[java-opensaml] branch main updated: OSJ-372: Add support for newer signing and/or encryption algorithms
Brent Putman
putmanb at georgetown.edu
Fri Aug 4 03:02:48 UTC 2023
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch main
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=c46a6dc5cf0f3fb9487d447369746f3d89fd458b
The following commit(s) were added to refs/heads/main by this push:
new c46a6dc5c OSJ-372: Add support for newer signing and/or encryption algorithms
c46a6dc5c is described below
commit c46a6dc5cf0f3fb9487d447369746f3d89fd458b
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Thu Aug 3 02:26:35 2023 -0400
OSJ-372: Add support for newer signing and/or encryption algorithms
---
.../org/opensaml/security/crypto/JCAConstants.java | 37 ++++++
.../algorithm/descriptors/DigestSHA3_224.java | 43 ++++++
.../algorithm/descriptors/DigestSHA3_256.java | 43 ++++++
.../algorithm/descriptors/DigestSHA3_384.java | 43 ++++++
.../algorithm/descriptors/DigestSHA3_512.java | 43 ++++++
.../descriptors/SignatureRSASSA_PSS_SHA1_MGF1.java | 53 ++++++++
.../SignatureRSASSA_PSS_SHA224_MGF1.java | 53 ++++++++
.../SignatureRSASSA_PSS_SHA256_MGF1.java | 53 ++++++++
.../SignatureRSASSA_PSS_SHA384_MGF1.java | 53 ++++++++
.../SignatureRSASSA_PSS_SHA3_224_MGF1.java | 53 ++++++++
.../SignatureRSASSA_PSS_SHA3_256_MGF1.java | 53 ++++++++
.../SignatureRSASSA_PSS_SHA3_384_MGF1.java | 53 ++++++++
.../SignatureRSASSA_PSS_SHA3_512_MGF1.java | 53 ++++++++
.../SignatureRSASSA_PSS_SHA512_MGF1.java | 53 ++++++++
.../signature/support/SignatureConstants.java | 58 +++++++-
...g.opensaml.xmlsec.algorithm.AlgorithmDescriptor | 13 ++
.../algorithm/tests/AlgorithmDescriptorsTest.java | 98 ++++++++++++++
.../algorithm/tests/AlgorithmRegistryTest.java | 91 +++++++++++--
.../tests/EnvelopedSignatureRSASSA_PSSTest.java | 148 +++++++++++++++++++++
19 files changed, 1079 insertions(+), 15 deletions(-)
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/JCAConstants.java b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/JCAConstants.java
index 957beff5f..3c8830ee2 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/JCAConstants.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/JCAConstants.java
@@ -122,6 +122,17 @@ public final class JCAConstants {
/** Digest algorithm: "SHA-512". */
@Nonnull @NotEmpty public static final String DIGEST_SHA512 = "SHA-512";
+ /** Digest algorithm: "SHA-512". */
+ @Nonnull @NotEmpty public static final String DIGEST_SHA3_224 = "SHA3-224";
+
+ /** Digest algorithm: "SHA-512". */
+ @Nonnull @NotEmpty public static final String DIGEST_SHA3_256 = "SHA3-256";
+
+ /** Digest algorithm: "SHA-512". */
+ @Nonnull @NotEmpty public static final String DIGEST_SHA3_384 = "SHA3-384";
+
+ /** Digest algorithm: "SHA-512". */
+ @Nonnull @NotEmpty public static final String DIGEST_SHA3_512 = "SHA3-512";
// Signature types
@@ -171,6 +182,32 @@ public final class JCAConstants {
/** Signature algorithm: "SHA512withECDSA". */
@Nonnull @NotEmpty public static final String SIGNATURE_ECDSA_SHA512 = "SHA512withECDSA";
+ /** Signature algorithm: "SHA1withRSAandMGF1". */
+ @Nonnull @NotEmpty public static final String SIGNATURE_RSA_SHA1_MGF1= "SHA1withRSAandMGF1";
+
+ /** Signature algorithm: "SHA224withRSAandMGF1". */
+ @Nonnull @NotEmpty public static final String SIGNATURE_RSA_SHA224_MGF1= "SHA224withRSAandMGF1";
+
+ /** Signature algorithm: "SHA256withRSAandMGF1". */
+ @Nonnull @NotEmpty public static final String SIGNATURE_RSA_SHA256_MGF1 = "SHA256withRSAandMGF1";
+
+ /** Signature algorithm: "SHA384withRSAandMGF1". */
+ @Nonnull @NotEmpty public static final String SIGNATURE_RSA_SHA384_MGF1 = "SHA384withRSAandMGF1";
+
+ /** Signature algorithm: "SHA512withRSAandMGF1". */
+ @Nonnull @NotEmpty public static final String SIGNATURE_RSA_SHA512_MGF1= "SHA512withRSAandMGF1";
+
+ /** Signature algorithm: "SHA3-224withRSAandMGF1". */
+ @Nonnull @NotEmpty public static final String SIGNATURE_RSA_SHA3_224_MGF1 = "SHA3-224withRSAandMGF1";
+
+ /** Signature algorithm: "SHA3-256withRSAandMGF1". */
+ @Nonnull @NotEmpty public static final String SIGNATURE_RSA_SHA3_256_MGF1 = "SHA3-256withRSAandMGF1";
+
+ /** Signature algorithm: "SHA3-384withRSAandMGF1". */
+ @Nonnull @NotEmpty public static final String SIGNATURE_RSA_SHA3_384_MGF1 = "SHA3-384withRSAandMGF1";
+
+ /** Signature algorithm: "SHA3-512withRSAandMGF1". */
+ @Nonnull @NotEmpty public static final String SIGNATURE_RSA_SHA3_512_MGF1 = "SHA3-512withRSAandMGF1";
// MAC types
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/DigestSHA3_224.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/DigestSHA3_224.java
new file mode 100644
index 000000000..11028978a
--- /dev/null
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/DigestSHA3_224.java
@@ -0,0 +1,43 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.xmlsec.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.DigestAlgorithm;
+import org.opensaml.xmlsec.signature.support.SignatureConstants;
+
+/**
+ * Algorithm descriptor for digest algorithm: SHA3-224
+ */
+public final class DigestSHA3_224 implements DigestAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull public String getURI() {
+ return SignatureConstants.ALGO_ID_DIGEST_SHA3_224;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public AlgorithmType getType() {
+ return AlgorithmType.MessageDigest;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getJCAAlgorithmID() {
+ return JCAConstants.DIGEST_SHA3_224;
+ }
+
+}
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/DigestSHA3_256.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/DigestSHA3_256.java
new file mode 100644
index 000000000..60d060c63
--- /dev/null
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/DigestSHA3_256.java
@@ -0,0 +1,43 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.xmlsec.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.DigestAlgorithm;
+import org.opensaml.xmlsec.signature.support.SignatureConstants;
+
+/**
+ * Algorithm descriptor for digest algorithm: SHA3-256
+ */
+public final class DigestSHA3_256 implements DigestAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull public String getURI() {
+ return SignatureConstants.ALGO_ID_DIGEST_SHA3_256;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public AlgorithmType getType() {
+ return AlgorithmType.MessageDigest;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getJCAAlgorithmID() {
+ return JCAConstants.DIGEST_SHA3_256;
+ }
+
+}
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/DigestSHA3_384.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/DigestSHA3_384.java
new file mode 100644
index 000000000..7f38dd3fd
--- /dev/null
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/DigestSHA3_384.java
@@ -0,0 +1,43 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.xmlsec.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.DigestAlgorithm;
+import org.opensaml.xmlsec.signature.support.SignatureConstants;
+
+/**
+ * Algorithm descriptor for digest algorithm: SHA3-384
+ */
+public final class DigestSHA3_384 implements DigestAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull public String getURI() {
+ return SignatureConstants.ALGO_ID_DIGEST_SHA3_384;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public AlgorithmType getType() {
+ return AlgorithmType.MessageDigest;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getJCAAlgorithmID() {
+ return JCAConstants.DIGEST_SHA3_384;
+ }
+
+}
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/DigestSHA3_512.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/DigestSHA3_512.java
new file mode 100644
index 000000000..b7bed5760
--- /dev/null
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/DigestSHA3_512.java
@@ -0,0 +1,43 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.xmlsec.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.DigestAlgorithm;
+import org.opensaml.xmlsec.signature.support.SignatureConstants;
+
+/**
+ * Algorithm descriptor for digest algorithm: SHA3-512
+ */
+public final class DigestSHA3_512 implements DigestAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull public String getURI() {
+ return SignatureConstants.ALGO_ID_DIGEST_SHA3_512;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public AlgorithmType getType() {
+ return AlgorithmType.MessageDigest;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getJCAAlgorithmID() {
+ return JCAConstants.DIGEST_SHA3_512;
+ }
+
+}
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA1_MGF1.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA1_MGF1.java
new file mode 100644
index 000000000..d76273c45
--- /dev/null
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA1_MGF1.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.xmlsec.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.SignatureAlgorithm;
+import org.opensaml.xmlsec.signature.support.SignatureConstants;
+
+/**
+ * Algorithm descriptor for signature algorithm: RSASSA-PSS SHA-1 with MGF1.
+ */
+public final class SignatureRSASSA_PSS_SHA1_MGF1 implements SignatureAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull public String getKey() {
+ return JCAConstants.KEY_ALGO_RSA;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getURI() {
+ return SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA1_MGF1;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public AlgorithmType getType() {
+ return AlgorithmType.Signature;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getJCAAlgorithmID() {
+ return JCAConstants.SIGNATURE_RSA_SHA1_MGF1;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getDigest() {
+ return JCAConstants.DIGEST_SHA1;
+ }
+
+}
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA224_MGF1.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA224_MGF1.java
new file mode 100644
index 000000000..fc078858a
--- /dev/null
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA224_MGF1.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.xmlsec.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.SignatureAlgorithm;
+import org.opensaml.xmlsec.signature.support.SignatureConstants;
+
+/**
+ * Algorithm descriptor for signature algorithm: RSASSA-PSS SHA-224 with MGF1.
+ */
+public final class SignatureRSASSA_PSS_SHA224_MGF1 implements SignatureAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull public String getKey() {
+ return JCAConstants.KEY_ALGO_RSA;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getURI() {
+ return SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA224_MGF1;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public AlgorithmType getType() {
+ return AlgorithmType.Signature;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getJCAAlgorithmID() {
+ return JCAConstants.SIGNATURE_RSA_SHA224_MGF1;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getDigest() {
+ return JCAConstants.DIGEST_SHA224;
+ }
+
+}
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA256_MGF1.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA256_MGF1.java
new file mode 100644
index 000000000..af559be40
--- /dev/null
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA256_MGF1.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.xmlsec.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.SignatureAlgorithm;
+import org.opensaml.xmlsec.signature.support.SignatureConstants;
+
+/**
+ * Algorithm descriptor for signature algorithm: RSASSA-PSS SHA-256 with MGF1.
+ */
+public final class SignatureRSASSA_PSS_SHA256_MGF1 implements SignatureAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull public String getKey() {
+ return JCAConstants.KEY_ALGO_RSA;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getURI() {
+ return SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA256_MGF1;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public AlgorithmType getType() {
+ return AlgorithmType.Signature;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getJCAAlgorithmID() {
+ return JCAConstants.SIGNATURE_RSA_SHA256_MGF1;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getDigest() {
+ return JCAConstants.DIGEST_SHA256;
+ }
+
+}
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA384_MGF1.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA384_MGF1.java
new file mode 100644
index 000000000..b3537e66c
--- /dev/null
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA384_MGF1.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.xmlsec.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.SignatureAlgorithm;
+import org.opensaml.xmlsec.signature.support.SignatureConstants;
+
+/**
+ * Algorithm descriptor for signature algorithm: RSASSA-PSS SHA-384 with MGF1.
+ */
+public final class SignatureRSASSA_PSS_SHA384_MGF1 implements SignatureAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull public String getKey() {
+ return JCAConstants.KEY_ALGO_RSA;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getURI() {
+ return SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA384_MGF1;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public AlgorithmType getType() {
+ return AlgorithmType.Signature;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getJCAAlgorithmID() {
+ return JCAConstants.SIGNATURE_RSA_SHA384_MGF1;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getDigest() {
+ return JCAConstants.DIGEST_SHA384;
+ }
+
+}
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_224_MGF1.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_224_MGF1.java
new file mode 100644
index 000000000..124ee777a
--- /dev/null
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_224_MGF1.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.xmlsec.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.SignatureAlgorithm;
+import org.opensaml.xmlsec.signature.support.SignatureConstants;
+
+/**
+ * Algorithm descriptor for signature algorithm: RSASSA-PSS SHA3-224 with MGF1.
+ */
+public final class SignatureRSASSA_PSS_SHA3_224_MGF1 implements SignatureAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull public String getKey() {
+ return JCAConstants.KEY_ALGO_RSA;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getURI() {
+ return SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_224_MGF1;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public AlgorithmType getType() {
+ return AlgorithmType.Signature;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getJCAAlgorithmID() {
+ return JCAConstants.SIGNATURE_RSA_SHA3_224_MGF1;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getDigest() {
+ return JCAConstants.DIGEST_SHA3_224;
+ }
+
+}
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_256_MGF1.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_256_MGF1.java
new file mode 100644
index 000000000..2f1b25bdd
--- /dev/null
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_256_MGF1.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.xmlsec.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.SignatureAlgorithm;
+import org.opensaml.xmlsec.signature.support.SignatureConstants;
+
+/**
+ * Algorithm descriptor for signature algorithm: RSASSA-PSS SHA3-256 with MGF1.
+ */
+public final class SignatureRSASSA_PSS_SHA3_256_MGF1 implements SignatureAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull public String getKey() {
+ return JCAConstants.KEY_ALGO_RSA;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getURI() {
+ return SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_256_MGF1;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public AlgorithmType getType() {
+ return AlgorithmType.Signature;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getJCAAlgorithmID() {
+ return JCAConstants.SIGNATURE_RSA_SHA3_256_MGF1;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getDigest() {
+ return JCAConstants.DIGEST_SHA3_256;
+ }
+
+}
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_384_MGF1.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_384_MGF1.java
new file mode 100644
index 000000000..62e3a1aa1
--- /dev/null
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_384_MGF1.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.xmlsec.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.SignatureAlgorithm;
+import org.opensaml.xmlsec.signature.support.SignatureConstants;
+
+/**
+ * Algorithm descriptor for signature algorithm: RSASSA-PSS SHA3-384 with MGF1.
+ */
+public final class SignatureRSASSA_PSS_SHA3_384_MGF1 implements SignatureAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull public String getKey() {
+ return JCAConstants.KEY_ALGO_RSA;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getURI() {
+ return SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_384_MGF1;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public AlgorithmType getType() {
+ return AlgorithmType.Signature;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getJCAAlgorithmID() {
+ return JCAConstants.SIGNATURE_RSA_SHA3_384_MGF1;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getDigest() {
+ return JCAConstants.DIGEST_SHA3_384;
+ }
+
+}
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_512_MGF1.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_512_MGF1.java
new file mode 100644
index 000000000..4037931da
--- /dev/null
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_512_MGF1.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.xmlsec.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.SignatureAlgorithm;
+import org.opensaml.xmlsec.signature.support.SignatureConstants;
+
+/**
+ * Algorithm descriptor for signature algorithm: RSASSA-PSS SHA3-512 with MGF1.
+ */
+public final class SignatureRSASSA_PSS_SHA3_512_MGF1 implements SignatureAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull public String getKey() {
+ return JCAConstants.KEY_ALGO_RSA;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getURI() {
+ return SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_512_MGF1;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public AlgorithmType getType() {
+ return AlgorithmType.Signature;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getJCAAlgorithmID() {
+ return JCAConstants.SIGNATURE_RSA_SHA3_512_MGF1;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getDigest() {
+ return JCAConstants.DIGEST_SHA3_512;
+ }
+
+}
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA512_MGF1.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA512_MGF1.java
new file mode 100644
index 000000000..f4ae8e5b9
--- /dev/null
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA512_MGF1.java
@@ -0,0 +1,53 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.xmlsec.algorithm.descriptors;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.security.crypto.JCAConstants;
+import org.opensaml.xmlsec.algorithm.SignatureAlgorithm;
+import org.opensaml.xmlsec.signature.support.SignatureConstants;
+
+/**
+ * Algorithm descriptor for signature algorithm: RSASSA-PSS SHA-512 with MGF1.
+ */
+public final class SignatureRSASSA_PSS_SHA512_MGF1 implements SignatureAlgorithm {
+
+ /** {@inheritDoc} */
+ @Nonnull public String getKey() {
+ return JCAConstants.KEY_ALGO_RSA;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getURI() {
+ return SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA512_MGF1;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public AlgorithmType getType() {
+ return AlgorithmType.Signature;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getJCAAlgorithmID() {
+ return JCAConstants.SIGNATURE_RSA_SHA512_MGF1;
+ }
+
+ /** {@inheritDoc} */
+ @Nonnull public String getDigest() {
+ return JCAConstants.DIGEST_SHA512;
+ }
+
+}
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignatureConstants.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignatureConstants.java
index 329f55f9e..b0aee92f4 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignatureConstants.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/signature/support/SignatureConstants.java
@@ -41,6 +41,9 @@ public final class SignatureConstants {
/** Algorithm URI prefix used by RFC 4051. */
@Nonnull @NotEmpty public static final String MORE_ALGO_NS = "http://www.w3.org/2001/04/xmldsig-more#";
+ /** Algorithm URI prefix used by RFC 4051 and RFC 9231. */
+ @Nonnull @NotEmpty public static final String MORE_ALGO_2007_05_NS = "http://www.w3.org/2007/05/xmldsig-more#";
+
// *********************************************************
// Algorithm URI's
// *********************************************************
@@ -208,9 +211,9 @@ public final class SignatureConstants {
* "http://www.w3.org/2002/06/xmldsig-filter2";
*/
- // *********************************************************
- // Some additional algorithm URIs from RFC 4051
- // *********************************************************
+ // ************************************************************
+ // Some additional algorithm URIs from RFC 4051 and RFC 9231
+ // ************************************************************
/** Signature - NOT Recommended RSAwithMD5. */
@Nonnull @NotEmpty public static final String ALGO_ID_SIGNATURE_NOT_RECOMMENDED_RSA_MD5 = MORE_ALGO_NS + "rsa-md5";
@@ -270,6 +273,55 @@ public final class SignatureConstants {
/** Digest - Optional SHA384. */
@Nonnull @NotEmpty public static final String ALGO_ID_DIGEST_SHA384 = MORE_ALGO_NS + "sha384";
+
+ /** Digest - Optional SHA-3 224. */
+ @Nonnull @NotEmpty public static final String ALGO_ID_DIGEST_SHA3_224 = MORE_ALGO_2007_05_NS + "sha3-224";
+
+ /** Digest - Optional SHA-3 256. */
+ @Nonnull @NotEmpty public static final String ALGO_ID_DIGEST_SHA3_256 = MORE_ALGO_2007_05_NS + "sha3-256";
+
+ /** Digest - Optional SHA-3 384. */
+ @Nonnull @NotEmpty public static final String ALGO_ID_DIGEST_SHA3_384 = MORE_ALGO_2007_05_NS + "sha3-384";
+
+ /** Digest - Optional SHA-3 512. */
+ @Nonnull @NotEmpty public static final String ALGO_ID_DIGEST_SHA3_512 = MORE_ALGO_2007_05_NS + "sha3-512";
+
+ /** Signature - Optional RSASSA-PSS with SHA1 and MGF1. */
+ @Nonnull @NotEmpty public static final String ALGO_ID_SIGNATURE_RSASSA_PSS_SHA1_MGF1 =
+ MORE_ALGO_2007_05_NS + "sha1-rsa-MGF1";
+
+ /** Signature - Optional RSASSA-PSS with SHA-224 and MGF1. */
+ @Nonnull @NotEmpty public static final String ALGO_ID_SIGNATURE_RSASSA_PSS_SHA224_MGF1 =
+ MORE_ALGO_2007_05_NS + "sha224-rsa-MGF1";
+
+ /** Signature - Optional RSASSA-PSS with SHA-256 and MGF1. */
+ @Nonnull @NotEmpty public static final String ALGO_ID_SIGNATURE_RSASSA_PSS_SHA256_MGF1 =
+ MORE_ALGO_2007_05_NS + "sha256-rsa-MGF1";
+
+ /** Signature - Optional RSASSA-PSS with SHA-384 and MGF1. */
+ @Nonnull @NotEmpty public static final String ALGO_ID_SIGNATURE_RSASSA_PSS_SHA384_MGF1 =
+ MORE_ALGO_2007_05_NS + "sha384-rsa-MGF1";
+
+ /** Signature - Optional RSASSA-PSS with SHA-512 and MGF1. */
+ @Nonnull @NotEmpty public static final String ALGO_ID_SIGNATURE_RSASSA_PSS_SHA512_MGF1 =
+ MORE_ALGO_2007_05_NS + "sha512-rsa-MGF1";
+
+ /** Signature - Optional RSASSA-PSS with SHA3-224 and MGF1. */
+ @Nonnull @NotEmpty public static final String ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_224_MGF1 =
+ MORE_ALGO_2007_05_NS + "sha3-224-rsa-MGF1";
+
+ /** Signature - Optional RSASSA-PSS with SHA3-256 and MGF1. */
+ @Nonnull @NotEmpty public static final String ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_256_MGF1 =
+ MORE_ALGO_2007_05_NS + "sha3-256-rsa-MGF1";
+
+ /** Signature - Optional RSASSA-PSS with SHA3-384 and MGF1. */
+ @Nonnull @NotEmpty public static final String ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_384_MGF1 =
+ MORE_ALGO_2007_05_NS + "sha3-384-rsa-MGF1";
+
+ /** Signature - Optional RSASSA-PSS with SHA3-512 and MGF1. */
+ @Nonnull @NotEmpty public static final String ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_512_MGF1 =
+ MORE_ALGO_2007_05_NS + "sha3-512-rsa-MGF1";
+
// *********************************************************
// Some additional algorithm URIs from XML Signature 1.1
diff --git a/opensaml-xmlsec-api/src/main/resources/META-INF/services/org.opensaml.xmlsec.algorithm.AlgorithmDescriptor b/opensaml-xmlsec-api/src/main/resources/META-INF/services/org.opensaml.xmlsec.algorithm.AlgorithmDescriptor
index 7c2ea2a40..76207f533 100644
--- a/opensaml-xmlsec-api/src/main/resources/META-INF/services/org.opensaml.xmlsec.algorithm.AlgorithmDescriptor
+++ b/opensaml-xmlsec-api/src/main/resources/META-INF/services/org.opensaml.xmlsec.algorithm.AlgorithmDescriptor
@@ -12,6 +12,10 @@ org.opensaml.xmlsec.algorithm.descriptors.DigestSHA224
org.opensaml.xmlsec.algorithm.descriptors.DigestSHA256
org.opensaml.xmlsec.algorithm.descriptors.DigestSHA384
org.opensaml.xmlsec.algorithm.descriptors.DigestSHA512
+org.opensaml.xmlsec.algorithm.descriptors.DigestSHA3_224
+org.opensaml.xmlsec.algorithm.descriptors.DigestSHA3_256
+org.opensaml.xmlsec.algorithm.descriptors.DigestSHA3_384
+org.opensaml.xmlsec.algorithm.descriptors.DigestSHA3_512
org.opensaml.xmlsec.algorithm.descriptors.HMACMD5
org.opensaml.xmlsec.algorithm.descriptors.HMACRIPEMD160
org.opensaml.xmlsec.algorithm.descriptors.HMACSHA1
@@ -39,6 +43,15 @@ org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASHA224
org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASHA256
org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASHA384
org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASHA512
+org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASSA_PSS_SHA1_MGF1
+org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASSA_PSS_SHA224_MGF1
+org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASSA_PSS_SHA256_MGF1
+org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASSA_PSS_SHA384_MGF1
+org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASSA_PSS_SHA3_224_MGF1
+org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASSA_PSS_SHA3_256_MGF1
+org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASSA_PSS_SHA3_384_MGF1
+org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASSA_PSS_SHA3_512_MGF1
+org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASSA_PSS_SHA512_MGF1
org.opensaml.xmlsec.algorithm.descriptors.SymmetricKeyWrapAES128
org.opensaml.xmlsec.algorithm.descriptors.SymmetricKeyWrapAES192
org.opensaml.xmlsec.algorithm.descriptors.SymmetricKeyWrapAES256
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmDescriptorsTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmDescriptorsTest.java
index abb71897c..73167ed08 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmDescriptorsTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmDescriptorsTest.java
@@ -36,6 +36,10 @@ import org.opensaml.xmlsec.algorithm.descriptors.DigestSHA1;
import org.opensaml.xmlsec.algorithm.descriptors.DigestSHA224;
import org.opensaml.xmlsec.algorithm.descriptors.DigestSHA256;
import org.opensaml.xmlsec.algorithm.descriptors.DigestSHA384;
+import org.opensaml.xmlsec.algorithm.descriptors.DigestSHA3_224;
+import org.opensaml.xmlsec.algorithm.descriptors.DigestSHA3_256;
+import org.opensaml.xmlsec.algorithm.descriptors.DigestSHA3_384;
+import org.opensaml.xmlsec.algorithm.descriptors.DigestSHA3_512;
import org.opensaml.xmlsec.algorithm.descriptors.DigestSHA512;
import org.opensaml.xmlsec.algorithm.descriptors.HMACMD5;
import org.opensaml.xmlsec.algorithm.descriptors.HMACRIPEMD160;
@@ -64,6 +68,15 @@ import org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASHA224;
import org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASHA256;
import org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASHA384;
import org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASHA512;
+import org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASSA_PSS_SHA1_MGF1;
+import org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASSA_PSS_SHA224_MGF1;
+import org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASSA_PSS_SHA256_MGF1;
+import org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASSA_PSS_SHA384_MGF1;
+import org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASSA_PSS_SHA3_224_MGF1;
+import org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASSA_PSS_SHA3_256_MGF1;
+import org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASSA_PSS_SHA3_384_MGF1;
+import org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASSA_PSS_SHA3_512_MGF1;
+import org.opensaml.xmlsec.algorithm.descriptors.SignatureRSASSA_PSS_SHA512_MGF1;
import org.opensaml.xmlsec.algorithm.descriptors.SymmetricKeyWrapAES128;
import org.opensaml.xmlsec.algorithm.descriptors.SymmetricKeyWrapAES192;
import org.opensaml.xmlsec.algorithm.descriptors.SymmetricKeyWrapAES256;
@@ -184,6 +197,28 @@ public class AlgorithmDescriptorsTest {
Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.DIGEST_SHA512);
Assert.assertEquals(descriptor.getURI(), SignatureConstants.ALGO_ID_DIGEST_SHA512);
Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.MessageDigest);
+
+ descriptor = new DigestSHA3_224();
+ Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.DIGEST_SHA3_224);
+ Assert.assertEquals(descriptor.getURI(), SignatureConstants.ALGO_ID_DIGEST_SHA3_224);
+ Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.MessageDigest);
+
+ descriptor = new DigestSHA3_256();
+ Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.DIGEST_SHA3_256);
+ Assert.assertEquals(descriptor.getURI(), SignatureConstants.ALGO_ID_DIGEST_SHA3_256);
+ Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.MessageDigest);
+
+ descriptor = new DigestSHA3_384();
+ Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.DIGEST_SHA3_384);
+ Assert.assertEquals(descriptor.getURI(), SignatureConstants.ALGO_ID_DIGEST_SHA3_384);
+ Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.MessageDigest);
+
+ descriptor = new DigestSHA3_512();
+ Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.DIGEST_SHA3_512);
+ Assert.assertEquals(descriptor.getURI(), SignatureConstants.ALGO_ID_DIGEST_SHA3_512);
+ Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.MessageDigest);
+
+
}
// HMAC
@@ -388,6 +423,69 @@ public class AlgorithmDescriptorsTest {
Assert.assertEquals(descriptor.getKey(), JCAConstants.KEY_ALGO_RSA);
Assert.assertEquals(descriptor.getURI(), SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA512);
Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.Signature);
+
+ descriptor = new SignatureRSASSA_PSS_SHA1_MGF1();
+ Assert.assertEquals(descriptor.getDigest(), JCAConstants.DIGEST_SHA1);
+ Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SHA1_MGF1);
+ Assert.assertEquals(descriptor.getKey(), JCAConstants.KEY_ALGO_RSA);
+ Assert.assertEquals(descriptor.getURI(), SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA1_MGF1);
+ Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.Signature);
+
+ descriptor = new SignatureRSASSA_PSS_SHA224_MGF1();
+ Assert.assertEquals(descriptor.getDigest(), JCAConstants.DIGEST_SHA224);
+ Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SHA224_MGF1);
+ Assert.assertEquals(descriptor.getKey(), JCAConstants.KEY_ALGO_RSA);
+ Assert.assertEquals(descriptor.getURI(), SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA224_MGF1);
+ Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.Signature);
+
+ descriptor = new SignatureRSASSA_PSS_SHA256_MGF1();
+ Assert.assertEquals(descriptor.getDigest(), JCAConstants.DIGEST_SHA256);
+ Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SHA256_MGF1);
+ Assert.assertEquals(descriptor.getKey(), JCAConstants.KEY_ALGO_RSA);
+ Assert.assertEquals(descriptor.getURI(), SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA256_MGF1);
+ Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.Signature);
+
+ descriptor = new SignatureRSASSA_PSS_SHA384_MGF1();
+ Assert.assertEquals(descriptor.getDigest(), JCAConstants.DIGEST_SHA384);
+ Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SHA384_MGF1);
+ Assert.assertEquals(descriptor.getKey(), JCAConstants.KEY_ALGO_RSA);
+ Assert.assertEquals(descriptor.getURI(), SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA384_MGF1);
+ Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.Signature);
+
+ descriptor = new SignatureRSASSA_PSS_SHA512_MGF1();
+ Assert.assertEquals(descriptor.getDigest(), JCAConstants.DIGEST_SHA512);
+ Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SHA512_MGF1);
+ Assert.assertEquals(descriptor.getKey(), JCAConstants.KEY_ALGO_RSA);
+ Assert.assertEquals(descriptor.getURI(), SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA512_MGF1);
+ Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.Signature);
+
+ descriptor = new SignatureRSASSA_PSS_SHA3_224_MGF1();
+ Assert.assertEquals(descriptor.getDigest(), JCAConstants.DIGEST_SHA3_224);
+ Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SHA3_224_MGF1);
+ Assert.assertEquals(descriptor.getKey(), JCAConstants.KEY_ALGO_RSA);
+ Assert.assertEquals(descriptor.getURI(), SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_224_MGF1);
+ Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.Signature);
+
+ descriptor = new SignatureRSASSA_PSS_SHA3_256_MGF1();
+ Assert.assertEquals(descriptor.getDigest(), JCAConstants.DIGEST_SHA3_256);
+ Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SHA3_256_MGF1);
+ Assert.assertEquals(descriptor.getKey(), JCAConstants.KEY_ALGO_RSA);
+ Assert.assertEquals(descriptor.getURI(), SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_256_MGF1);
+ Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.Signature);
+
+ descriptor = new SignatureRSASSA_PSS_SHA3_384_MGF1();
+ Assert.assertEquals(descriptor.getDigest(), JCAConstants.DIGEST_SHA3_384);
+ Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SHA3_384_MGF1);
+ Assert.assertEquals(descriptor.getKey(), JCAConstants.KEY_ALGO_RSA);
+ Assert.assertEquals(descriptor.getURI(), SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_384_MGF1);
+ Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.Signature);
+
+ descriptor = new SignatureRSASSA_PSS_SHA3_512_MGF1();
+ Assert.assertEquals(descriptor.getDigest(), JCAConstants.DIGEST_SHA3_512);
+ Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SHA3_512_MGF1);
+ Assert.assertEquals(descriptor.getKey(), JCAConstants.KEY_ALGO_RSA);
+ Assert.assertEquals(descriptor.getURI(), SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_512_MGF1);
+ Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.Signature);
}
// SymmetricKeyWrap
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmRegistryTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmRegistryTest.java
index 77367e8da..c126e2c73 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmRegistryTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmRegistryTest.java
@@ -152,6 +152,10 @@ public class AlgorithmRegistryTest extends OpenSAMLInitBaseTestCase {
Assert.assertNotNull(registry.get(SignatureConstants.ALGO_ID_DIGEST_SHA256));
Assert.assertNotNull(registry.get(SignatureConstants.ALGO_ID_DIGEST_SHA384));
Assert.assertNotNull(registry.get(SignatureConstants.ALGO_ID_DIGEST_SHA512));
+ Assert.assertNotNull(registry.get(SignatureConstants.ALGO_ID_DIGEST_SHA3_224));
+ Assert.assertNotNull(registry.get(SignatureConstants.ALGO_ID_DIGEST_SHA3_256));
+ Assert.assertNotNull(registry.get(SignatureConstants.ALGO_ID_DIGEST_SHA3_384));
+ Assert.assertNotNull(registry.get(SignatureConstants.ALGO_ID_DIGEST_SHA3_512));
// HMAC
Assert.assertNotNull(registry.get(SignatureConstants.ALGO_ID_MAC_HMAC_NOT_RECOMMENDED_MD5));
@@ -187,6 +191,15 @@ public class AlgorithmRegistryTest extends OpenSAMLInitBaseTestCase {
Assert.assertNotNull(registry.get(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256));
Assert.assertNotNull(registry.get(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA384));
Assert.assertNotNull(registry.get(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA512));
+ Assert.assertNotNull(registry.get(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA1_MGF1));
+ Assert.assertNotNull(registry.get(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA224_MGF1));
+ Assert.assertNotNull(registry.get(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA256_MGF1));
+ Assert.assertNotNull(registry.get(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA384_MGF1));
+ Assert.assertNotNull(registry.get(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA512_MGF1));
+ Assert.assertNotNull(registry.get(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_224_MGF1));
+ Assert.assertNotNull(registry.get(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_256_MGF1));
+ Assert.assertNotNull(registry.get(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_384_MGF1));
+ Assert.assertNotNull(registry.get(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_512_MGF1));
// SymmetricKeyWrap
Assert.assertNotNull(registry.get(EncryptionConstants.ALGO_ID_KEYWRAP_AES128));
@@ -224,6 +237,10 @@ public class AlgorithmRegistryTest extends OpenSAMLInitBaseTestCase {
Assert.assertTrue(byType.contains(SignatureConstants.ALGO_ID_DIGEST_SHA256));
Assert.assertTrue(byType.contains(SignatureConstants.ALGO_ID_DIGEST_SHA384));
Assert.assertTrue(byType.contains(SignatureConstants.ALGO_ID_DIGEST_SHA512));
+ Assert.assertTrue(byType.contains(SignatureConstants.ALGO_ID_DIGEST_SHA3_224));
+ Assert.assertTrue(byType.contains(SignatureConstants.ALGO_ID_DIGEST_SHA3_256));
+ Assert.assertTrue(byType.contains(SignatureConstants.ALGO_ID_DIGEST_SHA3_384));
+ Assert.assertTrue(byType.contains(SignatureConstants.ALGO_ID_DIGEST_SHA3_512));
Assert.assertEquals(registry.getRegisteredByType(AlgorithmType.MessageDigest).stream().filter(Objects::nonNull).count(), byType.size());
// HMAC
@@ -267,6 +284,15 @@ public class AlgorithmRegistryTest extends OpenSAMLInitBaseTestCase {
Assert.assertTrue(byType.contains(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA256));
Assert.assertTrue(byType.contains(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA384));
Assert.assertTrue(byType.contains(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA512));
+ Assert.assertTrue(byType.contains(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA1_MGF1));
+ Assert.assertTrue(byType.contains(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA224_MGF1));
+ Assert.assertTrue(byType.contains(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA256_MGF1));
+ Assert.assertTrue(byType.contains(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA384_MGF1));
+ Assert.assertTrue(byType.contains(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA512_MGF1));
+ Assert.assertTrue(byType.contains(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_224_MGF1));
+ Assert.assertTrue(byType.contains(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_256_MGF1));
+ Assert.assertTrue(byType.contains(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_384_MGF1));
+ Assert.assertTrue(byType.contains(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_512_MGF1));
Assert.assertEquals(registry.getRegisteredByType(AlgorithmType.Signature).stream().filter(Objects::nonNull).count(), byType.size());
// SymmetricKeyWrap
@@ -339,8 +365,28 @@ public class AlgorithmRegistryTest extends OpenSAMLInitBaseTestCase {
Assert.assertTrue(registry.isRuntimeSupported(EncryptionConstants.ALGO_ID_KEYWRAP_AES256));
Assert.assertTrue(registry.isRuntimeSupported(EncryptionConstants.ALGO_ID_KEYWRAP_TRIPLEDES));
+ // These added by later versions of Java
+
+ Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_DIGEST_SHA224));
+ Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA224));
+ Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_MAC_HMAC_SHA224));
+
+ Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_DSA_SHA256));
+
+ Assert.assertTrue(registry.isRuntimeSupported(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128_GCM));
+ Assert.assertTrue(registry.isRuntimeSupported(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES192_GCM));
+ Assert.assertTrue(registry.isRuntimeSupported(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256_GCM));
+
+ Assert.assertTrue(registry.isRuntimeSupported(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP11));
+
+ Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_DIGEST_SHA3_224));
+ Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_DIGEST_SHA3_256));
+ Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_DIGEST_SHA3_384));
+ Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_DIGEST_SHA3_512));
+
// Conditional environment tests
+ // Elliptic-Curve
if (providerSupport.haveSunEC() || providerSupport.haveBC()) {
Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA1));
Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_ECDSA_SHA256));
@@ -358,18 +404,7 @@ public class AlgorithmRegistryTest extends OpenSAMLInitBaseTestCase {
Assert.assertFalse(registry.isRuntimeSupported(EncryptionConstants.ALGO_ID_KEYAGREEMENT_ECDH_ES));
}
- Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_DIGEST_SHA224));
- Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSA_SHA224));
- Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_MAC_HMAC_SHA224));
-
- Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_DSA_SHA256));
-
- Assert.assertTrue(registry.isRuntimeSupported(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES128_GCM));
- Assert.assertTrue(registry.isRuntimeSupported(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES192_GCM));
- Assert.assertTrue(registry.isRuntimeSupported(EncryptionConstants.ALGO_ID_BLOCKCIPHER_AES256_GCM));
-
- Assert.assertTrue(registry.isRuntimeSupported(EncryptionConstants.ALGO_ID_KEYTRANSPORT_RSAOAEP11));
-
+ // RIPE
if (providerSupport.haveBC()) {
Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_DIGEST_RIPEMD160));
Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_MAC_HMAC_RIPEMD160));
@@ -379,6 +414,38 @@ public class AlgorithmRegistryTest extends OpenSAMLInitBaseTestCase {
Assert.assertFalse(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_MAC_HMAC_RIPEMD160));
Assert.assertFalse(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSA_RIPEMD160));
}
+
+ // RSASSA-PSA SHA-2
+ // According to the Java 17 security providers docs, these RSASSA-PSA SHA-2 variants are supposed to be
+ // supported by that version of the SunRsaSign provider. But in reality they appear to currently be unsupported.
+ // Confirmed by iterating the java.security.Security Providers. Brent 2023-08-03.
+ if (providerSupport.haveBC()) {
+ Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA1_MGF1));
+ Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA224_MGF1));
+ Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA256_MGF1));
+ Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA384_MGF1));
+ Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA512_MGF1));
+ } else {
+ Assert.assertFalse(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA1_MGF1));
+ Assert.assertFalse(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA224_MGF1));
+ Assert.assertFalse(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA256_MGF1));
+ Assert.assertFalse(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA384_MGF1));
+ Assert.assertFalse(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA512_MGF1));
+ }
+
+ // RSASSA-PSA SHA-3
+ if (providerSupport.haveBC()) {
+ Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_224_MGF1));
+ Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_256_MGF1));
+ Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_384_MGF1));
+ Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_512_MGF1));
+ } else {
+ Assert.assertFalse(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_224_MGF1));
+ Assert.assertFalse(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_256_MGF1));
+ Assert.assertFalse(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_384_MGF1));
+ Assert.assertFalse(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_512_MGF1));
+ }
+
} finally {
providerSupport.unloadBC();
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/EnvelopedSignatureRSASSA_PSSTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/EnvelopedSignatureRSASSA_PSSTest.java
new file mode 100644
index 000000000..3513cb308
--- /dev/null
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/EnvelopedSignatureRSASSA_PSSTest.java
@@ -0,0 +1,148 @@
+/*
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.opensaml.xmlsec.signature.support.tests;
+
+import java.security.KeyPair;
+
+import javax.annotation.Nonnull;
+
+import org.opensaml.core.testing.XMLObjectBaseTestCase;
+import org.opensaml.core.xml.XMLObjectBuilder;
+import org.opensaml.core.xml.config.XMLObjectProviderRegistrySupport;
+import org.opensaml.core.xml.io.Marshaller;
+import org.opensaml.core.xml.io.MarshallingException;
+import org.opensaml.security.credential.Credential;
+import org.opensaml.security.credential.CredentialSupport;
+import org.opensaml.security.crypto.KeySupport;
+import org.opensaml.security.testing.SecurityProviderTestSupport;
+import org.opensaml.xmlsec.mock.SignableSimpleXMLObject;
+import org.opensaml.xmlsec.mock.SignableSimpleXMLObjectBuilder;
+import org.opensaml.xmlsec.signature.Signature;
+import org.opensaml.xmlsec.signature.support.DocumentInternalIDContentReference;
+import org.opensaml.xmlsec.signature.support.SignatureConstants;
+import org.opensaml.xmlsec.signature.support.SignatureException;
+import org.opensaml.xmlsec.signature.support.SignatureValidator;
+import org.opensaml.xmlsec.signature.support.Signer;
+import org.slf4j.Logger;
+import org.testng.Assert;
+import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.Test;
+import org.w3c.dom.Element;
+
+import jakarta.xml.bind.ValidationException;
+import net.shibboleth.shared.primitive.LoggerFactory;
+import net.shibboleth.shared.xml.SerializeSupport;
+
+/**
+ * Test to verify {@link org.opensaml.xmlsec.signature.Signature} and its marshallers and unmarshallers.
+ */
+ at SuppressWarnings({"javadoc", "null"})
+public class EnvelopedSignatureRSASSA_PSSTest extends XMLObjectBaseTestCase {
+
+ /** Class logger. */
+ @Nonnull private final Logger log = LoggerFactory.getLogger(EnvelopedSignatureRSASSA_PSSTest.class);
+
+ /** Credential used to sign and verify. */
+ private Credential goodCredential;
+
+ /** Invalid credential for verification. */
+ private Credential badCredential;
+
+ /** Builder of mock XML objects. */
+ private SignableSimpleXMLObjectBuilder sxoBuilder;
+
+ /** Builder of Signature XML objects. */
+ private XMLObjectBuilder<Signature> sigBuilder;
+
+ /** Signature algorithm URI. */
+ private String algoURI = SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA256_MGF1;
+
+ @BeforeMethod
+ protected void setUp() throws Exception {
+ KeyPair keyPair = KeySupport.generateKeyPair("RSA", 2048, null);
+ goodCredential = CredentialSupport.getSimpleCredential(keyPair.getPublic(), keyPair.getPrivate());
+
+ keyPair = KeySupport.generateKeyPair("RSA", 2048, null);
+ badCredential = CredentialSupport.getSimpleCredential(keyPair.getPublic(), null);
+
+ sxoBuilder = new SignableSimpleXMLObjectBuilder();
+ sigBuilder = XMLObjectProviderRegistrySupport.getBuilderFactory().<Signature>ensureBuilder(
+ Signature.DEFAULT_ELEMENT_NAME);
+ }
+
+ /**
+ * Tests creating an enveloped signature and then verifying it.
+ *
+ * @throws MarshallingException thrown if the XMLObject tree can not be marshalled
+ * @throws ValidationException ...
+ * @throws SignatureException ...
+ */
+ @Test
+ public void testSigningAndVerification() throws MarshallingException, ValidationException, SignatureException {
+ // BC is currently necessary for the RSASSA-PSS SHA-2 algos, even though it shouldn't be.
+ final SecurityProviderTestSupport providerSupport = new SecurityProviderTestSupport();
+ try {
+ providerSupport.loadBC();
+
+ SignableSimpleXMLObject sxo = getXMLObjectWithSignature();
+ Signature signature = sxo.getSignature();
+
+ Marshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().ensureMarshaller(sxo);
+ Element signedElement = marshaller.marshall(sxo);
+
+ assert signature != null;
+ Signer.signObject(signature);
+
+ if (log.isDebugEnabled()) {
+ log.debug("Marshalled Signature: \n" + SerializeSupport.nodeToString(signedElement));
+ }
+
+ SignatureValidator.validate(signature, goodCredential);
+
+ try {
+ SignatureValidator.validate(signature, badCredential);
+ Assert.fail("Validated signature with improper public key");
+ } catch (SignatureException e) {
+ // expected
+ }
+ } finally {
+ providerSupport.unloadBC();
+ }
+ }
+
+ /**
+ * Creates a XMLObject that has a Signature child element.
+ *
+ * @return a XMLObject that has a Signature child element
+ */
+ private SignableSimpleXMLObject getXMLObjectWithSignature() {
+ SignableSimpleXMLObject sxo = sxoBuilder.buildObject();
+ sxo.setId("FOO");
+
+ Signature sig = sigBuilder.buildObject(Signature.DEFAULT_ELEMENT_NAME);
+ sig.setSigningCredential(goodCredential);
+ sig.setCanonicalizationAlgorithm(SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS);
+ sig.setSignatureAlgorithm(algoURI);
+
+ DocumentInternalIDContentReference contentReference = new DocumentInternalIDContentReference("FOO");
+ contentReference.getTransforms().add(SignatureConstants.TRANSFORM_ENVELOPED_SIGNATURE);
+ contentReference.getTransforms().add(SignatureConstants.TRANSFORM_C14N_EXCL_OMIT_COMMENTS);
+ contentReference.setDigestAlgorithm(SignatureConstants.ALGO_ID_DIGEST_SHA256);
+ sig.getContentReferences().add(contentReference);
+
+ sxo.setSignature(sig);
+ return sxo;
+ }
+}
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list