Java Code Examples for sun.security.util.KeyUtil#trimZeroes()

The following examples show how to use sun.security.util.KeyUtil#trimZeroes() . You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example 1
Source File: P11Signature.java    From openjdk-8 with GNU General Public License v2.0 6 votes vote down vote up 
private byte[] asn1ToECDSA(byte[] signature) throws SignatureException {
    try {
        DerInputStream in = new DerInputStream(signature);
        DerValue[] values = in.getSequence(2);
        BigInteger r = values[0].getPositiveBigInteger();
        BigInteger s = values[1].getPositiveBigInteger();
        // trim leading zeroes
        byte[] br = KeyUtil.trimZeroes(r.toByteArray());
        byte[] bs = KeyUtil.trimZeroes(s.toByteArray());
        int k = Math.max(br.length, bs.length);
        // r and s each occupy half the array
        byte[] res = new byte[k << 1];
        System.arraycopy(br, 0, res, k - br.length, br.length);
        System.arraycopy(bs, 0, res, res.length - bs.length, bs.length);
        return res;
    } catch (Exception e) {
        throw new SignatureException("invalid encoding for signature", e);
    }
}
Example 2
Source File: P11Signature.java    From jdk8u-dev-jdk with GNU General Public License v2.0 6 votes vote down vote up 
private byte[] asn1ToECDSA(byte[] signature) throws SignatureException {
    try {
        DerInputStream in = new DerInputStream(signature);
        DerValue[] values = in.getSequence(2);
        BigInteger r = values[0].getPositiveBigInteger();
        BigInteger s = values[1].getPositiveBigInteger();
        // trim leading zeroes
        byte[] br = KeyUtil.trimZeroes(r.toByteArray());
        byte[] bs = KeyUtil.trimZeroes(s.toByteArray());
        int k = Math.max(br.length, bs.length);
        // r and s each occupy half the array
        byte[] res = new byte[k << 1];
        System.arraycopy(br, 0, res, k - br.length, br.length);
        System.arraycopy(bs, 0, res, res.length - bs.length, bs.length);
        return res;
    } catch (Exception e) {
        throw new SignatureException("invalid encoding for signature", e);
    }
}
Example 3
Source File: P11Signature.java    From jdk8u60 with GNU General Public License v2.0 6 votes vote down vote up 
private byte[] asn1ToECDSA(byte[] signature) throws SignatureException {
    try {
        DerInputStream in = new DerInputStream(signature);
        DerValue[] values = in.getSequence(2);
        BigInteger r = values[0].getPositiveBigInteger();
        BigInteger s = values[1].getPositiveBigInteger();
        // trim leading zeroes
        byte[] br = KeyUtil.trimZeroes(r.toByteArray());
        byte[] bs = KeyUtil.trimZeroes(s.toByteArray());
        int k = Math.max(br.length, bs.length);
        // r and s each occupy half the array
        byte[] res = new byte[k << 1];
        System.arraycopy(br, 0, res, k - br.length, br.length);
        System.arraycopy(bs, 0, res, res.length - bs.length, bs.length);
        return res;
    } catch (Exception e) {
        throw new SignatureException("invalid encoding for signature", e);
    }
}
Example 4
Source File: P11Signature.java    From dragonwell8_jdk with GNU General Public License v2.0 5 votes vote down vote up 
private byte[] asn1ToECDSA(byte[] sig) throws SignatureException {
    try {
        // Enforce strict DER checking for signatures
        DerInputStream in = new DerInputStream(sig, 0, sig.length, false);
        DerValue[] values = in.getSequence(2);

        // check number of components in the read sequence
        // and trailing data
        if ((values.length != 2) || (in.available() != 0)) {
            throw new IOException("Invalid encoding for signature");
        }

        BigInteger r = values[0].getPositiveBigInteger();
        BigInteger s = values[1].getPositiveBigInteger();

        // trim leading zeroes
        byte[] br = KeyUtil.trimZeroes(r.toByteArray());
        byte[] bs = KeyUtil.trimZeroes(s.toByteArray());
        int k = Math.max(br.length, bs.length);
        // r and s each occupy half the array
        byte[] res = new byte[k << 1];
        System.arraycopy(br, 0, res, k - br.length, br.length);
        System.arraycopy(bs, 0, res, res.length - bs.length, bs.length);
        return res;
    } catch (Exception e) {
        throw new SignatureException("Invalid encoding for signature", e);
    }
}
Example 5
Source File: P11Signature.java    From jdk8u_jdk with GNU General Public License v2.0 5 votes vote down vote up 
private byte[] asn1ToECDSA(byte[] sig) throws SignatureException {
    try {
        // Enforce strict DER checking for signatures
        DerInputStream in = new DerInputStream(sig, 0, sig.length, false);
        DerValue[] values = in.getSequence(2);

        // check number of components in the read sequence
        // and trailing data
        if ((values.length != 2) || (in.available() != 0)) {
            throw new IOException("Invalid encoding for signature");
        }

        BigInteger r = values[0].getPositiveBigInteger();
        BigInteger s = values[1].getPositiveBigInteger();

        // trim leading zeroes
        byte[] br = KeyUtil.trimZeroes(r.toByteArray());
        byte[] bs = KeyUtil.trimZeroes(s.toByteArray());
        int k = Math.max(br.length, bs.length);
        // r and s each occupy half the array
        byte[] res = new byte[k << 1];
        System.arraycopy(br, 0, res, k - br.length, br.length);
        System.arraycopy(bs, 0, res, res.length - bs.length, bs.length);
        return res;
    } catch (Exception e) {
        throw new SignatureException("Invalid encoding for signature", e);
    }
}
Example 6
Source File: P11Signature.java    From jdk8u-jdk with GNU General Public License v2.0 5 votes vote down vote up 
private byte[] asn1ToECDSA(byte[] sig) throws SignatureException {
    try {
        // Enforce strict DER checking for signatures
        DerInputStream in = new DerInputStream(sig, 0, sig.length, false);
        DerValue[] values = in.getSequence(2);

        // check number of components in the read sequence
        // and trailing data
        if ((values.length != 2) || (in.available() != 0)) {
            throw new IOException("Invalid encoding for signature");
        }

        BigInteger r = values[0].getPositiveBigInteger();
        BigInteger s = values[1].getPositiveBigInteger();

        // trim leading zeroes
        byte[] br = KeyUtil.trimZeroes(r.toByteArray());
        byte[] bs = KeyUtil.trimZeroes(s.toByteArray());
        int k = Math.max(br.length, bs.length);
        // r and s each occupy half the array
        byte[] res = new byte[k << 1];
        System.arraycopy(br, 0, res, k - br.length, br.length);
        System.arraycopy(bs, 0, res, res.length - bs.length, bs.length);
        return res;
    } catch (Exception e) {
        throw new SignatureException("Invalid encoding for signature", e);
    }
}
Example 7
Source File: P11Signature.java    From openjdk-jdk9 with GNU General Public License v2.0 5 votes vote down vote up 
private byte[] asn1ToECDSA(byte[] sig) throws SignatureException {
    try {
        // Enforce strict DER checking for signatures
        DerInputStream in = new DerInputStream(sig, 0, sig.length, false);
        DerValue[] values = in.getSequence(2);

        // check number of components in the read sequence
        // and trailing data
        if ((values.length != 2) || (in.available() != 0)) {
            throw new IOException("Invalid encoding for signature");
        }

        BigInteger r = values[0].getPositiveBigInteger();
        BigInteger s = values[1].getPositiveBigInteger();

        // trim leading zeroes
        byte[] br = KeyUtil.trimZeroes(r.toByteArray());
        byte[] bs = KeyUtil.trimZeroes(s.toByteArray());
        int k = Math.max(br.length, bs.length);
        // r and s each occupy half the array
        byte[] res = new byte[k << 1];
        System.arraycopy(br, 0, res, k - br.length, br.length);
        System.arraycopy(bs, 0, res, res.length - bs.length, bs.length);
        return res;
    } catch (Exception e) {
        throw new SignatureException("Invalid encoding for signature", e);
    }
}
Example 8
Source File: P11Signature.java    From openjdk-jdk8u-backup with GNU General Public License v2.0 5 votes vote down vote up 
private byte[] asn1ToECDSA(byte[] sig) throws SignatureException {
    try {
        // Enforce strict DER checking for signatures
        DerInputStream in = new DerInputStream(sig, 0, sig.length, false);
        DerValue[] values = in.getSequence(2);

        // check number of components in the read sequence
        // and trailing data
        if ((values.length != 2) || (in.available() != 0)) {
            throw new IOException("Invalid encoding for signature");
        }

        BigInteger r = values[0].getPositiveBigInteger();
        BigInteger s = values[1].getPositiveBigInteger();

        // trim leading zeroes
        byte[] br = KeyUtil.trimZeroes(r.toByteArray());
        byte[] bs = KeyUtil.trimZeroes(s.toByteArray());
        int k = Math.max(br.length, bs.length);
        // r and s each occupy half the array
        byte[] res = new byte[k << 1];
        System.arraycopy(br, 0, res, k - br.length, br.length);
        System.arraycopy(bs, 0, res, res.length - bs.length, bs.length);
        return res;
    } catch (Exception e) {
        throw new SignatureException("Invalid encoding for signature", e);
    }
}
Example 9
Source File: P11Signature.java    From openjdk-jdk8u with GNU General Public License v2.0 5 votes vote down vote up 
private byte[] asn1ToECDSA(byte[] sig) throws SignatureException {
    try {
        // Enforce strict DER checking for signatures
        DerInputStream in = new DerInputStream(sig, 0, sig.length, false);
        DerValue[] values = in.getSequence(2);

        // check number of components in the read sequence
        // and trailing data
        if ((values.length != 2) || (in.available() != 0)) {
            throw new IOException("Invalid encoding for signature");
        }

        BigInteger r = values[0].getPositiveBigInteger();
        BigInteger s = values[1].getPositiveBigInteger();

        // trim leading zeroes
        byte[] br = KeyUtil.trimZeroes(r.toByteArray());
        byte[] bs = KeyUtil.trimZeroes(s.toByteArray());
        int k = Math.max(br.length, bs.length);
        // r and s each occupy half the array
        byte[] res = new byte[k << 1];
        System.arraycopy(br, 0, res, k - br.length, br.length);
        System.arraycopy(bs, 0, res, res.length - bs.length, bs.length);
        return res;
    } catch (Exception e) {
        throw new SignatureException("Invalid encoding for signature", e);
    }
}
Example 10
Source File: P11Signature.java    From TencentKona-8 with GNU General Public License v2.0 5 votes vote down vote up 
private byte[] asn1ToECDSA(byte[] sig) throws SignatureException {
    try {
        // Enforce strict DER checking for signatures
        DerInputStream in = new DerInputStream(sig, 0, sig.length, false);
        DerValue[] values = in.getSequence(2);

        // check number of components in the read sequence
        // and trailing data
        if ((values.length != 2) || (in.available() != 0)) {
            throw new IOException("Invalid encoding for signature");
        }

        BigInteger r = values[0].getPositiveBigInteger();
        BigInteger s = values[1].getPositiveBigInteger();

        // trim leading zeroes
        byte[] br = KeyUtil.trimZeroes(r.toByteArray());
        byte[] bs = KeyUtil.trimZeroes(s.toByteArray());
        int k = Math.max(br.length, bs.length);
        // r and s each occupy half the array
        byte[] res = new byte[k << 1];
        System.arraycopy(br, 0, res, k - br.length, br.length);
        System.arraycopy(bs, 0, res, res.length - bs.length, bs.length);
        return res;
    } catch (Exception e) {
        throw new SignatureException("Invalid encoding for signature", e);
    }
}
Example 11
Source File: P11KeyAgreement.java    From jdk8u-dev-jdk with GNU General Public License v2.0 4 votes vote down vote up 
private SecretKey nativeGenerateSecret(String algorithm)
        throws IllegalStateException, NoSuchAlgorithmException,
        InvalidKeyException {
    if ((privateKey == null) || (publicValue == null)) {
        throw new IllegalStateException("Not initialized correctly");
    }
    long keyType = CKK_GENERIC_SECRET;
    Session session = null;
    try {
        session = token.getObjSession();
        CK_ATTRIBUTE[] attributes = new CK_ATTRIBUTE[] {
            new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY),
            new CK_ATTRIBUTE(CKA_KEY_TYPE, keyType),
        };
        attributes = token.getAttributes
            (O_GENERATE, CKO_SECRET_KEY, keyType, attributes);
        long keyID = token.p11.C_DeriveKey(session.id(),
            new CK_MECHANISM(mechanism, publicValue), privateKey.keyID,
            attributes);
        CK_ATTRIBUTE[] lenAttributes = new CK_ATTRIBUTE[] {
            new CK_ATTRIBUTE(CKA_VALUE_LEN),
        };
        token.p11.C_GetAttributeValue(session.id(), keyID, lenAttributes);
        int keyLen = (int)lenAttributes[0].getLong();
        SecretKey key = P11Key.secretKey
                    (session, keyID, algorithm, keyLen << 3, attributes);
        if ("RAW".equals(key.getFormat())) {
            // Workaround for Solaris bug 6318543.
            // Strip leading zeroes ourselves if possible (key not sensitive).
            // This should be removed once the Solaris fix is available
            // as here we always retrieve the CKA_VALUE even for tokens
            // that do not have that bug.
            byte[] keyBytes = key.getEncoded();
            byte[] newBytes = KeyUtil.trimZeroes(keyBytes);
            if (keyBytes != newBytes) {
                key = new SecretKeySpec(newBytes, algorithm);
            }
        }
        return key;
    } catch (PKCS11Exception e) {
        throw new InvalidKeyException("Could not derive key", e);
    } finally {
        publicValue = null;
        token.releaseSession(session);
    }
}
Example 12
Source File: P11KeyAgreement.java    From jdk8u-jdk with GNU General Public License v2.0 4 votes vote down vote up 
private SecretKey nativeGenerateSecret(String algorithm)
        throws IllegalStateException, NoSuchAlgorithmException,
        InvalidKeyException {
    if ((privateKey == null) || (publicValue == null)) {
        throw new IllegalStateException("Not initialized correctly");
    }
    long keyType = CKK_GENERIC_SECRET;
    Session session = null;
    try {
        session = token.getObjSession();
        CK_ATTRIBUTE[] attributes = new CK_ATTRIBUTE[] {
            new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY),
            new CK_ATTRIBUTE(CKA_KEY_TYPE, keyType),
        };
        attributes = token.getAttributes
            (O_GENERATE, CKO_SECRET_KEY, keyType, attributes);
        long keyID = token.p11.C_DeriveKey(session.id(),
            new CK_MECHANISM(mechanism, publicValue), privateKey.keyID,
            attributes);
        CK_ATTRIBUTE[] lenAttributes = new CK_ATTRIBUTE[] {
            new CK_ATTRIBUTE(CKA_VALUE_LEN),
        };
        token.p11.C_GetAttributeValue(session.id(), keyID, lenAttributes);
        int keyLen = (int)lenAttributes[0].getLong();
        SecretKey key = P11Key.secretKey
                    (session, keyID, algorithm, keyLen << 3, attributes);
        if ("RAW".equals(key.getFormat())) {
            // Workaround for Solaris bug 6318543.
            // Strip leading zeroes ourselves if possible (key not sensitive).
            // This should be removed once the Solaris fix is available
            // as here we always retrieve the CKA_VALUE even for tokens
            // that do not have that bug.
            byte[] keyBytes = key.getEncoded();
            byte[] newBytes = KeyUtil.trimZeroes(keyBytes);
            if (keyBytes != newBytes) {
                key = new SecretKeySpec(newBytes, algorithm);
            }
        }
        return key;
    } catch (PKCS11Exception e) {
        throw new InvalidKeyException("Could not derive key", e);
    } finally {
        publicValue = null;
        token.releaseSession(session);
    }
}
Example 13
Source File: P11KeyAgreement.java    From openjdk-jdk8u with GNU General Public License v2.0 4 votes vote down vote up 
private SecretKey nativeGenerateSecret(String algorithm)
        throws IllegalStateException, NoSuchAlgorithmException,
        InvalidKeyException {
    if ((privateKey == null) || (publicValue == null)) {
        throw new IllegalStateException("Not initialized correctly");
    }
    long keyType = CKK_GENERIC_SECRET;
    Session session = null;
    long privKeyID = privateKey.getKeyID();
    try {
        session = token.getObjSession();
        CK_ATTRIBUTE[] attributes = new CK_ATTRIBUTE[] {
            new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY),
            new CK_ATTRIBUTE(CKA_KEY_TYPE, keyType),
        };
        attributes = token.getAttributes
            (O_GENERATE, CKO_SECRET_KEY, keyType, attributes);
        long keyID = token.p11.C_DeriveKey(session.id(),
                new CK_MECHANISM(mechanism, publicValue), privKeyID,
                attributes);
        CK_ATTRIBUTE[] lenAttributes = new CK_ATTRIBUTE[] {
            new CK_ATTRIBUTE(CKA_VALUE_LEN),
        };
        token.p11.C_GetAttributeValue(session.id(), keyID, lenAttributes);
        int keyLen = (int)lenAttributes[0].getLong();
        SecretKey key = P11Key.secretKey
                    (session, keyID, algorithm, keyLen << 3, attributes);
        if ("RAW".equals(key.getFormat())) {
            // Workaround for Solaris bug 6318543.
            // Strip leading zeroes ourselves if possible (key not sensitive).
            // This should be removed once the Solaris fix is available
            // as here we always retrieve the CKA_VALUE even for tokens
            // that do not have that bug.
            byte[] keyBytes = key.getEncoded();
            byte[] newBytes = KeyUtil.trimZeroes(keyBytes);
            if (keyBytes != newBytes) {
                key = new SecretKeySpec(newBytes, algorithm);
            }
        }
        return key;
    } catch (PKCS11Exception e) {
        throw new InvalidKeyException("Could not derive key", e);
    } finally {
        privateKey.releaseKeyID();
        publicValue = null;
        token.releaseSession(session);
    }
}
Example 14
Source File: P11KeyAgreement.java    From jdk8u-jdk with GNU General Public License v2.0 4 votes vote down vote up 
private SecretKey nativeGenerateSecret(String algorithm)
        throws IllegalStateException, NoSuchAlgorithmException,
        InvalidKeyException {
    if ((privateKey == null) || (publicValue == null)) {
        throw new IllegalStateException("Not initialized correctly");
    }
    long keyType = CKK_GENERIC_SECRET;
    Session session = null;
    try {
        session = token.getObjSession();
        CK_ATTRIBUTE[] attributes = new CK_ATTRIBUTE[] {
            new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY),
            new CK_ATTRIBUTE(CKA_KEY_TYPE, keyType),
        };
        attributes = token.getAttributes
            (O_GENERATE, CKO_SECRET_KEY, keyType, attributes);
        long keyID = token.p11.C_DeriveKey(session.id(),
            new CK_MECHANISM(mechanism, publicValue), privateKey.keyID,
            attributes);
        CK_ATTRIBUTE[] lenAttributes = new CK_ATTRIBUTE[] {
            new CK_ATTRIBUTE(CKA_VALUE_LEN),
        };
        token.p11.C_GetAttributeValue(session.id(), keyID, lenAttributes);
        int keyLen = (int)lenAttributes[0].getLong();
        SecretKey key = P11Key.secretKey
                    (session, keyID, algorithm, keyLen << 3, attributes);
        if ("RAW".equals(key.getFormat())) {
            // Workaround for Solaris bug 6318543.
            // Strip leading zeroes ourselves if possible (key not sensitive).
            // This should be removed once the Solaris fix is available
            // as here we always retrieve the CKA_VALUE even for tokens
            // that do not have that bug.
            byte[] keyBytes = key.getEncoded();
            byte[] newBytes = KeyUtil.trimZeroes(keyBytes);
            if (keyBytes != newBytes) {
                key = new SecretKeySpec(newBytes, algorithm);
            }
        }
        return key;
    } catch (PKCS11Exception e) {
        throw new InvalidKeyException("Could not derive key", e);
    } finally {
        publicValue = null;
        token.releaseSession(session);
    }
}
Example 15
Source File: P11KeyAgreement.java    From jdk8u_jdk with GNU General Public License v2.0 4 votes vote down vote up 
private SecretKey nativeGenerateSecret(String algorithm)
        throws IllegalStateException, NoSuchAlgorithmException,
        InvalidKeyException {
    if ((privateKey == null) || (publicValue == null)) {
        throw new IllegalStateException("Not initialized correctly");
    }
    long keyType = CKK_GENERIC_SECRET;
    Session session = null;
    long privKeyID = privateKey.getKeyID();
    try {
        session = token.getObjSession();
        CK_ATTRIBUTE[] attributes = new CK_ATTRIBUTE[] {
            new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY),
            new CK_ATTRIBUTE(CKA_KEY_TYPE, keyType),
        };
        attributes = token.getAttributes
            (O_GENERATE, CKO_SECRET_KEY, keyType, attributes);
        long keyID = token.p11.C_DeriveKey(session.id(),
                new CK_MECHANISM(mechanism, publicValue), privKeyID,
                attributes);
        CK_ATTRIBUTE[] lenAttributes = new CK_ATTRIBUTE[] {
            new CK_ATTRIBUTE(CKA_VALUE_LEN),
        };
        token.p11.C_GetAttributeValue(session.id(), keyID, lenAttributes);
        int keyLen = (int)lenAttributes[0].getLong();
        SecretKey key = P11Key.secretKey
                    (session, keyID, algorithm, keyLen << 3, attributes);
        if ("RAW".equals(key.getFormat())) {
            // Workaround for Solaris bug 6318543.
            // Strip leading zeroes ourselves if possible (key not sensitive).
            // This should be removed once the Solaris fix is available
            // as here we always retrieve the CKA_VALUE even for tokens
            // that do not have that bug.
            byte[] keyBytes = key.getEncoded();
            byte[] newBytes = KeyUtil.trimZeroes(keyBytes);
            if (keyBytes != newBytes) {
                key = new SecretKeySpec(newBytes, algorithm);
            }
        }
        return key;
    } catch (PKCS11Exception e) {
        throw new InvalidKeyException("Could not derive key", e);
    } finally {
        privateKey.releaseKeyID();
        publicValue = null;
        token.releaseSession(session);
    }
}
Example 16
Source File: P11KeyAgreement.java    From hottub with GNU General Public License v2.0 4 votes vote down vote up 
private SecretKey nativeGenerateSecret(String algorithm)
        throws IllegalStateException, NoSuchAlgorithmException,
        InvalidKeyException {
    if ((privateKey == null) || (publicValue == null)) {
        throw new IllegalStateException("Not initialized correctly");
    }
    long keyType = CKK_GENERIC_SECRET;
    Session session = null;
    try {
        session = token.getObjSession();
        CK_ATTRIBUTE[] attributes = new CK_ATTRIBUTE[] {
            new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY),
            new CK_ATTRIBUTE(CKA_KEY_TYPE, keyType),
        };
        attributes = token.getAttributes
            (O_GENERATE, CKO_SECRET_KEY, keyType, attributes);
        long keyID = token.p11.C_DeriveKey(session.id(),
            new CK_MECHANISM(mechanism, publicValue), privateKey.keyID,
            attributes);
        CK_ATTRIBUTE[] lenAttributes = new CK_ATTRIBUTE[] {
            new CK_ATTRIBUTE(CKA_VALUE_LEN),
        };
        token.p11.C_GetAttributeValue(session.id(), keyID, lenAttributes);
        int keyLen = (int)lenAttributes[0].getLong();
        SecretKey key = P11Key.secretKey
                    (session, keyID, algorithm, keyLen << 3, attributes);
        if ("RAW".equals(key.getFormat())) {
            // Workaround for Solaris bug 6318543.
            // Strip leading zeroes ourselves if possible (key not sensitive).
            // This should be removed once the Solaris fix is available
            // as here we always retrieve the CKA_VALUE even for tokens
            // that do not have that bug.
            byte[] keyBytes = key.getEncoded();
            byte[] newBytes = KeyUtil.trimZeroes(keyBytes);
            if (keyBytes != newBytes) {
                key = new SecretKeySpec(newBytes, algorithm);
            }
        }
        return key;
    } catch (PKCS11Exception e) {
        throw new InvalidKeyException("Could not derive key", e);
    } finally {
        publicValue = null;
        token.releaseSession(session);
    }
}
Example 17
Source File: P11KeyAgreement.java    From openjdk-8-source with GNU General Public License v2.0 4 votes vote down vote up 
private SecretKey nativeGenerateSecret(String algorithm)
        throws IllegalStateException, NoSuchAlgorithmException,
        InvalidKeyException {
    if ((privateKey == null) || (publicValue == null)) {
        throw new IllegalStateException("Not initialized correctly");
    }
    long keyType = CKK_GENERIC_SECRET;
    Session session = null;
    try {
        session = token.getObjSession();
        CK_ATTRIBUTE[] attributes = new CK_ATTRIBUTE[] {
            new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY),
            new CK_ATTRIBUTE(CKA_KEY_TYPE, keyType),
        };
        attributes = token.getAttributes
            (O_GENERATE, CKO_SECRET_KEY, keyType, attributes);
        long keyID = token.p11.C_DeriveKey(session.id(),
            new CK_MECHANISM(mechanism, publicValue), privateKey.keyID,
            attributes);
        CK_ATTRIBUTE[] lenAttributes = new CK_ATTRIBUTE[] {
            new CK_ATTRIBUTE(CKA_VALUE_LEN),
        };
        token.p11.C_GetAttributeValue(session.id(), keyID, lenAttributes);
        int keyLen = (int)lenAttributes[0].getLong();
        SecretKey key = P11Key.secretKey
                    (session, keyID, algorithm, keyLen << 3, attributes);
        if ("RAW".equals(key.getFormat())) {
            // Workaround for Solaris bug 6318543.
            // Strip leading zeroes ourselves if possible (key not sensitive).
            // This should be removed once the Solaris fix is available
            // as here we always retrieve the CKA_VALUE even for tokens
            // that do not have that bug.
            byte[] keyBytes = key.getEncoded();
            byte[] newBytes = KeyUtil.trimZeroes(keyBytes);
            if (keyBytes != newBytes) {
                key = new SecretKeySpec(newBytes, algorithm);
            }
        }
        return key;
    } catch (PKCS11Exception e) {
        throw new InvalidKeyException("Could not derive key", e);
    } finally {
        publicValue = null;
        token.releaseSession(session);
    }
}
Example 18
Source File: P11KeyAgreement.java    From TencentKona-8 with GNU General Public License v2.0 4 votes vote down vote up 
private SecretKey nativeGenerateSecret(String algorithm)
        throws IllegalStateException, NoSuchAlgorithmException,
        InvalidKeyException {
    if ((privateKey == null) || (publicValue == null)) {
        throw new IllegalStateException("Not initialized correctly");
    }
    long keyType = CKK_GENERIC_SECRET;
    Session session = null;
    try {
        session = token.getObjSession();
        CK_ATTRIBUTE[] attributes = new CK_ATTRIBUTE[] {
            new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY),
            new CK_ATTRIBUTE(CKA_KEY_TYPE, keyType),
        };
        attributes = token.getAttributes
            (O_GENERATE, CKO_SECRET_KEY, keyType, attributes);
        long keyID = token.p11.C_DeriveKey(session.id(),
            new CK_MECHANISM(mechanism, publicValue), privateKey.keyID,
            attributes);
        CK_ATTRIBUTE[] lenAttributes = new CK_ATTRIBUTE[] {
            new CK_ATTRIBUTE(CKA_VALUE_LEN),
        };
        token.p11.C_GetAttributeValue(session.id(), keyID, lenAttributes);
        int keyLen = (int)lenAttributes[0].getLong();
        SecretKey key = P11Key.secretKey
                    (session, keyID, algorithm, keyLen << 3, attributes);
        if ("RAW".equals(key.getFormat())) {
            // Workaround for Solaris bug 6318543.
            // Strip leading zeroes ourselves if possible (key not sensitive).
            // This should be removed once the Solaris fix is available
            // as here we always retrieve the CKA_VALUE even for tokens
            // that do not have that bug.
            byte[] keyBytes = key.getEncoded();
            byte[] newBytes = KeyUtil.trimZeroes(keyBytes);
            if (keyBytes != newBytes) {
                key = new SecretKeySpec(newBytes, algorithm);
            }
        }
        return key;
    } catch (PKCS11Exception e) {
        throw new InvalidKeyException("Could not derive key", e);
    } finally {
        publicValue = null;
        token.releaseSession(session);
    }
}
Example 19
Source File: P11KeyAgreement.java    From openjdk-8 with GNU General Public License v2.0 4 votes vote down vote up 
private SecretKey nativeGenerateSecret(String algorithm)
        throws IllegalStateException, NoSuchAlgorithmException,
        InvalidKeyException {
    if ((privateKey == null) || (publicValue == null)) {
        throw new IllegalStateException("Not initialized correctly");
    }
    long keyType = CKK_GENERIC_SECRET;
    Session session = null;
    try {
        session = token.getObjSession();
        CK_ATTRIBUTE[] attributes = new CK_ATTRIBUTE[] {
            new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY),
            new CK_ATTRIBUTE(CKA_KEY_TYPE, keyType),
        };
        attributes = token.getAttributes
            (O_GENERATE, CKO_SECRET_KEY, keyType, attributes);
        long keyID = token.p11.C_DeriveKey(session.id(),
            new CK_MECHANISM(mechanism, publicValue), privateKey.keyID,
            attributes);
        CK_ATTRIBUTE[] lenAttributes = new CK_ATTRIBUTE[] {
            new CK_ATTRIBUTE(CKA_VALUE_LEN),
        };
        token.p11.C_GetAttributeValue(session.id(), keyID, lenAttributes);
        int keyLen = (int)lenAttributes[0].getLong();
        SecretKey key = P11Key.secretKey
                    (session, keyID, algorithm, keyLen << 3, attributes);
        if ("RAW".equals(key.getFormat())) {
            // Workaround for Solaris bug 6318543.
            // Strip leading zeroes ourselves if possible (key not sensitive).
            // This should be removed once the Solaris fix is available
            // as here we always retrieve the CKA_VALUE even for tokens
            // that do not have that bug.
            byte[] keyBytes = key.getEncoded();
            byte[] newBytes = KeyUtil.trimZeroes(keyBytes);
            if (keyBytes != newBytes) {
                key = new SecretKeySpec(newBytes, algorithm);
            }
        }
        return key;
    } catch (PKCS11Exception e) {
        throw new InvalidKeyException("Could not derive key", e);
    } finally {
        publicValue = null;
        token.releaseSession(session);
    }
}
Example 20
Source File: P11KeyAgreement.java    From dragonwell8_jdk with GNU General Public License v2.0 4 votes vote down vote up 
private SecretKey nativeGenerateSecret(String algorithm)
        throws IllegalStateException, NoSuchAlgorithmException,
        InvalidKeyException {
    if ((privateKey == null) || (publicValue == null)) {
        throw new IllegalStateException("Not initialized correctly");
    }
    long keyType = CKK_GENERIC_SECRET;
    Session session = null;
    long privKeyID = privateKey.getKeyID();
    try {
        session = token.getObjSession();
        CK_ATTRIBUTE[] attributes = new CK_ATTRIBUTE[] {
            new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY),
            new CK_ATTRIBUTE(CKA_KEY_TYPE, keyType),
        };
        attributes = token.getAttributes
            (O_GENERATE, CKO_SECRET_KEY, keyType, attributes);
        long keyID = token.p11.C_DeriveKey(session.id(),
                new CK_MECHANISM(mechanism, publicValue), privKeyID,
                attributes);
        CK_ATTRIBUTE[] lenAttributes = new CK_ATTRIBUTE[] {
            new CK_ATTRIBUTE(CKA_VALUE_LEN),
        };
        token.p11.C_GetAttributeValue(session.id(), keyID, lenAttributes);
        int keyLen = (int)lenAttributes[0].getLong();
        SecretKey key = P11Key.secretKey
                    (session, keyID, algorithm, keyLen << 3, attributes);
        if ("RAW".equals(key.getFormat())) {
            // Workaround for Solaris bug 6318543.
            // Strip leading zeroes ourselves if possible (key not sensitive).
            // This should be removed once the Solaris fix is available
            // as here we always retrieve the CKA_VALUE even for tokens
            // that do not have that bug.
            byte[] keyBytes = key.getEncoded();
            byte[] newBytes = KeyUtil.trimZeroes(keyBytes);
            if (keyBytes != newBytes) {
                key = new SecretKeySpec(newBytes, algorithm);
            }
        }
        return key;
    } catch (PKCS11Exception e) {
        throw new InvalidKeyException("Could not derive key", e);
    } finally {
        privateKey.releaseKeyID();
        publicValue = null;
        token.releaseSession(session);
    }
}