[java-opensaml COMMIT] in /trunk/opensaml-xmlsec-api/src: main/java/org/opensaml/xmlsec/algorithm/AlgorithmRegistry.j...

[noreply at shibboleth.net]

Author: putmanb
Date: Tue Oct 25 14:34:05 2016
New Revision: 4555

URL: http://svn.shibboleth.net/view/java-opensaml?rev=4555&view=rev
Log:
OSJ-145: Enhance AlgorithmRegistry to check algorithm support based on key size

Modified:
    trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/AlgorithmRegistry.java
    trunk/opensaml-xmlsec-api/src/test/resources/logback-test.xml

Modified: trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/AlgorithmRegistry.java
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/AlgorithmRegistry.java?rev=4555&r1=4554&r2=4555&view=diff
==============================================================================
--- trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/AlgorithmRegistry.java	(original)
+++ trunk/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/AlgorithmRegistry.java	Tue Oct 25 14:34:05 2016
@@ -245,6 +245,7 @@
      * 
      * @return true if runtime supports the algorithm, false otherwise
      */
+    // Checkstyle: CyclomaticComplexity OFF
     private boolean checkRuntimeSupports(AlgorithmDescriptor descriptor) {
         
         try {
@@ -253,6 +254,9 @@
                 case KeyTransport:
                 case SymmetricKeyWrap:
                     Cipher.getInstance(descriptor.getJCAAlgorithmID());
+                    if (!checkCipherSupportedKeyLength(descriptor)) {
+                        return false;
+                    }
                     break;
                     
                 case Signature:
@@ -285,6 +289,28 @@
         
         return true;
     }
+    // Checkstyle: CyclomaticComplexity ON
+    
+    /**
+     * Check if the key length of the specified {@link Cipher}-based algorithm, if known, is 
+     * supported by the current runtime.
+     * 
+     * @param descriptor the algorithm
+     * @return true if key length supported, false otherwise
+     * @throws NoSuchAlgorithmException if the associated JCA algorithm is not supported by the runtime
+     */
+    private boolean checkCipherSupportedKeyLength(AlgorithmDescriptor descriptor) throws NoSuchAlgorithmException {
+        if (descriptor instanceof KeyLengthSpecifiedAlgorithm) {
+            int algoLength = ((KeyLengthSpecifiedAlgorithm)descriptor).getKeyLength();
+            int cipherMaxLength = Cipher.getMaxAllowedKeyLength(descriptor.getJCAAlgorithmID());
+            if (algoLength > cipherMaxLength) {
+                log.info("Cipher algorithm '{}' is not supported, its key length {} exceeds Cipher max key length {}",
+                        descriptor.getURI(), algoLength, cipherMaxLength);
+                return false;
+            }
+        }
+        return true;
+    }
     
     /**
      * Check for special cases of runtime support which failed the initial simple service class load check.

Modified: trunk/opensaml-xmlsec-api/src/test/resources/logback-test.xml
URL: http://svn.shibboleth.net/view/java-opensaml/trunk/opensaml-xmlsec-api/src/test/resources/logback-test.xml?rev=4555&r1=4554&r2=4555&view=diff
==============================================================================
--- trunk/opensaml-xmlsec-api/src/test/resources/logback-test.xml	(original)
+++ trunk/opensaml-xmlsec-api/src/test/resources/logback-test.xml	Tue Oct 25 14:34:05 2016
@@ -7,6 +7,10 @@
             <charset>UTF-8</charset>
         </encoder>
     </appender>
+    
+    <logger name="org.opensaml.xmlsec.algorithm">
+        <level value="DEBUG"/>
+    </logger>
     
     <logger name="org.opensaml">
         <level value="WARN"/>