[java-opensaml] branch master updated: OSJ-227 - Failure to load seemingly correct EC keypairs
Scott Cantor
cantor.2 at osu.edu
Fri May 4 14:41:49 EDT 2018
This is an automated email from the git hooks/post-receive script.
scantor pushed a commit to branch master
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=4015576004c4e962a21d1bf59f73c4f3e5123ef8
The following commit(s) were added to refs/heads/master by this push:
new 4015576 OSJ-227 - Failure to load seemingly correct EC keypairs
4015576 is described below
commit 4015576004c4e962a21d1bf59f73c4f3e5123ef8
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri May 4 14:41:38 2018 -0400
OSJ-227 - Failure to load seemingly correct EC keypairs
https://issues.shibboleth.net/jira/browse/OSJ-227
Unit tests.
---
.../opensaml/security/crypto/KeySupportTest.java | 10 ++++++++
.../opensaml/security/x509/X509SupportTest.java | 30 ++++++++++++++++++++++
.../src/test/resources/data/ec-certificate.pem | 11 ++++++++
.../src/test/resources/data/ec-privkey-nopass.pem | 8 ++++++
4 files changed, 59 insertions(+)
diff --git a/opensaml-security-api/src/test/java/org/opensaml/security/crypto/KeySupportTest.java b/opensaml-security-api/src/test/java/org/opensaml/security/crypto/KeySupportTest.java
index 9bc29d8..0d81051 100644
--- a/opensaml-security-api/src/test/java/org/opensaml/security/crypto/KeySupportTest.java
+++ b/opensaml-security-api/src/test/java/org/opensaml/security/crypto/KeySupportTest.java
@@ -64,6 +64,9 @@ public class KeySupportTest {
/** Location of encrypted, PEM formatted, DSA private key. */
private String dsaPrivKeyPEMEncrypt = "/data/dsa-privkey-changeit-pass.pem";
+ /** Location of non-encrypted, PEM formatted, EC private key. */
+ private String ecPrivKeyPEMNoEncrypt = "/data/ec-privkey-nopass.pem";
+
/** Test decoding an RSA private key, in PEM format, without encryption. */
@Test
public void testDecodeRSAPrivateKeyPEMNoEncrypt() throws Exception {
@@ -98,8 +101,15 @@ public class KeySupportTest {
@Test
public void testDecodeDSAPrivateKeyDERNoEncrypt() throws Exception {
testPrivKey(dsaPrivKeyDERNoEncrypt, null, "DSA");
+ }
+
+ /** Test decoding an EC private key, in PEM format, without encryption. */
+ @Test
+ public void testDecodeECPrivateKeyPEMNoEncrypt() throws Exception {
+ testPrivKey(ecPrivKeyPEMNoEncrypt, null, "EC");
}
+
/** Test deriving a public key from an RSA and DSA private key. */
@Test
public void testDerivePublicKey() throws Exception{
diff --git a/opensaml-security-api/src/test/java/org/opensaml/security/x509/X509SupportTest.java b/opensaml-security-api/src/test/java/org/opensaml/security/x509/X509SupportTest.java
index 55b4fcf..dd21a12 100644
--- a/opensaml-security-api/src/test/java/org/opensaml/security/x509/X509SupportTest.java
+++ b/opensaml-security-api/src/test/java/org/opensaml/security/x509/X509SupportTest.java
@@ -19,6 +19,7 @@ package org.opensaml.security.x509;
import java.io.InputStream;
import java.security.PrivateKey;
+import java.security.PublicKey;
import java.security.cert.CertificateParsingException;
import java.security.cert.X509CRL;
import java.security.cert.X509Certificate;
@@ -34,6 +35,7 @@ import org.apache.commons.codec.DecoderException;
import org.apache.commons.codec.binary.Hex;
import org.opensaml.security.SecurityException;
import org.opensaml.security.crypto.KeySupport;
+import org.opensaml.security.crypto.KeySupportTest;
import org.testng.Assert;
import org.testng.annotations.BeforeMethod;
import org.testng.annotations.Test;
@@ -234,6 +236,12 @@ public class X509SupportTest {
/** A PEM encoded CRL. */
private String crlDER = "/data/crl.der";
+
+ /** An EC certificate. */
+ private String certEC = "/data/ec-certificate.pem";
+
+ /** An EC private key. */
+ private String keyEC = "/data/ec-privkey-nopass.pem";
@BeforeMethod
protected void setUp() throws Exception {
@@ -571,6 +579,28 @@ public class X509SupportTest {
Assert.assertNotNull(crls);
Assert.assertEquals(crls.size(), 1);
}
+
+ /** Test decoding and matching EC keypair. */
+ @Test
+ public void testEC() throws Exception {
+ InputStream certInS = X509SupportTest.class.getResourceAsStream(certEC);
+
+ byte[] certBytes = new byte[certInS.available()];
+ certInS.read(certBytes);
+
+ Collection<X509Certificate> certs = X509Support.decodeCertificates(certBytes);
+ Assert.assertNotNull(certs);
+ Assert.assertEquals(certs.size(), 1);
+
+ PublicKey pubkey = certs.iterator().next().getPublicKey();
+ Assert.assertNotNull(pubkey);
+
+ PrivateKey key = KeySupport.decodePrivateKey(KeySupportTest.class.getResourceAsStream(keyEC), null);
+ Assert.assertNotNull(key);
+
+ Assert.assertTrue(KeySupport.matchKeyPair(pubkey, key));
+ }
+
/**
* Get the alt names from the certificate.
diff --git a/opensaml-security-api/src/test/resources/data/ec-certificate.pem b/opensaml-security-api/src/test/resources/data/ec-certificate.pem
new file mode 100644
index 0000000..1472d03
--- /dev/null
+++ b/opensaml-security-api/src/test/resources/data/ec-certificate.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBqDCCAU6gAwIBAgIJAN57+S/joHl2MAoGCCqGSM49BAMCMDIxCzAJBgNVBAYT
+AlVTMQ0wCwYDVQQIDARPaGlvMRQwEgYDVQQDDAt0ZXN0LXNlcnZlcjAeFw0xODA1
+MDQxNzQ4MDRaFw0xODA2MDMxNzQ4MDRaMDIxCzAJBgNVBAYTAlVTMQ0wCwYDVQQI
+DARPaGlvMRQwEgYDVQQDDAt0ZXN0LXNlcnZlcjBWMBAGByqGSM49AgEGBSuBBAAK
+A0IABLQ89hKV/avpvYaz672vx8LHMTVzG6BnIIWhz9Jrc61XVqnAg5abtb0F0b35
+Gsf/pdrK16pvv+C5ecdsS79dPJajUDBOMB0GA1UdDgQWBBR/pheyXhMejk4y5XW2
+NeOgw6YfnzAfBgNVHSMEGDAWgBR/pheyXhMejk4y5XW2NeOgw6YfnzAMBgNVHRME
+BTADAQH/MAoGCCqGSM49BAMCA0gAMEUCIFDTzKMe8UaMl67GYaLlAAtceitrY0dS
+zrKyKtwNUf4MAiEAjSZZpjB7gZUG9+7Q7Yck6uk6hiCI9zlrf3r8XnzoAQg=
+-----END CERTIFICATE-----
diff --git a/opensaml-security-api/src/test/resources/data/ec-privkey-nopass.pem b/opensaml-security-api/src/test/resources/data/ec-privkey-nopass.pem
new file mode 100644
index 0000000..be76db2
--- /dev/null
+++ b/opensaml-security-api/src/test/resources/data/ec-privkey-nopass.pem
@@ -0,0 +1,8 @@
+-----BEGIN EC PARAMETERS-----
+BgUrgQQACg==
+-----END EC PARAMETERS-----
+-----BEGIN EC PRIVATE KEY-----
+MHQCAQEEIB5bGSry81tj/mNMA+A+aZRQedk2ZwrXbQreuY+0PBe9oAcGBSuBBAAK
+oUQDQgAEtDz2EpX9q+m9hrPrva/HwscxNXMboGcghaHP0mtzrVdWqcCDlpu1vQXR
+vfkax/+l2srXqm+/4Ll5x2xLv108lg==
+-----END EC PRIVATE KEY-----
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list