[java-opensaml] 08/19: Change APIs to use algorithm URI rather then JCA key algorithm + length
Brent Putman
putmanb at georgetown.edu
Mon Mar 1 05:56:45 UTC 2021
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch dev/OSJ-82
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=c3b413f3fa78dfc3392e54e9fef616cce4352df7
commit c3b413f3fa78dfc3392e54e9fef616cce4352df7
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Sun Dec 27 18:21:32 2020 -0500
Change APIs to use algorithm URI rather then JCA key algorithm + length
---
.../xmlsec/agreement/KeyAgreementProcessor.java | 7 +++----
.../org/opensaml/xmlsec/derivation/KeyDerivation.java | 5 ++---
.../impl/AbstractDerivationKeyAgreementProcessor.java | 5 ++---
.../agreement/impl/AbstractKeyAgreementProcessor.java | 11 +++++------
.../org/opensaml/xmlsec/derivation/impl/ConcatKDF.java | 4 ++--
.../org/opensaml/xmlsec/derivation/impl/PBKDF2.java | 4 ++--
.../agreement/impl/ECDHKeyAgreementProcessorTest.java | 18 +++++++-----------
.../xmlsec/derivation/impl/MockKeyDerivation.java | 12 ++++++------
8 files changed, 29 insertions(+), 37 deletions(-)
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/agreement/KeyAgreementProcessor.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/agreement/KeyAgreementProcessor.java
index eaccabc0b..d90b7a47e 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/agreement/KeyAgreementProcessor.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/agreement/KeyAgreementProcessor.java
@@ -38,8 +38,7 @@ public interface KeyAgreementProcessor {
*
* @param publicCredential the public credential, which will belong either to the recipient or originator party,
* depending on whether encryption or decryption is being performed, respectively
- * @param keyAlgorithm the JCA key algorithm for the derived key
- * @param keyLength the key length for the derived key
+ * @param keyAlgorithm the algorithm URI for which the derived key will be used
* @param parameters parameters to the agreement operation. Internally a copy will be created so this input instance
* will not be modified.
*
@@ -48,7 +47,7 @@ public interface KeyAgreementProcessor {
* @throws KeyAgreementException
*/
@Nonnull public KeyAgreementCredential execute(@Nonnull final Credential publicCredential,
- @Nonnull final String keyAlgorithm, @Nonnull final Integer keyLength,
- @Nonnull final KeyAgreementParameters parameters) throws KeyAgreementException;
+ @Nonnull final String keyAlgorithm, @Nonnull final KeyAgreementParameters parameters)
+ throws KeyAgreementException;
}
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/derivation/KeyDerivation.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/derivation/KeyDerivation.java
index 9ef019e71..fa15b97f5 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/derivation/KeyDerivation.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/derivation/KeyDerivation.java
@@ -42,13 +42,12 @@ public interface KeyDerivation extends XMLExpressableKeyAgreementParameter {
* Derive a {@link SecretKey} from the specified secret.
*
* @param secret the input secret from which to derive the key.
- * @param keyAlgorithm the JCA key algorithm for the derived key
- * @param keyLength the length of for the derived key
+ * @param keyAlgorithm the algorithm URI for which the derived key will be used
*
* @return the derived key
*
* @throws KeyDerivationException
*/
- public SecretKey derive(byte[] secret, String keyAlgorithm, Integer keyLength) throws KeyDerivationException;
+ public SecretKey derive(byte[] secret, String keyAlgorithm) throws KeyDerivationException;
}
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/AbstractDerivationKeyAgreementProcessor.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/AbstractDerivationKeyAgreementProcessor.java
index 257f084f4..d079888bc 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/AbstractDerivationKeyAgreementProcessor.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/AbstractDerivationKeyAgreementProcessor.java
@@ -35,8 +35,7 @@ public abstract class AbstractDerivationKeyAgreementProcessor extends AbstractKe
/** {@inheritDoc} */
protected SecretKey deriveSecretKey(@Nonnull final byte[] secret, @Nonnull final String keyAlgorithm,
- @Nonnull final Integer keyLength, @Nonnull final KeyAgreementParameters parameters)
- throws KeyAgreementException {
+ @Nonnull final KeyAgreementParameters parameters) throws KeyAgreementException {
final KeyDerivation keyDerivation = parameters.stream()
.filter(KeyDerivation.class::isInstance)
@@ -48,7 +47,7 @@ public abstract class AbstractDerivationKeyAgreementProcessor extends AbstractKe
}
try {
- return keyDerivation.derive(secret, keyAlgorithm, keyLength);
+ return keyDerivation.derive(secret, keyAlgorithm);
} catch (final KeyDerivationException e) {
throw new KeyAgreementException("Key derivation failed using supplied KeyDerivation parameter", e);
}
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/AbstractKeyAgreementProcessor.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/AbstractKeyAgreementProcessor.java
index fd76c25ee..a1fe063d7 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/AbstractKeyAgreementProcessor.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/agreement/impl/AbstractKeyAgreementProcessor.java
@@ -38,8 +38,8 @@ public abstract class AbstractKeyAgreementProcessor implements KeyAgreementProce
/** {@inheritDoc} */
@Nonnull public KeyAgreementCredential execute(@Nonnull final Credential publicCredential,
- @Nonnull final String keyAlgorithm, @Nonnull final Integer keyLength,
- @Nonnull final KeyAgreementParameters inputParameters) throws KeyAgreementException {
+ @Nonnull final String keyAlgorithm, @Nonnull final KeyAgreementParameters inputParameters)
+ throws KeyAgreementException {
// Make a copy so methods can store items without mutating the input instance
final KeyAgreementParameters parameters = new KeyAgreementParameters(inputParameters);
@@ -48,7 +48,7 @@ public abstract class AbstractKeyAgreementProcessor implements KeyAgreementProce
final byte[] secret = generateAgreementSecret(publicCredential, privateCredential, parameters);
- final SecretKey derivedKey = deriveSecretKey(secret, keyAlgorithm, keyLength, parameters);
+ final SecretKey derivedKey = deriveSecretKey(secret, keyAlgorithm, parameters);
return buildKeyAgreementCredential(derivedKey, publicCredential, privateCredential, parameters);
}
@@ -95,7 +95,6 @@ public abstract class AbstractKeyAgreementProcessor implements KeyAgreementProce
*
* @param secret the input secret
* @param keyAlgorithm the JCA key algorithm for the derived key
- * @param keyLength the key length for the derived key
* @param parameters the key agreement parameters
*
* @return the derived secret key
@@ -103,8 +102,8 @@ public abstract class AbstractKeyAgreementProcessor implements KeyAgreementProce
* @throws KeyAgreementException
*/
@Nonnull protected abstract SecretKey deriveSecretKey(@Nonnull final byte[] secret,
- @Nonnull final String keyAlgorithm, @Nonnull final Integer keyLength,
- @Nonnull final KeyAgreementParameters parameters) throws KeyAgreementException;
+ @Nonnull final String keyAlgorithm, @Nonnull final KeyAgreementParameters parameters)
+ throws KeyAgreementException;
/**
* Build the final {@link KeyAgreementCredential} from the given inputs.
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/ConcatKDF.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/ConcatKDF.java
index 4be44939c..816297d84 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/ConcatKDF.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/ConcatKDF.java
@@ -39,8 +39,8 @@ public class ConcatKDF implements KeyDerivation {
}
/** {@inheritDoc} */
- public SecretKey derive(@Nonnull final byte[] secret, @Nonnull final String keyAlgorithm,
- @Nonnull final Integer keyLength) throws KeyDerivationException {
+ public SecretKey derive(@Nonnull final byte[] secret, @Nonnull final String keyAlgorithm)
+ throws KeyDerivationException {
// TODO Auto-generated method stub
diff --git a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/PBKDF2.java b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/PBKDF2.java
index 35c7e5fd3..e70077042 100644
--- a/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/PBKDF2.java
+++ b/opensaml-xmlsec-impl/src/main/java/org/opensaml/xmlsec/derivation/impl/PBKDF2.java
@@ -39,8 +39,8 @@ public class PBKDF2 implements KeyDerivation {
}
/** {@inheritDoc} */
- public SecretKey derive(@Nonnull final byte[] secret, @Nonnull final String keyAlgorithm,
- @Nonnull final Integer keyLength) throws KeyDerivationException {
+ public SecretKey derive(@Nonnull final byte[] secret, @Nonnull final String keyAlgorithm)
+ throws KeyDerivationException {
// TODO Auto-generated method stub
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/ECDHKeyAgreementProcessorTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/ECDHKeyAgreementProcessorTest.java
index c5d28d405..da02d01ff 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/ECDHKeyAgreementProcessorTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/agreement/impl/ECDHKeyAgreementProcessorTest.java
@@ -20,6 +20,7 @@ package org.opensaml.xmlsec.agreement.impl;
import java.security.KeyPair;
import java.security.spec.ECGenParameterSpec;
+import org.opensaml.core.testing.OpenSAMLInitBaseTestCase;
import org.opensaml.security.credential.Credential;
import org.opensaml.security.credential.CredentialSupport;
import org.opensaml.security.crypto.JCAConstants;
@@ -36,7 +37,7 @@ import org.testng.annotations.Test;
/**
*
*/
-public class ECDHKeyAgreementProcessorTest {
+public class ECDHKeyAgreementProcessorTest extends OpenSAMLInitBaseTestCase {
private ECDHKeyAgreementProcessor processor;
@@ -55,8 +56,7 @@ public class ECDHKeyAgreementProcessorTest {
params.add(new KANonce("someBase64"));
KeyAgreementCredential keyAgreementCredential = processor.execute(recipientCredential,
- JCAConstants.KEY_ALGO_AES,
- 128,
+ EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128,
params);
Assert.assertNotNull(keyAgreementCredential);
@@ -101,8 +101,7 @@ public class ECDHKeyAgreementProcessorTest {
params.add(new KANonce("someBase64"));
KeyAgreementCredential keyAgreementCredential = processor.execute(originatorCredential,
- JCAConstants.KEY_ALGO_AES,
- 128,
+ EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128,
params);
Assert.assertNotNull(keyAgreementCredential);
@@ -144,8 +143,7 @@ public class ECDHKeyAgreementProcessorTest {
params.add(new KANonce("someBase64"));
processor.execute(publicCredential,
- JCAConstants.KEY_ALGO_AES,
- 128,
+ EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128,
params);
}
@@ -159,8 +157,7 @@ public class ECDHKeyAgreementProcessorTest {
params.add(new KANonce("someBase64"));
processor.execute(publicCredential,
- "INVALID",
- 128,
+ "urn:test:InvalidBlockEncryption",
params);
}
@@ -173,8 +170,7 @@ public class ECDHKeyAgreementProcessorTest {
params.add(new KANonce("someBase64"));
processor.execute(publicCredential,
- JCAConstants.KEY_ALGO_AES,
- 128,
+ EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128,
params);
}
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/MockKeyDerivation.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/MockKeyDerivation.java
index 61e4f6ae8..6050b3c06 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/MockKeyDerivation.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/derivation/impl/MockKeyDerivation.java
@@ -17,14 +17,12 @@
package org.opensaml.xmlsec.derivation.impl;
-import java.security.NoSuchAlgorithmException;
-import java.security.NoSuchProviderException;
-
import javax.crypto.SecretKey;
import org.opensaml.core.xml.XMLObject;
import org.opensaml.core.xml.util.XMLObjectSupport;
import org.opensaml.security.crypto.KeySupport;
+import org.opensaml.xmlsec.algorithm.AlgorithmSupport;
import org.opensaml.xmlsec.derivation.KeyDerivation;
import org.opensaml.xmlsec.derivation.KeyDerivationException;
import org.opensaml.xmlsec.encryption.KeyDerivationMethod;
@@ -47,10 +45,12 @@ public class MockKeyDerivation implements KeyDerivation {
}
/** {@inheritDoc} */
- public SecretKey derive(byte[] secret, String keyAlgorithm, Integer keyLength) throws KeyDerivationException {
+ public SecretKey derive(byte[] secret, String keyAlgorithm) throws KeyDerivationException {
try {
- return KeySupport.generateKey(keyAlgorithm, keyLength, null);
- } catch (NoSuchAlgorithmException | NoSuchProviderException e) {
+ String algo = AlgorithmSupport.getKeyAlgorithm(keyAlgorithm);
+ Integer length = AlgorithmSupport.getKeyLength(keyAlgorithm);
+ return KeySupport.generateKey(algo, length, null);
+ } catch (Exception e) {
throw new KeyDerivationException("Error generating mock derived key", e);
}
}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list