[java-opensaml COMMIT] in /trunk: opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Encrypter....

[noreply at shibboleth.net]

Author: putmanb
Date: Fri Aug 22 19:27:30 2014
New Revision: 4012

URL: http://svn.shibboleth.net/view/java-opensaml?rev=4012&view=rev
Log:
Implement Encrypter support for RSA OAEP parameters on key transport encryption.

Modified:
    trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Encrypter.java
    trunk/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/encryption/support/SimpleEncryptionTest.java

Modified: trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Encrypter.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Encrypter.java?rev=4012&r1=4011&r2=4012&view=diff
==============================================================================
--- trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Encrypter.java (original)
+++ trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/Encrypter.java Fri Aug 22 19:27:30 2014
@@ -30,6 +30,7 @@
 import javax.annotation.Nullable;
 import javax.crypto.SecretKey;
 
+import net.shibboleth.utilities.java.support.codec.Base64Support;
 import net.shibboleth.utilities.java.support.logic.Constraint;
 import net.shibboleth.utilities.java.support.xml.ElementSupport;
 import net.shibboleth.utilities.java.support.xml.NamespaceSupport;
@@ -297,9 +298,9 @@
         checkParams(kekParams, false);
 
         Key encryptionKey = CredentialSupport.extractEncryptionKey(kekParams.getEncryptionCredential());
-        String encryptionAlgorithmURI = kekParams.getAlgorithm();
-
-        EncryptedKey encryptedKey = encryptKey(key, encryptionKey, encryptionAlgorithmURI, containingDocument);
+
+        EncryptedKey encryptedKey = encryptKey(key, encryptionKey, kekParams.getAlgorithm(),
+                kekParams.getRSAOAEPParameters(), containingDocument);
 
         if (kekParams.getKeyInfoGenerator() != null) {
             KeyInfoGenerator generator = kekParams.getKeyInfoGenerator();
@@ -326,13 +327,15 @@
      * @param targetKey the key to encrypt
      * @param encryptionKey the key with which to encrypt the target key
      * @param encryptionAlgorithmURI the XML Encryption algorithm URI corresponding to the encryption key
+     * @param rsaOAEPParams the RSA-OAEP params instance (may be null)
      * @param containingDocument the document that will own the resulting element
      * @return the new EncryptedKey object
      * @throws EncryptionException exception thrown on encryption errors
      */
     @Nonnull protected EncryptedKey encryptKey(@Nonnull final Key targetKey, @Nonnull final Key encryptionKey,
-            @Nonnull final String encryptionAlgorithmURI, @Nonnull final Document containingDocument)
-                    throws EncryptionException {
+            @Nonnull final String encryptionAlgorithmURI, @Nullable final RSAOAEPParameters rsaOAEPParams,
+            @Nonnull final Document containingDocument) throws EncryptionException {
+        
         Constraint.isNotNull(encryptionAlgorithmURI, "Encryption algorithm URI cannot be null");
         Constraint.isNotNull(containingDocument, "Containing document cannot be null");
 
@@ -345,14 +348,10 @@
         }
 
         log.debug("Encrypting encryption key with algorithm: {}", encryptionAlgorithmURI);
+        
         XMLCipher xmlCipher;
         try {
-            if (getJCAProviderName() != null) {
-                xmlCipher = XMLCipher.getProviderInstance(encryptionAlgorithmURI, getJCAProviderName());
-            } else {
-                xmlCipher = XMLCipher.getInstance(encryptionAlgorithmURI);
-            }
-            xmlCipher.init(XMLCipher.WRAP_MODE, encryptionKey);
+            xmlCipher = buildXMLCipher(encryptionKey, encryptionAlgorithmURI, rsaOAEPParams);
         } catch (XMLEncryptionException e) {
             log.error("Error initializing cipher instance on key encryption", e);
             throw new EncryptionException("Error initializing cipher instance on key encryption", e);
@@ -360,7 +359,13 @@
 
         org.apache.xml.security.encryption.EncryptedKey apacheEncryptedKey;
         try {
-            apacheEncryptedKey = xmlCipher.encryptKey(containingDocument, targetKey);
+            if (isRSAOAEP(encryptionAlgorithmURI) && rsaOAEPParams != null) {
+                apacheEncryptedKey = xmlCipher.encryptKey(containingDocument, targetKey, 
+                        getEffectiveMGF(encryptionAlgorithmURI, rsaOAEPParams), 
+                        decodeOAEPParams(rsaOAEPParams.getOAEPParams()));
+            } else {
+                apacheEncryptedKey = xmlCipher.encryptKey(containingDocument, targetKey);
+            }
             postProcessApacheEncryptedKey(apacheEncryptedKey, targetKey, encryptionKey, encryptionAlgorithmURI,
                     containingDocument);
         } catch (XMLEncryptionException e) {
@@ -378,6 +383,94 @@
     }
 
     /**
+     * Construct and return an instance of {@link XMLCipher} based on the given inputs.
+     * 

[... 280 lines stripped ...]