javax.crypto.spec.GCMParameterSpec Java Examples

private static void newGCMParameterSpecPass(
        int tLen, byte[] src, int offset, int len) {
    try {
        GCMParameterSpec gcmps =
            new GCMParameterSpec(tLen, src, offset, len);
        if (gcmps.getTLen() != tLen) {
            throw new Exception("tLen's not equal");
        }
        if (!Arrays.equals(gcmps.getIV(),
                Arrays.copyOfRange(src, offset, offset + len))) {
            System.out.println(offset + " " + len);
            System.out.println(Arrays.copyOfRange(src, offset, len)[0]);
            throw new Exception("IV's not equal");
        }
    } catch (Exception e) {
        e.printStackTrace();
        failed++;
    }
}
 

@Override
public byte[] encrypt(byte[] data, byte[] key) throws Exception {
    SecretKeySpec secretKeySpec = new SecretKeySpec(key, KEY_SPEC);
    byte[] iv = new byte[IV_SIZE];
    secureRandom.nextBytes(iv);
    GCMParameterSpec gcmParamSpec = new GCMParameterSpec(TAG_BIT_LENGTH, iv);
    Cipher cipher = Cipher.getInstance(ALGO_TRANSFORMATION_STRING);
    cipher.init(Cipher.ENCRYPT_MODE, secretKeySpec, gcmParamSpec, secureRandom);
    cipher.updateAAD(TAG.getBytes(StandardCharsets.UTF_8));

    ByteArrayOutputStream baos = new ByteArrayOutputStream();
    baos.write(iv);

    try (CipherOutputStream cipherOutputStream = new CipherOutputStream(baos, cipher)) {
        cipherOutputStream.write(data);
    }

    return baos.toByteArray();
}
 

private static void newGCMParameterSpecPass(
        int tLen, byte[] src, int offset, int len) {
    try {
        GCMParameterSpec gcmps =
            new GCMParameterSpec(tLen, src, offset, len);
        if (gcmps.getTLen() != tLen) {
            throw new Exception("tLen's not equal");
        }
        if (!Arrays.equals(gcmps.getIV(),
                Arrays.copyOfRange(src, offset, offset + len))) {
            System.out.println(offset + " " + len);
            System.out.println(Arrays.copyOfRange(src, offset, len)[0]);
            throw new Exception("IV's not equal");
        }
    } catch (Exception e) {
        e.printStackTrace();
        failed++;
    }
}
 

private void testGcmDecryption(final String kHex, final String pHex, final String ivHex, final String aadHex,
                               final String cHex, final String tHex) throws Exception {

    final byte[] keyBytes = DatatypeConverter.parseHexBinary(kHex);
    final byte[] plainBytes = DatatypeConverter.parseHexBinary(pHex);
    final byte[] ivBytes = DatatypeConverter.parseHexBinary(ivHex);

    final byte[] aad = DatatypeConverter.parseHexBinary(aadHex);
    final byte[] cipherBytes = DatatypeConverter.parseHexBinary(cHex+tHex);

    final byte[] input = cipherBytes;
    final byte[] output = new byte[plainBytes.length];

    final CryptoCipher c = Utils.getCipherInstance(transformation, props);

    final Key key = new SecretKeySpec(keyBytes, "AES");

    final GCMParameterSpec iv = new GCMParameterSpec(128, ivBytes);
    c.init(Cipher.DECRYPT_MODE, key, iv);
    c.updateAAD(aad);
    c.doFinal(input, 0, input.length, output, 0);

    Assert.assertArrayEquals(plainBytes, output);
    c.close();
}
 

/**
 * Run the test in case when AAD and text are placed in the same byte
 * array.
 */
private void doTestWithSameArrays(int offset, AlgorithmParameters params)
        throws Exception {
    // prepare buffers to test
    Cipher c = createCipher(Cipher.ENCRYPT_MODE, params);
    int outputLength = c.getOutputSize(textLength);
    int outputBufSize = AADLength + outputLength + offset * 2;

    byte[] AAD_and_text = Helper.generateBytes(outputBufSize);

    // do the test
    runGCMWithSameArray(Cipher.ENCRYPT_MODE, AAD_and_text, AADLength + offset,
            textLength, params);
    int tagLength = c.getParameters()
            .getParameterSpec(GCMParameterSpec.class).getTLen() / 8;
    runGCMWithSameArray(Cipher.DECRYPT_MODE, AAD_and_text, AADLength + offset,
            textLength + tagLength, params);
}
 

private static void newGCMParameterSpecPass(
        int tLen, byte[] src, int offset, int len) {
    try {
        GCMParameterSpec gcmps =
            new GCMParameterSpec(tLen, src, offset, len);
        if (gcmps.getTLen() != tLen) {
            throw new Exception("tLen's not equal");
        }
        if (!Arrays.equals(gcmps.getIV(),
                Arrays.copyOfRange(src, offset, offset + len))) {
            System.out.println(offset + " " + len);
            System.out.println(Arrays.copyOfRange(src, offset, len)[0]);
            throw new Exception("IV's not equal");
        }
    } catch (Exception e) {
        e.printStackTrace();
        failed++;
    }
}
 

private void doTestWithSeparateArrays(int offset,
        AlgorithmParameters params) throws Exception {
    // prepare buffers to test
    Cipher c = createCipher(Cipher.ENCRYPT_MODE, params);
    int outputLength = c.getOutputSize(textLength);
    int outputBufSize = outputLength + offset * 2;

    byte[] inputText = Helper.generateBytes(outputBufSize);
    byte[] AAD = Helper.generateBytes(AADLength);

    // do the test
    runGCMWithSeparateArray(Cipher.ENCRYPT_MODE, AAD, inputText, offset * 2,
            textLength, offset, params);
    int tagLength = c.getParameters()
            .getParameterSpec(GCMParameterSpec.class).getTLen() / 8;
    runGCMWithSeparateArray(Cipher.DECRYPT_MODE, AAD, inputText, offset,
            textLength + tagLength, offset, params);
}
 

private Cipher makeCipher(int mode, EncryptionKey key)
{
    if (key.getNonce().length != NONCE_BYTES) {
        throw new RuntimeException("Expected " + NONCE_BYTES + " nonce bytes but found " + key.getNonce().length);
    }

    if (key.getKey().length != KEY_BYTES) {
        throw new RuntimeException("Expected " + KEY_BYTES + " key bytes but found " + key.getKey().length);
    }

    GCMParameterSpec spec = new GCMParameterSpec(GCM_TAG_LENGTH_BITS, key.getNonce());
    SecretKeySpec secretKeySpec = new SecretKeySpec(key.getKey(), KEYSPEC);

    try {
        Cipher cipher = Cipher.getInstance(ALGO, ALGO_BC);
        cipher.init(mode, secretKeySpec, spec);
        return cipher;
    }
    catch (NoSuchAlgorithmException | InvalidKeyException | InvalidAlgorithmParameterException
            | NoSuchProviderException | NoSuchPaddingException ex) {
        throw new RuntimeException(ex);
    }
}
 

private void doTestWithSameBuffer(int offset, AlgorithmParameters params)
        throws Exception {
    // calculate output length
    Cipher c = createCipher(Cipher.ENCRYPT_MODE, params);
    int outputLength = c.getOutputSize(textLength);

    // prepare byte buffer contained AAD and plain text
    int bufSize = AADLength + offset + outputLength;
    byte[] AAD_and_Text = Helper.generateBytes(bufSize);
    ByteBuffer AAD_and_Text_Buf = ByteBuffer.allocate(bufSize);
    AAD_and_Text_Buf.put(AAD_and_Text, 0, AAD_and_Text.length);

    // do test
    runGCMWithSameBuffer(Cipher.ENCRYPT_MODE, AAD_and_Text_Buf, offset,
            textLength, params);
    int tagLength = c.getParameters()
            .getParameterSpec(GCMParameterSpec.class).getTLen() / 8;
    AAD_and_Text_Buf.limit(AADLength + offset + textLength + tagLength);
    runGCMWithSameBuffer(Cipher.DECRYPT_MODE, AAD_and_Text_Buf, offset,
            textLength + tagLength, params);

}
 

private static void newGCMParameterSpecPass(
        int tLen, byte[] src, int offset, int len) {
    try {
        GCMParameterSpec gcmps =
            new GCMParameterSpec(tLen, src, offset, len);
        if (gcmps.getTLen() != tLen) {
            throw new Exception("tLen's not equal");
        }
        if (!Arrays.equals(gcmps.getIV(),
                Arrays.copyOfRange(src, offset, offset + len))) {
            System.out.println(offset + " " + len);
            System.out.println(Arrays.copyOfRange(src, offset, len)[0]);
            throw new Exception("IV's not equal");
        }
    } catch (Exception e) {
        e.printStackTrace();
        failed++;
    }
}
 

Boolean isAvailable() {
    // We won't know whether a cipher for a particular key size is
    // available until the cipher is successfully initialized.
    //
    // We do not initialize AEAD cipher in the constructor.  Need to
    // initialize the cipher to ensure that the AEAD mode for a
    // particular key size is supported.
    if (cipherType == AEAD_CIPHER) {
        try {
            Authenticator authenticator =
                new Authenticator(protocolVersion);
            byte[] nonce = authenticator.sequenceNumber();
            byte[] iv = Arrays.copyOf(fixedIv,
                                        fixedIv.length + nonce.length);
            System.arraycopy(nonce, 0, iv, fixedIv.length, nonce.length);
            GCMParameterSpec spec = new GCMParameterSpec(tagSize * 8, iv);

            cipher.init(mode, key, spec, random);
        } catch (Exception e) {
            return Boolean.FALSE;
        }
    }   // Otherwise, we have initialized the cipher in the constructor.

    return Boolean.TRUE;
}
 

@Override
public String decryptValue(final String password, final String userId, final String value) {
	if (password != null && userId != null && value!=null) {
		try {			
			final Key buildKey = buildKey(userId, password);
			final ByteBuffer byteBuffer = ByteBuffer.wrap(Hex.decode(value.getBytes(StandardCharsets.UTF_8)));
			final int ivLength = byteBuffer.getInt();
			final byte[] iv = new byte[ivLength];
			byteBuffer.get(iv);
			final byte[] cipherText = new byte[byteBuffer.remaining()];
			byteBuffer.get(cipherText);
			
			final Cipher cipher = Cipher.getInstance(AES_GCM_NO_PADDING);
			cipher.init(Cipher.DECRYPT_MODE, buildKey, new GCMParameterSpec(TAG_BIT_LENGTH, iv));
			return new String(cipher.doFinal(cipherText),StandardCharsets.UTF_8);
		} catch (final GeneralSecurityException e) {
			LOGGER.error(DECRYPT_VALUE,e);
			return null;
		}		
	} else {
		return null;
	}

}
 

Boolean isAvailable() {
    // We won't know whether a cipher for a particular key size is
    // available until the cipher is successfully initialized.
    //
    // We do not initialize AEAD cipher in the constructor.  Need to
    // initialize the cipher to ensure that the AEAD mode for a
    // particular key size is supported.
    if (cipherType == AEAD_CIPHER) {
        try {
            Authenticator authenticator =
                new Authenticator(protocolVersion);
            byte[] nonce = authenticator.sequenceNumber();
            byte[] iv = Arrays.copyOf(fixedIv,
                                        fixedIv.length + nonce.length);
            System.arraycopy(nonce, 0, iv, fixedIv.length, nonce.length);
            GCMParameterSpec spec = new GCMParameterSpec(tagSize * 8, iv);

            cipher.init(mode, key, spec, random);
        } catch (Exception e) {
            return Boolean.FALSE;
        }
    }   // Otherwise, we have initialized the cipher in the constructor.

    return Boolean.TRUE;
}
 

/**
 * Run the test in case when AAD and text are placed in the same byte
 * array.
 */
private void doTestWithSameArrays(int offset, AlgorithmParameters params)
        throws Exception {
    // prepare buffers to test
    Cipher c = createCipher(Cipher.ENCRYPT_MODE, params);
    int outputLength = c.getOutputSize(textLength);
    int outputBufSize = AADLength + outputLength + offset * 2;

    byte[] AAD_and_text = Helper.generateBytes(outputBufSize);

    // do the test
    runGCMWithSameArray(Cipher.ENCRYPT_MODE, AAD_and_text, AADLength + offset,
            textLength, params);
    int tagLength = c.getParameters()
            .getParameterSpec(GCMParameterSpec.class).getTLen() / 8;
    runGCMWithSameArray(Cipher.DECRYPT_MODE, AAD_and_text, AADLength + offset,
            textLength + tagLength, params);
}
 

private void doTestWithSeparateArrays(int offset,
        AlgorithmParameters params) throws Exception {
    // prepare buffers to test
    Cipher c = createCipher(Cipher.ENCRYPT_MODE, params);
    int outputLength = c.getOutputSize(textLength);
    int outputBufSize = outputLength + offset * 2;

    byte[] inputText = Helper.generateBytes(outputBufSize);
    byte[] AAD = Helper.generateBytes(AADLength);

    // do the test
    runGCMWithSeparateArray(Cipher.ENCRYPT_MODE, AAD, inputText, offset * 2,
            textLength, offset, params);
    int tagLength = c.getParameters()
            .getParameterSpec(GCMParameterSpec.class).getTLen() / 8;
    runGCMWithSeparateArray(Cipher.DECRYPT_MODE, AAD, inputText, offset,
            textLength + tagLength, offset, params);
}
 

private void doTestWithSeparateArrays(int offset,
        AlgorithmParameters params) throws Exception {
    // prepare buffers to test
    Cipher c = createCipher(Cipher.ENCRYPT_MODE, params);
    int outputLength = c.getOutputSize(textLength);
    int outputBufSize = outputLength + offset * 2;

    byte[] inputText = Helper.generateBytes(outputBufSize);
    byte[] AAD = Helper.generateBytes(AADLength);

    // do the test
    runGCMWithSeparateArray(Cipher.ENCRYPT_MODE, AAD, inputText, offset * 2,
            textLength, offset, params);
    int tagLength = c.getParameters()
            .getParameterSpec(GCMParameterSpec.class).getTLen() / 8;
    runGCMWithSeparateArray(Cipher.DECRYPT_MODE, AAD, inputText, offset,
            textLength + tagLength, offset, params);
}
 

Boolean isAvailable() {
    // We won't know whether a cipher for a particular key size is
    // available until the cipher is successfully initialized.
    //
    // We do not initialize AEAD cipher in the constructor.  Need to
    // initialize the cipher to ensure that the AEAD mode for a
    // particular key size is supported.
    if (cipherType == AEAD_CIPHER) {
        try {
            Authenticator authenticator =
                new Authenticator(protocolVersion);
            byte[] nonce = authenticator.sequenceNumber();
            byte[] iv = Arrays.copyOf(fixedIv,
                                        fixedIv.length + nonce.length);
            System.arraycopy(nonce, 0, iv, fixedIv.length, nonce.length);
            GCMParameterSpec spec = new GCMParameterSpec(tagSize * 8, iv);

            cipher.init(mode, key, spec, random);
        } catch (Exception e) {
            return Boolean.FALSE;
        }
    }   // Otherwise, we have initialized the cipher in the constructor.

    return Boolean.TRUE;
}
 

private static void newGCMParameterSpecPass(
        int tLen, byte[] src, int offset, int len) {
    try {
        GCMParameterSpec gcmps =
            new GCMParameterSpec(tLen, src, offset, len);
        if (gcmps.getTLen() != tLen) {
            throw new Exception("tLen's not equal");
        }
        if (!Arrays.equals(gcmps.getIV(),
                Arrays.copyOfRange(src, offset, offset + len))) {
            System.out.println(offset + " " + len);
            System.out.println(Arrays.copyOfRange(src, offset, len)[0]);
            throw new Exception("IV's not equal");
        }
    } catch (Exception e) {
        e.printStackTrace();
        failed++;
    }
}
 

protected long doBatch(long numBytes) throws InterruptedException {
    long numIterations = java.lang.Math.round((double)numBytes/data.length)+1;
    long numBuffers = buffer / len;
    try {
        for (long i = 0; i < numIterations; i++) {
            if (modeInt == 1) {
                r.nextBytes(iv);
                iva = new GCMParameterSpec(16 * 8, iv);
                cipher.init(Cipher.ENCRYPT_MODE, skey, iva);
                cipher.updateAAD(aada, 0, aada.length);
                cipher.doFinal(data, (int) ((i % numBuffers) * len), (int) len, out11, (int) ((i % numBuffers) * (len + 16)));
            } else if (modeInt == 0) {
                cipher.init(Cipher.DECRYPT_MODE, skey, iva);
                cipher.updateAAD(aada, 0, aada.length);
                cipher.doFinal(out11, 0, out11.length, data);
            }
        }
    } catch (Exception e) {
        e.printStackTrace();
        System.exit(1);
    }
    return numIterations*len;
}
 

protected void engineInit(AlgorithmParameterSpec paramSpec)
    throws InvalidParameterSpecException {

    if (!(paramSpec instanceof GCMParameterSpec)) {
        throw new InvalidParameterSpecException
            ("Inappropriate parameter specification");
    }
    GCMParameterSpec gps = (GCMParameterSpec) paramSpec;
    // need to convert from bits to bytes for ASN.1 encoding
    this.tLen = gps.getTLen()/8;
    if (this.tLen < 12 || this.tLen > 16 ) {
        throw new InvalidParameterSpecException
            ("GCM parameter parsing error: unsupported tag len: " +
             this.tLen);
    }
    this.iv = gps.getIV();
}
 

private void doTestWithSeparateArrays(int offset,
        AlgorithmParameters params) throws Exception {
    // prepare buffers to test
    Cipher c = createCipher(Cipher.ENCRYPT_MODE, params);
    int outputLength = c.getOutputSize(textLength);
    int outputBufSize = outputLength + offset * 2;

    byte[] inputText = Helper.generateBytes(outputBufSize);
    byte[] AAD = Helper.generateBytes(AADLength);

    // do the test
    runGCMWithSeparateArray(Cipher.ENCRYPT_MODE, AAD, inputText, offset * 2,
            textLength, offset, params);
    int tagLength = c.getParameters()
            .getParameterSpec(GCMParameterSpec.class).getTLen() / 8;
    runGCMWithSeparateArray(Cipher.DECRYPT_MODE, AAD, inputText, offset,
            textLength + tagLength, offset, params);
}
 

private ByteBuf decryptData(SecretKey dataKeySecret, PulsarApi.MessageMetadata msgMetadata, ByteBuf payload) {

        // unpack iv and encrypted data
        ByteString ivString = msgMetadata.getEncryptionParam();
        ivString.copyTo(iv, 0);

        GCMParameterSpec gcmParams = new GCMParameterSpec(tagLen, iv);
        ByteBuf targetBuf = null;
        try {
            cipher.init(Cipher.DECRYPT_MODE, dataKeySecret, gcmParams);

            ByteBuffer sourceNioBuf = payload.nioBuffer(payload.readerIndex(), payload.readableBytes());

            int maxLength = cipher.getOutputSize(payload.readableBytes());
            targetBuf = PulsarByteBufAllocator.DEFAULT.buffer(maxLength, maxLength);
            ByteBuffer targetNioBuf = targetBuf.nioBuffer(0, maxLength);

            int decryptedSize = cipher.doFinal(sourceNioBuf, targetNioBuf);
            targetBuf.writerIndex(decryptedSize);

        } catch (InvalidKeyException | InvalidAlgorithmParameterException | IllegalBlockSizeException
                | BadPaddingException | ShortBufferException e) {
            log.error("{} Failed to decrypt message {}", logCtx, e.getMessage());
            if (targetBuf != null) {
                targetBuf.release();
                targetBuf = null;
            }
        }

        return targetBuf;
    }
 

protected void engineInit(AlgorithmParameterSpec paramSpec)
    throws InvalidParameterSpecException {

    if (!(paramSpec instanceof GCMParameterSpec)) {
        throw new InvalidParameterSpecException
            ("Inappropriate parameter specification");
    }
    GCMParameterSpec gps = (GCMParameterSpec) paramSpec;
    // need to convert from bits to bytes for ASN.1 encoding
    this.tLen = gps.getTLen()/8;
    this.iv = gps.getIV();
}
 

private static void newGCMParameterSpecPass(
        int tLen, byte[] src) {
    try {
        GCMParameterSpec gcmps = new GCMParameterSpec(tLen, src);
        if (gcmps.getTLen() != tLen) {
            throw new Exception("tLen's not equal");
        }
        if (!Arrays.equals(gcmps.getIV(), src)) {
            throw new Exception("IV's not equal");
        }
    } catch (Exception e) {
        e.printStackTrace();
        failed++;
    }
}
 

protected void engineInit(AlgorithmParameterSpec paramSpec)
    throws InvalidParameterSpecException {

    if (!(paramSpec instanceof GCMParameterSpec)) {
        throw new InvalidParameterSpecException
            ("Inappropriate parameter specification");
    }
    GCMParameterSpec gps = (GCMParameterSpec) paramSpec;
    // need to convert from bits to bytes for ASN.1 encoding
    this.tLen = gps.getTLen()/8;
    this.iv = gps.getIV();
}
 

protected void engineInit(AlgorithmParameterSpec paramSpec)
    throws InvalidParameterSpecException {

    if (!(paramSpec instanceof GCMParameterSpec)) {
        throw new InvalidParameterSpecException
            ("Inappropriate parameter specification");
    }
    GCMParameterSpec gps = (GCMParameterSpec) paramSpec;
    // need to convert from bits to bytes for ASN.1 encoding
    this.tLen = gps.getTLen()/8;
    this.iv = gps.getIV();
}
 

private static void newGCMParameterSpecFail(
        int tLen, byte[] src, int offset, int len) {
    try {
        new GCMParameterSpec(tLen, src, offset, len);
        new Exception("Didn't Fail as Expected").printStackTrace();
        failed++;
    } catch (IllegalArgumentException e) {
        // swallow
    }
}
 

private AlgorithmParameterSpec getAlgorithmParameterSpec(AliceContext.Mode mode, byte[] initializationVector) {
    switch (mode) {
        case CBC:
        case CTR:
            return new IvParameterSpec(initializationVector);
        case GCM:
            return new GCMParameterSpec(context.getGcmTagLength().bits(), initializationVector);
    }

    throw new IllegalArgumentException("Unknown mode");
}
 

private Cipher getCipher(int cipherMode, byte[] iv, byte[] aad, byte[] keyId) throws GeneralSecurityException {
    Key secretKey = keyProvider.getKey(keyId);
    GCMParameterSpec spec = new GCMParameterSpec(GCM_TAG_LENGTH, iv);
    Cipher cipher = Cipher.getInstance(ALGORITHM);
    cipher.init(cipherMode, secretKey, spec);
    cipher.updateAAD(aad);
    return cipher;
}
 

private static void newGCMParameterSpecFail(
        int tLen, byte[] src) {
    try {
        new GCMParameterSpec(tLen, src);
        new Exception("Didn't Fail as Expected").printStackTrace();
        failed++;
    } catch (IllegalArgumentException e) {
        // swallow
    }
}