[java-support] branch maint-8 updated: JSPT-125 - DataSealer encryption fails on Red Hat 9 OpenJDK in FIPS mode

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch maint-8
in repository java-support.

View the commit online:
http://git.shibboleth.net/view/?p=java-support.git;a=commit;h=4b61239d8014c728ac51f9ff07da45f66b9018e9

The following commit(s) were added to refs/heads/maint-8 by this push:
     new 4b61239  JSPT-125 - DataSealer encryption fails on Red Hat 9 OpenJDK in FIPS mode
4b61239 is described below

commit 4b61239d8014c728ac51f9ff07da45f66b9018e9
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Nov 27 09:23:26 2023 -0500

    JSPT-125 - DataSealer encryption fails on Red Hat 9 OpenJDK in FIPS mode
    
    https://shibboleth.atlassian.net/browse/JSPT-125
---
 .../java/support/security/DataSealer.java          | 27 +++++++++++-----------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/src/main/java/net/shibboleth/utilities/java/support/security/DataSealer.java b/src/main/java/net/shibboleth/utilities/java/support/security/DataSealer.java
index ca63b5f..b2c4853 100644
--- a/src/main/java/net/shibboleth/utilities/java/support/security/DataSealer.java
+++ b/src/main/java/net/shibboleth/utilities/java/support/security/DataSealer.java
@@ -284,11 +284,10 @@ public class DataSealer extends AbstractInitializableComponent {
                 final int dataSize = inputDataStream.read(data);
 
                 final byte[] plaintext = new byte[cipher.getOutputSize(dataSize)];
-                final int outputLen = cipher.update(data, 0, dataSize, plaintext, 0);
-                cipher.doFinal(plaintext, outputLen);
+                final int outputLen = cipher.doFinal(data, 0, dataSize, plaintext);
 
                 // Pass the plaintext into the subroutine for processing.
-                return extractAndCheckDecryptedData(plaintext);
+                return extractAndCheckDecryptedData(plaintext, 0, outputLen);
             }
 
         } catch (final KeyNotFoundException e) {
@@ -311,15 +310,20 @@ public class DataSealer extends AbstractInitializableComponent {
      * Extract the GZIP'd data and test for expiration before returning it.
      * 
      * @param decryptedBytes the data we are looking at
+     * @param decryptedOffset offset into the buffer
+     * @param decryptedLen length of data in the buffer
      * 
      * @return the decoded data if it is valid and unexpired
      * @throws DataSealerException if the data cannot be unwrapped and verified
      */
-    @Nonnull private String extractAndCheckDecryptedData(@Nonnull @NotEmpty final byte[] decryptedBytes)
+    @Nonnull private String extractAndCheckDecryptedData(@Nonnull @NotEmpty final byte[] decryptedBytes,
+            final int decryptedOffset, final int decryptedLen)
             throws DataSealerException {
         
         try (final DataInputStream dataInputStream =
-                new DataInputStream(new GZIPInputStream(new ByteArrayInputStream(decryptedBytes)))) {
+                new DataInputStream(
+                        new GZIPInputStream(
+                                new ByteArrayInputStream(decryptedBytes, decryptedOffset, decryptedLen)))) {
 
             final long decodedExpirationTime = dataInputStream.readLong();
             if (decodedExpirationTime > 0 && System.currentTimeMillis() > decodedExpirationTime) {
@@ -420,8 +424,7 @@ public class DataSealer extends AbstractInitializableComponent {
                 final byte[] plaintext = byteStream.toByteArray();
 
                 final byte[] encryptedData = new byte[cipher.getOutputSize(plaintext.length)];
-                int outputLen = cipher.update(plaintext, 0, plaintext.length, encryptedData, 0);
-                outputLen += cipher.doFinal(encryptedData, outputLen);
+                final int outputLen = cipher.doFinal(plaintext, 0, plaintext.length, encryptedData);
 
                 try (final ByteArrayOutputStream finalByteStream = new ByteArrayOutputStream();
                         final DataOutputStream finalDataStream = new DataOutputStream(finalByteStream)) {
@@ -479,17 +482,15 @@ public class DataSealer extends AbstractInitializableComponent {
             byte[] plaintext = "test".getBytes(StandardCharsets.UTF_8);
             
             final byte[] encryptedData = new byte[cipher.getOutputSize(plaintext.length)];
-            int outputLen = cipher.update(plaintext, 0, plaintext.length, encryptedData, 0);
-            cipher.doFinal(encryptedData, outputLen);
+            int outputLen = cipher.doFinal(plaintext, 0, plaintext.length, encryptedData);
 
             cipher.init(Cipher.DECRYPT_MODE, key, params);
             cipher.updateAAD("aad".getBytes(StandardCharsets.UTF_8));
             
             plaintext = new byte[cipher.getOutputSize(encryptedData.length)];
-            outputLen = cipher.update(encryptedData, 0, encryptedData.length, plaintext, 0);
-            cipher.doFinal(plaintext, outputLen);
+            outputLen = cipher.doFinal(encryptedData, 0, encryptedData.length, plaintext);
             
-            decrypted = new String(plaintext, StandardCharsets.UTF_8);
+            decrypted = new String(plaintext, 0, outputLen, StandardCharsets.UTF_8);
             
         } catch (final IllegalStateException | GeneralSecurityException e) {
             log.error("Round trip encryption/decryption test unsuccessful: {}", e.getMessage());
@@ -502,4 +503,4 @@ public class DataSealer extends AbstractInitializableComponent {
         }
     }
 
-}
\ No newline at end of file
+}

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.