[java-opensaml] 01/13: Additional constants and algorithm descriptors from XML Encryption 1.1.
Brent Putman
putmanb at georgetown.edu
Wed Jan 6 01:27:15 UTC 2021
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch dev/OSJ-82
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=bd343ec299232c29f9dceea1a17440e250c4f34b
commit bd343ec299232c29f9dceea1a17440e250c4f34b
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Wed Dec 2 22:10:09 2020 -0500
Additional constants and algorithm descriptors from XML Encryption 1.1.
---
.../org/opensaml/security/crypto/JCAConstants.java | 9 +++++
.../descriptors/KeyAgreementDHExplicitKDF.java | 46 ++++++++++++++++++++++
.../descriptors/KeyAgreementDHLegacyKDF.java | 46 ++++++++++++++++++++++
.../algorithm/descriptors/KeyAgreementECDH.java | 46 ++++++++++++++++++++++
.../encryption/support/EncryptionConstants.java | 20 +++++++++-
...g.opensaml.xmlsec.algorithm.AlgorithmDescriptor | 3 ++
.../xmlsec/algorithm/AlgorithmDescriptorsTest.java | 24 +++++++++++
.../xmlsec/algorithm/AlgorithmRegistryTest.java | 18 +++++++++
8 files changed, 211 insertions(+), 1 deletion(-)
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/JCAConstants.java b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/JCAConstants.java
index 8cfe31a77..329e220c7 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/JCAConstants.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/JCAConstants.java
@@ -188,6 +188,15 @@ public final class JCAConstants {
public static final String HMAC_SHA512 = "HmacSHA512";
+
+ // Key Agreement types
+
+ /** Key Agreement algorithm: Diffie-Hellman. */
+ public static final String KEY_AGREEMENT_DH = "DiffieHellman";
+
+ /** Key Agreement algorithm: Elliptic Curve Diffie-Hellman. */
+ public static final String KEY_AGREEMENT_ECDH = "ECDH";
+
/** Constructor. Private to disable instantiation. */
private JCAConstants() { }
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/KeyAgreementDHExplicitKDF.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/KeyAgreementDHExplicitKDF.java
new file mode 100644
index 000000000..bef43a74d
--- /dev/null
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/KeyAgreementDHExplicitKDF.java
@@ -0,0 +1,46 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.xmlsec.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.KeyAgreementAlgorithm;
+import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
+
+/**
+ * Algorithm descriptor for key agreement: Diffie-Hellman with Explicit KDF.
+ */
+public final class KeyAgreementDHExplicitKDF implements KeyAgreementAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull public String getURI() {
+ return EncryptionConstants.ALGO_ID_KEYAGREEMENT_DH_EXPLICIT_KDF;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public AlgorithmType getType() {
+ return AlgorithmType.KeyAgreement;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getJCAAlgorithmID() {
+ return JCAConstants.KEY_AGREEMENT_DH;
+ }
+
+}
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/KeyAgreementDHLegacyKDF.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/KeyAgreementDHLegacyKDF.java
new file mode 100644
index 000000000..04994012d
--- /dev/null
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/KeyAgreementDHLegacyKDF.java
@@ -0,0 +1,46 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.xmlsec.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.KeyAgreementAlgorithm;
+import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
+
+/**
+ * Algorithm descriptor for key agreement: Diffie-Hellman with Legacy KDF.
+ */
+public final class KeyAgreementDHLegacyKDF implements KeyAgreementAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull public String getURI() {
+ return EncryptionConstants.ALGO_ID_KEYAGREEMENT_DH;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public AlgorithmType getType() {
+ return AlgorithmType.KeyAgreement;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getJCAAlgorithmID() {
+ return JCAConstants.KEY_AGREEMENT_DH;
+ }
+
+}
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/KeyAgreementECDH.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/KeyAgreementECDH.java
new file mode 100644
index 000000000..7e6cd2bfd
--- /dev/null
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/KeyAgreementECDH.java
@@ -0,0 +1,46 @@
+/*
+ * Licensed to the University Corporation for Advanced Internet Development,
+ * Inc. (UCAID) under one or more contributor license agreements. See the
+ * NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The UCAID licenses this file to You under the Apache
+ * License, Version 2.0 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.xmlsec.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.KeyAgreementAlgorithm;
+import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
+
+/**
+ * Algorithm descriptor for key agreement: Elliptic Curve Diffie-Hellman Ephemeral-Static Mode.
+ */
+public final class KeyAgreementECDH implements KeyAgreementAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull public String getURI() {
+ return EncryptionConstants.ALGO_ID_KEYAGREEMENT_ECDH_ES;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public AlgorithmType getType() {
+ return AlgorithmType.KeyAgreement;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getJCAAlgorithmID() {
+ return JCAConstants.KEY_AGREEMENT_ECDH;
+ }
+
+}
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/EncryptionConstants.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/EncryptionConstants.java
index 5725042d8..db175ffbd 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/EncryptionConstants.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/encryption/support/EncryptionConstants.java
@@ -73,8 +73,11 @@ public final class EncryptionConstants {
// *************************************************
// Key Agreement
// *************************************************
- /** Key Agreement - OPTIONAL Diffie-Hellman. */
+ /** Key Agreement - OPTIONAL Diffie-Hellman with Legacy Key Derivation Function. */
public static final String ALGO_ID_KEYAGREEMENT_DH = XMLENC_NS + "dh";
+
+ /** URI for DHKeyValue. */
+ public static final String TYPE_DH_KEY_VALUE = XMLENC_NS + "DHKeyValue";
// *************************************************
// Symmetric Key Wrap
@@ -142,6 +145,21 @@ public final class EncryptionConstants {
/** URI for DerivedKey. */
public static final String TYPE_DERIVED_KEY = XMLENC11_NS + "DerivedKey";
+ /** URI for ECKeyValue. */
+ public static final String TYPE_EC_KEY_VALUE = XMLENC11_NS + "ECKeyValue";
+
+ /** Key Agreement - Diffie-Hellman with Explicit Key Derivation Function. */
+ public static final String ALGO_ID_KEYAGREEMENT_DH_EXPLICIT_KDF = XMLENC11_NS + "dh-es";
+
+ /** Key Agreement - Elliptic Curve Diffie-Hellman (ECDH) Ephemeral-Static Mode. */
+ public static final String ALGO_ID_KEYAGREEMENT_ECDH_ES = XMLENC11_NS + "ECDH-ES";
+
+ /** Key Derivation Method - ConcatKDF. */
+ public static final String ALGO_ID_KEYDERIVATION_CONCATKDF = XMLENC11_NS + "ConcatKDF";
+
+ /** Key Derivation Method - PBKDF2. */
+ public static final String ALGO_ID_KEYDERIVATION_PBKDF2 = XMLENC11_NS + "pbkdf2";
+
/** Constructor. */
private EncryptionConstants() {
diff --git a/opensaml-xmlsec-api/src/main/resources/META-INF/services/org.opensaml.xmlsec.algorithm.AlgorithmDescriptor b/opensaml-xmlsec-api/src/main/resources/META-INF/services/org.opensaml.xmlsec.algorithm.AlgorithmDescriptor
index 916712a07..7c2ea2a40 100644
--- a/opensaml-xmlsec-api/src/main/resources/META-INF/services/org.opensaml.xmlsec.algorithm.AlgorithmDescriptor
+++ b/opensaml-xmlsec-api/src/main/resources/META-INF/services/org.opensaml.xmlsec.algorithm.AlgorithmDescriptor
@@ -19,6 +19,9 @@ org.opensaml.xmlsec.algorithm.descriptors.HMACSHA224
org.opensaml.xmlsec.algorithm.descriptors.HMACSHA256
org.opensaml.xmlsec.algorithm.descriptors.HMACSHA384
org.opensaml.xmlsec.algorithm.descriptors.HMACSHA512
+org.opensaml.xmlsec.algorithm.descriptors.KeyAgreementDHExplicitKDF
+org.opensaml.xmlsec.algorithm.descriptors.KeyAgreementDHLegacyKDF
+org.opensaml.xmlsec.algorithm.descriptors.KeyAgreementECDH
org.opensaml.xmlsec.algorithm.descriptors.KeyTransportRSA15
org.opensaml.xmlsec.algorithm.descriptors.KeyTransportRSAOAEP
org.opensaml.xmlsec.algorithm.descriptors.KeyTransportRSAOAEPMGF1P
diff --git a/opensaml-xmlsec-api/src/test/java/org/opensaml/xmlsec/algorithm/AlgorithmDescriptorsTest.java b/opensaml-xmlsec-api/src/test/java/org/opensaml/xmlsec/algorithm/AlgorithmDescriptorsTest.java
index 9781b6026..2bf738c49 100644
--- a/opensaml-xmlsec-api/src/test/java/org/opensaml/xmlsec/algorithm/AlgorithmDescriptorsTest.java
+++ b/opensaml-xmlsec-api/src/test/java/org/opensaml/xmlsec/algorithm/AlgorithmDescriptorsTest.java
@@ -39,6 +39,9 @@ import org.opensaml.xmlsec.algorithm.descriptors.HMACSHA224;
import org.opensaml.xmlsec.algorithm.descriptors.HMACSHA256;
import org.opensaml.xmlsec.algorithm.descriptors.HMACSHA384;
import org.opensaml.xmlsec.algorithm.descriptors.HMACSHA512;
+import org.opensaml.xmlsec.algorithm.descriptors.KeyAgreementDHExplicitKDF;
+import org.opensaml.xmlsec.algorithm.descriptors.KeyAgreementDHLegacyKDF;
+import org.opensaml.xmlsec.algorithm.descriptors.KeyAgreementECDH;
import org.opensaml.xmlsec.algorithm.descriptors.KeyTransportRSA15;
import org.opensaml.xmlsec.algorithm.descriptors.KeyTransportRSAOAEP;
import org.opensaml.xmlsec.algorithm.descriptors.KeyTransportRSAOAEPMGF1P;
@@ -228,6 +231,27 @@ public class AlgorithmDescriptorsTest {
Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.Mac);
}
+ // KeyAgreement
+ @Test
+ public void testKeyAgreement() {
+ KeyAgreementAlgorithm descriptor;
+
+ descriptor = new KeyAgreementDHExplicitKDF();
+ Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.KEY_AGREEMENT_DH);
+ Assert.assertEquals(descriptor.getURI(), EncryptionConstants.ALGO_ID_KEYAGREEMENT_DH_EXPLICIT_KDF);
+ Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.KeyAgreement);
+
+ descriptor = new KeyAgreementDHLegacyKDF();
+ Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.KEY_AGREEMENT_DH);
+ Assert.assertEquals(descriptor.getURI(), EncryptionConstants.ALGO_ID_KEYAGREEMENT_DH);
+ Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.KeyAgreement);
+
+ descriptor = new KeyAgreementECDH();
+ Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.KEY_AGREEMENT_ECDH);
+ Assert.assertEquals(descriptor.getURI(), EncryptionConstants.ALGO_ID_KEYAGREEMENT_ECDH_ES);
+ Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.KeyAgreement);
+ }
+
// KeyTransport
@Test
public void testKeyTransport() {
diff --git a/opensaml-xmlsec-api/src/test/java/org/opensaml/xmlsec/algorithm/AlgorithmRegistryTest.java b/opensaml-xmlsec-api/src/test/java/org/opensaml/xmlsec/algorithm/AlgorithmRegistryTest.java
index 902a00fd7..cb3f7bad9 100644
--- a/opensaml-xmlsec-api/src/test/java/org/opensaml/xmlsec/algorithm/AlgorithmRegistryTest.java
+++ b/opensaml-xmlsec-api/src/test/java/org/opensaml/xmlsec/algorithm/AlgorithmRegistryTest.java
@@ -164,6 +164,11 @@ public class AlgorithmRegistryTest extends OpenSAMLInitBaseTestCase {
Assert.assertNotNull(registry.get(SignatureConstants.ALGO_ID_MAC_HMAC_SHA384));
Assert.assertNotNull(registry.get(SignatureConstants.ALGO_ID_MAC_HMAC_SHA512));
+ // KeyAgreement
+ Assert.assertNotNull(registry.get(EncryptionConstants.ALGO_ID_KEYAGREEMENT_DH));
+ Assert.assertNotNull(registry.get(EncryptionConstants.ALGO_ID_KEYAGREEMENT_DH_EXPLICIT_KDF));
+ Assert.assertNotNull(registry.get(EncryptionConstants.ALGO_ID_KEYAGREEMENT_ECDH_ES));
+
// KeyTransport
Assert.assertNotNull(registry.get(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15));
Assert.assertNotNull(registry.get(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP));
@@ -234,6 +239,13 @@ public class AlgorithmRegistryTest extends OpenSAMLInitBaseTestCase {
Assert.assertTrue(byType.contains(SignatureConstants.ALGO_ID_MAC_HMAC_SHA512));
Assert.assertEquals(registry.getRegisteredByType(AlgorithmType.Mac).stream().filter(Objects::nonNull).count(), byType.size());
+ // KeyAgreement
+ byType = registry.getRegisteredURIsByType(AlgorithmType.KeyAgreement);
+ Assert.assertTrue(byType.contains(EncryptionConstants.ALGO_ID_KEYAGREEMENT_DH));
+ Assert.assertTrue(byType.contains(EncryptionConstants.ALGO_ID_KEYAGREEMENT_DH_EXPLICIT_KDF));
+ Assert.assertTrue(byType.contains(EncryptionConstants.ALGO_ID_KEYAGREEMENT_ECDH_ES));
+ Assert.assertEquals(registry.getRegisteredByType(AlgorithmType.KeyAgreement).stream().filter(Objects::nonNull).count(), byType.size());
+
// KeyTransport
byType = registry.getRegisteredURIsByType(AlgorithmType.KeyTransport);
Assert.assertTrue(byType.contains(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15));
@@ -307,6 +319,10 @@ public class AlgorithmRegistryTest extends OpenSAMLInitBaseTestCase {
Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_MAC_HMAC_SHA384));
Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_MAC_HMAC_SHA512));
+ // KeyAgreement
+ Assert.assertTrue(registry.isRuntimeSupported(EncryptionConstants.ALGO_ID_KEYAGREEMENT_DH));
+ Assert.assertTrue(registry.isRuntimeSupported(EncryptionConstants.ALGO_ID_KEYAGREEMENT_DH_EXPLICIT_KDF));
+
// KeyTransport
Assert.assertTrue(registry.isRuntimeSupported(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSA15));
Assert.assertTrue(registry.isRuntimeSupported(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP));
@@ -334,6 +350,7 @@ public class AlgorithmRegistryTest extends OpenSAMLInitBaseTestCase {
Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA256));
Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA384));
Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA512));
+ Assert.assertTrue(registry.isRuntimeSupported(EncryptionConstants.ALGO_ID_KEYAGREEMENT_ECDH_ES));
if (providerSupport.haveBC() || TestSupport.isJavaV8OrLater()) {
Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA224));
@@ -344,6 +361,7 @@ public class AlgorithmRegistryTest extends OpenSAMLInitBaseTestCase {
Assert.assertFalse(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA256));
Assert.assertFalse(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA384));
Assert.assertFalse(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA512));
+ Assert.assertFalse(registry.isRuntimeSupported(EncryptionConstants.ALGO_ID_KEYAGREEMENT_ECDH_ES));
}
if (providerSupport.haveBC() || TestSupport.isJavaV8OrLater()) {
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list