[java-oidc-common] branch main updated: Remove incompatible key wrap credential key length check.

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-oidc-common.

View the commit online:
http://git.shibboleth.net/view/?p=java-oidc-common.git;a=commit;h=0bb72cea45ea7ac6ef18f12cbfb10efdf0ce02d4

The following commit(s) were added to refs/heads/main by this push:
     new 0bb72ce  Remove incompatible key wrap credential key length check.
0bb72ce is described below

commit 0bb72cea45ea7ac6ef18f12cbfb10efdf0ce02d4
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Mon Mar 6 15:40:42 2023 +0000

    Remove incompatible key wrap credential key length check.
---
 .../impl/DefaultEncryptionParametersResolver.java  |  8 ++----
 .../DefaultEncryptionParametersResolverTest.java   | 33 ++++++++++++++++++++++
 2 files changed, 36 insertions(+), 5 deletions(-)

diff --git a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolver.java b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolver.java
index 883b3b1..f6115b8 100644
--- a/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolver.java
+++ b/oidc-common-crypto-impl/src/main/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolver.java
@@ -384,9 +384,8 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
      * Resolve a credential (key) compatible with one-of the supported algorithms. Algorithms are tried in the order
      * they appear in the list of keyTransportAlgorithms (key management algorithms). The first compatible is returned. 
      * 
-     * <p>The first key that is compatible with the key transport algorithm is returned. That is, if two or more 
-     * keys support the same algorithm, the first key resolved will be returned. There is no guarantee which 
-     * key that is.</p>
+     * <p>If two or more keys support the same algorithm, the first key resolved will be returned. 
+     * There is no guarantee which key that is.</p>
      * 
      * @param criteria the set of criterion passed into additional source implementations
      * @param keyTransportAlgorithms the set of supported key transport algorithms
@@ -498,8 +497,7 @@ public class DefaultEncryptionParametersResolver extends AbstractSecurityParamet
             
             for (final Credential credential : keyTransportCredentials) {
 
-                if (checkCredentialSupportsAlgorithm(credential, algorithm) && 
-                        checkCredentialSupportsEncryptionMethod(credential, method)) {                      
+                if (checkCredentialSupportsAlgorithm(credential, algorithm)) {                      
                     if (log.isDebugEnabled()) {
                         log.debug("Resolved key from '{}' for 'alg={}' and 'enc={}'", 
                                 CredentialConversionUtil.resolveKid(credential),
diff --git a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolverTest.java b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolverTest.java
index 5c213e0..688316a 100644
--- a/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolverTest.java
+++ b/oidc-common-crypto-impl/src/test/java/net/shibboleth/oidc/security/jose/impl/DefaultEncryptionParametersResolverTest.java
@@ -315,6 +315,39 @@ public class DefaultEncryptionParametersResolverTest {
        
     }
     
+    /**
+     * The resolver only needs to resolve key wrapping credentials compatible with the key wrapping
+     * algorithm. It should not matter what the encryption method use is e.g. 192bit key for KW, and
+     * 256 bit key used for encryption, we only need to check the key for KW.
+     * 
+     * @throws Exception on error
+     */
+    @Test
+    public void testBasicAESKeyWrap_KeyWrapKeySizeDifferentThanEncryptionMethod() throws Exception {
+        final CriteriaSet criteria =  buildBasicCriteriaSet();
+        config.setKeyTransportEncryptionAlgorithms(
+                List.of(KeyManagementConstants.ALGO_ID_ALG_AES_192_KW));  
+        config.setDataEncryptionAlgorithms(List.of(EncryptionConstants.ALGO_ID_ENC_ALG_A128CBC_HS256));
+        
+        final List<Credential> creds = new ArrayList<>();
+        creds.add(TestCredentialHelper.createClientSecretCredential(SYMMETRIC_KEY)
+                .toEncryptionCredential(JWEAlgorithm.A192KW, EncryptionMethod.A128CBC_HS256));
+        
+        config.setKEKCredentialResolver(new MockStaticFilteringCredentialResolver(creds));
+        
+        final EncryptionParameters param = resolver.resolveSingle(criteria);
+        
+        assertNotNull(param);
+        assertNotNull(param.getDataEncryptionAlgorithm());
+        assertNotNull(param.getKeyTransportEncryptionAlgorithm());  
+        assertEquals(param.getDataEncryptionAlgorithm(),EncryptionConstants.ALGO_ID_ENC_ALG_A128CBC_HS256);
+        assertEquals(param.getKeyTransportEncryptionAlgorithm(),KeyManagementConstants.ALGO_ID_ALG_AES_192_KW);
+        assertNotNull(param.getKeyTransportEncryptionCredential());
+        assertNotNull(param.getKeyTransportEncryptionCredential().getSecretKey());
+        assertEquals(param.getKeyTransportEncryptionCredential().getSecretKey().getAlgorithm(),"AES");
+       
+    }
+    
     /* The key is 256bit and does not support the 128bit enc. algo.*/    
     @Test
     public void testBasicAESKeyWrap_WrongKeyLength() throws Exception {

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.