maxKeySize = (int)info.ulMaxKeySize;
                 if (keyGenMech != CKM_RC4_KEY_GEN || minKeySize < 8) {
                     minKeySize = (int)info.ulMinKeySize << 3;
                     maxKeySize = (int)info.ulMaxKeySize << 3;
                 }
                 // Explicitly disallow keys shorter than 40-bits for security
                 if (minKeySize < 40) minKeySize = 40;
                 if (keySize < minKeySize || keySize > maxKeySize) {
                     throw new InvalidAlgorithmParameterException
                             ("Key length must be between " + minKeySize +
                             " and " + maxKeySize + " bits");
                 }
                 if (keyGenMech == CKM_AES_KEY_GEN) {
                     if ((keySize != 128) && (keySize != 192) &&
                         (keySize != 256)) {
                         throw new InvalidAlgorithmParameterException
                                 ("AES key length must be " + minKeySize +
                                 (maxKeySize >= 192? ", 192":"") +
                                 (maxKeySize >= 256? ", or 256":"") + " bits");
                     }
                 }
                 sigKeySize = keySize;
         }
         return sigKeySize;
     }

     P11KeyGenerator(Token token, String algorithm, long mechanism)
             throws PKCS11Exception {
         super();
         this.token = token;
         this.algorithm = algorithm;
         this.mechanism = mechanism;

         if (this.mechanism == CKM_DES3_KEY_GEN) {
             /* Given the current lookup order specified in SunPKCS11.java,
                if CKM_DES2_KEY_GEN is used to construct this object, it
                means that CKM_DES3_KEY_GEN is disabled or unsupported.
             */
             supportBothKeySizes =
                 (token.provider.config.isEnabled(CKM_DES2_KEY_GEN) &&
                  (token.getMechanismInfo(CKM_DES2_KEY_GEN) != null));
         }
         setDefaultKeySize();
     }

     // set default keysize and also initialize keyType
     private void setDefaultKeySize() {
         switch ((int)mechanism) {
         case (int)CKM_DES_KEY_GEN:
             keySize = 64;
             keyType = CKK_DES;
             break;
         case (int)CKM_DES2_KEY_GEN:
             keySize = 128;
             keyType = CKK_DES2;
             break;
         case (int)CKM_DES3_KEY_GEN:
             keySize = 192;
             keyType = CKK_DES3;
             break;
         case (int)CKM_AES_KEY_GEN:
             keySize = 128;
             keyType = CKK_AES;
             break;
         case (int)CKM_RC4_KEY_GEN:
             keySize = 128;
             keyType = CKK_RC4;
             break;
         case (int)CKM_BLOWFISH_KEY_GEN:
             keySize = 128;
             keyType = CKK_BLOWFISH;
             break;
         default:
             throw new ProviderException("Unknown mechanism " + mechanism);
         }
         try {
             significantKeySize = checkKeySize(mechanism, keySize, token);
         } catch (InvalidAlgorithmParameterException iape) {
             throw new ProviderException("Unsupported default key size", iape);
         }
     }

     // see JCE spec
     protected void engineInit(SecureRandom random) {
         token.ensureValid();
         setDefaultKeySize();
     }

     // see JCE spec
     protected void engineInit(AlgorithmParameterSpec params,
             SecureRandom random) throws InvalidAlgorithmParameterException {
         throw new InvalidAlgorithmParameterException
                 ("AlgorithmParameterSpec not supported");
     }

     // see JCE spec
     protected void engineInit(int keySize, SecureRandom random) {
         token.ensureValid();
         int newSignificantKeySize;
         try {
             newSignificantKeySize = checkKeySize(mechanism, keySize, token);
         } catch (InvalidAlgorithmParameterException iape) {
             throw (InvalidParameterException)
                     (new InvalidParameterException().initCause(iape));
         }
         if ((mechanism == CKM_DES2_KEY_GEN) ||
             (mechanism == CKM_DES3_KEY_GEN))  {
             long newMechanism = (newSignificantKeySize == 112 ?
                 CKM_DES2_KEY_GEN : CKM_DES3_KEY_GEN);
             if (mechanism != newMechanism) {
                 if (supportBothKeySizes) {
                     mechanism = newMechanism;
                     // Adjust keyType to reflect the mechanism change
                     keyType = (mechanism == CKM_DES2_KEY_GEN ?
                         CKK_DES2 : CKK_DES3);
                 } else {
                     throw new InvalidParameterException
                             ("Only " + significantKeySize +
                              "-bit DESede is supported");
                 }
             }
         }
         this.keySize = keySize;
         this.significantKeySize = newSignificantKeySize;
     }

     // see JCE spec
     protected SecretKey engineGenerateKey() {
         Session session = null;
         try {
             session = token.getObjSession();
             CK_ATTRIBUTE[] attributes;
             switch ((int)keyType) {
             case (int)CKK_DES:
             case (int)CKK_DES2:
             case (int)CKK_DES3:
                 // fixed length, do not specify CKA_VALUE_LEN
                 attributes = new CK_ATTRIBUTE[] {
                     new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY),
                 };
                 break;
             default:
                 attributes = new CK_ATTRIBUTE[] {
                     new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY),
                     new CK_ATTRIBUTE(CKA_VALUE_LEN, keySize >> 3),
                 };
                 break;
             }
             attributes = token.getAttributes
                 (O_GENERATE, CKO_SECRET_KEY, keyType, attributes);
             long keyID = token.p11.C_GenerateKey
                 (session.id(), new CK_MECHANISM(mechanism), attributes);
             return P11Key.secretKey
                 (session, keyID, algorithm, significantKeySize, attributes);
         } catch (PKCS11Exception e) {
             throw new ProviderException("Could not generate key", e);
         } finally {
             token.releaseSession(session);
         }
     }

 }
	/*
	* Copyright (c) 2003, 2008, Oracle and/or its affiliates. All rights reserved.
	* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
	*
	* This code is free software; you can redistribute it and/or modify it
	* under the terms of the GNU General Public License version 2 only, as
	* published by the Free Software Foundation. Oracle designates this
	* particular file as subject to the "Classpath" exception as provided
	* by Oracle in the LICENSE file that accompanied this code.
	*
	* This code is distributed in the hope that it will be useful, but WITHOUT
	* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
	* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
	* version 2 for more details (a copy is included in the LICENSE file that
	* accompanied this code).
	*
	* You should have received a copy of the GNU General Public License version
	* 2 along with this work; if not, write to the Free Software Foundation,
	* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
	*
	* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
	* or visit www.oracle.com if you need additional information or have any
	* questions.
	*/

	package sun.security.pkcs11;

	import java.security.*;
	import java.security.spec.AlgorithmParameterSpec;

	import javax.crypto.*;

	import static sun.security.pkcs11.TemplateManager.*;
	import sun.security.pkcs11.wrapper.*;
	import static sun.security.pkcs11.wrapper.PKCS11Constants.*;

	/**
	* KeyGenerator implementation class. This class currently supports
	* DES, DESede, AES, ARCFOUR, and Blowfish.
	*
	* @author Andreas Sterbenz
	* @since 1.5
	*/
	final class P11KeyGenerator extends KeyGeneratorSpi {

	// token instance
	private final Token token;

	// algorithm name
	private final String algorithm;

	// mechanism id
	private long mechanism;

	// raw key size in bits, e.g. 64 for DES. Always valid.
	private int keySize;

	// bits of entropy in the key, e.g. 56 for DES. Always valid.
	private int significantKeySize;

	// keyType (CKK_*), needed for TemplateManager call only.
	private long keyType;

	// for determining if both 112 and 168 bits of DESede key lengths
	// are supported.
	private boolean supportBothKeySizes;

	/**
	* Utility method for checking if the specified key size is valid
	* and within the supported range. Return the significant key size
	* upon successful validation.
	* @param keyGenMech the PKCS#11 key generation mechanism.
	* @param keySize the to-be-checked key size for this mechanism.
	* @param token token which provides this mechanism.
	* @return the significant key size (in bits) corresponding to the
	* specified key size.
	* @throws InvalidParameterException if the specified key size is invalid.
	* @throws ProviderException if this mechanism isn't supported by SunPKCS11
	* or underlying native impl.
	*/
	static int checkKeySize(long keyGenMech, int keySize, Token token)
	throws InvalidAlgorithmParameterException, ProviderException {
	int sigKeySize;
	switch ((int)keyGenMech) {
	case (int)CKM_DES_KEY_GEN:
	if ((keySize != 64) && (keySize != 56)) {
	throw new InvalidAlgorithmParameterException
	("DES key length must be 56 bits");
	}
	sigKeySize = 56;
	break;
	case (int)CKM_DES2_KEY_GEN:
	case (int)CKM_DES3_KEY_GEN:
	if ((keySize == 112) \|\| (keySize == 128)) {
	sigKeySize = 112;
	} else if ((keySize == 168) \|\| (keySize == 192)) {
	sigKeySize = 168;
	} else {
	throw new InvalidAlgorithmParameterException
	("DESede key length must be 112, or 168 bits");
	}
	break;
	default:
	// Handle all variable-key-length algorithms here
	CK_MECHANISM_INFO info = null;
	try {
	info = token.getMechanismInfo(keyGenMech);
	} catch (PKCS11Exception p11e) {
	// Should never happen
	throw new ProviderException
	("Cannot retrieve mechanism info", p11e);
	}
	if (info == null) {
	// XXX Unable to retrieve the supported key length from
	// the underlying native impl. Skip the checking for now.
	return keySize;
	}
	// PKCS#11 defines these to be in number of bytes except for
	// RC4 which is in bits. However, some PKCS#11 impls still use
	// bytes for all mechs, e.g. NSS. We try to detect this
	// inconsistency if the minKeySize seems unreasonably small.
	int minKeySize = (int)info.ulMinKeySize;
	int maxKeySize = (int)info.ulMaxKeySize;
	if (keyGenMech != CKM_RC4_KEY_GEN \|\| minKeySize < 8) {
	minKeySize = (int)info.ulMinKeySize << 3;
	maxKeySize = (int)info.ulMaxKeySize << 3;
	}
	// Explicitly disallow keys shorter than 40-bits for security
	if (minKeySize < 40) minKeySize = 40;
	if (keySize < minKeySize \|\| keySize > maxKeySize) {
	throw new InvalidAlgorithmParameterException
	("Key length must be between " + minKeySize +
	" and " + maxKeySize + " bits");
	}
	if (keyGenMech == CKM_AES_KEY_GEN) {
	if ((keySize != 128) && (keySize != 192) &&
	(keySize != 256)) {
	throw new InvalidAlgorithmParameterException
	("AES key length must be " + minKeySize +
	(maxKeySize >= 192? ", 192":"") +
	(maxKeySize >= 256? ", or 256":"") + " bits");
	}
	}
	sigKeySize = keySize;
	}
	return sigKeySize;
	}

	P11KeyGenerator(Token token, String algorithm, long mechanism)
	throws PKCS11Exception {
	super();
	this.token = token;
	this.algorithm = algorithm;
	this.mechanism = mechanism;

	if (this.mechanism == CKM_DES3_KEY_GEN) {
	/* Given the current lookup order specified in SunPKCS11.java,
	if CKM_DES2_KEY_GEN is used to construct this object, it
	means that CKM_DES3_KEY_GEN is disabled or unsupported.
	*/
	supportBothKeySizes =
	(token.provider.config.isEnabled(CKM_DES2_KEY_GEN) &&
	(token.getMechanismInfo(CKM_DES2_KEY_GEN) != null));
	}
	setDefaultKeySize();
	}

	// set default keysize and also initialize keyType
	private void setDefaultKeySize() {
	switch ((int)mechanism) {
	case (int)CKM_DES_KEY_GEN:
	keySize = 64;
	keyType = CKK_DES;
	break;
	case (int)CKM_DES2_KEY_GEN:
	keySize = 128;
	keyType = CKK_DES2;
	break;
	case (int)CKM_DES3_KEY_GEN:
	keySize = 192;
	keyType = CKK_DES3;
	break;
	case (int)CKM_AES_KEY_GEN:
	keySize = 128;
	keyType = CKK_AES;
	break;
	case (int)CKM_RC4_KEY_GEN:
	keySize = 128;
	keyType = CKK_RC4;
	break;
	case (int)CKM_BLOWFISH_KEY_GEN:
	keySize = 128;
	keyType = CKK_BLOWFISH;
	break;
	default:
	throw new ProviderException("Unknown mechanism " + mechanism);
	}
	try {
	significantKeySize = checkKeySize(mechanism, keySize, token);
	} catch (InvalidAlgorithmParameterException iape) {
	throw new ProviderException("Unsupported default key size", iape);
	}
	}

	// see JCE spec
	protected void engineInit(SecureRandom random) {
	token.ensureValid();
	setDefaultKeySize();
	}

	// see JCE spec
	protected void engineInit(AlgorithmParameterSpec params,
	SecureRandom random) throws InvalidAlgorithmParameterException {
	throw new InvalidAlgorithmParameterException
	("AlgorithmParameterSpec not supported");
	}

	// see JCE spec
	protected void engineInit(int keySize, SecureRandom random) {
	token.ensureValid();
	int newSignificantKeySize;
	try {
	newSignificantKeySize = checkKeySize(mechanism, keySize, token);
	} catch (InvalidAlgorithmParameterException iape) {
	throw (InvalidParameterException)
	(new InvalidParameterException().initCause(iape));
	}
	if ((mechanism == CKM_DES2_KEY_GEN) \|\|
	(mechanism == CKM_DES3_KEY_GEN)) {
	long newMechanism = (newSignificantKeySize == 112 ?
	CKM_DES2_KEY_GEN : CKM_DES3_KEY_GEN);
	if (mechanism != newMechanism) {
	if (supportBothKeySizes) {
	mechanism = newMechanism;
	// Adjust keyType to reflect the mechanism change
	keyType = (mechanism == CKM_DES2_KEY_GEN ?
	CKK_DES2 : CKK_DES3);
	} else {
	throw new InvalidParameterException
	("Only " + significantKeySize +
	"-bit DESede is supported");
	}
	}
	}
	this.keySize = keySize;
	this.significantKeySize = newSignificantKeySize;
	}

	// see JCE spec
	protected SecretKey engineGenerateKey() {
	Session session = null;
	try {
	session = token.getObjSession();
	CK_ATTRIBUTE[] attributes;
	switch ((int)keyType) {
	case (int)CKK_DES:
	case (int)CKK_DES2:
	case (int)CKK_DES3:
	// fixed length, do not specify CKA_VALUE_LEN
	attributes = new CK_ATTRIBUTE[] {
	new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY),
	};
	break;
	default:
	attributes = new CK_ATTRIBUTE[] {
	new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY),
	new CK_ATTRIBUTE(CKA_VALUE_LEN, keySize >> 3),
	};
	break;
	}
	attributes = token.getAttributes
	(O_GENERATE, CKO_SECRET_KEY, keyType, attributes);
	long keyID = token.p11.C_GenerateKey
	(session.id(), new CK_MECHANISM(mechanism), attributes);
	return P11Key.secretKey
	(session, keyID, algorithm, significantKeySize, attributes);
	} catch (PKCS11Exception e) {
	throw new ProviderException("Could not generate key", e);
	} finally {
	token.releaseSession(session);
	}
	}

	}