org.keyczar.exceptions.KeyczarException Java Examples

@Test
public void testEncryptKey() throws KeyczarException {
  GenericKeyczar key = Util.createKey(DefaultKeyType.AES, KeyPurpose.DECRYPT_AND_ENCRYPT);

  KeyczarKey k = key.getKey(key.getMetadata().getPrimaryVersion());
  String unencryptedKey = k.toString();
  String encrypted = KeyczarPBEReader.encryptKey(unencryptedKey, PASSPHRASE);

  PBEKeyczarKey pbeKey = KeyczarPBEReader.parsePBEMetadata(encrypted);
  assertEquals(KeyczarPBEReader.DEFAULT_ITERATION_COUNT, pbeKey.iterationCount);
  assertEquals(KeyczarPBEReader.SALT_BYTES, Base64Coder.decodeWebSafe(pbeKey.salt).length);
  assertEquals(KeyczarPBEReader.PBE_AES_KEY_BYTES, Base64Coder.decodeWebSafe(pbeKey.iv).length);

  // decrypt the key
  KeyczarPBEReader reader = new KeyczarPBEReader(null, PASSPHRASE);
  String out = reader.decryptKey(encrypted);
  assertEquals(unencryptedKey, out);
}
 

@Override
protected MitroRPC processCommand(MitroRequestContext context)
    throws IOException, SQLException, MitroServletException {
  RPC.CheckTwoFactorRequiredRequest in = gson.fromJson(context.jsonRequest,
      RPC.CheckTwoFactorRequiredRequest.class);
  String url = null;
  // url stays null if 2fa isn't enabled. else, changes to 2fa login page
  if (context.requestor.isTwoFactorAuthEnabled()) {
    String token = GetMyPrivateKey.makeLoginTokenString(context.requestor,
        in.extensionId, in.deviceId);
    String signedToken;
    try {
      signedToken = TwoFactorSigningService.signToken(token);
    } catch (KeyczarException e) {
      throw new MitroServletException(e);
    }
    url = context.requestServerUrl + "/mitro-core/TwoFactorAuth?token="
        + URLEncoder.encode(token, "UTF-8") + "&signature="
        + URLEncoder.encode(signedToken, "UTF-8");
  }
  RPC.CheckTwoFactorRequiredResponse out = new RPC.CheckTwoFactorRequiredResponse();
  out.twoFactorUrl = url;
  return out;
}
 

@Test
public void testWriteEncrypted() throws KeyczarException {
  GenericKeyczar keyczar = makeKey();

  final String PASSWORD = "foopassword";
  StringBuilder builder = new StringBuilder();
  JsonWriter.writeEncrypted(keyczar, PASSWORD, builder);
  String serialized = builder.toString();

  JsonParser parser = new JsonParser();
  JsonElement element = parser.parse(serialized);
  String metadata = element.getAsJsonObject().getAsJsonPrimitive("meta").getAsString();
  element = parser.parse(metadata);
  JsonPrimitive p = element.getAsJsonObject().getAsJsonPrimitive("encrypted");
  assertTrue(p.getAsBoolean());

  KeyczarReader reader = new KeyczarJsonReader(serialized);
  KeyczarPBEReader pbeReader = new KeyczarPBEReader(reader, PASSWORD);
  Crypter c = new Crypter(pbeReader);
  assertEquals("hello", c.decrypt(c.encrypt("hello")));
}
 

@Test
public void testCreateExportKey() throws KeyczarException {
	// create the key, export the public key; 1024 bits is the smallest size
	GenericKeyczar keyczar = Util.createKey(
	    DefaultKeyType.RSA_PRIV, KeyPurpose.DECRYPT_AND_ENCRYPT, 1024);
	KeyczarReader publicKeyReader = Util.exportPublicKeys(keyczar);
	Encrypter encrypter = new Encrypter(publicKeyReader);

	// test that it works
	String ciphertext = encrypter.encrypt(MESSAGE);
	Crypter crypter = new Crypter(Util.readerFromKeyczar(keyczar));
	String decrypted = crypter.decrypt(ciphertext);
	assertEquals(MESSAGE, decrypted);

	// test a session
	StringBuilder longMessage = new StringBuilder("hello message ");
	while (longMessage.length() < 500) {
		longMessage.append(longMessage);
	}

	ciphertext = Util.encryptWithSession(encrypter, longMessage.toString());
	assertEquals(longMessage.toString(), Util.decryptWithSession(crypter, ciphertext));
}
 

@Test
public void testSimple() throws KeyczarException {
	KeyczarReader reader = new KeyczarJsonReader(JSON_KEY);
	KeyMetadata metadata = KeyMetadata.read(reader.getMetadata());
	assertEquals(0, metadata.getPrimaryVersion().getVersionNumber());
	assertEquals(KeyPurpose.DECRYPT_AND_ENCRYPT, metadata.getPurpose());
	assertEquals("Imported AES", metadata.getName());
	assertEquals(1, metadata.getVersions().size());
	assertEquals(0, metadata.getVersions().get(0).getVersionNumber());
	assertFalse(metadata.getVersions().get(0).isExportable());

	Crypter crypter = new Crypter(reader);
	String plaintext = "hello world";
	String encrypted = crypter.encrypt(plaintext);
	assertTrue(!encrypted.equals(plaintext));

	String decrypted = crypter.decrypt(encrypted);
	assertEquals(plaintext, decrypted);

	// TODO: Add an old version of a key; test decrypting with it
}
 

private String handleCSRFTokenGeneration(String unhashedToken) throws CSRFTokenGenerationException
{
	try
	{			
		Date currentTime = new Date();
		String currentTimeString = String.valueOf( currentTime.getTime() );
		KeyczarWrapper keyczarWrapper = ConfigUtil.getKeyczarWrapper();
		Signer csrfSigner = keyczarWrapper.getCSRFSigner();
		String csrfHmac = csrfSigner.sign(unhashedToken + ":" + currentTimeString);
		
		return csrfHmac + ":" + currentTimeString;
	}
	catch( KeyczarException ex ) 
	{
		String err = "Encountered error creating HMAC signature with the Keyczar library"
				+ ", exceptionmessage=" + ex.getMessage();
		LOG.info(err);
		throw new CSRFTokenGenerationException(err);
	}
}
 

@Test
public void verifyBadSignature() throws KeyczarException {
  SecretsBundle secrets = SecretsBundle.generateForTest();

  final String TOKEN = "token";
  String signature = secrets.signToken(TOKEN);
  assertTrue(secrets.verifyToken(TOKEN, signature));
  assertFalse(secrets.verifyToken(TOKEN, signature + "A"));
  // Base64DecodingException
  assertFalse(secrets.verifyToken(TOKEN, signature.substring(0, signature.length()-1)));
  assertFalse(secrets.verifyToken(TOKEN, signature.substring(0, signature.length()-2)));
  // ArrayIndexOutOfBoundsException
  assertFalse(secrets.verifyToken(TOKEN, ""));

  // change the first byte: version exception
  assert signature.charAt(0) == 'A';
  assertFalse(secrets.verifyToken(TOKEN, 'B' + signature.substring(1, signature.length())));
}
 

@Test(expected=DoTwoFactorAuthException.class)
public void testTwoFactorEnabledNotVerified() throws InvalidKeyException,
    NoSuchAlgorithmException, KeyczarException, SQLException, MitroServletException {
  // extension should check if 2FA is enabled, but we had a bug where this didn't happen
  testReq.encryptedPrivateKey = "some encrypted key";
  testProcessCommand(testIdentity);
}
 

public void testProcessCommand(DBIdentity identity)
    throws InvalidKeyException, NoSuchAlgorithmException, KeyczarException,
    SQLException, MitroServletException {
  testReq.deviceId = DEVICE_ID;

  //this is using a made up new private key
  testReq.encryptedPrivateKey ="ASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALFASDKJHAFKJSDHFSSDKJALSKDJALF";
  String testRequest = gson.toJson(testReq);
  MitroRequestContext testContext = new MitroRequestContext(identity,
      testRequest, manager, null);
  servlet.processCommand(testContext);
}
 

@Before
public void setup() throws KeyczarException, SQLException {
  servlet = new CheckTwoFactorRequired(managerFactory, keyFactory);

  String testToken1 = GetMyPrivateKey.makeLoginTokenString(testIdentity, "extensionID", DEVICE_ID);
  RPC.LoginToken tokenInGson = gson.fromJson(testToken1, RPC.LoginToken.class);
  tokenInGson.twoFactorAuthVerified = true;
  testRequest = new RPC.TwoFactorAuthRequest();
  testRequest.tfaToken = gson.toJson(tokenInGson);
  testRequest.tfaSignature = TwoFactorSigningService.signToken(testRequest.tfaToken);

  testIdentity.setTwoFactorSecret("12313123");
  testContext = new MitroRequestContext(testIdentity, testRequest.tfaToken, manager, "url");
}
 

@Test
public void testGenerateKeyczarReader() throws KeyczarException {
  KeyczarReader reader = Util.generateKeyczarReader(DefaultKeyType.AES, KeyPurpose.DECRYPT_AND_ENCRYPT);
  Crypter crypter = new Crypter(reader);

  // test that it works
  String ciphertext = crypter.encrypt(MESSAGE);
  String decrypted = crypter.decrypt(ciphertext);
  assertEquals(MESSAGE, decrypted);
}
 

/** Sets a correctly signed but expired token on request. */
private void setExpiredToken() throws KeyczarException {
  // create a token and modify the timestamp to be a timeout
  RPC.LoginToken lt = new RPC.LoginToken();
  lt.email = testIdentity.getName();
  lt.extensionId = "extensionId";
  lt.timestampMs = System.currentTimeMillis() - VerifyDeviceServlet.VALIDITY_TIMEOUT_MS;
  lt.deviceId = "deviceId";
  request.setParameter("token", gson.toJson(lt));
  request.setParameter("token_signature",
      TwoFactorSigningService.signToken(request.getParameter("token")));
}
 

public KeyczarWrapper(String hmacKeyfile) throws CSRFSignerException
{
	try {
		csrfSigner = new Signer(hmacKeyfile);
	} catch (KeyczarException e) {
		throw new CSRFSignerException(e);
	}
}
 

@Test
public void testReadEncryptedKey() throws KeyczarException {
  KeyczarReader staticReader = new KeyczarReader() {
    @Override
    public String getKey() throws KeyczarException {
      return JSON_KEY;
    }

    @Override
    public String getKey(int version) throws KeyczarException {
      assert version == 1;
      return JSON_KEY;
    }

    @Override
    public String getMetadata() throws KeyczarException {
      return METADATA;
    }
  };

  KeyczarPBEReader encrypted = new KeyczarPBEReader(staticReader, PASSPHRASE);
  String prefix = "{\"aesKeyString\":\"oThFEDqkkLyp80hhh1QFjA\"";
  assertEquals(prefix, encrypted.getKey().substring(0, prefix.length()));

  GenericKeyczar keyczar = new GenericKeyczar(encrypted);
  assertEquals(1, keyczar.getVersions().size());
}
 

@Test(expected=DoTwoFactorAuthException.class)
public void twoFactorLoginTokenNotTwoFactorToken() throws InvalidKeyException,
    NoSuchAlgorithmException, KeyczarException, SQLException, MitroServletException {
  testReq.tfaSignature = twoFactorData.testSignature;
  testReq.tfaToken = twoFactorData.testToken;
  testProcessCommand(testIdentity);
}
 

public static String decryptSession(String keyPath, String inPath, String expectedMessage) throws KeyczarException {
  KeyczarReader reader = Util.readJsonFromPath(keyPath);
  String input = Util.readFile(inPath);
  String output = Util.decryptWithSession(new Crypter(reader), input);

  if (expectedMessage != null && !output.equals(expectedMessage)) {
    System.err.println("Session decryption does not match?\n" + output);
    System.exit(1);
  }
  return output;
}
 

@Test
public void testSymmetricKeyToFromJson() throws KeyczarException {
  GenericKeyczar keyczar = Util.createKey(DefaultKeyType.AES, KeyPurpose.DECRYPT_AND_ENCRYPT);
  String json = JsonWriter.toString(keyczar);
  Crypter roundtripped = Util.crypterFromJson(json);
  verifyKeyCompatibility(keyczar, roundtripped);
}
 

@Test
public void testTwoFactorEnabledVerified() throws InvalidKeyException, NoSuchAlgorithmException, KeyczarException, SQLException, MitroServletException {
  RPC.LoginToken useToken = gson.fromJson(twoFactorData.testToken, RPC.LoginToken.class);
  assertFalse(useToken.twoFactorAuthVerified);
  useToken.twoFactorAuthVerified = true;
  testReq.tfaToken = gson.toJson(useToken);
  testReq.tfaSignature = TwoFactorSigningService.signToken(testReq.tfaToken);
  testProcessCommand(testIdentity);
}
 

protected void verifyKeyCompatibility(GenericKeyczar keyczar,
    Crypter roundtripped) throws KeyczarException {
  
  String ciphertext = roundtripped.encrypt(MESSAGE);
Crypter original = new Crypter(Util.readerFromKeyczar(keyczar));
String decrypted = original.decrypt(ciphertext);
assertEquals(MESSAGE, decrypted);

  ciphertext = original.encrypt(MESSAGE);
  decrypted = roundtripped.decrypt(ciphertext);
  assertEquals(MESSAGE, decrypted);
  
}
 

@Test
public void testWriteReadSymmetricKey() throws KeyczarException {
	GenericKeyczar keyczar = Util.createKey(DefaultKeyType.AES, KeyPurpose.DECRYPT_AND_ENCRYPT);

   String path = tempFolder.getRoot().getAbsolutePath() + "/out.json";
   Util.writeJsonToPath(keyczar, path);
   
   Crypter roundtripped = new Crypter(Util.readJsonFromPath(path));
	verifyKeyCompatibility(keyczar, roundtripped);
}
 

/** Loads secrets from path. */
public SecretsBundle(String path) {
  String subPathString = new File(path, SIGNING_RELATIVE_PATH).getPath();
  logger.info("loading signing key from {}", subPathString);
  try {
    signingKey = new Signer(new KeyczarFileReader(subPathString));
  } catch (KeyczarException e) {
    throw new RuntimeException("Unable to load signing key", e);
  }
}
 

@Test
public void testDoPostWrongCode() throws SQLException, KeyczarException,
    InvalidKeyException, NoSuchAlgorithmException, ServletException,
    IOException {
  //create a wrong code
  String wrongCode = "1234567890";
  boolean failure = false;
  try {
    testDoPost(wrongCode);// testDoPost with a wrong code
  } catch (AssertionError e) {
    failure = true;// when code is wrong, failure becomes true, which is what
                   // we want
  }
  assertTrue(failure);
}
 

@Test
public void testDoGetWrongCode() throws ServletException, IOException,
    InvalidKeyException, NoSuchAlgorithmException, SQLException,
    KeyczarException, CryptoError {
  // create incorrect code
  String wrongCode = "123456";
  MockHttpServletResponse response = testDoGet(wrongCode);
  assertThat(response.getOutput(),
      containsString(TwoFactorServlet.INCORRECT_CODE_ERROR_MESSAGE));

  // asserts that the oldBackup is the same as the newBackup, that because it
  // failed it didn't change.
  assertEquals(oldBackup, testIdentity.getBackup(0));
}
 

@Test
public void testDoGetSuccess() throws ServletException, IOException,
    InvalidKeyException, NoSuchAlgorithmException, SQLException,
    KeyczarException, CryptoError {
  MockHttpServletResponse response = testDoGet(twoFactorData.validTimeCode);
  // check that the token worked and that the correct page was rendered.
  assertThat(response.getOutput(),
      containsString("Your one-time backup emergency codes are below."));

  // asserts that the backup code is now different
  assertTrue(!testIdentity.getBackup(0).equals(oldBackup));
}
 

@Test
public void testDoGetIsEnabled() throws ServletException, IOException,
    InvalidKeyException, NoSuchAlgorithmException, SQLException,
    KeyczarException, CryptoError {
  MockHttpServletResponse response = testDoGet(null, false, false, false);
  assertThat(response.getOutput(), containsString("Enabled"));
  testIdentity = DBIdentity.getIdentityForUserName(manager, testIdentity.getName());
  assertTrue(testIdentity.getTwoFactorSecret() != null);
}
 

@Before
public void setUp() throws InvalidKeyException, NoSuchAlgorithmException,
    KeyczarException, SQLException {
  servlet = new NewUser(managerFactory, keyFactory);
  TokenData token = new UserSignedTwoFactorServlet.TokenData();
  token.email = testIdentity.getName();
  token.nonce = "123456";
  tokenString = gson.toJson(token);
}
 

/** Signs a string using a SecretBundle. Used to debug a token signature verification error. */
public static void main(String[] arguments) throws KeyczarException {
  if (arguments.length != 2) {
    System.err.println("SecretsBundle (path) (string to sign)");
    System.exit(1);
  }
  String secretsPath = arguments[0];
  String data = arguments[1];

  System.out.println("Signing string: " + data);
  SecretsBundle secrets = new SecretsBundle(secretsPath);
  String signature = secrets.signToken(data);
  System.out.println("Signature: " + signature);
}
 

/** Returns a new SecretsBundle with random test secrets. */
public static SecretsBundle generateForTest() {
  try {
    Signer signer = new Signer(Util.generateKeyczarReader(
        DefaultKeyType.HMAC_SHA1, KeyPurpose.SIGN_AND_VERIFY));
    return new SecretsBundle(signer);
  } catch (KeyczarException e) {
    throw new RuntimeException("Error generating signing key", e);
  }
}
 

/**
 * {@inheritDoc}
 *
 * <p>Uses Keyczar client to encrypt the byte array.
 *
 * @throws EncryptionException if any underlying component fails
 */
@Override
public byte[] encrypt(byte[] plain) throws EncryptionException {
  try {
    Crypter crypter = getCrypter();
    return crypter.encrypt(plain);
  } catch (KeyczarException e) {
    throw new EncryptionException(e);
  }
}
 

/**
 * Returns true if signature is valid for data, using the signing key. Keyczar throws exceptions
 * for many cases of malformed signatures, but this instead returns false.
 */
public boolean verifyToken(String data, String signature) {
  if (signature.length() == 0) {
    // throws ArrayIndexOutOfBoundsException with current Keyczar
    return false;
  }

  try {
    return signingKey.verify(data, signature);
  } catch (KeyczarException e) {
    // thrown if input length, version, or key doesn't match.
    return false;
  }
}