[java-metadata-aggregator] 03/06: MDA-74 provide validator for RSA modulus smaller than N bits
Ian Young
ian at iay.org.uk
Thu Dec 10 12:32:46 EST 2015
This is an automated email from the git hooks/post-receive script.
iay pushed a commit to branch master
in repository java-metadata-aggregator.
commit 2988cb0b2314e0821a2617c32968a152f1dcf3a9
Author: Ian Young <ian at iay.org.uk>
AuthorDate: Thu Dec 10 17:21:46 2015 +0000
MDA-74 provide validator for RSA modulus smaller than N bits
Initial import from ukf-mda project.
---
.../validate/x509/X509RSAKeyLengthValidator.java | 110 +++++++++++++++++++++
.../x509/X509RSAKeyLengthValidatorTest.java | 48 +++++++++
.../x509/X509RSAKeyLengthValidator-1024.pem | 15 +++
.../x509/X509RSAKeyLengthValidator-2048.pem | 21 ++++
4 files changed, 194 insertions(+)
diff --git a/aggregator-pipeline/src/main/java/net/shibboleth/metadata/validate/x509/X509RSAKeyLengthValidator.java b/aggregator-pipeline/src/main/java/net/shibboleth/metadata/validate/x509/X509RSAKeyLengthValidator.java
new file mode 100644
index 0000000..2a17b5b
--- /dev/null
+++ b/aggregator-pipeline/src/main/java/net/shibboleth/metadata/validate/x509/X509RSAKeyLengthValidator.java
@@ -0,0 +1,110 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.metadata.validate.x509;
+
+import java.security.PublicKey;
+import java.security.cert.X509Certificate;
+import java.security.interfaces.RSAPublicKey;
+
+import javax.annotation.Nonnull;
+import javax.annotation.concurrent.ThreadSafe;
+
+import net.shibboleth.metadata.Item;
+
+/**
+ * Validator class to check RSA key lengths in X.509 certificates.
+ *
+ * An instance of the class can be configured to have both a warning boundary and an
+ * error boundary. The default is to give an error for any key smaller than 2048 bits,
+ * with no provision for warnings. This seems the right long term default.
+ *
+ * During the transition to 2048-bit keys, it may be appropriate to set the warning
+ * boundary to 2048 bits and the error boundary to 1024 bits.
+ */
+ at ThreadSafe
+public class X509RSAKeyLengthValidator extends AbstractX509Validator {
+
+ /** The RSA key length below which an error should result. Default: 2048. */
+ private int errorBoundary = 2048;
+
+ /** The RSA key length below which a warning should result. Default: 0 (disabled). */
+ private int warningBoundary;
+
+ /**
+ * Constructor.
+ */
+ public X509RSAKeyLengthValidator() {
+ super();
+ setId("RSAKeyLength");
+ }
+
+ /**
+ * Get the RSA key length below which an error will result.
+ *
+ * @return the RSA key length below which an error will result.
+ */
+ public int getErrorBoundary() {
+ return errorBoundary;
+ }
+
+ /**
+ * Set the RSA key length below which an error should result.
+ *
+ * @param length the RSA key length below which an error should result
+ */
+ public void setErrorBoundary(final int length) {
+ errorBoundary = length;
+ }
+
+ /**
+ * Get the RSA key length below which a warning will result.
+ *
+ * @return the RSA key length below which a warning will result.
+ */
+ public int getWarningBoundary() {
+ return warningBoundary;
+ }
+
+ /**
+ * Set the RSA key length below which a warning should result.
+ *
+ * @param length the RSA key length below which a warning should result
+ */
+ public void setWarningBoundary(final int length) {
+ warningBoundary = length;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public void validate(@Nonnull final X509Certificate cert, @Nonnull final Item<?> item,
+ @Nonnull final String stageId) {
+ final PublicKey key = cert.getPublicKey();
+ if ("RSA".equals(key.getAlgorithm())) {
+ final RSAPublicKey rsaKey = (RSAPublicKey) key;
+ final int keyLen = rsaKey.getModulus().bitLength();
+ if (keyLen < errorBoundary) {
+ addError("RSA key length of " + keyLen + " bits is less than required " + errorBoundary,
+ item, stageId);
+ } else if (keyLen < warningBoundary) {
+ addWarning("RSA key length of " + keyLen + " bits is less than recommended " + warningBoundary,
+ item, stageId);
+ }
+ }
+ }
+
+}
diff --git a/aggregator-pipeline/src/test/java/net/shibboleth/metadata/validate/x509/X509RSAKeyLengthValidatorTest.java b/aggregator-pipeline/src/test/java/net/shibboleth/metadata/validate/x509/X509RSAKeyLengthValidatorTest.java
new file mode 100644
index 0000000..056ce14
--- /dev/null
+++ b/aggregator-pipeline/src/test/java/net/shibboleth/metadata/validate/x509/X509RSAKeyLengthValidatorTest.java
@@ -0,0 +1,48 @@
+
+package net.shibboleth.metadata.validate.x509;
+
+import java.security.cert.X509Certificate;
+
+import net.shibboleth.metadata.Item;
+import net.shibboleth.metadata.MockItem;
+import net.shibboleth.metadata.validate.Validator;
+
+import org.testng.annotations.Test;
+
+public class X509RSAKeyLengthValidatorTest extends BaseX509ValidatorTest {
+
+ /** Constructor sets class under test. */
+ public X509RSAKeyLengthValidatorTest() throws Exception {
+ super(X509RSAKeyLengthValidator.class);
+ }
+
+ @Test
+ public void testDefaults2048() throws Exception {
+ final Item<String> item = new MockItem("foo");
+ final Validator<X509Certificate> val = new X509RSAKeyLengthValidator();
+ final X509Certificate cert = getCertificate("2048.pem");
+ val.validate(cert, item, "stage");
+ errorsAndWarnings(item, 0, 0);
+ }
+
+ @Test
+ public void testDefaults1024() throws Exception {
+ final Item<String> item = new MockItem("foo");
+ final Validator<X509Certificate> val = new X509RSAKeyLengthValidator();
+ final X509Certificate cert = getCertificate("1024.pem");
+ val.validate(cert, item, "stage");
+ errorsAndWarnings(item, 1, 0);
+ }
+
+ @Test
+ public void testWarningOn1024() throws Exception {
+ final Item<String> item = new MockItem("foo");
+ final X509RSAKeyLengthValidator val = new X509RSAKeyLengthValidator();
+ val.setErrorBoundary(1024);
+ val.setWarningBoundary(2048);
+ final X509Certificate cert = getCertificate("1024.pem");
+ val.validate(cert, item, "stage");
+ errorsAndWarnings(item, 0, 1);
+ }
+
+}
diff --git a/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509RSAKeyLengthValidator-1024.pem b/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509RSAKeyLengthValidator-1024.pem
new file mode 100644
index 0000000..59cf2ad
--- /dev/null
+++ b/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509RSAKeyLengthValidator-1024.pem
@@ -0,0 +1,15 @@
+-----BEGIN CERTIFICATE-----
+MIICWDCCAcGgAwIBAgIJALVn6hKym4syMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNV
+BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
+aWRnaXRzIFB0eSBMdGQwHhcNMTMxMTEzMTcxODQxWhcNMTMxMjEzMTcxODQxWjBF
+MQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50
+ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB
+gQCpxP9J+o4wQkyOkwPMyPjcF0bdKbhgtWD4cRmsBmyPN9gjRcIX5JYyWhTP4BQp
+1yi1hRekT5+xCMRNBrjjEybW7OG/tZq61kwTku/5dqLyoobY6nG6Q1xVsIdUZ2iT
+06HVS3UWkvjydVvTZNniU1ZXNeAKQr4AJkyFo1o+caOAfQIDAQABo1AwTjAdBgNV
+HQ4EFgQUmVV6yvBQ7gSBqSxHNZDi72ei2+EwHwYDVR0jBBgwFoAUmVV6yvBQ7gSB
+qSxHNZDi72ei2+EwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOBgQCPf0hB
+/sFveac6IQ7nWJYwm2NnxmdfNztjpHRhNu3smDSP/nrFfDgwysQaMZq30nAhVYNc
+KsmamKiPz96MEiR0lCCz/EGQth4aUSOi6m/RfGfPfvBQoSOes0npmV/jJzYBLZju
+m9gpKsaeJibTQ/XAd3sWnDJ4vs/nMR3J3+uzrQ==
+-----END CERTIFICATE-----
diff --git a/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509RSAKeyLengthValidator-2048.pem b/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509RSAKeyLengthValidator-2048.pem
new file mode 100644
index 0000000..3d4419a
--- /dev/null
+++ b/aggregator-pipeline/src/test/resources/net/shibboleth/metadata/validate/x509/X509RSAKeyLengthValidator-2048.pem
@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDXTCCAkWgAwIBAgIJAJ7maLmongppMA0GCSqGSIb3DQEBBQUAMEUxCzAJBgNV
+BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
+aWRnaXRzIFB0eSBMdGQwHhcNMTMxMTEzMTcxOTE3WhcNMTMxMjEzMTcxOTE3WjBF
+MQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50
+ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEA9curKPRogWvCRrdVadl6Nm17VqSxa0fSGw6iUOdmZBXEViL9CEfv0VN8
+FrB2yC3e4V8mAGaXpkAiy9vGivfUxnUJ/d0AH46IQ0IrmTMlNMHiPPdKFxuAn629
+TQ5uxIa4RJTYJsewhDqLlIv5nQfcTm1iAj+xzIpnCWegIdcc0ykTMMPg4dVTMtnP
+uMzm8AKRWq2fQ6ldXLaYY1vAMSZXC3wWJUr+oY1sRPPQRzXEAGfYu2YSfVZZ9yfQ
+PreufPtuTaBfWZWoLR9DMaC5E9IlRr+yN9LIXeCGWNXX0fuXOmrCIM2bQ2Ms9oFK
+R9vM3U8xAWmmNDY6X/iuoPXxQPqZrQIDAQABo1AwTjAdBgNVHQ4EFgQUmQDBqR/B
+hXEe5OSbdaDZ1rjKLQYwHwYDVR0jBBgwFoAUmQDBqR/BhXEe5OSbdaDZ1rjKLQYw
+DAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQUFAAOCAQEAFLwg4ep0uBFD11hA08Ix
+AbH6xWAsvqCaG+RgElWDrGUN7t2SsImMOZSRB+Xyr4tXoXoio5SbejgE3JIF6ukw
+6lfwz1eIt5NQLt0PMHjvvvsb1M+rPKAB22nb66X447KSSTYvcWZO/1hhgtqR+E93
+LMvO4zG2PYuw3agMXr71Likd0tS65d13AZRNsYkJFdqrpaui0HP3POe5JUXnBWtg
+2UoGhB0l7IpX1HMpqgPhGlB3iPTy/AwL3JT/Q+rTp/Qbhxm8mG+JO0w2ujG1ciuo
+XjmW9D5MUfaLdR3qxQs6/iW/V/EYnIzkecTLbO8TrfXaSmW7m3MG8g1xFeUadwKT
+Hw==
+-----END CERTIFICATE-----
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list