[java-xmltooling COMMIT] in /branches/REL_1: doc/RELEASE-NOTES.txt src/main/java/org/opensaml/xml/security/SecurityHe...

[noreply at shibboleth.net]

Author: putmanb
Date: Mon Mar 16 17:22:11 2015
New Revision: 853

URL: http://svn.shibboleth.net/view/java-xmltooling?rev=853&view=rev
Log:
JXT-120: Symmetric key generation for Triple DES keys fails with invalid key size

Modified:
    branches/REL_1/doc/RELEASE-NOTES.txt
    branches/REL_1/src/main/java/org/opensaml/xml/security/SecurityHelper.java
    branches/REL_1/src/test/java/org/opensaml/xml/security/SecurityHelperTest.java

Modified: branches/REL_1/doc/RELEASE-NOTES.txt
URL: http://svn.shibboleth.net/view/java-xmltooling/branches/REL_1/doc/RELEASE-NOTES.txt?rev=853&r1=852&r2=853&view=diff
==============================================================================
--- branches/REL_1/doc/RELEASE-NOTES.txt (original)
+++ branches/REL_1/doc/RELEASE-NOTES.txt Mon Mar 16 17:22:11 2015
@@ -2,6 +2,7 @@
 =============================================
 [JXT-118] - ParserPool impls are not correctly resetting builder ErrorHandler and EntityResolver on second and subsequent checkout 
 [JXT-119] - Various ParserPool interface methods should never return null 
+[JXT-120] - Symmetric key generation for Triple DES keys fails with invalid key size
 
 Changes in Release 1.4.5
 =============================================

Modified: branches/REL_1/src/main/java/org/opensaml/xml/security/SecurityHelper.java
URL: http://svn.shibboleth.net/view/java-xmltooling/branches/REL_1/src/main/java/org/opensaml/xml/security/SecurityHelper.java?rev=853&r1=852&r2=853&view=diff
==============================================================================
--- branches/REL_1/src/main/java/org/opensaml/xml/security/SecurityHelper.java (original)
+++ branches/REL_1/src/main/java/org/opensaml/xml/security/SecurityHelper.java Mon Mar 16 17:22:11 2015
@@ -60,6 +60,7 @@
 import org.apache.xml.security.Init;
 import org.apache.xml.security.algorithms.JCEMapper;
 import org.opensaml.xml.Configuration;
+import org.opensaml.xml.encryption.EncryptionConstants;
 import org.opensaml.xml.encryption.EncryptionParameters;
 import org.opensaml.xml.encryption.KeyEncryptionParameters;
 import org.opensaml.xml.security.credential.BasicCredential;
@@ -198,7 +199,18 @@
                     + "' to key algorithm not available, key generation failed");
             throw new NoSuchAlgorithmException("Algorithm URI'" + algoURI + "' is invalid for key generation");
         }
-        Integer keyLength = getKeyLengthFromURI(algoURI);
+        
+        Integer keyLength = null;
+        if (EncryptionConstants.ALGO_ID_BLOCKCIPHER_TRIPLEDES.equals(algoURI)
+                || EncryptionConstants.ALGO_ID_KEYWRAP_TRIPLEDES.equals(algoURI)) {
+            // We have to special case this b/c a 3DES key is 192 bits, but with KeyGenerator the JCA providers
+            // inconsistently allow either 112/168 (SunJCE) or 112/168/192 (BC). Per JCA docs they're all 
+            // required to support 168. We don't do this in getKeyLength() b/c the 3DES key actually is 192 bits.
+            keyLength = 168;
+        } else {
+            keyLength = getKeyLengthFromURI(algoURI);
+        }
+        
         if (keyLength == null) {
             log.error("Key length could not be determined from algorithm URI, can't generate key");
             throw new KeyException("Key length not determinable from algorithm URI, could not generate new key");

Modified: branches/REL_1/src/test/java/org/opensaml/xml/security/SecurityHelperTest.java
URL: http://svn.shibboleth.net/view/java-xmltooling/branches/REL_1/src/test/java/org/opensaml/xml/security/SecurityHelperTest.java?rev=853&r1=852&r2=853&view=diff
==============================================================================
--- branches/REL_1/src/test/java/org/opensaml/xml/security/SecurityHelperTest.java (original)
+++ branches/REL_1/src/test/java/org/opensaml/xml/security/SecurityHelperTest.java Mon Mar 16 17:22:11 2015
@@ -18,16 +18,17 @@
 package org.opensaml.xml.security;
 
 import java.io.InputStream;
+import java.security.KeyException;
 import java.security.KeyPair;
 import java.security.NoSuchAlgorithmException;
 import java.security.NoSuchProviderException;
 import java.security.PrivateKey;
 import java.security.PublicKey;
 
+import junit.framework.TestCase;
+
 import org.opensaml.xml.encryption.EncryptionConstants;
 import org.opensaml.xml.signature.SignatureConstants;
-
-import junit.framework.TestCase;
 
 /**
  * Unit test for {@link SecurityHelper}.
@@ -187,6 +188,23 @@
             // expected
         }
     }
+    
+    public void testGenerateSymmetricKey() throws NoSuchAlgorithmException, KeyException {
+        assertNotNull(SecurityHelper.generateSymmetricKey(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128));
+        assertNotNull(SecurityHelper.generateSymmetricKey(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128_GCM));
+        assertNotNull(SecurityHelper.generateSymmetricKey(EncryptionConstants.ALGO_ID_KEYWRAP_AES128));
+       
+        assertNotNull(SecurityHelper.generateSymmetricKey(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES192));

[... 14 lines stripped ...]