[java-oidc-common] branch main updated: JCOMOIDC-6 Move common crypto/security code from the OIDC plugin
Henri Mikkonen
henri.mikkonen at iki.fi
Fri Nov 13 14:00:55 UTC 2020
This is an automated email from the git hooks/post-receive script.
hjmikkon pushed a commit to branch main
in repository java-oidc-common.
View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=d260f25c4471c0e58783cf3e27b94fe800470cc1
The following commit(s) were added to refs/heads/main by this push:
new d260f25 JCOMOIDC-6 Move common crypto/security code from the OIDC plugin
d260f25 is described below
commit d260f25c4471c0e58783cf3e27b94fe800470cc1
Author: Henri Mikkonen <henri.mikkonen at iki.fi>
AuthorDate: Fri Nov 13 15:57:17 2020 +0200
JCOMOIDC-6 Move common crypto/security code from the OIDC plugin
https://issues.shibboleth.net/jira/browse/JCOMOIDC-6
Initial import of JWA algorithm descriptors and credential extensions
from java-idp-oidc.
---
oidc-common-crypto-api/pom.xml | 32 ++++++
.../descriptors/EncryptionA128CBCHS256.java | 75 +++++++++++++
.../algorithm/descriptors/EncryptionA128GCM.java | 74 ++++++++++++
.../descriptors/EncryptionA192CBCHS384.java | 75 +++++++++++++
.../algorithm/descriptors/EncryptionA192GCM.java | 74 ++++++++++++
.../descriptors/EncryptionA256CBCHS512.java | 75 +++++++++++++
.../algorithm/descriptors/EncryptionA256GCM.java | 74 ++++++++++++
.../algorithm/descriptors/KeyAgreementECDHES.java | 85 ++++++++++++++
.../algorithm/descriptors/KeyTransportRSA15.java | 75 +++++++++++++
.../algorithm/descriptors/KeyTransportRSAOAEP.java | 76 +++++++++++++
.../descriptors/KeyTransportRSAOAEP256.java | 76 +++++++++++++
.../jwa/algorithm/descriptors/SignatureES256.java | 62 +++++++++++
.../jwa/algorithm/descriptors/SignatureES384.java | 62 +++++++++++
.../jwa/algorithm/descriptors/SignatureES512.java | 62 +++++++++++
.../jwa/algorithm/descriptors/SignatureHS256.java | 56 ++++++++++
.../jwa/algorithm/descriptors/SignatureHS384.java | 56 ++++++++++
.../jwa/algorithm/descriptors/SignatureHS512.java | 56 ++++++++++
.../jwa/algorithm/descriptors/SignatureRS256.java | 62 +++++++++++
.../jwa/algorithm/descriptors/SignatureRS384.java | 62 +++++++++++
.../jwa/algorithm/descriptors/SignatureRS512.java | 62 +++++++++++
.../descriptors/SymmetricKeyWrapA128GCMKW.java | 66 +++++++++++
.../descriptors/SymmetricKeyWrapA128KW.java | 66 +++++++++++
.../descriptors/SymmetricKeyWrapA192GCMKW.java | 66 +++++++++++
.../descriptors/SymmetricKeyWrapA192KW.java | 66 +++++++++++
.../descriptors/SymmetricKeyWrapA256GCMKW.java | 66 +++++++++++
.../descriptors/SymmetricKeyWrapA256KW.java | 66 +++++++++++
.../jwa/algorithm/descriptors/package-info.java | 19 ++++
.../oidc/jwa/support/EncryptionConstants.java | 48 ++++++++
.../oidc/jwa/support/JCAConstantExtension.java | 42 +++++++
.../oidc/jwa/support/KeyManagementConstants.java | 81 ++++++++++++++
.../oidc/jwa/support/SignatureConstants.java | 68 +++++++++++
.../shibboleth/oidc/jwa/support/package-info.java | 19 ++++
.../security/credential/BasicJWKCredential.java | 64 +++++++++++
.../credential/BasicJWKReferenceCredential.java | 71 ++++++++++++
.../credential/BasicNimbusSecretCredential.java | 71 ++++++++++++
.../oidc/security/credential/JWKCredential.java | 44 ++++++++
.../credential/JWKReferenceCredential.java | 37 ++++++
.../credential/NimbusSecretCredential.java | 39 +++++++
.../oidc/security/credential/package-info.java | 19 ++++
...g.opensaml.xmlsec.algorithm.AlgorithmDescriptor | 25 +++++
.../descriptors/EncryptionA128CBCHS256Test.java | 46 ++++++++
.../descriptors/EncryptionA128GCMTest.java | 45 ++++++++
.../descriptors/EncryptionA192CBCHS384Test.java | 45 ++++++++
.../descriptors/EncryptionA192GCMTest.java | 45 ++++++++
.../descriptors/EncryptionA256CBCHS512Test.java | 45 ++++++++
.../descriptors/EncryptionA256GCMTest.java | 45 ++++++++
.../descriptors/KeyAgreementECDHESTest.java | 45 ++++++++
.../descriptors/KeyTransportRSA15Test.java | 45 ++++++++
.../descriptors/KeyTransportRSAOAEP256Test.java | 45 ++++++++
.../descriptors/KeyTransportRSAOAEPTest.java | 45 ++++++++
.../algorithm/descriptors/SignatureES256Test.java | 44 ++++++++
.../algorithm/descriptors/SignatureES384Test.java | 44 ++++++++
.../algorithm/descriptors/SignatureES512Test.java | 44 ++++++++
.../algorithm/descriptors/SignatureHS256Test.java | 43 +++++++
.../algorithm/descriptors/SignatureHS384Test.java | 43 +++++++
.../algorithm/descriptors/SignatureHS512Test.java | 43 +++++++
.../algorithm/descriptors/SignatureRS256Test.java | 44 ++++++++
.../algorithm/descriptors/SignatureRS384Test.java | 44 ++++++++
.../algorithm/descriptors/SignatureRS512Test.java | 44 ++++++++
.../descriptors/SymmetricKeyWrapA128GCMKWTest.java | 44 ++++++++
.../descriptors/SymmetricKeyWrapA128KWTest.java | 45 ++++++++
.../descriptors/SymmetricKeyWrapA192GCMKWTest.java | 44 ++++++++
.../descriptors/SymmetricKeyWrapA192KWTest.java | 44 ++++++++
.../descriptors/SymmetricKeyWrapA256GCMKWTest.java | 44 ++++++++
.../descriptors/SymmetricKeyWrapA256KWTest.java | 44 ++++++++
.../credential/BasicJWKCredentialTest.java | 52 +++++++++
oidc-common-crypto-impl/pom.xml | 35 ++++++
.../security/impl/CredentialConversionUtil.java | 124 +++++++++++++++++++++
.../oidc/security/impl/package-info.java | 19 ++++
.../src/test/resources/logback-test.xml | 19 ++++
pom.xml | 23 ++++
71 files changed, 3755 insertions(+)
diff --git a/oidc-common-crypto-api/pom.xml b/oidc-common-crypto-api/pom.xml
new file mode 100644
index 0000000..f63b6c0
--- /dev/null
+++ b/oidc-common-crypto-api/pom.xml
@@ -0,0 +1,32 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+ <modelVersion>4.0.0</modelVersion>
+
+ <parent>
+ <groupId>net.shibboleth.oidc</groupId>
+ <artifactId>oidc-common-parent</artifactId>
+ <version>0.0.1-SNAPSHOT</version>
+ </parent>
+
+ <artifactId>oidc-common-crypto-api</artifactId>
+ <packaging>jar</packaging>
+ <name>Shibboleth OIDC Java Common Library - Crypto API</name>
+ <description>Interfaces for common crypto/security functions/features.</description>
+
+ <properties>
+ <checkstyle.configLocation>${project.basedir}/../checkstyle.xml</checkstyle.configLocation>
+ <automatic.module.name>net.shibboleth.oidc.crypto.api</automatic.module.name>
+ </properties>
+
+ <dependencies>
+ <dependency>
+ <groupId>org.opensaml</groupId>
+ <artifactId>opensaml-saml-api</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>com.nimbusds</groupId>
+ <artifactId>oauth2-oidc-sdk</artifactId>
+ </dependency>
+ </dependencies>
+
+</project>
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA128CBCHS256.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA128CBCHS256.java
new file mode 100644
index 0000000..0efff6f
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA128CBCHS256.java
@@ -0,0 +1,75 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.BlockEncryptionAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.EncryptionConstants;
+import net.shibboleth.oidc.jwa.support.JCAConstantExtension;
+
+/**
+ * Algorithm descriptor for block encryption algorithm: A128CBC-HS256.
+ */
+public final class EncryptionA128CBCHS256 implements BlockEncryptionAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getKey() {
+ return JCAConstants.KEY_ALGO_AES;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getURI() {
+ return EncryptionConstants.ALGO_ID_ENC_ALG_A128CBC_HS256;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.BlockEncryption;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getJCAAlgorithmID() {
+ return String.format("%s/%s/%s", getKey(), getCipherMode(), getPadding());
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public Integer getKeyLength() {
+ return 128;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getCipherMode() {
+ return JCAConstants.CIPHER_MODE_CBC;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getPadding() {
+ return JCAConstantExtension.CIPHER_PADDING_PKCS5;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA128GCM.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA128GCM.java
new file mode 100644
index 0000000..a4183bf
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA128GCM.java
@@ -0,0 +1,74 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.BlockEncryptionAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.EncryptionConstants;
+
+/**
+ * Algorithm descriptor for block encryption algorithm: 128GCM.
+ */
+public final class EncryptionA128GCM implements BlockEncryptionAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getKey() {
+ return JCAConstants.KEY_ALGO_AES;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getURI() {
+ return EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.BlockEncryption;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getJCAAlgorithmID() {
+ return String.format("%s/%s/%s", getKey(), getCipherMode(), getPadding());
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public Integer getKeyLength() {
+ return 128;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getCipherMode() {
+ return JCAConstants.CIPHER_MODE_GCM;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getPadding() {
+ return JCAConstants.CIPHER_PADDING_NONE;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA192CBCHS384.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA192CBCHS384.java
new file mode 100644
index 0000000..5eaeed8
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA192CBCHS384.java
@@ -0,0 +1,75 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.BlockEncryptionAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.EncryptionConstants;
+import net.shibboleth.oidc.jwa.support.JCAConstantExtension;
+
+/**
+ * Algorithm descriptor for block encryption algorithm: A192CBC-HS384.
+ */
+public final class EncryptionA192CBCHS384 implements BlockEncryptionAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getKey() {
+ return JCAConstants.KEY_ALGO_AES;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getURI() {
+ return EncryptionConstants.ALGO_ID_ENC_ALG_A192CBC_HS384;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.BlockEncryption;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getJCAAlgorithmID() {
+ return String.format("%s/%s/%s", getKey(), getCipherMode(), getPadding());
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public Integer getKeyLength() {
+ return 192;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getCipherMode() {
+ return JCAConstants.CIPHER_MODE_CBC;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getPadding() {
+ return JCAConstantExtension.CIPHER_PADDING_PKCS5;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA192GCM.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA192GCM.java
new file mode 100644
index 0000000..24b1852
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA192GCM.java
@@ -0,0 +1,74 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.BlockEncryptionAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.EncryptionConstants;
+
+/**
+ * Algorithm descriptor for block encryption algorithm: 192GCM.
+ */
+public final class EncryptionA192GCM implements BlockEncryptionAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getKey() {
+ return JCAConstants.KEY_ALGO_AES;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getURI() {
+ return EncryptionConstants.ALGO_ID_ENC_ALG_A192GCM;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.BlockEncryption;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getJCAAlgorithmID() {
+ return String.format("%s/%s/%s", getKey(), getCipherMode(), getPadding());
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public Integer getKeyLength() {
+ return 192;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getCipherMode() {
+ return JCAConstants.CIPHER_MODE_GCM;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getPadding() {
+ return JCAConstants.CIPHER_PADDING_NONE;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA256CBCHS512.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA256CBCHS512.java
new file mode 100644
index 0000000..edcd401
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA256CBCHS512.java
@@ -0,0 +1,75 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.BlockEncryptionAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.EncryptionConstants;
+import net.shibboleth.oidc.jwa.support.JCAConstantExtension;
+
+/**
+ * Algorithm descriptor for block encryption algorithm: A256CBC-HS512.
+ */
+public final class EncryptionA256CBCHS512 implements BlockEncryptionAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getKey() {
+ return JCAConstants.KEY_ALGO_AES;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getURI() {
+ return EncryptionConstants.ALGO_ID_ENC_ALG_A256CBC_HS512;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.BlockEncryption;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getJCAAlgorithmID() {
+ return String.format("%s/%s/%s", getKey(), getCipherMode(), getPadding());
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public Integer getKeyLength() {
+ return 256;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getCipherMode() {
+ return JCAConstants.CIPHER_MODE_CBC;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getPadding() {
+ return JCAConstantExtension.CIPHER_PADDING_PKCS5;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA256GCM.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA256GCM.java
new file mode 100644
index 0000000..17e08f4
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA256GCM.java
@@ -0,0 +1,74 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.BlockEncryptionAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.EncryptionConstants;
+
+/**
+ * Algorithm descriptor for block encryption algorithm: 256GCM.
+ */
+public final class EncryptionA256GCM implements BlockEncryptionAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getKey() {
+ return JCAConstants.KEY_ALGO_AES;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getURI() {
+ return EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.BlockEncryption;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getJCAAlgorithmID() {
+ return String.format("%s/%s/%s", getKey(), getCipherMode(), getPadding());
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public Integer getKeyLength() {
+ return 256;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getCipherMode() {
+ return JCAConstants.CIPHER_MODE_GCM;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getPadding() {
+ return JCAConstants.CIPHER_PADDING_NONE;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/KeyAgreementECDHES.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/KeyAgreementECDHES.java
new file mode 100644
index 0000000..354b786
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/KeyAgreementECDHES.java
@@ -0,0 +1,85 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.KeyAgreementAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+
+/**
+ * Algorithm descriptor for JWE key management algorithm: ECDH-ES.
+ *
+ */
+public class KeyAgreementECDHES implements KeyAgreementAlgorithm {
+
+ /**
+ * Get the key algorithm.
+ * @return The key algorithm.
+ */
+ @Nonnull
+ @NotEmpty
+ public String getKey() {
+ return JCAConstants.KEY_ALGO_EC;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getURI() {
+ return KeyManagementConstants.ALGO_ID_ALG_ECDH_ES;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.KeyAgreement;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getJCAAlgorithmID() {
+ return String.format("%s/%s/%s", getKey(), getCipherMode(), getPadding());
+ }
+
+ /**
+ * Get the cipher mode.
+ * @return The cipher mode.
+ */
+ @Nonnull
+ @NotEmpty
+ public String getCipherMode() {
+ return JCAConstants.CIPHER_MODE_ECB;
+ }
+
+ /**
+ * Get the cipher padding.
+ * @return The cipher padding.
+ */
+ @Nonnull
+ @NotEmpty
+ public String getPadding() {
+ //TODO: Verify padding scheme value
+ return JCAConstants.CIPHER_PADDING_PKCS1;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/KeyTransportRSA15.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/KeyTransportRSA15.java
new file mode 100644
index 0000000..5b000ae
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/KeyTransportRSA15.java
@@ -0,0 +1,75 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.KeyTransportAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+
+/**
+ * Algorithm descriptor for JWE key transport algorithm: RSA1_5.
+ *
+ */
+public class KeyTransportRSA15 implements KeyTransportAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getKey() {
+ return JCAConstants.KEY_ALGO_RSA;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getURI() {
+ return KeyManagementConstants.ALGO_ID_ALG_RSA_1_5;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.KeyTransport;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getJCAAlgorithmID() {
+ return String.format("%s/%s/%s", getKey(), getCipherMode(), getPadding());
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getCipherMode() {
+ return JCAConstants.CIPHER_MODE_ECB;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getPadding() {
+ return JCAConstants.CIPHER_PADDING_PKCS1;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/KeyTransportRSAOAEP.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/KeyTransportRSAOAEP.java
new file mode 100644
index 0000000..5c66eec
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/KeyTransportRSAOAEP.java
@@ -0,0 +1,76 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.KeyTransportAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.JCAConstantExtension;
+import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+
+/**
+ * Algorithm descriptor for JWE key transport algorithm: RSA-OAEP.
+ *
+ */
+public class KeyTransportRSAOAEP implements KeyTransportAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getKey() {
+ return JCAConstants.KEY_ALGO_RSA;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getURI() {
+ return KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.KeyTransport;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getJCAAlgorithmID() {
+ return String.format("%s/%s/%s", getKey(), getCipherMode(), getPadding());
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getCipherMode() {
+ return JCAConstants.CIPHER_MODE_ECB;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getPadding() {
+ return JCAConstantExtension.CIPHER_PADDING_OAEP;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/KeyTransportRSAOAEP256.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/KeyTransportRSAOAEP256.java
new file mode 100644
index 0000000..3b60732
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/KeyTransportRSAOAEP256.java
@@ -0,0 +1,76 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.KeyTransportAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.JCAConstantExtension;
+import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+
+/**
+ * Algorithm descriptor for JWE key transport algorithm: RSA-OAEP-256.
+ *
+ */
+public class KeyTransportRSAOAEP256 implements KeyTransportAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getKey() {
+ return JCAConstants.KEY_ALGO_RSA;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getURI() {
+ return KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP_256;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.KeyTransport;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getJCAAlgorithmID() {
+ return String.format("%s/%s/%s", getKey(), getCipherMode(), getPadding());
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getCipherMode() {
+ return JCAConstants.CIPHER_MODE_ECB;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getPadding() {
+ return JCAConstantExtension.CIPHER_PADDING_OAEP_256;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureES256.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureES256.java
new file mode 100644
index 0000000..c1238ce
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureES256.java
@@ -0,0 +1,62 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.SignatureAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.SignatureConstants;
+
+/**
+ * Algorithm descriptor for signature algorithm: ES256.
+ */
+public final class SignatureES256 implements SignatureAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getKey() {
+ return JCAConstants.KEY_ALGO_EC;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getURI() {
+ return SignatureConstants.ALGO_ID_SIGNATURE_ES_256;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.Signature;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getJCAAlgorithmID() {
+ return JCAConstants.SIGNATURE_ECDSA_SHA256;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getDigest() {
+ return JCAConstants.DIGEST_SHA256;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureES384.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureES384.java
new file mode 100644
index 0000000..c7b6b85
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureES384.java
@@ -0,0 +1,62 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.SignatureAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.SignatureConstants;
+
+/**
+ * Algorithm descriptor for signature algorithm: ES384.
+ */
+public final class SignatureES384 implements SignatureAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getKey() {
+ return JCAConstants.KEY_ALGO_EC;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getURI() {
+ return SignatureConstants.ALGO_ID_SIGNATURE_ES_384;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.Signature;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getJCAAlgorithmID() {
+ return JCAConstants.SIGNATURE_ECDSA_SHA384;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getDigest() {
+ return JCAConstants.DIGEST_SHA384;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureES512.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureES512.java
new file mode 100644
index 0000000..0edf36c
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureES512.java
@@ -0,0 +1,62 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.SignatureAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.SignatureConstants;
+
+/**
+ * Algorithm descriptor for signature algorithm: ES512.
+ */
+public final class SignatureES512 implements SignatureAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getKey() {
+ return JCAConstants.KEY_ALGO_EC;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getURI() {
+ return SignatureConstants.ALGO_ID_SIGNATURE_ES_512;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.Signature;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getJCAAlgorithmID() {
+ return JCAConstants.SIGNATURE_ECDSA_SHA512;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getDigest() {
+ return JCAConstants.DIGEST_SHA512;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureHS256.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureHS256.java
new file mode 100644
index 0000000..9e48e00
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureHS256.java
@@ -0,0 +1,56 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.MACAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.SignatureConstants;
+
+/**
+ * Algorithm descriptor for HMAC algorithm: HS256.
+ */
+public final class SignatureHS256 implements MACAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getURI() {
+ return SignatureConstants.ALGO_ID_SIGNATURE_HS_256;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.Mac;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getJCAAlgorithmID() {
+ return JCAConstants.HMAC_SHA256;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getDigest() {
+ return JCAConstants.DIGEST_SHA256;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureHS384.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureHS384.java
new file mode 100644
index 0000000..27c7865
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureHS384.java
@@ -0,0 +1,56 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.MACAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.SignatureConstants;
+
+/**
+ * Algorithm descriptor for HMAC algorithm: HS384.
+ */
+public final class SignatureHS384 implements MACAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getURI() {
+ return SignatureConstants.ALGO_ID_SIGNATURE_HS_384;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.Mac;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getJCAAlgorithmID() {
+ return JCAConstants.HMAC_SHA384;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getDigest() {
+ return JCAConstants.DIGEST_SHA384;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureHS512.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureHS512.java
new file mode 100644
index 0000000..ff94b30
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureHS512.java
@@ -0,0 +1,56 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.MACAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.SignatureConstants;
+
+/**
+ * Algorithm descriptor for HMAC algorithm: HS512.
+ */
+public final class SignatureHS512 implements MACAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getURI() {
+ return SignatureConstants.ALGO_ID_SIGNATURE_HS_512;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.Mac;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getJCAAlgorithmID() {
+ return JCAConstants.HMAC_SHA512;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getDigest() {
+ return JCAConstants.DIGEST_SHA512;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureRS256.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureRS256.java
new file mode 100644
index 0000000..2302028
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureRS256.java
@@ -0,0 +1,62 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.SignatureAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.SignatureConstants;
+
+/**
+ * Algorithm descriptor for signature algorithm: RS256.
+ */
+public final class SignatureRS256 implements SignatureAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getKey() {
+ return JCAConstants.KEY_ALGO_RSA;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getURI() {
+ return SignatureConstants.ALGO_ID_SIGNATURE_RS_256;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.Signature;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getJCAAlgorithmID() {
+ return JCAConstants.SIGNATURE_RSA_SHA256;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getDigest() {
+ return JCAConstants.DIGEST_SHA256;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureRS384.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureRS384.java
new file mode 100644
index 0000000..78be305
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureRS384.java
@@ -0,0 +1,62 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.SignatureAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.SignatureConstants;
+
+/**
+ * Algorithm descriptor for signature algorithm: RS384.
+ */
+public final class SignatureRS384 implements SignatureAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getKey() {
+ return JCAConstants.KEY_ALGO_RSA;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getURI() {
+ return SignatureConstants.ALGO_ID_SIGNATURE_RS_384;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.Signature;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getJCAAlgorithmID() {
+ return JCAConstants.SIGNATURE_RSA_SHA384;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getDigest() {
+ return JCAConstants.DIGEST_SHA384;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureRS512.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureRS512.java
new file mode 100644
index 0000000..08acc50
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureRS512.java
@@ -0,0 +1,62 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.SignatureAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.SignatureConstants;
+
+/**
+ * Algorithm descriptor for signature algorithm: RS512.
+ */
+public final class SignatureRS512 implements SignatureAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getKey() {
+ return JCAConstants.KEY_ALGO_RSA;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getURI() {
+ return SignatureConstants.ALGO_ID_SIGNATURE_RS_512;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.Signature;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getJCAAlgorithmID() {
+ return JCAConstants.SIGNATURE_RSA_SHA512;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getDigest() {
+ return JCAConstants.DIGEST_SHA512;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA128GCMKW.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA128GCMKW.java
new file mode 100644
index 0000000..d817221
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA128GCMKW.java
@@ -0,0 +1,66 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.SymmetricKeyWrapAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+
+/**
+ * Algorithm descriptor for JWE key management algorithm: AES128GCMKW.
+ *
+ */
+public class SymmetricKeyWrapA128GCMKW implements SymmetricKeyWrapAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getKey() {
+ return JCAConstants.KEY_ALGO_AES;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getURI() {
+ return KeyManagementConstants.ALGO_ID_ALG_AES_128_GCM_KW;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.SymmetricKeyWrap;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getJCAAlgorithmID() {
+ return JCAConstants.KEYWRAP_ALGO_AES;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public Integer getKeyLength() {
+ return 128;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA128KW.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA128KW.java
new file mode 100644
index 0000000..d6f2a70
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA128KW.java
@@ -0,0 +1,66 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.SymmetricKeyWrapAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+
+/**
+ * Algorithm descriptor for JWE key management algorithm: AES128KW.
+ *
+ */
+public class SymmetricKeyWrapA128KW implements SymmetricKeyWrapAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getKey() {
+ return JCAConstants.KEY_ALGO_AES;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getURI() {
+ return KeyManagementConstants.ALGO_ID_ALG_AES_128_KW;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.SymmetricKeyWrap;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getJCAAlgorithmID() {
+ return JCAConstants.KEYWRAP_ALGO_AES;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public Integer getKeyLength() {
+ return 128;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA192GCMKW.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA192GCMKW.java
new file mode 100644
index 0000000..261243c
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA192GCMKW.java
@@ -0,0 +1,66 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.SymmetricKeyWrapAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+
+/**
+ * Algorithm descriptor for JWE key management algorithm: AES192GCMKW.
+ *
+ */
+public class SymmetricKeyWrapA192GCMKW implements SymmetricKeyWrapAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getKey() {
+ return JCAConstants.KEY_ALGO_AES;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getURI() {
+ return KeyManagementConstants.ALGO_ID_ALG_AES_192_GCM_KW;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.SymmetricKeyWrap;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getJCAAlgorithmID() {
+ return JCAConstants.KEYWRAP_ALGO_AES;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public Integer getKeyLength() {
+ return 192;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA192KW.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA192KW.java
new file mode 100644
index 0000000..3f75f52
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA192KW.java
@@ -0,0 +1,66 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.SymmetricKeyWrapAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+
+/**
+ * Algorithm descriptor for JWE key management algorithm: AES192KW.
+ *
+ */
+public class SymmetricKeyWrapA192KW implements SymmetricKeyWrapAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getKey() {
+ return JCAConstants.KEY_ALGO_AES;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getURI() {
+ return KeyManagementConstants.ALGO_ID_ALG_AES_192_KW;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.SymmetricKeyWrap;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getJCAAlgorithmID() {
+ return JCAConstants.KEYWRAP_ALGO_AES;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public Integer getKeyLength() {
+ return 192;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA256GCMKW.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA256GCMKW.java
new file mode 100644
index 0000000..2deefa8
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA256GCMKW.java
@@ -0,0 +1,66 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.SymmetricKeyWrapAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+
+/**
+ * Algorithm descriptor for JWE key management algorithm: AES256GCMKW.
+ *
+ */
+public class SymmetricKeyWrapA256GCMKW implements SymmetricKeyWrapAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getKey() {
+ return JCAConstants.KEY_ALGO_AES;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getURI() {
+ return KeyManagementConstants.ALGO_ID_ALG_AES_256_GCM_KW;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.SymmetricKeyWrap;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getJCAAlgorithmID() {
+ return JCAConstants.KEYWRAP_ALGO_AES;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public Integer getKeyLength() {
+ return 256;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA256KW.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA256KW.java
new file mode 100644
index 0000000..14d3183
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA256KW.java
@@ -0,0 +1,66 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.SymmetricKeyWrapAlgorithm;
+
+import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
+import net.shibboleth.utilities.java.support.annotation.constraint.NotEmpty;
+
+/**
+ * Algorithm descriptor for JWE key management algorithm: AES256KW.
+ *
+ */
+public class SymmetricKeyWrapA256KW implements SymmetricKeyWrapAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getKey() {
+ return JCAConstants.KEY_ALGO_AES;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ @NotEmpty
+ public String getURI() {
+ return KeyManagementConstants.ALGO_ID_ALG_AES_256_KW;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public AlgorithmType getType() {
+ return AlgorithmType.SymmetricKeyWrap;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull
+ public String getJCAAlgorithmID() {
+ return JCAConstants.KEYWRAP_ALGO_AES;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public Integer getKeyLength() {
+ return 256;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/package-info.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/package-info.java
new file mode 100644
index 0000000..d04a6a6
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/algorithm/descriptors/package-info.java
@@ -0,0 +1,19 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/** OIDC Signing/Encryption Algorithms. */
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/support/EncryptionConstants.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/support/EncryptionConstants.java
new file mode 100644
index 0000000..b339b32
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/support/EncryptionConstants.java
@@ -0,0 +1,48 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.support;
+
+/** Algorithm Header Parameter 'enc' Values for JWE as defined by RFC 7518. */
+public final class EncryptionConstants {
+
+ /** Encryption - Required- A128CBC-HS256. */
+ public static final String ALGO_ID_ENC_ALG_A128CBC_HS256 = "A128CBC-HS256";
+
+ /** Encryption - Optional- A192CBC-HS384. */
+ public static final String ALGO_ID_ENC_ALG_A192CBC_HS384 = "A192CBC-HS384";
+
+ /** Encryption -Required- A256CBC-HS512. */
+ public static final String ALGO_ID_ENC_ALG_A256CBC_HS512 = "A256CBC-HS512";
+
+ /** Encryption -Recommended- A128GCM. */
+ public static final String ALGO_ID_ENC_ALG_A128GCM = "A128GCM";
+
+ /** Encryption -Optional- A192GCM. */
+ public static final String ALGO_ID_ENC_ALG_A192GCM = "A192GCM";
+
+ /** Encryption -Recommended- A256GCM. */
+ public static final String ALGO_ID_ENC_ALG_A256GCM = "A256GCM";
+
+ /**
+ * Constructor.
+ */
+ private EncryptionConstants() {
+ // no op
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/support/JCAConstantExtension.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/support/JCAConstantExtension.java
new file mode 100644
index 0000000..87abb82
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/support/JCAConstantExtension.java
@@ -0,0 +1,42 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.support;
+
+import org.opensaml.security.crypto.JCAConstants;
+
+/**
+ * Additional constants to {@link JCAConstants} defined in and/or used with the
+ * Java Cryptography Architecture (JCA) specification.
+ */
+public final class JCAConstantExtension {
+
+ /** Cipher padding: "PKCS5Padding". */
+ public static final String CIPHER_PADDING_PKCS5 = "PKCS5Padding";
+
+ /** Cipher padding "OAEP". */
+ public static final String CIPHER_PADDING_OAEP = "OAEPWithSHA-1AndMGF1Padding";
+
+ /** Cipher padding "OAEP-256". */
+ public static final String CIPHER_PADDING_OAEP_256 = "OAEPWithSHA-256AndMGF1Padding";
+
+ /** Private constructor. */
+ private JCAConstantExtension() {
+
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/support/KeyManagementConstants.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/support/KeyManagementConstants.java
new file mode 100644
index 0000000..a28edd4
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/support/KeyManagementConstants.java
@@ -0,0 +1,81 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.support;
+
+/** Algorithm Header Parameter 'alg' Values for JWE as defined by RFC 7518. */
+public final class KeyManagementConstants {
+
+ /** Encryption - Recommended- RSAES-PKCS1-v1_5. */
+ public static final String ALGO_ID_ALG_RSA_1_5 = "RSA1_5";
+
+ /** Encryption - Recommended+ RSAES OAEP using default parameters. */
+ public static final String ALGO_ID_ALG_RSA_OAEP = "RSA-OAEP";
+
+ /** Encryption - Optional RSAES OAEP using SHA-256 and MGF1 with SHA-256. */
+ public static final String ALGO_ID_ALG_RSA_OAEP_256 = "RSA-OAEP-256";
+
+ /** Encryption - Recommended AES Key Wrap with default initial value using 128-bit key. */
+ public static final String ALGO_ID_ALG_AES_128_KW = "A128KW";
+
+ /** Encryption - Optional AES Key Wrap with default initial value using 192-bit key. */
+ public static final String ALGO_ID_ALG_AES_192_KW = "A192KW";
+
+ /** Encryption - Recommended AES Key Wrap with default initial value using 256-bit key. */
+ public static final String ALGO_ID_ALG_AES_256_KW = "A256KW";
+
+ /** Encryption - Recommended Direct use of a shared symmetric key as the CEK. */
+ public static final String ALGO_ID_ALG_DIR = "dir";
+
+ /** Encryption - Recommended+ Elliptic Curve Diffie-Helman Ephemeral Static key agreement. */
+ public static final String ALGO_ID_ALG_ECDH_ES = "ECDH-ES";
+
+ /** Encryption - Recommended ECDH-ES using Concat KDF and CEK wrapped with A128KW. */
+ public static final String ALGO_ID_ALG_ECDH_ES_AES_128_KW = "ECDH-ES+A128KW";
+
+ /** Encryption - Optional ECDH-ES using Concat KDF and CEK wrapped with A192KW. */
+ public static final String ALGO_ID_ALG_ECDH_ES_AES_192_KW = "ECDH-ES+A192KW";
+
+ /** Encryption - Recommended ECDH-ES using Concat KDF and CEK wrapped with A256KW. */
+ public static final String ALGO_ID_ALG_ECDH_ES_AES_256_KW = "ECDH-ES+A256KW";
+
+ /** Encryption - Optional key wrapping with AES GCM using 128-bit key. */
+ public static final String ALGO_ID_ALG_AES_128_GCM_KW = "A128GCMKW";
+
+ /** Encryption - Optional key wrapping with AES GCM using 192-bit key. */
+ public static final String ALGO_ID_ALG_AES_192_GCM_KW = "A192GCMKW";
+
+ /** Encryption - Optional key wrapping with AES GCM using 256-bit key. */
+ public static final String ALGO_ID_ALG_AES_256_GCM_KW = "A256GCMKW";
+
+ /** Encryption - Optional PBES2 with HMAC SHA-256 and A128KW wrapping. */
+ public static final String ALGO_ID_ALG_PBES2_HS_256_AES_128_KW = "PBES2-HS256+A128KW";
+
+ /** Encryption - Optional PBES2 with HMAC SHA-538 and A192KW wrapping. */
+ public static final String ALGO_ID_ALG_PBES2_HS_384_AES_192_KW = "PBES2-HS384+A192KW";
+
+ /** Encryption - Optional PBES2 with HMAC SHA-512 and A256KW wrapping. */
+ public static final String ALGO_ID_ALG_PBES2_HS_512_AES_256_KW = "PBES2-HS512+A256KW";
+
+ /**
+ * Constructor.
+ */
+ private KeyManagementConstants() {
+ // no op
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/support/SignatureConstants.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/support/SignatureConstants.java
new file mode 100644
index 0000000..4bf0c06
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/support/SignatureConstants.java
@@ -0,0 +1,68 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.support;
+
+/** Algorithm Header Parameter Values for JWS. */
+public final class SignatureConstants {
+
+ /** Signature - Required HS256. */
+ public static final String ALGO_ID_SIGNATURE_HS_256 = "HS256";
+
+ /** Signature - Optional HS384. */
+ public static final String ALGO_ID_SIGNATURE_HS_384 = "HS384";
+
+ /** Signature - Optional HS512. */
+ public static final String ALGO_ID_SIGNATURE_HS_512 = "HS512";
+
+ /** Signature - Recommended RS256. */
+ public static final String ALGO_ID_SIGNATURE_RS_256 = "RS256";
+
+ /** Signature - Optional RS384. */
+ public static final String ALGO_ID_SIGNATURE_RS_384 = "RS384";
+
+ /** Signature - Optional RS512. */
+ public static final String ALGO_ID_SIGNATURE_RS_512 = "RS512";
+
+ /** Signature - Recommended+ ES256. */
+ public static final String ALGO_ID_SIGNATURE_ES_256 = "ES256";
+
+ /** Signature - Optional ES384. */
+ public static final String ALGO_ID_SIGNATURE_ES_384 = "ES384";
+
+ /** Signature - Optional ES512. */
+ public static final String ALGO_ID_SIGNATURE_ES_512 = "ES512";
+
+ /** Signature - Optional PS256. */
+ public static final String ALGO_ID_SIGNATURE_PS_256 = "PS256";
+
+ /** Signature - Optional PS384. */
+ public static final String ALGO_ID_SIGNATURE_PS_384 = "PS384";
+
+ /** Signature - Optional PS512. */
+ public static final String ALGO_ID_SIGNATURE_PS_512 = "PS512";
+
+ /** No Signature. */
+ public static final String ALGO_ID_SIGNATURE_NONE = "none";
+
+ /**
+ * Constructor.
+ */
+ private SignatureConstants() {
+ // no op
+ }
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/support/package-info.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/support/package-info.java
new file mode 100644
index 0000000..00d365c
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/jwa/support/package-info.java
@@ -0,0 +1,19 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/** Constants related to OIDC crypto features, like signature and ecryption.*/
+package net.shibboleth.oidc.jwa.support;
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/BasicJWKCredential.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/BasicJWKCredential.java
new file mode 100644
index 0000000..0d29194
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/BasicJWKCredential.java
@@ -0,0 +1,64 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.credential;
+
+import org.opensaml.security.credential.BasicCredential;
+import com.nimbusds.jose.Algorithm;
+
+/**
+ * A basic implementation of {@link JWKCredential}.
+ */
+public class BasicJWKCredential extends BasicCredential implements JWKCredential {
+
+ /** jwk algorithm. */
+ private Algorithm jwkAlgorithm;
+
+ /** jwk kid. */
+ private String jwkKid;
+
+ /**
+ * Set the kid of jwk.
+ *
+ * @param kid kid of jwk
+ */
+ public void setKid(final String kid) {
+ jwkKid = kid;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public String getKid() {
+ return jwkKid;
+ }
+
+ /**
+ * Set the algorithm of jwk.
+ *
+ * @param algorithm algorithm of jwk.
+ */
+ public void setAlgorithm(final Algorithm algorithm) {
+ jwkAlgorithm = algorithm;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public Algorithm getAlgorithm() {
+ return jwkAlgorithm;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/BasicJWKReferenceCredential.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/BasicJWKReferenceCredential.java
new file mode 100644
index 0000000..6bd009f
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/BasicJWKReferenceCredential.java
@@ -0,0 +1,71 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.credential;
+
+import java.net.URI;
+
+import org.opensaml.security.credential.AbstractCredential;
+import org.opensaml.security.credential.Credential;
+
+/**
+ * A basic implementation of {@link JWKReferenceCredential}.
+ */
+public class BasicJWKReferenceCredential extends AbstractCredential implements JWKReferenceCredential {
+
+ /** A reference to a JWK. */
+ private URI referenceUri;
+
+ /**
+ * Constructor.
+ */
+ public BasicJWKReferenceCredential() {
+ super();
+ }
+
+ /**
+ * Constructor.
+ *
+ * @param uri A reference to a JWK.
+ */
+ public BasicJWKReferenceCredential(final URI uri) {
+ this();
+ referenceUri = uri;
+ }
+
+ /**
+ * Set the reference to a JWK.
+ *
+ * @param uri What to set.
+ */
+ public void setReferenceURI(final URI uri) {
+ referenceUri = uri;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public URI getReferenceURI() {
+ return referenceUri;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public Class<? extends Credential> getCredentialType() {
+ return JWKReferenceCredential.class;
+ }
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/BasicNimbusSecretCredential.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/BasicNimbusSecretCredential.java
new file mode 100644
index 0000000..a6f3dcf
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/BasicNimbusSecretCredential.java
@@ -0,0 +1,71 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.credential;
+
+import org.opensaml.security.credential.AbstractCredential;
+import org.opensaml.security.credential.Credential;
+
+import com.nimbusds.oauth2.sdk.auth.Secret;
+
+/**
+ * A basic implementation of {@link NimbusSecretCredential}.
+ */
+public class BasicNimbusSecretCredential extends AbstractCredential implements NimbusSecretCredential {
+
+ /** The client secret. */
+ private Secret clientSecret;
+
+ /**
+ * Constructor.
+ */
+ public BasicNimbusSecretCredential() {
+ super();
+ }
+
+ /**
+ * Constructor.
+ *
+ * @param secret The client secret.
+ */
+ public BasicNimbusSecretCredential(final Secret secret) {
+ this();
+ clientSecret = secret;
+ }
+
+ /**
+ * Set the client secret.
+ *
+ * @param secret What to set.
+ */
+ public void setSecret(final Secret secret) {
+ clientSecret = secret;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public Secret getSecret() {
+ return clientSecret;
+ }
+
+ /** {@inheritDoc} */
+ @Override
+ public Class<? extends Credential> getCredentialType() {
+ return NimbusSecretCredential.class;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/JWKCredential.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/JWKCredential.java
new file mode 100644
index 0000000..f503078
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/JWKCredential.java
@@ -0,0 +1,44 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.credential;
+
+import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
+import org.opensaml.security.credential.Credential;
+import com.nimbusds.jose.Algorithm;
+
+/** Credential based on JSON Web Key (JWK). */
+public interface JWKCredential extends Credential {
+
+ /**
+ * Get kid of JWK.
+ *
+ * @return kid parameter.
+ */
+ @Nullable
+ public String getKid();
+
+ /**
+ * Get algorithm of JWK.
+ *
+ * @return algorithm of JWK.
+ */
+ @Nonnull
+ public Algorithm getAlgorithm();
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/JWKReferenceCredential.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/JWKReferenceCredential.java
new file mode 100644
index 0000000..149f224
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/JWKReferenceCredential.java
@@ -0,0 +1,37 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.credential;
+
+import java.net.URI;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.credential.Credential;
+
+/** Credential based on a reference (URI) to a JSON Web Key (JWK). */
+public interface JWKReferenceCredential extends Credential {
+
+ /**
+ * Get the reference URI to the remote JWK.
+ *
+ * @return The reference URI to the remote JWK.
+ */
+ @Nonnull
+ public URI getReferenceURI();
+
+}
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/NimbusSecretCredential.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/NimbusSecretCredential.java
new file mode 100644
index 0000000..b91627d
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/NimbusSecretCredential.java
@@ -0,0 +1,39 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.credential;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.credential.Credential;
+
+import com.nimbusds.oauth2.sdk.auth.Secret;
+
+/**
+ * Credential wrapping {@link Secret}.
+ */
+public interface NimbusSecretCredential extends Credential {
+
+ /**
+ * Get the client secret.
+ *
+ * @return The client secret.
+ */
+ @Nonnull
+ public Secret getSecret();
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/package-info.java b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/package-info.java
new file mode 100644
index 0000000..10e9341
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/java/net/shibboleth/oidc/security/credential/package-info.java
@@ -0,0 +1,19 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/** JWK Credentials.*/
+package net.shibboleth.oidc.security.credential;
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/main/resources/META-INF/services/org.opensaml.xmlsec.algorithm.AlgorithmDescriptor b/oidc-common-crypto-api/src/main/resources/META-INF/services/org.opensaml.xmlsec.algorithm.AlgorithmDescriptor
new file mode 100644
index 0000000..1a40908
--- /dev/null
+++ b/oidc-common-crypto-api/src/main/resources/META-INF/services/org.opensaml.xmlsec.algorithm.AlgorithmDescriptor
@@ -0,0 +1,25 @@
+net.shibboleth.oidc.jwa.algorithm.descriptors.SignatureRS256
+net.shibboleth.oidc.jwa.algorithm.descriptors.SignatureRS384
+net.shibboleth.oidc.jwa.algorithm.descriptors.SignatureRS512
+net.shibboleth.oidc.jwa.algorithm.descriptors.SignatureES256
+net.shibboleth.oidc.jwa.algorithm.descriptors.SignatureES384
+net.shibboleth.oidc.jwa.algorithm.descriptors.SignatureES512
+net.shibboleth.oidc.jwa.algorithm.descriptors.SignatureHS256
+net.shibboleth.oidc.jwa.algorithm.descriptors.SignatureHS384
+net.shibboleth.oidc.jwa.algorithm.descriptors.SignatureHS512
+net.shibboleth.oidc.jwa.algorithm.descriptors.KeyAgreementECDHES
+net.shibboleth.oidc.jwa.algorithm.descriptors.KeyTransportRSA15
+net.shibboleth.oidc.jwa.algorithm.descriptors.KeyTransportRSAOAEP
+net.shibboleth.oidc.jwa.algorithm.descriptors.KeyTransportRSAOAEP256
+net.shibboleth.oidc.jwa.algorithm.descriptors.SymmetricKeyWrapA128KW
+net.shibboleth.oidc.jwa.algorithm.descriptors.SymmetricKeyWrapA192KW
+net.shibboleth.oidc.jwa.algorithm.descriptors.SymmetricKeyWrapA256KW
+net.shibboleth.oidc.jwa.algorithm.descriptors.SymmetricKeyWrapA128GCMKW
+net.shibboleth.oidc.jwa.algorithm.descriptors.SymmetricKeyWrapA192GCMKW
+net.shibboleth.oidc.jwa.algorithm.descriptors.SymmetricKeyWrapA256GCMKW
+net.shibboleth.oidc.jwa.algorithm.descriptors.EncryptionA128CBCHS256
+net.shibboleth.oidc.jwa.algorithm.descriptors.EncryptionA128GCM
+net.shibboleth.oidc.jwa.algorithm.descriptors.EncryptionA192CBCHS384
+net.shibboleth.oidc.jwa.algorithm.descriptors.EncryptionA192GCM
+net.shibboleth.oidc.jwa.algorithm.descriptors.EncryptionA256CBCHS512
+net.shibboleth.oidc.jwa.algorithm.descriptors.EncryptionA256GCM
diff --git a/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA128CBCHS256Test.java b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA128CBCHS256Test.java
new file mode 100644
index 0000000..b6556fd
--- /dev/null
+++ b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA128CBCHS256Test.java
@@ -0,0 +1,46 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
+import org.testng.Assert;
+import org.testng.annotations.Test;
+
+import net.shibboleth.oidc.jwa.support.EncryptionConstants;
+import net.shibboleth.oidc.jwa.support.JCAConstantExtension;
+
+/**
+ * Unit tests for {@link EncryptionA128CBCHS256}
+ */
+public class EncryptionA128CBCHS256Test {
+
+ private EncryptionA128CBCHS256 algorithm = new EncryptionA128CBCHS256();
+
+ @Test
+ public void testInitialState() {
+ Assert.assertEquals(JCAConstants.KEY_ALGO_AES, algorithm.getKey());
+ Assert.assertEquals(EncryptionConstants.ALGO_ID_ENC_ALG_A128CBC_HS256, algorithm.getURI());
+ Assert.assertEquals(AlgorithmType.BlockEncryption, algorithm.getType());
+ Assert.assertEquals("AES/CBC/PKCS5Padding", algorithm.getJCAAlgorithmID());
+ Assert.assertEquals(Integer.valueOf(128), algorithm.getKeyLength());
+ Assert.assertEquals(JCAConstants.CIPHER_MODE_CBC, algorithm.getCipherMode());
+ Assert.assertEquals(JCAConstantExtension.CIPHER_PADDING_PKCS5, algorithm.getPadding());
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA128GCMTest.java b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA128GCMTest.java
new file mode 100644
index 0000000..0e5bd0b
--- /dev/null
+++ b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA128GCMTest.java
@@ -0,0 +1,45 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import net.shibboleth.oidc.jwa.support.EncryptionConstants;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
+import org.testng.Assert;
+import org.testng.annotations.Test;
+
+/**
+ * Unit tests for {@link EncryptionA128GCM}
+ */
+public class EncryptionA128GCMTest {
+
+ private EncryptionA128GCM algorithm = new EncryptionA128GCM();
+
+ @Test
+ public void testInitialState() {
+ Assert.assertEquals(JCAConstants.KEY_ALGO_AES, algorithm.getKey());
+ Assert.assertEquals(EncryptionConstants.ALGO_ID_ENC_ALG_A128GCM, algorithm.getURI());
+ Assert.assertEquals(AlgorithmType.BlockEncryption, algorithm.getType());
+ Assert.assertEquals("AES/GCM/NoPadding", algorithm.getJCAAlgorithmID());
+ Assert.assertEquals(Integer.valueOf(128), algorithm.getKeyLength());
+ Assert.assertEquals(JCAConstants.CIPHER_MODE_GCM, algorithm.getCipherMode());
+ Assert.assertEquals(JCAConstants.CIPHER_PADDING_NONE, algorithm.getPadding());
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA192CBCHS384Test.java b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA192CBCHS384Test.java
new file mode 100644
index 0000000..085417e
--- /dev/null
+++ b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA192CBCHS384Test.java
@@ -0,0 +1,45 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import net.shibboleth.oidc.jwa.support.EncryptionConstants;
+import net.shibboleth.oidc.jwa.support.JCAConstantExtension;
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
+import org.testng.Assert;
+import org.testng.annotations.Test;
+
+/**
+ * Unit tests for {@link EncryptionA192CBCHS384}
+ */
+public class EncryptionA192CBCHS384Test {
+
+ private EncryptionA192CBCHS384 algorithm = new EncryptionA192CBCHS384();
+
+ @Test
+ public void testInitialState() {
+ Assert.assertEquals(JCAConstants.KEY_ALGO_AES, algorithm.getKey());
+ Assert.assertEquals(EncryptionConstants.ALGO_ID_ENC_ALG_A192CBC_HS384, algorithm.getURI());
+ Assert.assertEquals(AlgorithmType.BlockEncryption, algorithm.getType());
+ Assert.assertEquals("AES/CBC/PKCS5Padding", algorithm.getJCAAlgorithmID());
+ Assert.assertEquals(Integer.valueOf(192), algorithm.getKeyLength());
+ Assert.assertEquals(JCAConstants.CIPHER_MODE_CBC, algorithm.getCipherMode());
+ Assert.assertEquals(JCAConstantExtension.CIPHER_PADDING_PKCS5, algorithm.getPadding());
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA192GCMTest.java b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA192GCMTest.java
new file mode 100644
index 0000000..2f6a3f9
--- /dev/null
+++ b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA192GCMTest.java
@@ -0,0 +1,45 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import net.shibboleth.oidc.jwa.support.EncryptionConstants;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
+import org.testng.Assert;
+import org.testng.annotations.Test;
+
+/**
+ * Unit tests for {@link EncryptionA192GCM}
+ */
+public class EncryptionA192GCMTest {
+
+ private EncryptionA192GCM algorithm = new EncryptionA192GCM();
+
+ @Test
+ public void testInitialState() {
+ Assert.assertEquals(JCAConstants.KEY_ALGO_AES, algorithm.getKey());
+ Assert.assertEquals(EncryptionConstants.ALGO_ID_ENC_ALG_A192GCM, algorithm.getURI());
+ Assert.assertEquals(AlgorithmType.BlockEncryption, algorithm.getType());
+ Assert.assertEquals("AES/GCM/NoPadding", algorithm.getJCAAlgorithmID());
+ Assert.assertEquals(Integer.valueOf(192), algorithm.getKeyLength());
+ Assert.assertEquals(JCAConstants.CIPHER_MODE_GCM, algorithm.getCipherMode());
+ Assert.assertEquals(JCAConstants.CIPHER_PADDING_NONE, algorithm.getPadding());
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA256CBCHS512Test.java b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA256CBCHS512Test.java
new file mode 100644
index 0000000..023daa6
--- /dev/null
+++ b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA256CBCHS512Test.java
@@ -0,0 +1,45 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import net.shibboleth.oidc.jwa.support.EncryptionConstants;
+import net.shibboleth.oidc.jwa.support.JCAConstantExtension;
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
+import org.testng.Assert;
+import org.testng.annotations.Test;
+
+/**
+ * Unit tests for {@link EncryptionA256CBCHS512}
+ */
+public class EncryptionA256CBCHS512Test {
+
+ private EncryptionA256CBCHS512 algorithm = new EncryptionA256CBCHS512();
+
+ @Test
+ public void testInitialState() {
+ Assert.assertEquals(JCAConstants.KEY_ALGO_AES, algorithm.getKey());
+ Assert.assertEquals(EncryptionConstants.ALGO_ID_ENC_ALG_A256CBC_HS512, algorithm.getURI());
+ Assert.assertEquals(AlgorithmType.BlockEncryption, algorithm.getType());
+ Assert.assertEquals("AES/CBC/PKCS5Padding", algorithm.getJCAAlgorithmID());
+ Assert.assertEquals(Integer.valueOf(256), algorithm.getKeyLength());
+ Assert.assertEquals(JCAConstants.CIPHER_MODE_CBC, algorithm.getCipherMode());
+ Assert.assertEquals(JCAConstantExtension.CIPHER_PADDING_PKCS5, algorithm.getPadding());
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA256GCMTest.java b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA256GCMTest.java
new file mode 100644
index 0000000..a27a670
--- /dev/null
+++ b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/EncryptionA256GCMTest.java
@@ -0,0 +1,45 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
+import org.testng.Assert;
+import org.testng.annotations.Test;
+
+import net.shibboleth.oidc.jwa.support.EncryptionConstants;
+
+/**
+ * Unit tests for {@link EncryptionA256GCM}
+ */
+public class EncryptionA256GCMTest {
+
+ private EncryptionA256GCM algorithm = new EncryptionA256GCM();
+
+ @Test
+ public void testInitialState() {
+ Assert.assertEquals(JCAConstants.KEY_ALGO_AES, algorithm.getKey());
+ Assert.assertEquals(EncryptionConstants.ALGO_ID_ENC_ALG_A256GCM, algorithm.getURI());
+ Assert.assertEquals(AlgorithmType.BlockEncryption, algorithm.getType());
+ Assert.assertEquals("AES/GCM/NoPadding", algorithm.getJCAAlgorithmID());
+ Assert.assertEquals(Integer.valueOf(256), algorithm.getKeyLength());
+ Assert.assertEquals(JCAConstants.CIPHER_MODE_GCM, algorithm.getCipherMode());
+ Assert.assertEquals(JCAConstants.CIPHER_PADDING_NONE, algorithm.getPadding());
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/KeyAgreementECDHESTest.java b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/KeyAgreementECDHESTest.java
new file mode 100644
index 0000000..467f74f
--- /dev/null
+++ b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/KeyAgreementECDHESTest.java
@@ -0,0 +1,45 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import org.testng.Assert;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
+import org.testng.annotations.Test;
+
+import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
+
+/**
+ * Unit tests for {@link KeyAgreementECDHES}
+ */
+public class KeyAgreementECDHESTest {
+
+ private KeyAgreementECDHES algorithm = new KeyAgreementECDHES();
+
+ @Test
+ public void testInitialState() {
+ Assert.assertEquals(JCAConstants.KEY_ALGO_EC, algorithm.getKey());
+ Assert.assertEquals(KeyManagementConstants.ALGO_ID_ALG_ECDH_ES, algorithm.getURI());
+ Assert.assertEquals(AlgorithmType.KeyAgreement, algorithm.getType());
+ Assert.assertEquals("EC/ECB/PKCS1Padding", algorithm.getJCAAlgorithmID());
+ Assert.assertEquals(JCAConstants.CIPHER_MODE_ECB, algorithm.getCipherMode());
+ Assert.assertEquals(JCAConstants.CIPHER_PADDING_PKCS1, algorithm.getPadding());
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/KeyTransportRSA15Test.java b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/KeyTransportRSA15Test.java
new file mode 100644
index 0000000..3cceb32
--- /dev/null
+++ b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/KeyTransportRSA15Test.java
@@ -0,0 +1,45 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import org.testng.Assert;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
+import org.testng.annotations.Test;
+
+import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
+
+/**
+ * Unit tests for {@link KeyTransportRSA15}
+ */
+public class KeyTransportRSA15Test {
+
+ private KeyTransportRSA15 algorithm = new KeyTransportRSA15();
+
+ @Test
+ public void testInitialState() {
+ Assert.assertEquals(JCAConstants.KEY_ALGO_RSA, algorithm.getKey());
+ Assert.assertEquals(KeyManagementConstants.ALGO_ID_ALG_RSA_1_5, algorithm.getURI());
+ Assert.assertEquals(AlgorithmType.KeyTransport, algorithm.getType());
+ Assert.assertEquals("RSA/ECB/PKCS1Padding", algorithm.getJCAAlgorithmID());
+ Assert.assertEquals(JCAConstants.CIPHER_MODE_ECB, algorithm.getCipherMode());
+ Assert.assertEquals(JCAConstants.CIPHER_PADDING_PKCS1, algorithm.getPadding());
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/KeyTransportRSAOAEP256Test.java b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/KeyTransportRSAOAEP256Test.java
new file mode 100644
index 0000000..63e3715
--- /dev/null
+++ b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/KeyTransportRSAOAEP256Test.java
@@ -0,0 +1,45 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import net.shibboleth.oidc.jwa.support.JCAConstantExtension;
+import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
+import org.testng.Assert;
+import org.testng.annotations.Test;
+
+/**
+ * Unit tests for {@link KeyTransportRSAOAEP256}
+ */
+public class KeyTransportRSAOAEP256Test {
+
+ private KeyTransportRSAOAEP256 algorithm = new KeyTransportRSAOAEP256();
+
+ @Test
+ public void testInitialState() {
+ Assert.assertEquals(JCAConstants.KEY_ALGO_RSA, algorithm.getKey());
+ Assert.assertEquals(KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP_256, algorithm.getURI());
+ Assert.assertEquals(AlgorithmType.KeyTransport, algorithm.getType());
+ Assert.assertEquals("RSA/ECB/OAEPWithSHA-256AndMGF1Padding", algorithm.getJCAAlgorithmID());
+ Assert.assertEquals(JCAConstants.CIPHER_MODE_ECB, algorithm.getCipherMode());
+ Assert.assertEquals(JCAConstantExtension.CIPHER_PADDING_OAEP_256, algorithm.getPadding());
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/KeyTransportRSAOAEPTest.java b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/KeyTransportRSAOAEPTest.java
new file mode 100644
index 0000000..ddadc03
--- /dev/null
+++ b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/KeyTransportRSAOAEPTest.java
@@ -0,0 +1,45 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
+import org.testng.Assert;
+import org.testng.annotations.Test;
+
+import net.shibboleth.oidc.jwa.support.JCAConstantExtension;
+import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
+
+/**
+ * Unit tests for {@link KeyTransportRSAOAEP}
+ */
+public class KeyTransportRSAOAEPTest {
+
+ private KeyTransportRSAOAEP algorithm = new KeyTransportRSAOAEP();
+
+ @Test
+ public void testInitialState() {
+ Assert.assertEquals(JCAConstants.KEY_ALGO_RSA, algorithm.getKey());
+ Assert.assertEquals(KeyManagementConstants.ALGO_ID_ALG_RSA_OAEP, algorithm.getURI());
+ Assert.assertEquals(AlgorithmType.KeyTransport, algorithm.getType());
+ Assert.assertEquals("RSA/ECB/OAEPWithSHA-1AndMGF1Padding", algorithm.getJCAAlgorithmID());
+ Assert.assertEquals(JCAConstants.CIPHER_MODE_ECB, algorithm.getCipherMode());
+ Assert.assertEquals(JCAConstantExtension.CIPHER_PADDING_OAEP, algorithm.getPadding());
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureES256Test.java b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureES256Test.java
new file mode 100644
index 0000000..e9ff68a
--- /dev/null
+++ b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureES256Test.java
@@ -0,0 +1,44 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import org.testng.Assert;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
+import org.testng.annotations.Test;
+
+import net.shibboleth.oidc.jwa.support.SignatureConstants;
+
+/**
+ * Unit tests for {@link SignatureES256}
+ */
+public class SignatureES256Test {
+
+ private SignatureES256 algorithm = new SignatureES256();
+
+ @Test
+ public void testInitialState() {
+ Assert.assertEquals(JCAConstants.KEY_ALGO_EC, algorithm.getKey());
+ Assert.assertEquals(SignatureConstants.ALGO_ID_SIGNATURE_ES_256, algorithm.getURI());
+ Assert.assertEquals(AlgorithmType.Signature, algorithm.getType());
+ Assert.assertEquals(JCAConstants.SIGNATURE_ECDSA_SHA256, algorithm.getJCAAlgorithmID());
+ Assert.assertEquals(JCAConstants.DIGEST_SHA256, algorithm.getDigest());
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureES384Test.java b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureES384Test.java
new file mode 100644
index 0000000..473e2e4
--- /dev/null
+++ b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureES384Test.java
@@ -0,0 +1,44 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import org.testng.Assert;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
+import org.testng.annotations.Test;
+
+import net.shibboleth.oidc.jwa.support.SignatureConstants;
+
+/**
+ * Unit tests for {@link SignatureES384}
+ */
+public class SignatureES384Test {
+
+ private SignatureES384 algorithm = new SignatureES384();
+
+ @Test
+ public void testInitialState() {
+ Assert.assertEquals(JCAConstants.KEY_ALGO_EC, algorithm.getKey());
+ Assert.assertEquals(SignatureConstants.ALGO_ID_SIGNATURE_ES_384, algorithm.getURI());
+ Assert.assertEquals(AlgorithmType.Signature, algorithm.getType());
+ Assert.assertEquals(JCAConstants.SIGNATURE_ECDSA_SHA384, algorithm.getJCAAlgorithmID());
+ Assert.assertEquals(JCAConstants.DIGEST_SHA384, algorithm.getDigest());
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureES512Test.java b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureES512Test.java
new file mode 100644
index 0000000..a6b7801
--- /dev/null
+++ b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureES512Test.java
@@ -0,0 +1,44 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import org.testng.Assert;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
+import org.testng.annotations.Test;
+
+import net.shibboleth.oidc.jwa.support.SignatureConstants;
+
+/**
+ * Unit tests for {@link SignatureES512}
+ */
+public class SignatureES512Test {
+
+ private SignatureES512 algorithm = new SignatureES512();
+
+ @Test
+ public void testInitialState() {
+ Assert.assertEquals(JCAConstants.KEY_ALGO_EC, algorithm.getKey());
+ Assert.assertEquals(SignatureConstants.ALGO_ID_SIGNATURE_ES_512, algorithm.getURI());
+ Assert.assertEquals(AlgorithmType.Signature, algorithm.getType());
+ Assert.assertEquals(JCAConstants.SIGNATURE_ECDSA_SHA512, algorithm.getJCAAlgorithmID());
+ Assert.assertEquals(JCAConstants.DIGEST_SHA512, algorithm.getDigest());
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureHS256Test.java b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureHS256Test.java
new file mode 100644
index 0000000..8b13ea4
--- /dev/null
+++ b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureHS256Test.java
@@ -0,0 +1,43 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import org.testng.Assert;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
+import org.testng.annotations.Test;
+
+import net.shibboleth.oidc.jwa.support.SignatureConstants;
+
+/**
+ * Unit tests for {@link SignatureHS256}
+ */
+public class SignatureHS256Test {
+
+ private SignatureHS256 algorithm = new SignatureHS256();
+
+ @Test
+ public void testInitialState() {
+ Assert.assertEquals(SignatureConstants.ALGO_ID_SIGNATURE_HS_256, algorithm.getURI());
+ Assert.assertEquals(AlgorithmType.Mac, algorithm.getType());
+ Assert.assertEquals(JCAConstants.HMAC_SHA256, algorithm.getJCAAlgorithmID());
+ Assert.assertEquals(JCAConstants.DIGEST_SHA256, algorithm.getDigest());
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureHS384Test.java b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureHS384Test.java
new file mode 100644
index 0000000..7880b82
--- /dev/null
+++ b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureHS384Test.java
@@ -0,0 +1,43 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import org.testng.Assert;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
+import org.testng.annotations.Test;
+
+import net.shibboleth.oidc.jwa.support.SignatureConstants;
+
+/**
+ * Unit tests for {@link SignatureHS384}
+ */
+public class SignatureHS384Test {
+
+ private SignatureHS384 algorithm = new SignatureHS384();
+
+ @Test
+ public void testInitialState() {
+ Assert.assertEquals(SignatureConstants.ALGO_ID_SIGNATURE_HS_384, algorithm.getURI());
+ Assert.assertEquals(AlgorithmType.Mac, algorithm.getType());
+ Assert.assertEquals(JCAConstants.HMAC_SHA384, algorithm.getJCAAlgorithmID());
+ Assert.assertEquals(JCAConstants.DIGEST_SHA384, algorithm.getDigest());
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureHS512Test.java b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureHS512Test.java
new file mode 100644
index 0000000..34c507c
--- /dev/null
+++ b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureHS512Test.java
@@ -0,0 +1,43 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import org.testng.Assert;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
+import org.testng.annotations.Test;
+
+import net.shibboleth.oidc.jwa.support.SignatureConstants;
+
+/**
+ * Unit tests for {@link SignatureHS512}
+ */
+public class SignatureHS512Test {
+
+ private SignatureHS512 algorithm = new SignatureHS512();
+
+ @Test
+ public void testInitialState() {
+ Assert.assertEquals(SignatureConstants.ALGO_ID_SIGNATURE_HS_512, algorithm.getURI());
+ Assert.assertEquals(AlgorithmType.Mac, algorithm.getType());
+ Assert.assertEquals(JCAConstants.HMAC_SHA512, algorithm.getJCAAlgorithmID());
+ Assert.assertEquals(JCAConstants.DIGEST_SHA512, algorithm.getDigest());
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureRS256Test.java b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureRS256Test.java
new file mode 100644
index 0000000..5a52144
--- /dev/null
+++ b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureRS256Test.java
@@ -0,0 +1,44 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import org.testng.Assert;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
+import org.testng.annotations.Test;
+
+import net.shibboleth.oidc.jwa.support.SignatureConstants;
+
+/**
+ * Unit tests for {@link SignatureRS256}
+ */
+public class SignatureRS256Test {
+
+ private SignatureRS256 algorithm = new SignatureRS256();
+
+ @Test
+ public void testInitialState() {
+ Assert.assertEquals(JCAConstants.KEY_ALGO_RSA, algorithm.getKey());
+ Assert.assertEquals(SignatureConstants.ALGO_ID_SIGNATURE_RS_256, algorithm.getURI());
+ Assert.assertEquals(AlgorithmType.Signature, algorithm.getType());
+ Assert.assertEquals(JCAConstants.SIGNATURE_RSA_SHA256, algorithm.getJCAAlgorithmID());
+ Assert.assertEquals(JCAConstants.DIGEST_SHA256, algorithm.getDigest());
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureRS384Test.java b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureRS384Test.java
new file mode 100644
index 0000000..f468389
--- /dev/null
+++ b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureRS384Test.java
@@ -0,0 +1,44 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import org.testng.Assert;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
+import org.testng.annotations.Test;
+
+import net.shibboleth.oidc.jwa.support.SignatureConstants;
+
+/**
+ * Unit tests for {@link SignatureRS384}
+ */
+public class SignatureRS384Test {
+
+ private SignatureRS384 algorithm = new SignatureRS384();
+
+ @Test
+ public void testInitialState() {
+ Assert.assertEquals(JCAConstants.KEY_ALGO_RSA, algorithm.getKey());
+ Assert.assertEquals(SignatureConstants.ALGO_ID_SIGNATURE_RS_384, algorithm.getURI());
+ Assert.assertEquals(AlgorithmType.Signature, algorithm.getType());
+ Assert.assertEquals(JCAConstants.SIGNATURE_RSA_SHA384, algorithm.getJCAAlgorithmID());
+ Assert.assertEquals(JCAConstants.DIGEST_SHA384, algorithm.getDigest());
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureRS512Test.java b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureRS512Test.java
new file mode 100644
index 0000000..6ba7310
--- /dev/null
+++ b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SignatureRS512Test.java
@@ -0,0 +1,44 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import org.testng.Assert;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
+import org.testng.annotations.Test;
+
+import net.shibboleth.oidc.jwa.support.SignatureConstants;
+
+/**
+ * Unit tests for {@link SignatureRS512}
+ */
+public class SignatureRS512Test {
+
+ private SignatureRS512 algorithm = new SignatureRS512();
+
+ @Test
+ public void testInitialState() {
+ Assert.assertEquals(JCAConstants.KEY_ALGO_RSA, algorithm.getKey());
+ Assert.assertEquals(SignatureConstants.ALGO_ID_SIGNATURE_RS_512, algorithm.getURI());
+ Assert.assertEquals(AlgorithmType.Signature, algorithm.getType());
+ Assert.assertEquals(JCAConstants.SIGNATURE_RSA_SHA512, algorithm.getJCAAlgorithmID());
+ Assert.assertEquals(JCAConstants.DIGEST_SHA512, algorithm.getDigest());
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA128GCMKWTest.java b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA128GCMKWTest.java
new file mode 100644
index 0000000..7423cea
--- /dev/null
+++ b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA128GCMKWTest.java
@@ -0,0 +1,44 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import org.testng.Assert;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
+import org.testng.annotations.Test;
+
+import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
+
+/**
+ * Unit tests for {@link SymmetricKeyWrapA128GCMKW}
+ */
+public class SymmetricKeyWrapA128GCMKWTest {
+
+ private SymmetricKeyWrapA128GCMKW algorithm = new SymmetricKeyWrapA128GCMKW();
+
+ @Test
+ public void testInitialState() {
+ Assert.assertEquals(JCAConstants.KEY_ALGO_AES, algorithm.getKey());
+ Assert.assertEquals(KeyManagementConstants.ALGO_ID_ALG_AES_128_GCM_KW, algorithm.getURI());
+ Assert.assertEquals(AlgorithmType.SymmetricKeyWrap, algorithm.getType());
+ Assert.assertEquals(JCAConstants.KEYWRAP_ALGO_AES, algorithm.getJCAAlgorithmID());
+ Assert.assertEquals(Integer.valueOf(128), algorithm.getKeyLength());
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA128KWTest.java b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA128KWTest.java
new file mode 100644
index 0000000..dd08c57
--- /dev/null
+++ b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA128KWTest.java
@@ -0,0 +1,45 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import org.testng.Assert;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
+import org.testng.annotations.Test;
+
+import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
+
+/**
+ * Unit tests for {@link SymmetricKeyWrapA128KW}
+ */
+public class SymmetricKeyWrapA128KWTest {
+
+ private SymmetricKeyWrapA128KW algorithm = new SymmetricKeyWrapA128KW();
+
+ @Test
+ public void testInitialState() {
+ Assert.assertEquals(JCAConstants.KEY_ALGO_AES, algorithm.getKey());
+ Assert.assertEquals(KeyManagementConstants.ALGO_ID_ALG_AES_128_KW, algorithm.getURI());
+ Assert.assertEquals(AlgorithmType.SymmetricKeyWrap, algorithm.getType());
+ Assert.assertEquals(JCAConstants.KEYWRAP_ALGO_AES, algorithm.getJCAAlgorithmID());
+ Assert.assertEquals(Integer.valueOf(128), algorithm.getKeyLength());
+
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA192GCMKWTest.java b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA192GCMKWTest.java
new file mode 100644
index 0000000..b3167a9
--- /dev/null
+++ b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA192GCMKWTest.java
@@ -0,0 +1,44 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import org.testng.Assert;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
+import org.testng.annotations.Test;
+
+import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
+
+/**
+ * Unit tests for {@link SymmetricKeyWrapA192GCMKW}
+ */
+public class SymmetricKeyWrapA192GCMKWTest {
+
+ private SymmetricKeyWrapA192GCMKW algorithm = new SymmetricKeyWrapA192GCMKW();
+
+ @Test
+ public void testInitialState() {
+ Assert.assertEquals(JCAConstants.KEY_ALGO_AES, algorithm.getKey());
+ Assert.assertEquals(KeyManagementConstants.ALGO_ID_ALG_AES_192_GCM_KW, algorithm.getURI());
+ Assert.assertEquals(AlgorithmType.SymmetricKeyWrap, algorithm.getType());
+ Assert.assertEquals(JCAConstants.KEYWRAP_ALGO_AES, algorithm.getJCAAlgorithmID());
+ Assert.assertEquals(Integer.valueOf(192), algorithm.getKeyLength());
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA192KWTest.java b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA192KWTest.java
new file mode 100644
index 0000000..6939ebc
--- /dev/null
+++ b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA192KWTest.java
@@ -0,0 +1,44 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import org.testng.Assert;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
+import org.testng.annotations.Test;
+
+import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
+
+/**
+ * Unit tests for {@link SymmetricKeyWrapA192KW}
+ */
+public class SymmetricKeyWrapA192KWTest {
+
+ private SymmetricKeyWrapA192KW algorithm = new SymmetricKeyWrapA192KW();
+
+ @Test
+ public void testInitialState() {
+ Assert.assertEquals(JCAConstants.KEY_ALGO_AES, algorithm.getKey());
+ Assert.assertEquals(KeyManagementConstants.ALGO_ID_ALG_AES_192_KW, algorithm.getURI());
+ Assert.assertEquals(AlgorithmType.SymmetricKeyWrap, algorithm.getType());
+ Assert.assertEquals(JCAConstants.KEYWRAP_ALGO_AES, algorithm.getJCAAlgorithmID());
+ Assert.assertEquals(Integer.valueOf(192), algorithm.getKeyLength());
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA256GCMKWTest.java b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA256GCMKWTest.java
new file mode 100644
index 0000000..1fc1e39
--- /dev/null
+++ b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA256GCMKWTest.java
@@ -0,0 +1,44 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import org.testng.Assert;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
+import org.testng.annotations.Test;
+
+import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
+
+/**
+ * Unit tests for {@link SymmetricKeyWrapA256GCMKW}
+ */
+public class SymmetricKeyWrapA256GCMKWTest {
+
+ private SymmetricKeyWrapA256GCMKW algorithm = new SymmetricKeyWrapA256GCMKW();
+
+ @Test
+ public void testInitialState() {
+ Assert.assertEquals(JCAConstants.KEY_ALGO_AES, algorithm.getKey());
+ Assert.assertEquals(KeyManagementConstants.ALGO_ID_ALG_AES_256_GCM_KW, algorithm.getURI());
+ Assert.assertEquals(AlgorithmType.SymmetricKeyWrap, algorithm.getType());
+ Assert.assertEquals(JCAConstants.KEYWRAP_ALGO_AES, algorithm.getJCAAlgorithmID());
+ Assert.assertEquals(Integer.valueOf(256), algorithm.getKeyLength());
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA256KWTest.java b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA256KWTest.java
new file mode 100644
index 0000000..44e441d
--- /dev/null
+++ b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/jwa/algorithm/descriptors/SymmetricKeyWrapA256KWTest.java
@@ -0,0 +1,44 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.jwa.algorithm.descriptors;
+
+import org.testng.Assert;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
+import org.testng.annotations.Test;
+
+import net.shibboleth.oidc.jwa.support.KeyManagementConstants;
+
+/**
+ * Unit tests for {@link SymmetricKeyWrapA256KW}
+ */
+public class SymmetricKeyWrapA256KWTest {
+
+ private SymmetricKeyWrapA256KW algorithm = new SymmetricKeyWrapA256KW();
+
+ @Test
+ public void testInitialState() {
+ Assert.assertEquals(JCAConstants.KEY_ALGO_AES, algorithm.getKey());
+ Assert.assertEquals(KeyManagementConstants.ALGO_ID_ALG_AES_256_KW, algorithm.getURI());
+ Assert.assertEquals(AlgorithmType.SymmetricKeyWrap, algorithm.getType());
+ Assert.assertEquals(JCAConstants.KEYWRAP_ALGO_AES, algorithm.getJCAAlgorithmID());
+ Assert.assertEquals(Integer.valueOf(256), algorithm.getKeyLength());
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/security/credential/BasicJWKCredentialTest.java b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/security/credential/BasicJWKCredentialTest.java
new file mode 100644
index 0000000..c8c46d7
--- /dev/null
+++ b/oidc-common-crypto-api/src/test/java/net/shibboleth/oidc/security/credential/BasicJWKCredentialTest.java
@@ -0,0 +1,52 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.credential;
+
+import org.testng.Assert;
+
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+
+import com.nimbusds.jose.Algorithm;
+
+public class BasicJWKCredentialTest {
+
+ private BasicJWKCredential jwk;
+ private Algorithm algo;
+
+ @BeforeMethod
+ protected void setUp() throws Exception {
+ jwk = new BasicJWKCredential();
+ algo = new Algorithm("RS256");
+ }
+
+ @Test
+ public void testInitialState() {
+ Assert.assertNull(jwk.getKid());
+ Assert.assertNull(jwk.getAlgorithm());
+ }
+
+ @Test
+ public void testSetters() {
+ jwk.setKid("kid");
+ jwk.setAlgorithm(algo);
+ Assert.assertEquals(jwk.getKid(), "kid");
+ Assert.assertEquals(jwk.getAlgorithm(), new Algorithm("RS256"));
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/pom.xml b/oidc-common-crypto-impl/pom.xml
new file mode 100644
index 0000000..e3a31c8
--- /dev/null
+++ b/oidc-common-crypto-impl/pom.xml
@@ -0,0 +1,35 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+ xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+ <modelVersion>4.0.0</modelVersion>
+
+ <parent>
+ <groupId>net.shibboleth.oidc</groupId>
+ <artifactId>oidc-common-parent</artifactId>
+ <version>0.0.1-SNAPSHOT</version>
+ </parent>
+
+ <artifactId>oidc-common-crypto-impl</artifactId>
+ <packaging>jar</packaging>
+ <name>Shibboleth OIDC Java Common Library - Crypto implementation</name>
+ <description>Implementation for common crypto/security functions/features.</description>
+
+ <properties>
+ <checkstyle.configLocation>${project.basedir}/../checkstyle.xml</checkstyle.configLocation>
+ <automatic.module.name>net.shibboleth.oidc.crypto.impl</automatic.module.name>
+ </properties>
+
+ <dependencies>
+ <dependency>
+ <groupId>net.shibboleth.oidc</groupId>
+ <artifactId>oidc-common-crypto-api</artifactId>
+ </dependency>
+ <dependency>
+ <groupId>${opensaml.groupId}</groupId>
+ <artifactId>opensaml-core</artifactId>
+ <version>${opensaml.version}</version>
+ <type>test-jar</type>
+ <scope>test</scope>
+ </dependency>
+ </dependencies>
+
+</project>
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CredentialConversionUtil.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CredentialConversionUtil.java
new file mode 100644
index 0000000..8272e2a
--- /dev/null
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/CredentialConversionUtil.java
@@ -0,0 +1,124 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package net.shibboleth.oidc.security.impl;
+
+import java.security.interfaces.ECPublicKey;
+import java.security.interfaces.RSAPublicKey;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.credential.Credential;
+import org.opensaml.security.credential.UsageType;
+
+import com.nimbusds.jose.jwk.Curve;
+import com.nimbusds.jose.jwk.ECKey;
+import com.nimbusds.jose.jwk.JWK;
+import com.nimbusds.jose.jwk.KeyUse;
+import com.nimbusds.jose.jwk.RSAKey;
+
+import net.shibboleth.oidc.security.credential.JWKCredential;
+
+/**
+ * Generic tool methods related to converting {@link Credential} to JWK.
+ */
+public final class CredentialConversionUtil {
+
+ /** Private constructor. */
+ private CredentialConversionUtil() {
+
+ }
+
+ /**
+ * Resolves kid from key name. If there is no key name and the credential is JWK, the kid is read from JWK.
+ *
+ * @param credential input key names
+ *
+ * @return key names or null if not found
+ */
+ public static String resolveKid(@Nonnull final Credential credential) {
+ if (credential.getKeyNames() != null) {
+ for (final String keyName : credential.getKeyNames()) {
+ return keyName;
+ }
+ }
+ if (credential instanceof JWKCredential) {
+ return ((JWKCredential) credential).getKid();
+ }
+ return null;
+ }
+
+ /**
+ * Resolves KeyUse parameter from credential.
+ *
+ * @param credential credential to resolve KeyUse of
+ * @return KeyUse of credential
+ */
+ public static KeyUse resolveKeyUse(final Credential credential) {
+ if (credential == null || credential.getUsageType() == null) {
+ return null;
+ }
+ if (credential.getUsageType().equals(UsageType.SIGNING)) {
+ return KeyUse.SIGNATURE;
+ }
+ if (credential.getUsageType().equals(UsageType.ENCRYPTION)) {
+ return KeyUse.ENCRYPTION;
+ }
+ return null;
+ }
+
+ /**
+ * Converts credential to JWK. Only RSA and EC keys supported.
+ *
+ * @param credential to convert.
+ * @return credential as JWK.
+ */
+ public static JWK credentialToKey(final Credential credential) {
+ if (credential == null || credential.getPublicKey() == null) {
+ return null;
+ }
+ final String algorithm = credential.getPublicKey().getAlgorithm();
+ if ("RSA".equals(algorithm)) {
+ return new RSAKey.Builder((RSAPublicKey) credential.getPublicKey()).keyUse(resolveKeyUse(credential))
+ .keyID(resolveKid(credential)).build();
+ }
+ if ("EC".equals(algorithm)) {
+ return new ECKey.Builder(Curve.forECParameterSpec(((ECPublicKey) credential.getPublicKey()).getParams()),
+ (ECPublicKey) credential.getPublicKey()).keyUse(resolveKeyUse(credential))
+ .keyID(resolveKid(credential)).build();
+ }
+ return null;
+ }
+
+
+ /**
+ * Converts JWK key usage type to OpenSAML usage type.
+ *
+ * @param jwk containing usage type. Must not be null.
+ * @return usage type.
+ */
+ public static UsageType getUsageType(@Nonnull final JWK jwk) {
+ if (KeyUse.ENCRYPTION.equals(jwk.getKeyUse())) {
+ return UsageType.ENCRYPTION;
+ }
+ if (KeyUse.SIGNATURE.equals(jwk.getKeyUse())) {
+ return UsageType.SIGNING;
+ }
+ return UsageType.UNSPECIFIED;
+ }
+
+}
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/package-info.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/package-info.java
new file mode 100644
index 0000000..1e45d49
--- /dev/null
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/impl/package-info.java
@@ -0,0 +1,19 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/** Utility classes for security related functions. */
+package net.shibboleth.oidc.security.impl;
\ No newline at end of file
diff --git a/oidc-common-crypto-impl/src/test/resources/logback-test.xml b/oidc-common-crypto-impl/src/test/resources/logback-test.xml
new file mode 100644
index 0000000..a58ce3f
--- /dev/null
+++ b/oidc-common-crypto-impl/src/test/resources/logback-test.xml
@@ -0,0 +1,19 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<configuration>
+ <logger name="net.shibboleth" level="ALL"/>
+ <logger name="org.springframework" level="DEBUG"/>
+
+ <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
+ <encoder class="ch.qos.logback.classic.encoder.PatternLayoutEncoder">
+ <pattern>%level [%logger:%line] - %msg%n</pattern>
+ <charset>UTF-8</charset>
+ </encoder>
+ </appender>
+
+ <root>
+ <level value="ALL" />
+ <appender-ref ref="STDOUT" />
+ </root>
+
+</configuration>
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index d44f275..3fba214 100644
--- a/pom.xml
+++ b/pom.xml
@@ -82,6 +82,16 @@
<dependencyManagement>
<!-- oidc-common project dependencies -->
<dependencies>
+ <dependency>
+ <groupId>net.shibboleth.oidc</groupId>
+ <artifactId>oidc-common-crypto-api</artifactId>
+ <version>${project.version}</version>
+ </dependency>
+ <dependency>
+ <groupId>net.shibboleth.oidc</groupId>
+ <artifactId>oidc-common-crypto-impl</artifactId>
+ <version>${project.version}</version>
+ </dependency>
<dependency>
<groupId>net.shibboleth.oidc</groupId>
<artifactId>oidc-common-saml-api</artifactId>
@@ -92,6 +102,17 @@
<artifactId>oidc-common-saml-impl</artifactId>
<version>${project.version}</version>
</dependency>
+ <dependency>
+ <groupId>com.nimbusds</groupId>
+ <artifactId>oauth2-oidc-sdk</artifactId>
+ <version>7.1.1</version>
+ <exclusions>
+ <exclusion>
+ <groupId>com.sun.mail</groupId>
+ <artifactId>javax.mail</artifactId>
+ </exclusion>
+ </exclusions>
+ </dependency>
<!-- Shibboleth IdP BOM for importing IdP dependencies -->
<dependency>
<groupId>net.shibboleth.idp</groupId>
@@ -118,6 +139,8 @@
</dependencies>
</dependencyManagement>
<modules>
+ <module>oidc-common-crypto-api</module>
+ <module>oidc-common-crypto-impl</module>
<module>oidc-common-saml-api</module>
<module>oidc-common-saml-impl</module>
</modules>
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list