directory-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From erodrig...@apache.org
Subject svn commit: r533937 - /directory/apacheds/branches/kerberos-encryption-types/kerberos-shared/src/main/java/org/apache/directory/server/kerberos/shared/crypto/encryption/EncryptionEngine.java
Date Tue, 01 May 2007 04:45:57 GMT
Author: erodriguez
Date: Mon Apr 30 21:45:56 2007
New Revision: 533937

URL: http://svn.apache.org/viewvc?view=rev&rev=533937
Log:
Enhancements to base EncryptionEngine class:
o  Simplified API.
o  Addition of support for Derive Random (DR) function.

Modified:
    directory/apacheds/branches/kerberos-encryption-types/kerberos-shared/src/main/java/org/apache/directory/server/kerberos/shared/crypto/encryption/EncryptionEngine.java

Modified: directory/apacheds/branches/kerberos-encryption-types/kerberos-shared/src/main/java/org/apache/directory/server/kerberos/shared/crypto/encryption/EncryptionEngine.java
URL: http://svn.apache.org/viewvc/directory/apacheds/branches/kerberos-encryption-types/kerberos-shared/src/main/java/org/apache/directory/server/kerberos/shared/crypto/encryption/EncryptionEngine.java?view=diff&rev=533937&r1=533936&r2=533937
==============================================================================
--- directory/apacheds/branches/kerberos-encryption-types/kerberos-shared/src/main/java/org/apache/directory/server/kerberos/shared/crypto/encryption/EncryptionEngine.java
(original)
+++ directory/apacheds/branches/kerberos-encryption-types/kerberos-shared/src/main/java/org/apache/directory/server/kerberos/shared/crypto/encryption/EncryptionEngine.java
Mon Apr 30 21:45:56 2007
@@ -20,19 +20,8 @@
 package org.apache.directory.server.kerberos.shared.crypto.encryption;
 
 
-import java.security.GeneralSecurityException;
 import java.security.SecureRandom;
-import java.security.spec.AlgorithmParameterSpec;
-import java.util.Arrays;
 
-import javax.crypto.Cipher;
-import javax.crypto.SecretKey;
-import javax.crypto.spec.IvParameterSpec;
-import javax.crypto.spec.SecretKeySpec;
-
-import org.apache.directory.server.kerberos.shared.crypto.checksum.ChecksumEngine;
-import org.apache.directory.server.kerberos.shared.crypto.checksum.ChecksumType;
-import org.apache.directory.server.kerberos.shared.exceptions.ErrorType;
 import org.apache.directory.server.kerberos.shared.exceptions.KerberosException;
 import org.apache.directory.server.kerberos.shared.messages.value.EncryptedData;
 import org.apache.directory.server.kerberos.shared.messages.value.EncryptionKey;
@@ -47,97 +36,63 @@
     private static final SecureRandom random = new SecureRandom();
 
 
-    public abstract ChecksumEngine getChecksumEngine();
+    protected abstract byte[] getDecryptedData( EncryptionKey key, EncryptedData data ) throws
KerberosException;
 
 
-    public abstract Cipher getCipher() throws GeneralSecurityException;
+    protected abstract EncryptedData getEncryptedData( EncryptionKey key, byte[] plainText
);
 
 
-    public abstract EncryptionType encryptionType();
+    protected abstract EncryptionType getEncryptionType();
 
 
-    public abstract ChecksumType checksumType();
+    protected abstract int getConfounderLength();
 
 
-    public abstract CipherType keyType();
+    protected abstract int getChecksumLength();
 
 
-    public abstract int confounderSize();
+    protected abstract byte[] encrypt( byte[] plainText, byte[] key );
 
 
-    public abstract int checksumSize();
+    protected abstract byte[] decrypt( byte[] cipherText, byte[] key );
 
 
-    public abstract int blockSize();
+    protected abstract byte[] calculateChecksum( byte[] plainText, byte[] key );
 
 
-    public abstract int minimumPadSize();
-
-
-    public abstract int keySize();
-
-
-    public byte[] getDecryptedData( EncryptionKey key, EncryptedData data ) throws KerberosException
+    protected byte[] deriveRandom( byte[] key, byte[] usage, int n, int k )
     {
-        byte[] decryptedData = decrypt( data.getCipherText(), key.getKeyValue() );
-
-        // extract the old checksum
-        byte[] oldChecksum = new byte[checksumSize()];
-        System.arraycopy( decryptedData, confounderSize(), oldChecksum, 0, oldChecksum.length
);
-
-        // zero out the old checksum in the cipher text
-        for ( int i = confounderSize(); i < confounderSize() + checksumSize(); i++ )
-        {
-            decryptedData[i] = 0;
-        }
+        byte[] nFoldedUsage = NFold.nFold( n, usage );
 
-        // calculate a new checksum
-        byte[] newChecksum = calculateChecksum( decryptedData );
+        int kBytes = k / 8;
+        byte[] result = new byte[kBytes];
 
-        // compare checksums
-        if ( !Arrays.equals( oldChecksum, newChecksum ) )
-        {
-            throw new KerberosException( ErrorType.KRB_AP_ERR_BAD_INTEGRITY );
-        }
+        byte[] fillingKey = encrypt( nFoldedUsage, key );
 
-        return removeBytes( decryptedData, confounderSize(), checksumSize() );
-    }
-
-
-    public EncryptedData getEncryptedData( EncryptionKey key, byte[] plainText )
-    {
-        byte[] conFounder = getRandomBytes( confounderSize() );
-        byte[] zeroedChecksum = new byte[checksumSize()];
-        byte[] paddedPlainText = padString( plainText );
-        byte[] dataBytes = concatenateBytes( conFounder, concatenateBytes( zeroedChecksum,
paddedPlainText ) );
-        byte[] checksumBytes = calculateChecksum( dataBytes );
-        byte[] paddedDataBytes = padString( dataBytes );
+        int pos = 0;
 
-        // lay the checksum into the ciphertext
-        for ( int i = confounderSize(); i < confounderSize() + checksumSize(); i++ )
+        for ( int i = 0; i < kBytes; i++ )
         {
-            paddedDataBytes[i] = checksumBytes[i - confounderSize()];
+            if ( pos < fillingKey.length )
+            {
+                result[i] = fillingKey[pos];
+                pos++;
+            }
+            else
+            {
+                fillingKey = encrypt( fillingKey, key );
+                pos = 0;
+                result[i] = fillingKey[pos];
+                pos++;
+            }
         }
 
-        byte[] encryptedData = encrypt( paddedDataBytes, key.getKeyValue() );
-
-        return new EncryptedData( encryptionType(), key.getKeyVersion(), encryptedData );
-    }
-
-
-    private byte[] encrypt( byte[] data, byte[] key )
-    {
-        return processCipher( true, data, key );
-    }
-
-
-    private byte[] decrypt( byte[] data, byte[] key )
-    {
-        return processCipher( false, data, key );
+        return result;
     }
 
 
-    private byte[] getRandomBytes( int size )
+    // Encryption
+    protected byte[] getRandomBytes( int size )
     {
         byte[] bytes = new byte[size];
 
@@ -148,7 +103,8 @@
     }
 
 
-    private byte[] padString( byte encodedString[] )
+    // Encryption
+    protected byte[] padString( byte encodedString[] )
     {
         int x;
         if ( encodedString.length < 8 )
@@ -178,7 +134,8 @@
     }
 
 
-    private byte[] concatenateBytes( byte[] array1, byte[] array2 )
+    // Encryption
+    protected byte[] concatenateBytes( byte[] array1, byte[] array2 )
     {
         byte concatenatedBytes[] = new byte[array1.length + array2.length];
 
@@ -196,20 +153,28 @@
     }
 
 
-    private byte[] calculateChecksum( byte[] data )
+    // Decryption
+    protected byte[] removeLeadingBytes( byte[] array, int confounder, int checksum )
     {
-        ChecksumEngine digester = getChecksumEngine();
+        byte lessBytes[] = new byte[array.length - confounder - checksum];
+
+        int j = 0;
+        for ( int i = confounder + checksum; i < array.length; i++ )
+        {
+            lessBytes[j] = array[i];
+            j++;
+        }
 
-        return digester.calculateChecksum( data );
+        return lessBytes;
     }
 
 
-    private byte[] removeBytes( byte[] array, int confounder, int checksum )
+    protected byte[] removeTrailingBytes( byte[] array, int confounder, int checksum )
     {
         byte lessBytes[] = new byte[array.length - confounder - checksum];
 
         int j = 0;
-        for ( int i = confounder + checksum; i < array.length; i++ )
+        for ( int i = 0; i < array.length - confounder - checksum; i++ )
         {
             lessBytes[j] = array[i];
             j++;
@@ -219,34 +184,46 @@
     }
 
 
-    private byte[] processCipher( boolean encrypt, byte[] data, byte[] keyBytes )
+    /**
+     * The "well-known constant" used for the DK function is the key
+     * usage number, expressed as four octets in big-endian order,
+     * followed by one octet indicated below.
+     * 
+     *  Kc = DK(base-key, usage | 0x99);
+     *  Ke = DK(base-key, usage | 0xAA);
+     *  Ki = DK(base-key, usage | 0x55);
+     */
+    protected byte[] getUsageBytes( int usage )
     {
-        try
-        {
-            Cipher cipher = getCipher();
-            SecretKey key = new SecretKeySpec( keyBytes, "DES" );
+        byte[] result = new byte[4];
 
-            byte[] iv = new byte[]
-                { ( byte ) 0x00, ( byte ) 0x00, ( byte ) 0x00, ( byte ) 0x00, ( byte ) 0x00,
( byte ) 0x00,
-                    ( byte ) 0x00, ( byte ) 0x00 };
-            AlgorithmParameterSpec paramSpec = new IvParameterSpec( iv );
+        result[0] = ( byte ) ( usage >> 24 );
+        result[1] = ( byte ) ( ( usage << 8 ) >> 24 );
+        result[2] = ( byte ) ( ( usage << 16 ) >> 24 );
+        result[3] = ( byte ) ( ( usage << 24 ) >> 24 );
 
-            if ( encrypt )
-            {
-                cipher.init( Cipher.ENCRYPT_MODE, key, paramSpec );
-            }
-            else
-            {
-                cipher.init( Cipher.DECRYPT_MODE, key, paramSpec );
-            }
+        return result;
+    }
 
-            byte[] finalBytes = cipher.doFinal( data );
 
-            return finalBytes;
-        }
-        catch ( GeneralSecurityException nsae )
-        {
-            return null;
-        }
+    protected int getBit( byte[] data, int pos )
+    {
+        int posByte = pos / 8;
+        int posBit = pos % 8;
+
+        byte valByte = data[posByte];
+        int valInt = valByte >> ( 8 - ( posBit + 1 ) ) & 0x0001;
+        return valInt;
+    }
+
+
+    protected void setBit( byte[] data, int pos, int val )
+    {
+        int posByte = pos / 8;
+        int posBit = pos % 8;
+        byte oldByte = data[posByte];
+        oldByte = ( byte ) ( ( ( 0xFF7F >> posBit ) & oldByte ) & 0x00FF );
+        byte newByte = ( byte ) ( ( val << ( 8 - ( posBit + 1 ) ) ) | oldByte );
+        data[posByte] = newByte;
     }
 }



Mime
View raw message