java.security.interfaces.ECKey Java Examples

ECParameterSpec getECParameterSpec() {
    if (popPrivateKey == null ||
            !"EC".equals(popPrivateKey.getAlgorithm())) {
        return null;
    }

    if (popPrivateKey instanceof ECKey) {
        return ((ECKey)popPrivateKey).getParams();
    } else if (popCerts != null && popCerts.length != 0) {
        // The private key not extractable, get the parameters from
        // the X.509 certificate.
        PublicKey publicKey = popCerts[0].getPublicKey();
        if (publicKey instanceof ECKey) {
            return ((ECKey)publicKey).getParams();
        }
    }

    return null;
}
 

ECParameterSpec getECParameterSpec() {
    if (popPrivateKey == null ||
            !"EC".equals(popPrivateKey.getAlgorithm())) {
        return null;
    }

    if (popPrivateKey instanceof ECKey) {
        return ((ECKey)popPrivateKey).getParams();
    } else if (popCerts != null && popCerts.length != 0) {
        // The private key not extractable, get the parameters from
        // the X.509 certificate.
        PublicKey publicKey = popCerts[0].getPublicKey();
        if (publicKey instanceof ECKey) {
            return ((ECKey)publicKey).getParams();
        }
    }

    return null;
}
 

/**
 * 初始化密钥协商算法的乙方密钥对
 *
 * @param publicKey 甲方公钥的二进制形式
 * @return 乙方密钥对
 */
public Map<String, Key> initKey(byte[] publicKey) {
    PublicKey pubKey = this.toPublicKey(publicKey);
    KeyPairGenerator keyPairGenerator = getKeyPairGenerator();
    AlgorithmParameterSpec algorithmParameterSpec = null;
    if (pubKey instanceof DHKey) {
        algorithmParameterSpec = ((DHKey) pubKey).getParams();
    } else if (pubKey instanceof ECKey) {
        algorithmParameterSpec = ((ECKey) pubKey).getParams();
    } else {
        throw new CryptographyException(ExceptionInfo.NO_SUCH_ALGORITHM_EXCEPTION_INFO + getConfiguration().getKeyAlgorithm());
    }
    try {
        keyPairGenerator.initialize(algorithmParameterSpec);
    } catch (InvalidAlgorithmParameterException e) {
        throw new CryptographyException(ExceptionInfo.NO_SUCH_ALGORITHM_EXCEPTION_INFO + getConfiguration().getKeyAlgorithm(), e);
    }
    KeyPair keyPair = keyPairGenerator.generateKeyPair();
    Map<String, Key> keyMap = new HashMap<String, Key>();
    keyMap.put(PRIVATE_KEY, keyPair.getPrivate());
    keyMap.put(PUBLIC_KEY, keyPair.getPublic());
    return keyMap;
}
 

/**
 * Get the key size of a public key.
 * 
 * @param pubKey The public key
 * @return The key size, {@link #UNKNOWN_KEY_SIZE} if not known
 */
public static int getKeyLength(PublicKey pubKey)
{
	if (pubKey instanceof RSAKey)
	{
		return ((RSAKey) pubKey).getModulus().bitLength();
	}
	else if (pubKey instanceof DSAKey)
	{
		return ((DSAKey) pubKey).getParams().getP().bitLength();
	}
	else if (pubKey instanceof DHKey)
	{
		return ((DHKey) pubKey).getParams().getP().bitLength();
	}
	else if (pubKey instanceof ECKey)
	{
		// TODO: how to get key size from these?
		return UNKNOWN_KEY_SIZE;
	}

	_logger.warn("Don't know how to get key size from key " + pubKey);
	return UNKNOWN_KEY_SIZE;
}
 

@Test
public void shouldPassECDSA256VerificationWithJOSESignature() throws Exception {
    String jwt = "eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJhdXRoMCJ9.4iVk3-Y0v4RT4_9IaQlp-8dZ_4fsTzIylgrPTDLrEvTHBTyVS3tgPbr2_IZfLETtiKRqCg0aQ5sh9eIsTTwB1g";
    ECKey key = (ECKey) readPublicKeyFromFile(PUBLIC_KEY_FILE_256, "EC");
    Algorithm algorithm = Algorithm.ECDSA256(key);
    algorithm.verify(JWT.decode(jwt));
}
 

@Test
public void shouldFailOnECDSA384SigningWhenUsingPublicKey() throws Exception {
    exception.expect(SignatureGenerationException.class);
    exception.expectMessage("The Token's Signature couldn't be generated when signing using the Algorithm: SHA384withECDSA");
    exception.expectCause(isA(IllegalStateException.class));
    exception.expectCause(hasMessage(is("The given Private Key is null.")));

    Algorithm algorithm = Algorithm.ECDSA384((ECKey) readPublicKeyFromFile(PUBLIC_KEY_FILE_384, "EC"));
    algorithm.sign(new byte[0], new byte[0]);
}
 

@Test
public void shouldFailOnECDSA256SigningWhenUsingPublicKey() throws Exception {
    exception.expect(SignatureGenerationException.class);
    exception.expectMessage("The Token's Signature couldn't be generated when signing using the Algorithm: SHA256withECDSA");
    exception.expectCause(isA(IllegalStateException.class));
    exception.expectCause(hasMessage(is("The given Private Key is null.")));

    Algorithm algorithm = Algorithm.ECDSA256((ECKey) readPublicKeyFromFile(PUBLIC_KEY_FILE_256, "EC"));
    algorithm.sign(new byte[0], new byte[0]);
}
 

@Test
public void shouldFailECDSA512VerificationOnInvalidJOSESignature() throws Exception {
    exception.expect(SignatureVerificationException.class);
    exception.expectMessage("The Token's Signature resulted invalid when verified using the Algorithm: SHA512withECDSA");

    byte[] bytes = new byte[132];
    new SecureRandom().nextBytes(bytes);
    String signature = Base64.encodeBase64URLSafeString(bytes);
    String jwt = "eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJhdXRoMCJ9." + signature;
    Algorithm algorithm = Algorithm.ECDSA512((ECKey) readPublicKeyFromFile(INVALID_PUBLIC_KEY_FILE_512, "EC"));
    algorithm.verify(JWT.decode(jwt));
}
 

@Test
public void shouldFailECDSA512VerificationOnInvalidJOSESignatureLength() throws Exception {
    exception.expect(SignatureVerificationException.class);
    exception.expectMessage("The Token's Signature resulted invalid when verified using the Algorithm: SHA512withECDSA");
    exception.expectCause(isA(SignatureException.class));
    exception.expectCause(hasMessage(is("Invalid JOSE signature format.")));

    byte[] bytes = new byte[131];
    new SecureRandom().nextBytes(bytes);
    String signature = Base64.encodeBase64URLSafeString(bytes);
    String jwt = "eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJhdXRoMCJ9." + signature;
    Algorithm algorithm = Algorithm.ECDSA512((ECKey) readPublicKeyFromFile(INVALID_PUBLIC_KEY_FILE_512, "EC"));
    algorithm.verify(JWT.decode(jwt));
}
 

@Test
public void shouldFailECDSA512VerificationWhenUsingPrivateKey() throws Exception {
    exception.expect(SignatureVerificationException.class);
    exception.expectMessage("The Token's Signature resulted invalid when verified using the Algorithm: SHA512withECDSA");
    exception.expectCause(isA(IllegalStateException.class));
    exception.expectCause(hasMessage(is("The given Public Key is null.")));
    String jwt = "eyJhbGciOiJFUzUxMiJ9.eyJpc3MiOiJhdXRoMCJ9.AZgdopFFsN0amCSs2kOucXdpylD31DEm5ChK1PG0_gq5Mf47MrvVph8zHSVuvcrXzcE1U3VxeCg89mYW1H33Y-8iAF0QFkdfTUQIWKNObH543WNMYYssv3OtOj0znPv8atDbaF8DMYAtcT1qdmaSJRhx-egRE9HGZkinPh9CfLLLt58X";
    Algorithm algorithm = Algorithm.ECDSA512((ECKey) readPrivateKeyFromFile(PRIVATE_KEY_FILE_512, "EC"));
    algorithm.verify(JWT.decode(jwt));
}
 

@Test
public void shouldFailECDSA512VerificationWithInvalidPublicKey() throws Exception {
    exception.expect(SignatureVerificationException.class);
    exception.expectMessage("The Token's Signature resulted invalid when verified using the Algorithm: SHA512withECDSA");
    String jwt = "eyJhbGciOiJFUzUxMiJ9.eyJpc3MiOiJhdXRoMCJ9.AZgdopFFsN0amCSs2kOucXdpylD31DEm5ChK1PG0_gq5Mf47MrvVph8zHSVuvcrXzcE1U3VxeCg89mYW1H33Y-8iAF0QFkdfTUQIWKNObH543WNMYYssv3OtOj0znPv8atDbaF8DMYAtcT1qdmaSJRhx-egRE9HGZkinPh9CfLLLt58X";
    Algorithm algorithm = Algorithm.ECDSA512((ECKey) readPublicKeyFromFile(INVALID_PUBLIC_KEY_FILE_512, "EC"));
    algorithm.verify(JWT.decode(jwt));
}
 

@Test
public void shouldFailECDSA512VerificationOnInvalidDERSignature() throws Exception {
    exception.expect(SignatureVerificationException.class);
    exception.expectMessage("The Token's Signature resulted invalid when verified using the Algorithm: SHA512withECDSA");

    byte[] bytes = new byte[132];
    new SecureRandom().nextBytes(bytes);
    bytes[0] = 0x30;
    String signature = Base64.encodeBase64URLSafeString(bytes);
    String jwt = "eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJhdXRoMCJ9." + signature;
    Algorithm algorithm = Algorithm.ECDSA512((ECKey) readPublicKeyFromFile(INVALID_PUBLIC_KEY_FILE_512, "EC"));
    algorithm.verify(JWT.decode(jwt));
}
 

@Test
public void shouldFailECDSA256VerificationOnInvalidJOSESignature() throws Exception {
    exception.expect(SignatureVerificationException.class);
    exception.expectMessage("The Token's Signature resulted invalid when verified using the Algorithm: SHA256withECDSA");

    byte[] bytes = new byte[64];
    new SecureRandom().nextBytes(bytes);
    String signature = Base64.encodeBase64URLSafeString(bytes);
    String jwt = "eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJhdXRoMCJ9." + signature;
    Algorithm algorithm = Algorithm.ECDSA256((ECKey) readPublicKeyFromFile(INVALID_PUBLIC_KEY_FILE_256, "EC"));
    algorithm.verify(JWT.decode(jwt));
}
 

@Test
public void shouldFailECDSA256VerificationOnInvalidJOSESignatureLength() throws Exception {
    exception.expect(SignatureVerificationException.class);
    exception.expectMessage("The Token's Signature resulted invalid when verified using the Algorithm: SHA256withECDSA");
    exception.expectCause(isA(SignatureException.class));
    exception.expectCause(hasMessage(is("Invalid JOSE signature format.")));

    byte[] bytes = new byte[63];
    new SecureRandom().nextBytes(bytes);
    String signature = Base64.encodeBase64URLSafeString(bytes);
    String jwt = "eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJhdXRoMCJ9." + signature;
    Algorithm algorithm = Algorithm.ECDSA256((ECKey) readPublicKeyFromFile(INVALID_PUBLIC_KEY_FILE_256, "EC"));
    algorithm.verify(JWT.decode(jwt));
}
 

@Test
public void shouldFailECDSA256VerificationWhenUsingPrivateKey() throws Exception {
    exception.expect(SignatureVerificationException.class);
    exception.expectMessage("The Token's Signature resulted invalid when verified using the Algorithm: SHA256withECDSA");
    exception.expectCause(isA(IllegalStateException.class));
    exception.expectCause(hasMessage(is("The given Public Key is null.")));
    String jwt = "eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJhdXRoMCJ9.W9qfN1b80B9hnMo49WL8THrOsf1vEjOhapeFemPMGySzxTcgfyudS5esgeBTO908X5SLdAr5jMwPUPBs9b6nNg";
    Algorithm algorithm = Algorithm.ECDSA256((ECKey) readPrivateKeyFromFile(PRIVATE_KEY_FILE_256, "EC"));
    algorithm.verify(JWT.decode(jwt));
}
 

@Test
public void shouldFailECDSA256VerificationWithInvalidPublicKey() throws Exception {
    exception.expect(SignatureVerificationException.class);
    exception.expectMessage("The Token's Signature resulted invalid when verified using the Algorithm: SHA256withECDSA");
    String jwt = "eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJhdXRoMCJ9.W9qfN1b80B9hnMo49WL8THrOsf1vEjOhapeFemPMGySzxTcgfyudS5esgeBTO908X5SLdAr5jMwPUPBs9b6nNg";
    Algorithm algorithm = Algorithm.ECDSA256((ECKey) readPublicKeyFromFile(INVALID_PUBLIC_KEY_FILE_256, "EC"));
    algorithm.verify(JWT.decode(jwt));
}
 

@Test
public void shouldThrowOnECDSA256VerificationWithDERSignature() throws Exception {
    exception.expect(SignatureVerificationException.class);
    exception.expectMessage("The Token's Signature resulted invalid when verified using the Algorithm: SHA256withECDSA");
    exception.expectCause(isA(SignatureException.class));
    exception.expectCause(hasMessage(is("Invalid JOSE signature format.")));

    String jwt = "eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJhdXRoMCJ9.MEYCIQDiJWTf5jShFPj0hpCWn7x1nhxPMjKWCs9MMusS9AIhAMcFPJVLe2A9uvb8hl8sRO2IpGoKDRpDmyH14ixNPAHW";
    ECKey key = (ECKey) readPublicKeyFromFile(PUBLIC_KEY_FILE_256, "EC");
    Algorithm algorithm = Algorithm.ECDSA256(key);
    algorithm.verify(JWT.decode(jwt));
}
 

@Test
public void shouldCreateAnEmptyECDSA384SignedToken() throws Exception {
    String signed = JWT.create().sign(Algorithm.ECDSA384((ECKey) PemUtils.readPrivateKeyFromFile(PRIVATE_KEY_FILE_EC_384, "EC")));
    assertThat(signed, is(notNullValue()));

    String[] parts = signed.split("\\.");
    String headerJson = new String(Base64.decodeBase64(parts[0]), StandardCharsets.UTF_8);
    assertThat(headerJson, JsonMatcher.hasEntry("alg", "ES384"));
    assertThat(headerJson, JsonMatcher.hasEntry("typ", "JWT"));
    assertThat(parts[1], is("e30"));

    JWTVerifier verified = JWT.require(Algorithm.ECDSA384((ECKey) PemUtils.readPublicKeyFromFile(PUBLIC_KEY_FILE_EC_384, "EC")))
            .build();
    assertThat(verified, is(notNullValue()));
}
 

@Test
public void shouldFailOnECDSA512SigningWhenUsingPublicKey() throws Exception {
    exception.expect(SignatureGenerationException.class);
    exception.expectMessage("The Token's Signature couldn't be generated when signing using the Algorithm: SHA512withECDSA");
    exception.expectCause(isA(IllegalStateException.class));
    exception.expectCause(hasMessage(is("The given Private Key is null.")));

    Algorithm algorithm = Algorithm.ECDSA512((ECKey) readPublicKeyFromFile(PUBLIC_KEY_FILE_512, "EC"));
    algorithm.sign(new byte[0], new byte[0]);
}
 

@Test
public void shouldDoECDSA512Signing() throws Exception {
    Algorithm algorithmSign = Algorithm.ECDSA512((ECKey) readPrivateKeyFromFile(PRIVATE_KEY_FILE_512, "EC"));
    Algorithm algorithmVerify = Algorithm.ECDSA512((ECKey) readPublicKeyFromFile(PUBLIC_KEY_FILE_512, "EC"));
    
    String jwt = asJWT(algorithmSign, ES512Header, auth0IssPayload);

    assertSignaturePresent(jwt);
    algorithmVerify.verify(JWT.decode(jwt));
}
 

@Test
public void shouldFailOnECDSA384SigningWhenUsingPublicKey() throws Exception {
    exception.expect(SignatureGenerationException.class);
    exception.expectMessage("The Token's Signature couldn't be generated when signing using the Algorithm: SHA384withECDSA");
    exception.expectCause(isA(IllegalStateException.class));
    exception.expectCause(hasMessage(is("The given Private Key is null.")));

    Algorithm algorithm = Algorithm.ECDSA384((ECKey) readPublicKeyFromFile(PUBLIC_KEY_FILE_384, "EC"));
    algorithm.sign(new byte[0], new byte[0]);
}
 

@Test
public void shouldDoECDSA384Signing() throws Exception {
    Algorithm algorithmSign = Algorithm.ECDSA384((ECKey) readPrivateKeyFromFile(PRIVATE_KEY_FILE_384, "EC"));
    Algorithm algorithmVerify = Algorithm.ECDSA384((ECKey) readPublicKeyFromFile(PUBLIC_KEY_FILE_384, "EC"));
    String jwt = asJWT(algorithmSign, ES384Header, auth0IssPayload);

    assertSignaturePresent(jwt);
    algorithmVerify.verify(JWT.decode(jwt));
}
 

@Test
public void shouldFailOnECDSA256SigningWhenUsingPublicKey() throws Exception {
    exception.expect(SignatureGenerationException.class);
    exception.expectMessage("The Token's Signature couldn't be generated when signing using the Algorithm: SHA256withECDSA");
    exception.expectCause(isA(IllegalStateException.class));
    exception.expectCause(hasMessage(is("The given Private Key is null.")));

    Algorithm algorithm = Algorithm.ECDSA256((ECKey) readPublicKeyFromFile(PUBLIC_KEY_FILE_256, "EC"));
    algorithm.sign(new byte[0], new byte[0]);
}
 

@Test
public void shouldDoECDSA256Signing() throws Exception {
    Algorithm algorithmSign = Algorithm.ECDSA256((ECKey) readPrivateKeyFromFile(PRIVATE_KEY_FILE_256, "EC"));
    Algorithm algorithmVerify = Algorithm.ECDSA256((ECKey) readPublicKeyFromFile(PUBLIC_KEY_FILE_256, "EC"));
    String jwt = asJWT(algorithmSign, ES256Header, auth0IssPayload);

    assertSignaturePresent(jwt);
    algorithmVerify.verify(JWT.decode(jwt));
}
 

@Test
public void shouldFailECDSA512VerificationOnInvalidDERSignature() throws Exception {
    exception.expect(SignatureVerificationException.class);
    exception.expectMessage("The Token's Signature resulted invalid when verified using the Algorithm: SHA512withECDSA");

    byte[] bytes = new byte[132];
    new SecureRandom().nextBytes(bytes);
    bytes[0] = 0x30;
    String signature = Base64.encodeBase64URLSafeString(bytes);
    String jwt = "eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJhdXRoMCJ9." + signature;
    Algorithm algorithm = Algorithm.ECDSA512((ECKey) readPublicKeyFromFile(INVALID_PUBLIC_KEY_FILE_512, "EC"));
    algorithm.verify(JWT.decode(jwt));
}
 

@Test
public void shouldFailECDSA512VerificationOnInvalidJOSESignature() throws Exception {
    exception.expect(SignatureVerificationException.class);
    exception.expectMessage("The Token's Signature resulted invalid when verified using the Algorithm: SHA512withECDSA");

    byte[] bytes = new byte[132];
    new SecureRandom().nextBytes(bytes);
    String signature = Base64.encodeBase64URLSafeString(bytes);
    String jwt = "eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJhdXRoMCJ9." + signature;
    Algorithm algorithm = Algorithm.ECDSA512((ECKey) readPublicKeyFromFile(INVALID_PUBLIC_KEY_FILE_512, "EC"));
    algorithm.verify(JWT.decode(jwt));
}
 

@Test
public void shouldFailECDSA512VerificationOnInvalidJOSESignatureLength() throws Exception {
    exception.expect(SignatureVerificationException.class);
    exception.expectMessage("The Token's Signature resulted invalid when verified using the Algorithm: SHA512withECDSA");
    exception.expectCause(isA(SignatureException.class));
    exception.expectCause(hasMessage(is("Invalid JOSE signature format.")));

    byte[] bytes = new byte[131];
    new SecureRandom().nextBytes(bytes);
    String signature = Base64.encodeBase64URLSafeString(bytes);
    String jwt = "eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJhdXRoMCJ9." + signature;
    Algorithm algorithm = Algorithm.ECDSA512((ECKey) readPublicKeyFromFile(INVALID_PUBLIC_KEY_FILE_512, "EC"));
    algorithm.verify(JWT.decode(jwt));
}
 

@Test
public void shouldFailECDSA512VerificationWhenUsingPrivateKey() throws Exception {
    exception.expect(SignatureVerificationException.class);
    exception.expectMessage("The Token's Signature resulted invalid when verified using the Algorithm: SHA512withECDSA");
    exception.expectCause(isA(IllegalStateException.class));
    exception.expectCause(hasMessage(is("The given Public Key is null.")));
    String jwt = "eyJhbGciOiJFUzUxMiJ9.eyJpc3MiOiJhdXRoMCJ9.AZgdopFFsN0amCSs2kOucXdpylD31DEm5ChK1PG0_gq5Mf47MrvVph8zHSVuvcrXzcE1U3VxeCg89mYW1H33Y-8iAF0QFkdfTUQIWKNObH543WNMYYssv3OtOj0znPv8atDbaF8DMYAtcT1qdmaSJRhx-egRE9HGZkinPh9CfLLLt58X";
    Algorithm algorithm = Algorithm.ECDSA512((ECKey) readPrivateKeyFromFile(PRIVATE_KEY_FILE_512, "EC"));
    algorithm.verify(JWT.decode(jwt));
}
 

@Test
public void shouldFailECDSA512VerificationWithInvalidPublicKey() throws Exception {
    exception.expect(SignatureVerificationException.class);
    exception.expectMessage("The Token's Signature resulted invalid when verified using the Algorithm: SHA512withECDSA");
    String jwt = "eyJhbGciOiJFUzUxMiJ9.eyJpc3MiOiJhdXRoMCJ9.AZgdopFFsN0amCSs2kOucXdpylD31DEm5ChK1PG0_gq5Mf47MrvVph8zHSVuvcrXzcE1U3VxeCg89mYW1H33Y-8iAF0QFkdfTUQIWKNObH543WNMYYssv3OtOj0znPv8atDbaF8DMYAtcT1qdmaSJRhx-egRE9HGZkinPh9CfLLLt58X";
    Algorithm algorithm = Algorithm.ECDSA512((ECKey) readPublicKeyFromFile(INVALID_PUBLIC_KEY_FILE_512, "EC"));
    algorithm.verify(JWT.decode(jwt));
}
 

@Test
public void shouldThrowOnECDSA512VerificationWithDERSignature() throws Exception {
    exception.expect(SignatureVerificationException.class);
    exception.expectMessage("The Token's Signature resulted invalid when verified using the Algorithm: SHA512withECDSA");
    exception.expectCause(isA(SignatureException.class));
    exception.expectCause(hasMessage(is("Invalid JOSE signature format.")));

    String jwt = "eyJhbGciOiJFUzUxMiJ9.eyJpc3MiOiJhdXRoMCJ9.MIGIAkIB4Ik8MixIeHBFIZkJjquymLzN6Q7DQr2pgw2uJ0/UW726GsDVCsb4RTFeUTTrK+aHZHtHPRoTuTEHCuerwvxo4EICQgGALKocz3lL8qfH1444LNBLaOSNJp3RNkB5YHDEhQEsox21PMA9kau2TcxkOW9jGX6b9N9FhlGo0/mmWFhVCR1YNg==";
    ECKey key = (ECKey) readPublicKeyFromFile(PUBLIC_KEY_FILE_512, "EC");
    Algorithm algorithm = Algorithm.ECDSA512(key);
    algorithm.verify(JWT.decode(jwt));
}