Java Code Examples for java.security.Key#getAlgorithm()

public static JsonWebSignature hmacSHA(Key symmetricKey, Value unprotectedHeader,
                                       Value protectedHeader, Data payloadData) {
  final String algorithm = symmetricKey.getAlgorithm();
  final Mac mac;
  try {
    if ("HmacSHA256".equals(algorithm)) {
      protectedHeader = protectedHeader.updatedSlot("alg", "HS256");
      mac = Mac.getInstance("HmacSHA256");
    } else if ("HmacSHA384".equals(algorithm)) {
      protectedHeader = protectedHeader.updatedSlot("alg", "HS384");
      mac = Mac.getInstance("HmacSHA384");
    } else if ("HmacSHA512".equals(algorithm)) {
      protectedHeader = protectedHeader.updatedSlot("alg", "HS512");
      mac = Mac.getInstance("HmacSHA512");
    } else {
      throw new IllegalArgumentException("unsupported key size");
    }
    return hmacSHA(mac, symmetricKey, unprotectedHeader, protectedHeader, payloadData);
  } catch (GeneralSecurityException cause) {
    throw new RuntimeException(cause);
  }
}
 

public static Cipher initCipher(Key secretKey, KeyProperties keyProps, int mode)  throws SecurityException {
    try {
        String algorithm = keyProps != null && keyProps.getKeyAlgo() != null
            ? keyProps.getKeyAlgo() : secretKey.getAlgorithm();
        Cipher c = Cipher.getInstance(algorithm);
        if (keyProps == null || keyProps.getAlgoSpec() == null && keyProps.getSecureRandom() == null) {
            c.init(mode, secretKey);
        } else {
            AlgorithmParameterSpec algoSpec = keyProps.getAlgoSpec();
            SecureRandom random = keyProps.getSecureRandom();
            if (algoSpec == null) {
                c.init(mode, secretKey, random);
            } else if (random == null) {
                c.init(mode, secretKey, algoSpec);
            } else {
                c.init(mode, secretKey, algoSpec, random);
            }
        }
        if (keyProps != null && keyProps.getAdditionalData() != null) {
            c.updateAAD(keyProps.getAdditionalData());
        }
        return c;
    } catch (Exception ex) {
        throw new SecurityException(ex);
    }
}
 

private HFileContext createHFileContext(Path path,
    FixedFileTrailer trailer, Configuration conf) throws IOException {
  HFileContextBuilder builder = new HFileContextBuilder()
    .withHBaseCheckSum(true)
    .withHFileName(path.getName())
    .withCompression(trailer.getCompressionCodec())
    .withCellComparator(trailer.createComparator(trailer.getComparatorClassName()));
  // Check for any key material available
  byte[] keyBytes = trailer.getEncryptionKey();
  if (keyBytes != null) {
    Encryption.Context cryptoContext = Encryption.newContext(conf);
    Key key = EncryptionUtil.unwrapKey(conf, keyBytes);
    // Use the algorithm the key wants
    Cipher cipher = Encryption.getCipher(conf, key.getAlgorithm());
    if (cipher == null) {
      throw new IOException("Cipher '" + key.getAlgorithm() + "' is not available"
          + ", path=" + path);
    }
    cryptoContext.setCipher(cipher);
    cryptoContext.setKey(key);
    builder.withEncryptionContext(cryptoContext);
  }
  HFileContext context = builder.build();
  return context;
}
 

@Test
public void simple() {
    DirectKmsMaterialsProvider prov = new DirectKmsMaterialsProvider(kms, keyId);

    EncryptionMaterials eMat = prov.getEncryptionMaterials(ctx);
    SecretKey encryptionKey = eMat.getEncryptionKey();
    assertNotNull(encryptionKey);
    Key signingKey = eMat.getSigningKey();
    assertNotNull(signingKey);

    DecryptionMaterials dMat = prov.getDecryptionMaterials(ctx(eMat));
    assertEquals(encryptionKey, dMat.getDecryptionKey());
    assertEquals(signingKey, dMat.getVerificationKey());

    String expectedEncAlg = encryptionKey.getAlgorithm() + "/"
            + (encryptionKey.getEncoded().length * 8);
    String expectedSigAlg = signingKey.getAlgorithm() + "/"
            + (signingKey.getEncoded().length * 8);

    Map<String, String> kmsCtx = kms.getSingleEc();
    assertEquals(expectedEncAlg,
            kmsCtx.get("*" + WrappedRawMaterials.CONTENT_KEY_ALGORITHM + "*"));
    assertEquals(expectedSigAlg, kmsCtx.get("*amzn-ddb-sig-alg*"));
}
 

@Test
public void simple() throws GeneralSecurityException {
    DirectKmsMaterialProvider prov = new DirectKmsMaterialProvider(kms, keyId);

    EncryptionMaterials eMat = prov.getEncryptionMaterials(ctx);
    SecretKey encryptionKey = eMat.getEncryptionKey();
    assertNotNull(encryptionKey);
    Key signingKey = eMat.getSigningKey();
    assertNotNull(signingKey);

    DecryptionMaterials dMat = prov.getDecryptionMaterials(ctx(eMat));
    assertEquals(encryptionKey, dMat.getDecryptionKey());
    assertEquals(signingKey, dMat.getVerificationKey());

    String expectedEncAlg = encryptionKey.getAlgorithm() + "/"
            + (encryptionKey.getEncoded().length * 8);
    String expectedSigAlg = signingKey.getAlgorithm() + "/"
            + (signingKey.getEncoded().length * 8);

    Map<String, String> kmsCtx = kms.getSingleEc();
    assertEquals(expectedEncAlg,
            kmsCtx.get("*" + WrappedRawMaterials.CONTENT_KEY_ALGORITHM + "*"));
    assertEquals(expectedSigAlg, kmsCtx.get("*amzn-ddb-sig-alg*"));
}
 

private String getSignatureAlgorithm(String hash) throws Exception {
  String signatureAlgorithm;
  KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
  FileInputStream fileIn = new FileInputStream(config.mSignatureFile);
  keyStore.load(fileIn, config.mStorePass.toCharArray());
  Key key = keyStore.getKey(config.mStoreAlias, config.mKeyPass.toCharArray());
  if (key == null) {
    throw new RuntimeException("Can't get private key, please check if storepass storealias and keypass are correct");
  }
  String keyAlgorithm = key.getAlgorithm();
  hash = formatHashAlgorithName(hash);
  if (keyAlgorithm.equalsIgnoreCase("DSA")) {
    keyAlgorithm = "DSA";
  } else if (keyAlgorithm.equalsIgnoreCase("RSA")) {
    keyAlgorithm = "RSA";
  } else if (keyAlgorithm.equalsIgnoreCase("EC")) {
    keyAlgorithm = "ECDSA";
  } else {
    throw new RuntimeException("private key is not a DSA or RSA key");
  }
  signatureAlgorithm = String.format("%swith%s", hash, keyAlgorithm);
  return signatureAlgorithm;
}
 

public static void validateAesWrappingKey(Key managementKey, String joseAlg, int expectedKeyByteLength) throws InvalidKeyException
{
    KeyValidationSupport.notNull(managementKey);

    String alg = managementKey.getAlgorithm();

    if (!AesKey.ALGORITHM.equals(alg))
    {
        throw new InvalidKeyException("Invalid key for JWE " + joseAlg + ", expected an "
                + AesKey.ALGORITHM+ " key but an " + alg + " key was provided.");
    }

    if (managementKey.getEncoded() != null)
    {
        int managementKeyByteLength = managementKey.getEncoded().length;
        if (managementKeyByteLength != expectedKeyByteLength)
        {
            throw new InvalidKeyException("Invalid key for JWE " + joseAlg + ", expected a "
                    + ByteUtil.bitLength(expectedKeyByteLength)+ " bit key but a "
                    + ByteUtil.bitLength(managementKeyByteLength) + " bit key was provided.");
        }
    }
}
 

/**
 * @param kek
 *            the key encrypting key, which is either an AES key or a public
 *            key
 */
String getKeyWrapAlgorithm(Key kek) {
    String algorithm = kek.getAlgorithm();
    if (COSCryptoScheme.AES.equals(algorithm)) {
        return AESWrap;
    }
    if (COSCryptoScheme.RSA.equals(algorithm)) {
        if (CryptoRuntime.isRsaKeyWrapAvailable())
            return RSA_ECB_OAEPWithSHA256AndMGF1Padding;
    }
    throw new IllegalArgumentException("Unsupported key wrap algorithm " + algorithm);
}
 

/**
 * Helper to create an encyption context.
 *
 * @param conf The current configuration.
 * @param family The current column descriptor.
 * @return The created encryption context.
 * @throws IOException if an encryption key for the column cannot be unwrapped
 */
public static Encryption.Context createEncryptionContext(Configuration conf,
  ColumnFamilyDescriptor family) throws IOException {
  Encryption.Context cryptoContext = Encryption.Context.NONE;
  String cipherName = family.getEncryptionType();
  if (cipherName != null) {
    Cipher cipher;
    Key key;
    byte[] keyBytes = family.getEncryptionKey();
    if (keyBytes != null) {
      // Family provides specific key material
      key = unwrapKey(conf, keyBytes);
      // Use the algorithm the key wants
      cipher = Encryption.getCipher(conf, key.getAlgorithm());
      if (cipher == null) {
        throw new RuntimeException("Cipher '" + key.getAlgorithm() + "' is not available");
      }
      // Fail if misconfigured
      // We use the encryption type specified in the column schema as a sanity check on
      // what the wrapped key is telling us
      if (!cipher.getName().equalsIgnoreCase(cipherName)) {
        throw new RuntimeException("Encryption for family '" + family.getNameAsString()
          + "' configured with type '" + cipherName + "' but key specifies algorithm '"
          + cipher.getName() + "'");
      }
    } else {
      // Family does not provide key material, create a random key
      cipher = Encryption.getCipher(conf, cipherName);
      if (cipher == null) {
        throw new RuntimeException("Cipher '" + cipherName + "' is not available");
      }
      key = cipher.getRandomKey();
    }
    cryptoContext = Encryption.newContext(conf);
    cryptoContext.setCipher(cipher);
    cryptoContext.setKey(key);
  }
  return cryptoContext;
}
 

private static SignatureAlgorithm getSignatureAlgorithm(Key key) {
    switch (key.getAlgorithm()) {
        case "EC":
            return SignatureAlgorithm.SHA512_WITH_ECDSA;
        case "RSA":
            return SignatureAlgorithm.SHA512_WITH_RSA;
        default:
            throw new RuntimeException("Unknown Key algorithm " + key.getAlgorithm());
    }
}
 

/**
 * @param kek
 *            the key encrypting key, which is either an AES key or a public
 *            key
 */
String getKeyWrapAlgorithm(Key kek) {
    String algorithm = kek.getAlgorithm();
    if (S3CryptoScheme.AES.equals(algorithm)) {
        return AESWrap;
    }
    if (S3CryptoScheme.RSA.equals(algorithm)) {
        if (CryptoRuntime.isRsaKeyWrapAvailable())
            return RSA_ECB_OAEPWithSHA256AndMGF1Padding;
    }
    return null;
}
 

private String fullDisplayAlgName(Key key) {
    String result = key.getAlgorithm();
    if (key instanceof ECKey) {
        ECParameterSpec paramSpec = ((ECKey) key).getParams();
        if (paramSpec instanceof NamedCurve) {
            result += " (" + paramSpec.toString().split(" ")[0] + ")";
        }
    }
    return result;
}
 

/** {@inheritDoc} */
public String getKeyTransportEncryptionAlgorithmURI(Credential credential, String wrappedKeyAlgorithm) {
    Key key = SecurityHelper.extractEncryptionKey(credential);
    if (key == null) {
        log.debug("Could not extract key transport encryption key from credential, unable to map to algorithm URI");
        return null;
    } else if (key.getAlgorithm() == null){
        log.debug("Key transport encryption key algorithm value was not available, unable to map to algorithm URI");
        return null;
    }
    Integer length = SecurityHelper.getKeyLength(key);
    return getKeyTransportEncryptionAlgorithmURI(key.getAlgorithm(), length, wrappedKeyAlgorithm);
}
 

/** {@inheritDoc} */
public String getDataEncryptionAlgorithmURI(Credential credential) {
    Key key = SecurityHelper.extractEncryptionKey(credential);
    if (key == null) {
        log.debug("Could not extract data encryption key from credential, unable to map to algorithm URI");
        return null;
    } else if (key.getAlgorithm() == null){
        log.debug("Data encryption key algorithm value was not available, unable to map to algorithm URI");
        return null;
    }
    Integer length = SecurityHelper.getKeyLength(key);
    return getDataEncryptionAlgorithmURI(key.getAlgorithm(), length);
}
 

/** {@inheritDoc} */
public String getSignatureAlgorithmURI(Credential credential) {
    Key key = SecurityHelper.extractSigningKey(credential);
    if (key == null) {
        log.debug("Could not extract signing key from credential, unable to map to algorithm URI");
        return null;
    } else if (key.getAlgorithm() == null) {
        log.debug("Signing key algorithm value was not available, unable to map to algorithm URI");
        return null;
    }
    return getSignatureAlgorithmURI(key.getAlgorithm());
}
 

/**
 * @param kek
 *            the key encrypting key, which is either an AES key or a public
 *            key
 */
String getKeyWrapAlgorithm(Key kek) {
    String algorithm = kek.getAlgorithm();
    if (COSCryptoScheme.AES.equals(algorithm)) {
        return AESWrap;
    }
    if (COSCryptoScheme.RSA.equals(algorithm)) {
        if (CryptoRuntime.isRsaKeyWrapAvailable())
            return RSA_ECB_OAEPWithSHA256AndMGF1Padding;
    }
    throw new IllegalArgumentException("Unsupported key wrap algorithm " + algorithm);
}
 

/**
 * Used to return the default signing algorithm for the given key type
 * 
 * @param key
 * @return
 */
public static String getSigningAlgorithm(final Key key) {
	final String defaultAlgorithm;
	if (key.getAlgorithm().equals("ECDSA")) {
		defaultAlgorithm = CommonConfiguration.EC_SIGNATURE_ALGORITHM;
	} else if (key.getAlgorithm().equals("EdDSA")) {
		defaultAlgorithm = CommonConfiguration.ED_SIGNATURE_ALGORITHM;
	} else if (key.getAlgorithm().equals("RSA")) {
		defaultAlgorithm = CommonConfiguration.RSA_SIGNATURE_ALGORITHM;
	} else {
		throw new RuntimeException("Unknown key type: " + key.getAlgorithm());
	}
	return defaultAlgorithm;
}
 

public SignatureKeyImpl(Key publicKey) {
  this(publicKey.getEncoded(), publicKey.getAlgorithm(), publicKey.getFormat());
}
 

/**
 *
 * Retrieve the Crypto Context.  This is borrowed from the DefaultCompactor logic.
 *
 * @return
 * @throws IOException
 */
public Encryption.Context getCryptoContext() throws IOException {
    // Crypto context for new store files
    String cipherName = store.getColumnFamilyDescriptor().getEncryptionType();
    if (cipherName != null) {
        Cipher cipher;
        Key key;
        byte[] keyBytes = store.getColumnFamilyDescriptor().getEncryptionKey();
        if (keyBytes != null) {
            // Family provides specific key material
            String masterKeyName = conf.get(HConstants.CRYPTO_MASTERKEY_NAME_CONF_KEY,
                    User.getCurrent().getShortName());
            try {
                // First try the master key
                key = EncryptionUtil.unwrapKey(conf, masterKeyName, keyBytes);
            } catch (KeyException e) {
                // If the current master key fails to unwrap, try the alternate, if
                // one is configured
                if (LOG.isDebugEnabled()) {
                    LOG.debug("Unable to unwrap key with current master key '" + masterKeyName + "'");
                }
                String alternateKeyName =
                        conf.get(HConstants.CRYPTO_MASTERKEY_ALTERNATE_NAME_CONF_KEY);
                if (alternateKeyName != null) {
                    try {
                        key = EncryptionUtil.unwrapKey(conf, alternateKeyName, keyBytes);
                    } catch (KeyException ex) {
                        throw new IOException(ex);
                    }
                } else {
                    throw new IOException(e);
                }
            }
            // Use the algorithm the key wants
            cipher = Encryption.getCipher(conf, key.getAlgorithm());
            if (cipher == null) {
                throw new RuntimeException("Cipher '" + key.getAlgorithm() + "' is not available");
            }
            // Fail if misconfigured
            // We use the encryption type specified in the column schema as a sanity check on
            // what the wrapped key is telling us
            if (!cipher.getName().equalsIgnoreCase(cipherName)) {
                throw new RuntimeException("Encryption for family '" + store.getColumnFamilyDescriptor().getNameAsString() +
                        "' configured with type '" + cipherName +
                        "' but key specifies algorithm '" + cipher.getName() + "'");
            }
        } else {
            // Family does not provide key material, create a random key
            cipher = Encryption.getCipher(conf, cipherName);
            if (cipher == null) {
                throw new RuntimeException("Cipher '" + cipherName + "' is not available");
            }
            key = cipher.getRandomKey();
        }
        Encryption.Context cryptoContext = Encryption.newContext(conf);
        cryptoContext.setCipher(cipher);
        cryptoContext.setKey(key);
        return cryptoContext;
    } else
        return Encryption.Context.NONE;
}