[java-opensaml COMMIT] in /trunk/opensaml-xmlsec-api/src: main/java/org/opensaml/xmlsec/algorithm/AlgorithmSupport.ja...

[noreply at shibboleth.net]

Author: putmanb
Date: Mon Mar 16 17:07:27 2015
New Revision: 4253

URL: http://svn.shibboleth.net/view/java-opensaml?rev=4253&view=rev
Log:
OSJ-112: IDP 3.1 Wrong keysize

Modified:
    trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/AlgorithmSupport.java
    trunk/opensaml-xmlsec-api/src/test/java/org/opensaml/xmlsec/algorithm/AlgorithmSupportTest.java

Modified: trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/AlgorithmSupport.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/AlgorithmSupport.java?rev=4253&r1=4252&r2=4253&view=diff
==============================================================================
--- trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/AlgorithmSupport.java (original)
+++ trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/AlgorithmSupport.java Mon Mar 16 17:07:27 2015
@@ -319,7 +319,20 @@
                     + "' to key algorithm not available, key generation failed");
             throw new NoSuchAlgorithmException("Algorithm URI'" + algoURI + "' is invalid for key generation");
         }
-        Integer keyLength = getKeyLength(algoURI);
+        
+        Integer keyLength = null;
+        switch(algoURI) {
+            case EncryptionConstants.ALGO_ID_BLOCKCIPHER_TRIPLEDES:
+            case EncryptionConstants.ALGO_ID_KEYWRAP_TRIPLEDES:
+                // We have to special case this b/c a 3DES key is 192 bits, but with KeyGenerator the JCA providers
+                // inconsistently allow either 112/168 (SunJCE) or 112/168/192 (BC). Per JCA docs they're all 
+                // required to support 168. We don't do this in getKeyLength() b/c the 3DES key actually is 192 bits.
+                keyLength = 168;
+                break;
+            default:
+                keyLength = getKeyLength(algoURI);
+        }
+        
         if (keyLength == null) {
             log.error("Key length could not be determined from algorithm URI, can't generate key");
             throw new KeyException("Key length not determinable from algorithm URI, could not generate new key");

Modified: trunk/opensaml-xmlsec-api/src/test/java/org/opensaml/xmlsec/algorithm/AlgorithmSupportTest.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-xmlsec-api/src/test/java/org/opensaml/xmlsec/algorithm/AlgorithmSupportTest.java?rev=4253&r1=4252&r2=4253&view=diff
==============================================================================
--- trunk/opensaml-xmlsec-api/src/test/java/org/opensaml/xmlsec/algorithm/AlgorithmSupportTest.java (original)
+++ trunk/opensaml-xmlsec-api/src/test/java/org/opensaml/xmlsec/algorithm/AlgorithmSupportTest.java Mon Mar 16 17:07:27 2015
@@ -23,6 +23,8 @@
 import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
 import java.util.HashSet;
+
+import javax.crypto.SecretKey;
 
 import org.opensaml.core.OpenSAMLInitBaseTestCase;
 import org.opensaml.security.credential.Credential;
@@ -383,5 +385,23 @@
         Assert.assertFalse(AlgorithmSupport.validateAlgorithmURI(targetURI, whiteList, blackList));
         whiteList.clear();
     }
+    
+    @Test
+    public void testGenerateSymmetricKey() throws NoSuchAlgorithmException, KeyException {
+        Assert.assertNotNull(AlgorithmSupport.generateSymmetricKey(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128));
+        Assert.assertNotNull(AlgorithmSupport.generateSymmetricKey(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128_GCM));
+        Assert.assertNotNull(AlgorithmSupport.generateSymmetricKey(EncryptionConstants.ALGO_ID_KEYWRAP_AES128));
+        
+        Assert.assertNotNull(AlgorithmSupport.generateSymmetricKey(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES192));
+        Assert.assertNotNull(AlgorithmSupport.generateSymmetricKey(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES192_GCM));
+        Assert.assertNotNull(AlgorithmSupport.generateSymmetricKey(EncryptionConstants.ALGO_ID_KEYWRAP_AES192));
+        
+        Assert.assertNotNull(AlgorithmSupport.generateSymmetricKey(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256));
+        Assert.assertNotNull(AlgorithmSupport.generateSymmetricKey(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256_GCM));
+        Assert.assertNotNull(AlgorithmSupport.generateSymmetricKey(EncryptionConstants.ALGO_ID_KEYWRAP_AES256));
+        
+        Assert.assertNotNull(AlgorithmSupport.generateSymmetricKey(EncryptionConstants.ALGO_ID_BLOCKCIPHER_TRIPLEDES));
+        Assert.assertNotNull(AlgorithmSupport.generateSymmetricKey(EncryptionConstants.ALGO_ID_KEYWRAP_TRIPLEDES));
+    }
 
 }