Java Code Examples for org.apache.cxf.rt.security.crypto.CryptoUtils#createSecretKeySpec()
The following examples show how to use
org.apache.cxf.rt.security.crypto.CryptoUtils#createSecretKeySpec() .
You can vote up the ones you like or vote down the ones you don't like,
and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example 1
Source File: ApacheCXFConsumer.java From cxf with Apache License 2.0 | 6 votes |
private JweDecryptionProvider getJweDecryptionProvider(JsonWebKey key, KeyAlgorithm keyEncryptionAlgorithm, ContentAlgorithm contentEncryptionAlgorithm) { if (key.getAlgorithm() != null) { return JweUtils.createJweDecryptionProvider(key, contentEncryptionAlgorithm); } switch (key.getKeyType()) { case EC: return JweUtils.createJweDecryptionProvider(JwkUtils.toECPrivateKey(key), keyEncryptionAlgorithm, contentEncryptionAlgorithm); case RSA: return JweUtils.createJweDecryptionProvider(JwkUtils.toRSAPrivateKey(key), keyEncryptionAlgorithm, contentEncryptionAlgorithm); case OCTET: SecretKey secretKey = CryptoUtils.createSecretKeySpec( (String) key.getProperty(JsonWebKey.OCTET_KEY_VALUE), keyEncryptionAlgorithm.getJavaName()); return JweUtils.createJweDecryptionProvider(secretKey, keyEncryptionAlgorithm, contentEncryptionAlgorithm); default: throw new IllegalArgumentException("JWK KeyType not supported: " + key.getKeyType()); } }
Example 2
Source File: JweJsonConsumerTest.java From cxf with Apache License 2.0 | 6 votes |
private void doTestMultipleRecipients(String jweJson) { final String text = "The true sign of intelligence is not knowledge but imagination."; SecretKey wrapperKey1 = CryptoUtils.createSecretKeySpec(JweJsonProducerTest.WRAPPER_BYTES1, "AES"); SecretKey wrapperKey2 = CryptoUtils.createSecretKeySpec(JweJsonProducerTest.WRAPPER_BYTES2, "AES"); JweJsonConsumer consumer = new JweJsonConsumer(jweJson); KeyAlgorithm keyAlgo = consumer.getSharedUnprotectedHeader().getKeyEncryptionAlgorithm(); ContentAlgorithm ctAlgo = consumer.getProtectedHeader().getContentEncryptionAlgorithm(); // Recipient 1 JweDecryptionProvider jwe1 = JweUtils.createJweDecryptionProvider(wrapperKey1, keyAlgo, ctAlgo); JweDecryptionOutput out1 = consumer.decryptWith(jwe1, Collections.singletonMap("kid", "key1")); assertEquals(text, out1.getContentText()); // Recipient 2 JweDecryptionProvider jwe2 = JweUtils.createJweDecryptionProvider(wrapperKey2, keyAlgo, ctAlgo); JweDecryptionOutput out2 = consumer.decryptWith(jwe2, Collections.singletonMap("kid", "key2")); assertEquals(text, out2.getContentText()); // Extra AAD assertEquals(JweJsonProducerTest.EXTRA_AAD_SOURCE, consumer.getAadText()); }
Example 3
Source File: JweJsonConsumerTest.java From cxf with Apache License 2.0 | 6 votes |
@Test public void testSingleRecipientAllTypeOfHeadersAndAadModified() { SecretKey wrapperKey = CryptoUtils.createSecretKeySpec(JweJsonProducerTest.WRAPPER_BYTES1, "AES"); JweDecryptionProvider jwe = JweUtils.createJweDecryptionProvider(wrapperKey, KeyAlgorithm.A128KW, ContentAlgorithm.A128GCM); JweJsonConsumer consumer = new JweJsonConsumer(SINGLE_RECIPIENT_ALL_HEADERS_AAD_MODIFIED_OUTPUT); try { consumer.decryptWith(jwe); fail("AAD check has passed unexpectedly"); } catch (SecurityException ex) { // expected } }
Example 4
Source File: JweJsonConsumerTest.java From cxf with Apache License 2.0 | 6 votes |
private void doTestSingleRecipient(String text, String input, ContentAlgorithm contentEncryptionAlgo, final byte[] wrapperKeyBytes, final byte[] cek) throws Exception { JweDecryptionProvider jwe = null; if (wrapperKeyBytes != null) { SecretKey wrapperKey = CryptoUtils.createSecretKeySpec(wrapperKeyBytes, "AES"); jwe = JweUtils.createJweDecryptionProvider(wrapperKey, KeyAlgorithm.A128KW, contentEncryptionAlgo); } else { SecretKey cekKey = CryptoUtils.createSecretKeySpec(cek, "AES"); jwe = JweUtils.getDirectKeyJweDecryption(cekKey, contentEncryptionAlgo); } JweJsonConsumer consumer = new JweJsonConsumer(input); JweDecryptionOutput out = consumer.decryptWith(jwe); assertEquals(text, out.getContentText()); }
Example 5
Source File: JweJsonProducerTest.java From cxf with Apache License 2.0 | 5 votes |
@Test public void testSingleRecipientAllTypeOfHeadersAndAad() { final String text = "The true sign of intelligence is not knowledge but imagination."; SecretKey wrapperKey = CryptoUtils.createSecretKeySpec(WRAPPER_BYTES1, "AES"); JweHeaders protectedHeaders = new JweHeaders(ContentAlgorithm.A128GCM); JweHeaders sharedUnprotectedHeaders = new JweHeaders(); sharedUnprotectedHeaders.setJsonWebKeysUrl("https://server.example.com/keys.jwks"); JweEncryptionProvider jwe = JweUtils.createJweEncryptionProvider(wrapperKey, KeyAlgorithm.A128KW, ContentAlgorithm.A128GCM, null); JweJsonProducer p = new JweJsonProducer(protectedHeaders, sharedUnprotectedHeaders, StringUtils.toBytesUTF8(text), StringUtils.toBytesUTF8(EXTRA_AAD_SOURCE), false) { protected JweEncryptionInput createEncryptionInput(JweHeaders jsonHeaders) { JweEncryptionInput input = super.createEncryptionInput(jsonHeaders); input.setCek(CEK_BYTES); input.setIv(JweCompactReaderWriterTest.INIT_VECTOR_A1); return input; } }; JweHeaders recepientUnprotectedHeaders = new JweHeaders(); recepientUnprotectedHeaders.setKeyEncryptionAlgorithm(KeyAlgorithm.A128KW); String jweJson = p.encryptWith(jwe, recepientUnprotectedHeaders); assertEquals(SINGLE_RECIPIENT_ALL_HEADERS_AAD_OUTPUT, jweJson); }
Example 6
Source File: JweJsonProducerTest.java From cxf with Apache License 2.0 | 5 votes |
private String doTestSingleRecipient(String text, String expectedOutput, ContentAlgorithm contentEncryptionAlgo, final byte[] wrapperKeyBytes, final byte[] iv, final byte[] cek, boolean canBeFlat) throws Exception { JweHeaders headers = new JweHeaders(KeyAlgorithm.A128KW, contentEncryptionAlgo); JweEncryptionProvider jwe = null; if (wrapperKeyBytes == null) { headers.asMap().remove("alg"); SecretKey cekKey = CryptoUtils.createSecretKeySpec(cek, "AES"); jwe = JweUtils.getDirectKeyJweEncryption(cekKey, contentEncryptionAlgo); } else { SecretKey wrapperKey = CryptoUtils.createSecretKeySpec(wrapperKeyBytes, "AES"); jwe = JweUtils.createJweEncryptionProvider(wrapperKey, headers); } JweJsonProducer p = new JweJsonProducer(headers, StringUtils.toBytesUTF8(text), canBeFlat) { protected JweEncryptionInput createEncryptionInput(JweHeaders jsonHeaders) { JweEncryptionInput input = super.createEncryptionInput(jsonHeaders); input.setCek(cek); input.setIv(iv); return input; } }; String jweJson = p.encryptWith(jwe); assertEquals(expectedOutput, jweJson); return jweJson; }
Example 7
Source File: JwaSpecTestCasesTest.java From cxf with Apache License 2.0 | 5 votes |
private void doTestSingleRecipient(String text, String expectedOutput, ContentAlgorithm contentEncryptionAlgo, final byte[] iv, final byte[] cek) throws Exception { JweHeaders headers = new JweHeaders(KeyAlgorithm.A128KW, contentEncryptionAlgo); headers.asMap().remove("alg"); JweEncryptionProvider jwe = null; SecretKey cekKey = CryptoUtils.createSecretKeySpec(cek, "AES"); jwe = JweUtils.getDirectKeyJweEncryption(cekKey, contentEncryptionAlgo); JweJsonProducer p = new JweJsonProducer(headers, Hex.decode(text.getBytes())) { protected JweEncryptionInput createEncryptionInput(JweHeaders jsonHeaders) { JweEncryptionInput input = super.createEncryptionInput(jsonHeaders); input.setCek(cek); input.setIv(iv); return input; } }; String jweJson = p.encryptWith(jwe); JsonMapObjectReaderWriter jsonReader = new JsonMapObjectReaderWriter(); Map<String, Object> json = jsonReader.fromJson(jweJson); // Check IV matches byte[] outputIv = Base64UrlUtility.decode((String)json.get("iv")); assertArrayEquals(outputIv, iv); // Check CipherText matches byte[] cipherTextBytes = Base64UrlUtility.decode((String)json.get("ciphertext")); assertArrayEquals(cipherTextBytes, Hex.decode(expectedOutput)); }
Example 8
Source File: JweCompactReaderWriterTest.java From cxf with Apache License 2.0 | 5 votes |
private SecretKey createSecretKey(boolean createIfException) throws Exception { SecretKey key = null; if (Cipher.getMaxAllowedKeyLength("AES") > 128) { key = CryptoUtils.createSecretKeySpec(CONTENT_ENCRYPTION_KEY_A1, "AES"); } else if (createIfException) { key = CryptoUtils.createSecretKeySpec(CryptoUtils.generateSecureRandomBytes(128 / 8), "AES"); } return key; }
Example 9
Source File: AbstractJweDecryption.java From cxf with Apache License 2.0 | 5 votes |
protected JweDecryptionOutput doDecrypt(JweDecryptionInput jweDecryptionInput, byte[] cek) { KeyProperties keyProperties = new KeyProperties(getContentEncryptionAlgorithm(jweDecryptionInput)); keyProperties.setAdditionalData(getContentEncryptionCipherAAD(jweDecryptionInput)); AlgorithmParameterSpec spec = getContentEncryptionCipherSpec(jweDecryptionInput); keyProperties.setAlgoSpec(spec); boolean compressionSupported = JoseConstants.JWE_DEFLATE_ZIP_ALGORITHM.equals(jweDecryptionInput.getJweHeaders().getZipAlgorithm()); keyProperties.setCompressionSupported(compressionSupported); byte[] actualCek = getActualCek(cek, jweDecryptionInput.getJweHeaders().getContentEncryptionAlgorithm().getJwaName()); SecretKey secretKey = CryptoUtils.createSecretKeySpec(actualCek, keyProperties.getKeyAlgo()); byte[] bytes = CryptoUtils.decryptBytes(getEncryptedContentWithAuthTag(jweDecryptionInput), secretKey, keyProperties); // Here we're finished with the SecretKey we created, so we can destroy it try { secretKey.destroy(); } catch (DestroyFailedException e) { // ignore } Arrays.fill(cek, (byte) 0); if (actualCek != cek) { Arrays.fill(actualCek, (byte) 0); } return new JweDecryptionOutput(jweDecryptionInput.getJweHeaders(), bytes); }
Example 10
Source File: JweJsonConsumerTest.java From cxf with Apache License 2.0 | 5 votes |
@Test public void testSingleRecipientAllTypeOfHeadersAndAad() { final String text = "The true sign of intelligence is not knowledge but imagination."; SecretKey wrapperKey = CryptoUtils.createSecretKeySpec(JweJsonProducerTest.WRAPPER_BYTES1, "AES"); JweDecryptionProvider jwe = JweUtils.createJweDecryptionProvider(wrapperKey, KeyAlgorithm.A128KW, ContentAlgorithm.A128GCM); JweJsonConsumer consumer = new JweJsonConsumer(JweJsonProducerTest.SINGLE_RECIPIENT_ALL_HEADERS_AAD_OUTPUT); JweDecryptionOutput out = consumer.decryptWith(jwe); assertEquals(text, out.getContentText()); assertEquals(JweJsonProducerTest.EXTRA_AAD_SOURCE, consumer.getAadText()); }
Example 11
Source File: JweJsonConsumerTest.java From cxf with Apache License 2.0 | 5 votes |
@Test public void testMultipleRecipientsAutogeneratedCek() { final String text = "The true sign of intelligence is not knowledge but imagination."; SecretKey wrapperKey1 = CryptoUtils.createSecretKeySpec(JweJsonProducerTest.WRAPPER_BYTES1, "AES"); SecretKey wrapperKey2 = CryptoUtils.createSecretKeySpec(JweJsonProducerTest.WRAPPER_BYTES2, "AES"); JweHeaders protectedHeaders = new JweHeaders(ContentAlgorithm.A128GCM); JweHeaders sharedUnprotectedHeaders = new JweHeaders(); sharedUnprotectedHeaders.setJsonWebKeysUrl("https://server.example.com/keys.jwks"); sharedUnprotectedHeaders.setKeyEncryptionAlgorithm(KeyAlgorithm.A128KW); List<JweEncryptionProvider> jweProviders = new LinkedList<>(); KeyEncryptionProvider keyEncryption1 = JweUtils.getSecretKeyEncryptionAlgorithm(wrapperKey1, KeyAlgorithm.A128KW); ContentEncryptionProvider contentEncryption = new AesGcmContentEncryptionAlgorithm(ContentAlgorithm.A128GCM, true); JweEncryptionProvider jwe1 = new JweEncryption(keyEncryption1, contentEncryption); KeyEncryptionProvider keyEncryption2 = JweUtils.getSecretKeyEncryptionAlgorithm(wrapperKey2, KeyAlgorithm.A128KW); JweEncryptionProvider jwe2 = new JweEncryption(keyEncryption2, contentEncryption); jweProviders.add(jwe1); jweProviders.add(jwe2); List<JweHeaders> perRecipientHeaders = new LinkedList<>(); perRecipientHeaders.add(new JweHeaders("key1")); perRecipientHeaders.add(new JweHeaders("key2")); JweJsonProducer p = new JweJsonProducer(protectedHeaders, sharedUnprotectedHeaders, StringUtils.toBytesUTF8(text), StringUtils.toBytesUTF8(JweJsonProducerTest.EXTRA_AAD_SOURCE), false); String jweJson = p.encryptWith(jweProviders, perRecipientHeaders); doTestMultipleRecipients(jweJson); }
Example 12
Source File: JweJsonProducerTest.java From cxf with Apache License 2.0 | 4 votes |
@Test public void testMultipleRecipientsA128CBCHS256GivenCek() throws Exception { final String text = "The true sign of intelligence is not knowledge but imagination."; KeyAlgorithm keyAlgo = KeyAlgorithm.A128KW; ContentAlgorithm contentAlgo = ContentAlgorithm.A128CBC_HS256; SecretKey wrapperKey1 = CryptoUtils.createSecretKeySpec(WRAPPER_BYTES1, "AES"); SecretKey wrapperKey2 = CryptoUtils.createSecretKeySpec(WRAPPER_BYTES2, "AES"); JweHeaders protectedHeaders = new JweHeaders(contentAlgo); JweHeaders sharedUnprotectedHeaders = new JweHeaders(); sharedUnprotectedHeaders.setJsonWebKeysUrl("https://server.example.com/keys.jwks"); sharedUnprotectedHeaders.setKeyEncryptionAlgorithm(keyAlgo); List<JweEncryptionProvider> jweProviders = new LinkedList<>(); KeyEncryptionProvider keyEncryption1 = JweUtils.getSecretKeyEncryptionAlgorithm(wrapperKey1, keyAlgo); JweEncryptionProvider jwe1 = new AesCbcHmacJweEncryption(contentAlgo, Hex.decode(CEK_32_HEX), JweCompactReaderWriterTest.INIT_VECTOR_A3, keyEncryption1); KeyEncryptionProvider keyEncryption2 = JweUtils.getSecretKeyEncryptionAlgorithm(wrapperKey2, keyAlgo); JweEncryptionProvider jwe2 = new AesCbcHmacJweEncryption(contentAlgo, CEK_BYTES, JweCompactReaderWriterTest.INIT_VECTOR_A3, keyEncryption2); jweProviders.add(jwe1); jweProviders.add(jwe2); List<JweHeaders> perRecipientHeades = new LinkedList<>(); perRecipientHeades.add(new JweHeaders("key1")); perRecipientHeades.add(new JweHeaders("key2")); JweJsonProducer p = new JweJsonProducer(protectedHeaders, sharedUnprotectedHeaders, StringUtils.toBytesUTF8(text), StringUtils.toBytesUTF8(EXTRA_AAD_SOURCE), false); String jweJson = p.encryptWith(jweProviders, perRecipientHeades); assertEquals(MULTIPLE_RECIPIENTS_A128CBCHS256_JSON_OUTPUT, jweJson); }
Example 13
Source File: JwkUtils.java From cxf with Apache License 2.0 | 4 votes |
public static SecretKey toSecretKey(JsonWebKey jwk) { return CryptoUtils.createSecretKeySpec((String)jwk.getProperty(JsonWebKey.OCTET_KEY_VALUE), AlgorithmUtils.toJavaName(jwk.getAlgorithm())); }
Example 14
Source File: JweJsonProducerTest.java From cxf with Apache License 2.0 | 4 votes |
@Test public void testMultipleRecipientsA128CBCHS256() { final String text = "The true sign of intelligence is not knowledge but imagination."; KeyAlgorithm keyAlgo = KeyAlgorithm.A128KW; ContentAlgorithm contentAlgo = ContentAlgorithm.A128CBC_HS256; SecretKey wrapperKey1 = CryptoUtils.createSecretKeySpec(WRAPPER_BYTES1, "AES"); SecretKey wrapperKey2 = CryptoUtils.createSecretKeySpec(WRAPPER_BYTES2, "AES"); JweHeaders protectedHeaders = new JweHeaders(contentAlgo); JweHeaders sharedUnprotectedHeaders = new JweHeaders(); sharedUnprotectedHeaders.setJsonWebKeysUrl("https://server.example.com/keys.jwks"); sharedUnprotectedHeaders.setKeyEncryptionAlgorithm(keyAlgo); List<JweEncryptionProvider> jweProviders = new LinkedList<>(); AesCbcContentEncryptionAlgorithm contentEncryption = new AesCbcContentEncryptionAlgorithm(contentAlgo, true); KeyEncryptionProvider keyEncryption1 = JweUtils.getSecretKeyEncryptionAlgorithm(wrapperKey1, keyAlgo); JweEncryptionProvider jwe1 = new AesCbcHmacJweEncryption(keyEncryption1, contentEncryption); KeyEncryptionProvider keyEncryption2 = JweUtils.getSecretKeyEncryptionAlgorithm(wrapperKey2, keyAlgo); JweEncryptionProvider jwe2 = new AesCbcHmacJweEncryption(keyEncryption2, contentEncryption); jweProviders.add(jwe1); jweProviders.add(jwe2); List<JweHeaders> perRecipientHeades = new LinkedList<>(); perRecipientHeades.add(new JweHeaders("key1")); perRecipientHeades.add(new JweHeaders("key2")); JweJsonProducer p = new JweJsonProducer(protectedHeaders, sharedUnprotectedHeaders, StringUtils.toBytesUTF8(text), StringUtils.toBytesUTF8(EXTRA_AAD_SOURCE), false); String jweJson = p.encryptWith(jweProviders, perRecipientHeades); JweJsonConsumer consumer = new JweJsonConsumer(jweJson); Assert.assertEquals(keyAlgo, consumer.getSharedUnprotectedHeader().getKeyEncryptionAlgorithm()); Assert.assertEquals(contentAlgo, consumer.getProtectedHeader().getContentEncryptionAlgorithm()); // Recipient 1 JweDecryptionProvider jwd1 = JweUtils.createJweDecryptionProvider(wrapperKey1, keyAlgo, contentAlgo); JweDecryptionOutput out1 = consumer.decryptWith(jwd1, Collections.singletonMap("kid", "key1")); assertEquals(text, out1.getContentText()); // Recipient 2 JweDecryptionProvider jwd2 = JweUtils.createJweDecryptionProvider(wrapperKey2, keyAlgo, contentAlgo); JweDecryptionOutput out2 = consumer.decryptWith(jwd2, Collections.singletonMap("kid", "key2")); assertEquals(text, out2.getContentText()); }
Example 15
Source File: AbstractJweEncryption.java From cxf with Apache License 2.0 | 4 votes |
protected SecretKey createCekSecretKey(JweEncryptionInternal state) { return CryptoUtils.createSecretKeySpec(getActualCek(state.secretKey, this.getContentEncryptionAlgoJwt()), state.keyProps.getKeyAlgo()); }
Example 16
Source File: AesWrapKeyDecryptionAlgorithm.java From cxf with Apache License 2.0 | 4 votes |
public AesWrapKeyDecryptionAlgorithm(byte[] secretKey, KeyAlgorithm supportedAlgo) { this(CryptoUtils.createSecretKeySpec(secretKey, AlgorithmUtils.AES_WRAP_ALGO_JAVA), supportedAlgo); }
Example 17
Source File: AesGcmWrapKeyEncryptionAlgorithm.java From cxf with Apache License 2.0 | 4 votes |
public AesGcmWrapKeyEncryptionAlgorithm(byte[] keyBytes, KeyAlgorithm keyAlgoJwt) { this(CryptoUtils.createSecretKeySpec(keyBytes, AlgorithmUtils.AES), keyAlgoJwt); }
Example 18
Source File: AesGcmWrapKeyDecryptionAlgorithm.java From cxf with Apache License 2.0 | 4 votes |
public AesGcmWrapKeyDecryptionAlgorithm(byte[] secretKey, KeyAlgorithm supportedAlgo) { this(CryptoUtils.createSecretKeySpec(secretKey, AlgorithmUtils.AES), supportedAlgo); }
Example 19
Source File: AesWrapKeyEncryptionAlgorithm.java From cxf with Apache License 2.0 | 4 votes |
public AesWrapKeyEncryptionAlgorithm(byte[] keyBytes, KeyAlgorithm keyAlgoJwt) { this(CryptoUtils.createSecretKeySpec(keyBytes, keyAlgoJwt.getJavaName()), keyAlgoJwt); }
Example 20
Source File: JwkUtils.java From cxf with Apache License 2.0 | 4 votes |
public static SecretKey toSecretKey(JsonWebKey jwk, KeyAlgorithm algorithm) { return CryptoUtils.createSecretKeySpec((String)jwk.getProperty(JsonWebKey.OCTET_KEY_VALUE), algorithm.getJavaName()); }