[java-opensaml] branch main updated: OSJ-388: Update RSASSA-PSS AlgorithmDescriptors when Santuario ...
Brent Putman
putmanb at georgetown.edu
Fri Oct 20 18:54:41 UTC 2023
This is an automated email from the git hooks/post-receive script.
putmanb pushed a commit to branch main
in repository java-opensaml.
View the commit online:
http://git.shibboleth.net/view/?p=java-opensaml.git;a=commit;h=6f19ecc583cbcf7766e61ec61e015754720ae67f
The following commit(s) were added to refs/heads/main by this push:
new 6f19ecc58 OSJ-388: Update RSASSA-PSS AlgorithmDescriptors when Santuario ...
6f19ecc58 is described below
commit 6f19ecc583cbcf7766e61ec61e015754720ae67f
Author: Brent Putman <putmanb at georgetown.edu>
AuthorDate: Wed Oct 11 22:26:45 2023 -0400
OSJ-388: Update RSASSA-PSS AlgorithmDescriptors when Santuario ...
Update RSASSA-PSS AlgorithmDescriptors when Santuario updates their
methodology.
---
.../org/opensaml/security/crypto/JCAConstants.java | 3 +
.../xmlsec/algorithm/AlgorithmRegistry.java | 7 ++
.../descriptors/SignatureRSASSA_PSS_SHA1_MGF1.java | 2 +-
.../SignatureRSASSA_PSS_SHA224_MGF1.java | 2 +-
.../SignatureRSASSA_PSS_SHA256_MGF1.java | 2 +-
.../SignatureRSASSA_PSS_SHA384_MGF1.java | 2 +-
.../SignatureRSASSA_PSS_SHA3_224_MGF1.java | 2 +-
.../SignatureRSASSA_PSS_SHA3_256_MGF1.java | 2 +-
.../SignatureRSASSA_PSS_SHA3_384_MGF1.java | 2 +-
.../SignatureRSASSA_PSS_SHA3_512_MGF1.java | 2 +-
.../SignatureRSASSA_PSS_SHA512_MGF1.java | 2 +-
.../algorithm/tests/AlgorithmDescriptorsTest.java | 18 ++---
.../algorithm/tests/AlgorithmRegistryTest.java | 37 +++-------
.../tests/EnvelopedSignatureRSASSA_PSSTest.java | 79 ++++++++++++----------
14 files changed, 81 insertions(+), 81 deletions(-)
diff --git a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/JCAConstants.java b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/JCAConstants.java
index 3c8830ee2..c41cbdfa4 100644
--- a/opensaml-security-api/src/main/java/org/opensaml/security/crypto/JCAConstants.java
+++ b/opensaml-security-api/src/main/java/org/opensaml/security/crypto/JCAConstants.java
@@ -209,6 +209,9 @@ public final class JCAConstants {
/** Signature algorithm: "SHA3-512withRSAandMGF1". */
@Nonnull @NotEmpty public static final String SIGNATURE_RSA_SHA3_512_MGF1 = "SHA3-512withRSAandMGF1";
+ /** Signature algorithm: "RSASSA-PSS". */
+ @Nonnull @NotEmpty public static final String SIGNATURE_RSA_SSA_PSS= "RSASSA-PSS";
+
// MAC types
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/AlgorithmRegistry.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/AlgorithmRegistry.java
index 9f7e29fc7..b4ec8a27a 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/AlgorithmRegistry.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/AlgorithmRegistry.java
@@ -38,6 +38,7 @@ import net.shibboleth.shared.logic.Constraint;
import net.shibboleth.shared.primitive.LoggerFactory;
import net.shibboleth.shared.primitive.StringSupport;
+import org.opensaml.security.crypto.JCAConstants;
import org.opensaml.xmlsec.algorithm.AlgorithmDescriptor.AlgorithmType;
import org.opensaml.xmlsec.encryption.support.EncryptionConstants;
import org.slf4j.Logger;
@@ -328,6 +329,12 @@ public class AlgorithmRegistry {
case Signature:
Signature.getInstance(descriptor.getJCAAlgorithmID());
+ // Have to special case and test the implicit digest method separately,
+ // since the Santuario and hence AlgorithmDescriptor methodology of "RSASSA-PSS"
+ // doesn't include the digest explicitly like the others do. See OSJ-272 and OSJ-388.
+ if (JCAConstants.SIGNATURE_RSA_SSA_PSS.equals(descriptor.getJCAAlgorithmID())) {
+ MessageDigest.getInstance(SignatureAlgorithm.class.cast(descriptor).getDigest());
+ }
break;
case Mac:
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA1_MGF1.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA1_MGF1.java
index 6e2be48ea..87ab58860 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA1_MGF1.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA1_MGF1.java
@@ -44,7 +44,7 @@ public final class SignatureRSASSA_PSS_SHA1_MGF1 implements SignatureAlgorithm {
/** {@inheritDoc} */
@Nonnull public String getJCAAlgorithmID() {
- return JCAConstants.SIGNATURE_RSA_SHA1_MGF1;
+ return JCAConstants.SIGNATURE_RSA_SSA_PSS;
}
/** {@inheritDoc} */
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA224_MGF1.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA224_MGF1.java
index 3c59ae333..b3392e7a7 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA224_MGF1.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA224_MGF1.java
@@ -44,7 +44,7 @@ public final class SignatureRSASSA_PSS_SHA224_MGF1 implements SignatureAlgorithm
/** {@inheritDoc} */
@Nonnull public String getJCAAlgorithmID() {
- return JCAConstants.SIGNATURE_RSA_SHA224_MGF1;
+ return JCAConstants.SIGNATURE_RSA_SSA_PSS;
}
/** {@inheritDoc} */
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA256_MGF1.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA256_MGF1.java
index 61acaf109..6215b3809 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA256_MGF1.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA256_MGF1.java
@@ -44,7 +44,7 @@ public final class SignatureRSASSA_PSS_SHA256_MGF1 implements SignatureAlgorithm
/** {@inheritDoc} */
@Nonnull public String getJCAAlgorithmID() {
- return JCAConstants.SIGNATURE_RSA_SHA256_MGF1;
+ return JCAConstants.SIGNATURE_RSA_SSA_PSS;
}
/** {@inheritDoc} */
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA384_MGF1.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA384_MGF1.java
index 14b751455..7a321fe74 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA384_MGF1.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA384_MGF1.java
@@ -44,7 +44,7 @@ public final class SignatureRSASSA_PSS_SHA384_MGF1 implements SignatureAlgorithm
/** {@inheritDoc} */
@Nonnull public String getJCAAlgorithmID() {
- return JCAConstants.SIGNATURE_RSA_SHA384_MGF1;
+ return JCAConstants.SIGNATURE_RSA_SSA_PSS;
}
/** {@inheritDoc} */
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_224_MGF1.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_224_MGF1.java
index 726111bf2..42c563662 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_224_MGF1.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_224_MGF1.java
@@ -44,7 +44,7 @@ public final class SignatureRSASSA_PSS_SHA3_224_MGF1 implements SignatureAlgorit
/** {@inheritDoc} */
@Nonnull public String getJCAAlgorithmID() {
- return JCAConstants.SIGNATURE_RSA_SHA3_224_MGF1;
+ return JCAConstants.SIGNATURE_RSA_SSA_PSS;
}
/** {@inheritDoc} */
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_256_MGF1.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_256_MGF1.java
index 4ceaa3554..2aac821e9 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_256_MGF1.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_256_MGF1.java
@@ -44,7 +44,7 @@ public final class SignatureRSASSA_PSS_SHA3_256_MGF1 implements SignatureAlgorit
/** {@inheritDoc} */
@Nonnull public String getJCAAlgorithmID() {
- return JCAConstants.SIGNATURE_RSA_SHA3_256_MGF1;
+ return JCAConstants.SIGNATURE_RSA_SSA_PSS;
}
/** {@inheritDoc} */
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_384_MGF1.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_384_MGF1.java
index 1f93454dc..71be127ad 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_384_MGF1.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_384_MGF1.java
@@ -44,7 +44,7 @@ public final class SignatureRSASSA_PSS_SHA3_384_MGF1 implements SignatureAlgorit
/** {@inheritDoc} */
@Nonnull public String getJCAAlgorithmID() {
- return JCAConstants.SIGNATURE_RSA_SHA3_384_MGF1;
+ return JCAConstants.SIGNATURE_RSA_SSA_PSS;
}
/** {@inheritDoc} */
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_512_MGF1.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_512_MGF1.java
index d1bc9e482..83059a10e 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_512_MGF1.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA3_512_MGF1.java
@@ -44,7 +44,7 @@ public final class SignatureRSASSA_PSS_SHA3_512_MGF1 implements SignatureAlgorit
/** {@inheritDoc} */
@Nonnull public String getJCAAlgorithmID() {
- return JCAConstants.SIGNATURE_RSA_SHA3_512_MGF1;
+ return JCAConstants.SIGNATURE_RSA_SSA_PSS;
}
/** {@inheritDoc} */
diff --git a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA512_MGF1.java b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA512_MGF1.java
index a0115e1dd..8e996205f 100644
--- a/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA512_MGF1.java
+++ b/opensaml-xmlsec-api/src/main/java/org/opensaml/xmlsec/algorithm/descriptors/SignatureRSASSA_PSS_SHA512_MGF1.java
@@ -44,7 +44,7 @@ public final class SignatureRSASSA_PSS_SHA512_MGF1 implements SignatureAlgorithm
/** {@inheritDoc} */
@Nonnull public String getJCAAlgorithmID() {
- return JCAConstants.SIGNATURE_RSA_SHA512_MGF1;
+ return JCAConstants.SIGNATURE_RSA_SSA_PSS;
}
/** {@inheritDoc} */
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmDescriptorsTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmDescriptorsTest.java
index 73167ed08..83fb123db 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmDescriptorsTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmDescriptorsTest.java
@@ -426,63 +426,63 @@ public class AlgorithmDescriptorsTest {
descriptor = new SignatureRSASSA_PSS_SHA1_MGF1();
Assert.assertEquals(descriptor.getDigest(), JCAConstants.DIGEST_SHA1);
- Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SHA1_MGF1);
+ Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SSA_PSS);
Assert.assertEquals(descriptor.getKey(), JCAConstants.KEY_ALGO_RSA);
Assert.assertEquals(descriptor.getURI(), SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA1_MGF1);
Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.Signature);
descriptor = new SignatureRSASSA_PSS_SHA224_MGF1();
Assert.assertEquals(descriptor.getDigest(), JCAConstants.DIGEST_SHA224);
- Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SHA224_MGF1);
+ Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SSA_PSS);
Assert.assertEquals(descriptor.getKey(), JCAConstants.KEY_ALGO_RSA);
Assert.assertEquals(descriptor.getURI(), SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA224_MGF1);
Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.Signature);
descriptor = new SignatureRSASSA_PSS_SHA256_MGF1();
Assert.assertEquals(descriptor.getDigest(), JCAConstants.DIGEST_SHA256);
- Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SHA256_MGF1);
+ Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SSA_PSS);
Assert.assertEquals(descriptor.getKey(), JCAConstants.KEY_ALGO_RSA);
Assert.assertEquals(descriptor.getURI(), SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA256_MGF1);
Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.Signature);
descriptor = new SignatureRSASSA_PSS_SHA384_MGF1();
Assert.assertEquals(descriptor.getDigest(), JCAConstants.DIGEST_SHA384);
- Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SHA384_MGF1);
+ Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SSA_PSS);
Assert.assertEquals(descriptor.getKey(), JCAConstants.KEY_ALGO_RSA);
Assert.assertEquals(descriptor.getURI(), SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA384_MGF1);
Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.Signature);
descriptor = new SignatureRSASSA_PSS_SHA512_MGF1();
Assert.assertEquals(descriptor.getDigest(), JCAConstants.DIGEST_SHA512);
- Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SHA512_MGF1);
+ Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SSA_PSS);
Assert.assertEquals(descriptor.getKey(), JCAConstants.KEY_ALGO_RSA);
Assert.assertEquals(descriptor.getURI(), SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA512_MGF1);
Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.Signature);
descriptor = new SignatureRSASSA_PSS_SHA3_224_MGF1();
Assert.assertEquals(descriptor.getDigest(), JCAConstants.DIGEST_SHA3_224);
- Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SHA3_224_MGF1);
+ Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SSA_PSS);
Assert.assertEquals(descriptor.getKey(), JCAConstants.KEY_ALGO_RSA);
Assert.assertEquals(descriptor.getURI(), SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_224_MGF1);
Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.Signature);
descriptor = new SignatureRSASSA_PSS_SHA3_256_MGF1();
Assert.assertEquals(descriptor.getDigest(), JCAConstants.DIGEST_SHA3_256);
- Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SHA3_256_MGF1);
+ Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SSA_PSS);
Assert.assertEquals(descriptor.getKey(), JCAConstants.KEY_ALGO_RSA);
Assert.assertEquals(descriptor.getURI(), SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_256_MGF1);
Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.Signature);
descriptor = new SignatureRSASSA_PSS_SHA3_384_MGF1();
Assert.assertEquals(descriptor.getDigest(), JCAConstants.DIGEST_SHA3_384);
- Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SHA3_384_MGF1);
+ Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SSA_PSS);
Assert.assertEquals(descriptor.getKey(), JCAConstants.KEY_ALGO_RSA);
Assert.assertEquals(descriptor.getURI(), SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_384_MGF1);
Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.Signature);
descriptor = new SignatureRSASSA_PSS_SHA3_512_MGF1();
Assert.assertEquals(descriptor.getDigest(), JCAConstants.DIGEST_SHA3_512);
- Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SHA3_512_MGF1);
+ Assert.assertEquals(descriptor.getJCAAlgorithmID(), JCAConstants.SIGNATURE_RSA_SSA_PSS);
Assert.assertEquals(descriptor.getKey(), JCAConstants.KEY_ALGO_RSA);
Assert.assertEquals(descriptor.getURI(), SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_512_MGF1);
Assert.assertEquals(descriptor.getType(), AlgorithmDescriptor.AlgorithmType.Signature);
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmRegistryTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmRegistryTest.java
index 70bb8bc10..620b6798f 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmRegistryTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/algorithm/tests/AlgorithmRegistryTest.java
@@ -451,36 +451,17 @@ public class AlgorithmRegistryTest extends OpenSAMLInitBaseTestCase {
}
// RSASSA-PSA SHA-2
- // According to the Java 17 security providers docs, these RSASSA-PSA SHA-2 variants are supposed to be
- // supported by that version of the SunRsaSign provider. But in reality they appear to currently be unsupported.
- // Confirmed by iterating the java.security.Security Providers. Brent 2023-08-03.
- if (providerSupport.haveBC()) {
- Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA1_MGF1));
- Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA224_MGF1));
- Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA256_MGF1));
- Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA384_MGF1));
- Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA512_MGF1));
- } else {
- Assert.assertFalse(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA1_MGF1));
- Assert.assertFalse(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA224_MGF1));
- Assert.assertFalse(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA256_MGF1));
- Assert.assertFalse(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA384_MGF1));
- Assert.assertFalse(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA512_MGF1));
- }
+ Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA1_MGF1));
+ Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA224_MGF1));
+ Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA256_MGF1));
+ Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA384_MGF1));
+ Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA512_MGF1));
// RSASSA-PSA SHA-3
- if (providerSupport.haveBC()) {
- Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_224_MGF1));
- Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_256_MGF1));
- Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_384_MGF1));
- Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_512_MGF1));
- } else {
- Assert.assertFalse(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_224_MGF1));
- Assert.assertFalse(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_256_MGF1));
- Assert.assertFalse(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_384_MGF1));
- Assert.assertFalse(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_512_MGF1));
- }
-
+ Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_224_MGF1));
+ Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_256_MGF1));
+ Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_384_MGF1));
+ Assert.assertTrue(registry.isRuntimeSupported(SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_512_MGF1));
} finally {
providerSupport.unloadBC();
diff --git a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/EnvelopedSignatureRSASSA_PSSTest.java b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/EnvelopedSignatureRSASSA_PSSTest.java
index 8fc0a6999..6d578e5d4 100644
--- a/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/EnvelopedSignatureRSASSA_PSSTest.java
+++ b/opensaml-xmlsec-impl/src/test/java/org/opensaml/xmlsec/signature/support/tests/EnvelopedSignatureRSASSA_PSSTest.java
@@ -26,7 +26,6 @@ import org.opensaml.core.xml.io.MarshallingException;
import org.opensaml.security.credential.Credential;
import org.opensaml.security.credential.CredentialSupport;
import org.opensaml.security.crypto.KeySupport;
-import org.opensaml.security.testing.SecurityProviderTestSupport;
import org.opensaml.xmlsec.mock.SignableSimpleXMLObject;
import org.opensaml.xmlsec.mock.SignableSimpleXMLObjectBuilder;
import org.opensaml.xmlsec.signature.Signature;
@@ -38,6 +37,7 @@ import org.opensaml.xmlsec.signature.support.Signer;
import org.slf4j.Logger;
import org.testng.Assert;
import org.testng.annotations.BeforeMethod;
+import org.testng.annotations.DataProvider;
import org.testng.annotations.Test;
import org.w3c.dom.Element;
@@ -65,9 +65,6 @@ public class EnvelopedSignatureRSASSA_PSSTest extends XMLObjectBaseTestCase {
/** Builder of Signature XML objects. */
private XMLObjectBuilder<Signature> sigBuilder;
- /** Signature algorithm URI. */
- private String algoURI = SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA256_MGF1;
-
@BeforeMethod
protected void setUp() throws Exception {
KeyPair keyPair = KeySupport.generateKeyPair("RSA", 2048, null);
@@ -81,58 +78,70 @@ public class EnvelopedSignatureRSASSA_PSSTest extends XMLObjectBaseTestCase {
Signature.DEFAULT_ELEMENT_NAME);
}
+ @DataProvider(name = "testAlgorithms")
+ protected Object[][] testAlgorithms() {
+ return new Object[][] {
+ // SHA-2 ones
+ new Object[] { SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA1_MGF1 },
+ new Object[] { SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA224_MGF1 },
+ new Object[] { SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA256_MGF1 },
+ new Object[] { SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA384_MGF1 },
+ new Object[] { SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA512_MGF1 },
+
+ // SHA-3 ones
+ new Object[] { SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_224_MGF1 },
+ new Object[] { SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_256_MGF1 },
+ new Object[] { SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_384_MGF1 },
+ new Object[] { SignatureConstants.ALGO_ID_SIGNATURE_RSASSA_PSS_SHA3_512_MGF1 },
+ };
+
+ }
+
/**
* Tests creating an enveloped signature and then verifying it.
*
* @throws MarshallingException thrown if the XMLObject tree can not be marshalled
* @throws SignatureException ...
*/
- @Test
- public void testSigningAndVerification() throws MarshallingException, SignatureException {
- // BC is currently necessary for the RSASSA-PSS SHA-2 algos, even though it shouldn't be.
- final SecurityProviderTestSupport providerSupport = new SecurityProviderTestSupport();
+ @Test(dataProvider = "testAlgorithms")
+ public void testSigningAndVerification(final String signatureAlgorithmURI) throws MarshallingException, SignatureException {
+ SignableSimpleXMLObject sxo = getXMLObjectWithSignature(signatureAlgorithmURI);
+ Signature signature = sxo.getSignature();
+
+ Marshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().ensureMarshaller(sxo);
+ Element signedElement = marshaller.marshall(sxo);
+
+ assert signature != null;
+ Signer.signObject(signature);
+
+ if (log.isDebugEnabled()) {
+ log.debug("Marshalled Signature: \n" + SerializeSupport.nodeToString(signedElement));
+ }
+
+ SignatureValidator.validate(signature, goodCredential);
+
try {
- providerSupport.loadBC();
-
- SignableSimpleXMLObject sxo = getXMLObjectWithSignature();
- Signature signature = sxo.getSignature();
-
- Marshaller marshaller = XMLObjectProviderRegistrySupport.getMarshallerFactory().ensureMarshaller(sxo);
- Element signedElement = marshaller.marshall(sxo);
-
- assert signature != null;
- Signer.signObject(signature);
-
- if (log.isDebugEnabled()) {
- log.debug("Marshalled Signature: \n" + SerializeSupport.nodeToString(signedElement));
- }
-
- SignatureValidator.validate(signature, goodCredential);
-
- try {
- SignatureValidator.validate(signature, badCredential);
- Assert.fail("Validated signature with improper public key");
- } catch (SignatureException e) {
- // expected
- }
- } finally {
- providerSupport.unloadBC();
+ SignatureValidator.validate(signature, badCredential);
+ Assert.fail("Validated signature with improper public key");
+ } catch (SignatureException e) {
+ // expected
}
}
/**
* Creates a XMLObject that has a Signature child element.
+ * @param signatureAlgorithmURI
*
* @return a XMLObject that has a Signature child element
*/
- private SignableSimpleXMLObject getXMLObjectWithSignature() {
+ private SignableSimpleXMLObject getXMLObjectWithSignature(final String signatureAlgorithmURI) {
SignableSimpleXMLObject sxo = sxoBuilder.buildObject();
sxo.setId("FOO");
Signature sig = sigBuilder.buildObject(Signature.DEFAULT_ELEMENT_NAME);
sig.setSigningCredential(goodCredential);
sig.setCanonicalizationAlgorithm(SignatureConstants.ALGO_ID_C14N_EXCL_OMIT_COMMENTS);
- sig.setSignatureAlgorithm(algoURI);
+ sig.setSignatureAlgorithm(signatureAlgorithmURI);
DocumentInternalIDContentReference contentReference = new DocumentInternalIDContentReference("FOO");
contentReference.getTransforms().add(SignatureConstants.TRANSFORM_ENVELOPED_SIGNATURE);
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list