Projects
Mega:23.09
openjdk-1.8.0
_service:tar_scm:8014628-Support-AES-Encryption...
Sign Up
Log In
Username
Password
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File _service:tar_scm:8014628-Support-AES-Encryption-with-HMAC-SHA2-for-Ke.patch of Package openjdk-1.8.0
From 1f3126944b08e62bd79bb1624319f934654d933c Mon Sep 17 00:00:00 2001 Date: Thu, 27 Jul 2023 11:48:47 +0800 Subject: [PATCH] [Backport]8014628: Support AES Encryption with HMAC-SHA2 for Kerberos 5 --- .../javax/security/auth/kerberos/KeyImpl.java | 8 +- .../sun/security/jgss/krb5/CipherHelper.java | 204 +++++++ .../classes/sun/security/krb5/Checksum.java | 4 + .../classes/sun/security/krb5/Config.java | 16 +- .../sun/security/krb5/EncryptedData.java | 8 +- .../sun/security/krb5/EncryptionKey.java | 17 +- .../crypto/Aes128CtsHmacSha2EType.java | 112 ++++ .../krb5/internal/crypto/Aes128Sha2.java | 83 +++ .../crypto/Aes256CtsHmacSha2EType.java | 112 ++++ .../krb5/internal/crypto/Aes256Sha2.java | 86 +++ .../krb5/internal/crypto/CksumType.java | 12 + .../security/krb5/internal/crypto/EType.java | 44 +- .../crypto/HmacSha2Aes128CksumType.java | 106 ++++ .../crypto/HmacSha2Aes256CksumType.java | 106 ++++ .../internal/crypto/dk/AesSha2DkCrypto.java | 541 ++++++++++++++++++ .../krb5/internal/crypto/dk/DkCrypto.java | 6 +- .../sun/security/krb5/auto/BasicKrb5Test.java | 30 +- jdk/test/sun/security/krb5/auto/KDC.java | 42 +- .../krb5/auto/ReplayCacheTestProc.java | 11 +- .../sun/security/krb5/etype/ETypeOrder.java | 4 +- .../security/krb5/etype/KerberosAesSha2.java | 209 +++++++ 21 files changed, 1704 insertions(+), 57 deletions(-) create mode 100644 jdk/src/share/classes/sun/security/krb5/internal/crypto/Aes128CtsHmacSha2EType.java create mode 100644 jdk/src/share/classes/sun/security/krb5/internal/crypto/Aes128Sha2.java create mode 100644 jdk/src/share/classes/sun/security/krb5/internal/crypto/Aes256CtsHmacSha2EType.java create mode 100644 jdk/src/share/classes/sun/security/krb5/internal/crypto/Aes256Sha2.java create mode 100644 jdk/src/share/classes/sun/security/krb5/internal/crypto/HmacSha2Aes128CksumType.java create mode 100644 jdk/src/share/classes/sun/security/krb5/internal/crypto/HmacSha2Aes256CksumType.java create mode 100644 jdk/src/share/classes/sun/security/krb5/internal/crypto/dk/AesSha2DkCrypto.java create mode 100644 jdk/test/sun/security/krb5/etype/KerberosAesSha2.java diff --git a/jdk/src/share/classes/javax/security/auth/kerberos/KeyImpl.java b/jdk/src/share/classes/javax/security/auth/kerberos/KeyImpl.java index 9d36d1e9e..571387e0c 100644 --- a/jdk/src/share/classes/javax/security/auth/kerberos/KeyImpl.java +++ b/jdk/src/share/classes/javax/security/auth/kerberos/KeyImpl.java @@ -1,5 +1,5 @@ /* - * Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -138,6 +138,12 @@ class KeyImpl implements SecretKey, Destroyable, Serializable { case EncryptedData.ETYPE_AES256_CTS_HMAC_SHA1_96: return "aes256-cts-hmac-sha1-96"; + case EncryptedData.ETYPE_AES128_CTS_HMAC_SHA256_128: + return "aes128-cts-hmac-sha256-128"; + + case EncryptedData.ETYPE_AES256_CTS_HMAC_SHA384_192: + return "aes256-cts-hmac-sha384-192"; + case EncryptedData.ETYPE_NULL: return "none"; diff --git a/jdk/src/share/classes/sun/security/jgss/krb5/CipherHelper.java b/jdk/src/share/classes/sun/security/jgss/krb5/CipherHelper.java index 0b8adfb61..2eac76256 100644 --- a/jdk/src/share/classes/sun/security/jgss/krb5/CipherHelper.java +++ b/jdk/src/share/classes/sun/security/jgss/krb5/CipherHelper.java @@ -40,6 +40,8 @@ import java.security.MessageDigest; import java.security.GeneralSecurityException; import java.security.NoSuchAlgorithmException; import sun.security.krb5.*; +import sun.security.krb5.internal.crypto.Aes128Sha2; +import sun.security.krb5.internal.crypto.Aes256Sha2; import sun.security.krb5.internal.crypto.Des3; import sun.security.krb5.internal.crypto.Aes128; import sun.security.krb5.internal.crypto.Aes256; @@ -101,6 +103,8 @@ class CipherHelper { case EncryptedData.ETYPE_AES128_CTS_HMAC_SHA1_96: case EncryptedData.ETYPE_AES256_CTS_HMAC_SHA1_96: + case EncryptedData.ETYPE_AES128_CTS_HMAC_SHA256_128: + case EncryptedData.ETYPE_AES256_CTS_HMAC_SHA384_192: sgnAlg = -1; sealAlg = -1; break; @@ -365,6 +369,33 @@ class CipherHelper { throw ge; } + case EncryptedData.ETYPE_AES128_CTS_HMAC_SHA256_128: + try { + byte[] answer = Aes128Sha2.calculateChecksum(keybytes, key_usage, + buf, 0, total); + return answer; + } catch (GeneralSecurityException e) { + GSSException ge = new GSSException(GSSException.FAILURE, -1, + "Could not use AES128 signing algorithm - " + + e.getMessage()); + ge.initCause(e); + throw ge; + } + + case EncryptedData.ETYPE_AES256_CTS_HMAC_SHA384_192: + try { + byte[] answer = Aes256Sha2.calculateChecksum(keybytes, key_usage, + buf, 0, total); + return answer; + } catch (GeneralSecurityException e) { + GSSException ge = new GSSException(GSSException.FAILURE, -1, + "Could not use AES256 signing algorithm - " + + e.getMessage()); + ge.initCause(e); + throw ge; + } + + default: throw new GSSException(GSSException.FAILURE, -1, "Unsupported encryption type: " + etype); @@ -517,6 +548,11 @@ class CipherHelper { case EncryptedData.ETYPE_AES256_CTS_HMAC_SHA1_96: return Aes256.getChecksumLength(); + case EncryptedData.ETYPE_AES128_CTS_HMAC_SHA256_128: + return Aes128Sha2.getChecksumLength(); + case EncryptedData.ETYPE_AES256_CTS_HMAC_SHA384_192: + return Aes256Sha2.getChecksumLength(); + case EncryptedData.ETYPE_ARCFOUR_HMAC: // only first 8 octets of HMAC Sgn_Cksum are used return HMAC_CHECKSUM_SIZE; @@ -574,6 +610,14 @@ class CipherHelper { aes256Decrypt(token, ciphertext, cStart, cLen, plaintext, pStart, key_usage); break; + case EncryptedData.ETYPE_AES128_CTS_HMAC_SHA256_128: + aes128Sha2Decrypt(token, ciphertext, cStart, cLen, + plaintext, pStart, key_usage); + break; + case EncryptedData.ETYPE_AES256_CTS_HMAC_SHA384_192: + aes256Sha2Decrypt(token, ciphertext, cStart, cLen, + plaintext, pStart, key_usage); + break; default: throw new GSSException(GSSException.FAILURE, -1, "Unsupported etype: " + etype); @@ -654,6 +698,14 @@ class CipherHelper { aes256Decrypt(token, ciphertext, 0, cLen, plaintext, pStart, key_usage); break; + case EncryptedData.ETYPE_AES128_CTS_HMAC_SHA256_128: + aes128Sha2Decrypt(token, ciphertext, 0, cLen, + plaintext, pStart, key_usage); + break; + case EncryptedData.ETYPE_AES256_CTS_HMAC_SHA384_192: + aes256Sha2Decrypt(token, ciphertext, 0, cLen, + plaintext, pStart, key_usage); + break; default: throw new GSSException(GSSException.FAILURE, -1, "Unsupported etype: " + etype); @@ -720,6 +772,12 @@ class CipherHelper { case EncryptedData.ETYPE_AES256_CTS_HMAC_SHA1_96: return aes256Encrypt(confounder, tokenHeader, plaintext, start, len, key_usage); + case EncryptedData.ETYPE_AES128_CTS_HMAC_SHA256_128: + return aes128Sha2Encrypt(confounder, tokenHeader, + plaintext, start, len, key_usage); + case EncryptedData.ETYPE_AES256_CTS_HMAC_SHA384_192: + return aes256Sha2Encrypt(confounder, tokenHeader, + plaintext, start, len, key_usage); default: throw new GSSException(GSSException.FAILURE, -1, "Unsupported etype: " + etype); @@ -796,6 +854,14 @@ class CipherHelper { ctext = aes256Encrypt(confounder, tokenHeader, plaintext, pStart, pLen, key_usage); break; + case EncryptedData.ETYPE_AES128_CTS_HMAC_SHA256_128: + ctext = aes128Sha2Encrypt(confounder, tokenHeader, + plaintext, pStart, pLen, key_usage); + break; + case EncryptedData.ETYPE_AES256_CTS_HMAC_SHA384_192: + ctext = aes256Sha2Encrypt(confounder, tokenHeader, + plaintext, pStart, pLen, key_usage); + break; default: throw new GSSException(GSSException.FAILURE, -1, "Unsupported etype: " + etype); @@ -1317,6 +1383,38 @@ class CipherHelper { } } + private byte[] aes128Sha2Encrypt(byte[] confounder, byte[] tokenHeader, + byte[] plaintext, int start, int len, int key_usage) + throws GSSException { + + // encrypt { AES-plaintext-data | filler | header } + // AES-plaintext-data { confounder | plaintext } + // WrapToken = { tokenHeader | + // Encrypt (confounder | plaintext | tokenHeader ) | HMAC } + + byte[] all = new byte[confounder.length + len + tokenHeader.length]; + System.arraycopy(confounder, 0, all, 0, confounder.length); + System.arraycopy(plaintext, start, all, confounder.length, len); + System.arraycopy(tokenHeader, 0, all, confounder.length+len, + tokenHeader.length); + + // Krb5Token.debug("\naes128Sha2Encrypt:" + Krb5Token.getHexBytes(all)); + try { + byte[] answer = Aes128Sha2.encryptRaw(keybytes, key_usage, + ZERO_IV_AES, + all, 0, all.length); + // Krb5Token.debug("\naes128Sha2Encrypt encrypted:" + + // Krb5Token.getHexBytes(answer)); + return answer; + } catch (Exception e) { + // GeneralSecurityException, KrbCryptoException + GSSException ge = new GSSException(GSSException.FAILURE, -1, + "Could not use Aes128Sha2 Cipher - " + e.getMessage()); + ge.initCause(e); + throw ge; + } + } + private void aes128Decrypt(WrapToken_v2 token, byte[] ciphertext, int cStart, int cLen, byte[] plaintext, int pStart, int key_usage) throws GSSException { @@ -1354,6 +1452,43 @@ class CipherHelper { */ } + private void aes128Sha2Decrypt(WrapToken_v2 token, byte[] ciphertext, + int cStart, int cLen, byte[] plaintext, int pStart, int key_usage) + throws GSSException { + + byte[] ptext = null; + + try { + ptext = Aes128Sha2.decryptRaw(keybytes, key_usage, + ZERO_IV_AES, ciphertext, cStart, cLen); + } catch (GeneralSecurityException e) { + GSSException ge = new GSSException(GSSException.FAILURE, -1, + "Could not use AES128Sha2 Cipher - " + e.getMessage()); + ge.initCause(e); + throw ge; + } + + /* + Krb5Token.debug("\naes128Sha2Decrypt in: " + + Krb5Token.getHexBytes(ciphertext, cStart, cLen)); + Krb5Token.debug("\naes128Sha2Decrypt plain: " + + Krb5Token.getHexBytes(ptext)); + Krb5Token.debug("\naes128Sha2Decrypt ptext: " + + Krb5Token.getHexBytes(ptext)); + */ + + // Strip out confounder and token header + int len = ptext.length - WrapToken_v2.CONFOUNDER_SIZE - + WrapToken_v2.TOKEN_HEADER_SIZE; + System.arraycopy(ptext, WrapToken_v2.CONFOUNDER_SIZE, + plaintext, pStart, len); + + /* + Krb5Token.debug("\naes128Sha2Decrypt plaintext: " + + Krb5Token.getHexBytes(plaintext, pStart, len)); + */ + } + private byte[] aes256Encrypt(byte[] confounder, byte[] tokenHeader, byte[] plaintext, int start, int len, int key_usage) throws GSSException { @@ -1386,6 +1521,38 @@ class CipherHelper { } } + private byte[] aes256Sha2Encrypt(byte[] confounder, byte[] tokenHeader, + byte[] plaintext, int start, int len, int key_usage) + throws GSSException { + + // encrypt { AES-plaintext-data | filler | header } + // AES-plaintext-data { confounder | plaintext } + // WrapToken = { tokenHeader | + // Encrypt (confounder | plaintext | tokenHeader ) | HMAC } + + byte[] all = new byte[confounder.length + len + tokenHeader.length]; + System.arraycopy(confounder, 0, all, 0, confounder.length); + System.arraycopy(plaintext, start, all, confounder.length, len); + System.arraycopy(tokenHeader, 0, all, confounder.length+len, + tokenHeader.length); + + // Krb5Token.debug("\naes256Sha2Encrypt:" + Krb5Token.getHexBytes(all)); + + try { + byte[] answer = Aes256Sha2.encryptRaw(keybytes, key_usage, + ZERO_IV_AES, all, 0, all.length); + // Krb5Token.debug("\naes256Sha2Encrypt encrypted:" + + // Krb5Token.getHexBytes(answer)); + return answer; + } catch (Exception e) { + // GeneralSecurityException, KrbCryptoException + GSSException ge = new GSSException(GSSException.FAILURE, -1, + "Could not use Aes256Sha2 Cipher - " + e.getMessage()); + ge.initCause(e); + throw ge; + } + } + private void aes256Decrypt(WrapToken_v2 token, byte[] ciphertext, int cStart, int cLen, byte[] plaintext, int pStart, int key_usage) throws GSSException { @@ -1423,6 +1590,43 @@ class CipherHelper { } + private void aes256Sha2Decrypt(WrapToken_v2 token, byte[] ciphertext, + int cStart, int cLen, byte[] plaintext, int pStart, int key_usage) + throws GSSException { + + byte[] ptext; + try { + ptext = Aes256Sha2.decryptRaw(keybytes, key_usage, + ZERO_IV_AES, ciphertext, cStart, cLen); + } catch (GeneralSecurityException e) { + GSSException ge = new GSSException(GSSException.FAILURE, -1, + "Could not use AES256Sha2 Cipher - " + e.getMessage()); + ge.initCause(e); + throw ge; + } + + /* + Krb5Token.debug("\naes256Sha2Decrypt in: " + + Krb5Token.getHexBytes(ciphertext, cStart, cLen)); + Krb5Token.debug("\naes256Sha2Decrypt plain: " + + Krb5Token.getHexBytes(ptext)); + Krb5Token.debug("\naes256Sha2Decrypt ptext: " + + Krb5Token.getHexBytes(ptext)); + */ + + // Strip out confounder and token header + int len = ptext.length - WrapToken_v2.CONFOUNDER_SIZE - + WrapToken_v2.TOKEN_HEADER_SIZE; + System.arraycopy(ptext, WrapToken_v2.CONFOUNDER_SIZE, + plaintext, pStart, len); + + /* + Krb5Token.debug("\naes256Sha2Decrypt plaintext: " + + Krb5Token.getHexBytes(plaintext, pStart, len)); + */ + + } + /** * This class provides a truncated inputstream needed by WrapToken. The * truncated inputstream is passed to CipherInputStream. It prevents diff --git a/jdk/src/share/classes/sun/security/krb5/Checksum.java b/jdk/src/share/classes/sun/security/krb5/Checksum.java index 3f89f97cd..61ed36397 100644 --- a/jdk/src/share/classes/sun/security/krb5/Checksum.java +++ b/jdk/src/share/classes/sun/security/krb5/Checksum.java @@ -66,6 +66,10 @@ public class Checksum { public static final int CKSUMTYPE_HMAC_SHA1_96_AES128 = 15; // 96 public static final int CKSUMTYPE_HMAC_SHA1_96_AES256 = 16; // 96 + // rfc8009 + public static final int CKSUMTYPE_HMAC_SHA256_128_AES128 = 19; // 96 + public static final int CKSUMTYPE_HMAC_SHA384_192_AES256 = 20; // 96 + // draft-brezak-win2k-krb-rc4-hmac-04.txt public static final int CKSUMTYPE_HMAC_MD5_ARCFOUR = -138; diff --git a/jdk/src/share/classes/sun/security/krb5/Config.java b/jdk/src/share/classes/sun/security/krb5/Config.java index 117acb840..9873fcbef 100644 --- a/jdk/src/share/classes/sun/security/krb5/Config.java +++ b/jdk/src/share/classes/sun/security/krb5/Config.java @@ -1005,11 +1005,19 @@ public class Config { } else if (input.startsWith("a") || (input.startsWith("A"))) { // AES if (input.equalsIgnoreCase("aes128-cts") || - input.equalsIgnoreCase("aes128-cts-hmac-sha1-96")) { + input.equalsIgnoreCase("aes128-sha1") || + input.equalsIgnoreCase("aes128-cts-hmac-sha1-96")) { result = EncryptedData.ETYPE_AES128_CTS_HMAC_SHA1_96; } else if (input.equalsIgnoreCase("aes256-cts") || - input.equalsIgnoreCase("aes256-cts-hmac-sha1-96")) { + input.equalsIgnoreCase("aes256-sha1") || + input.equalsIgnoreCase("aes256-cts-hmac-sha1-96")) { result = EncryptedData.ETYPE_AES256_CTS_HMAC_SHA1_96; + } else if (input.equalsIgnoreCase("aes128-sha2") || + input.equalsIgnoreCase("aes128-cts-hmac-sha256-128")) { + result = EncryptedData.ETYPE_AES128_CTS_HMAC_SHA256_128; + } else if (input.equalsIgnoreCase("aes256-sha2") || + input.equalsIgnoreCase("aes256-cts-hmac-sha384-192")) { + result = EncryptedData.ETYPE_AES256_CTS_HMAC_SHA384_192; // ARCFOUR-HMAC } else if (input.equalsIgnoreCase("arcfour-hmac") || input.equalsIgnoreCase("arcfour-hmac-md5")) { @@ -1032,6 +1040,10 @@ public class Config { result = Checksum.CKSUMTYPE_HMAC_SHA1_96_AES128; } else if (input.equalsIgnoreCase("hmac-sha1-96-aes256")) { result = Checksum.CKSUMTYPE_HMAC_SHA1_96_AES256; + } else if (input.equalsIgnoreCase("hmac-sha256-128-aes128")) { + result = Checksum.CKSUMTYPE_HMAC_SHA256_128_AES128; + } else if (input.equalsIgnoreCase("hmac-sha384-192-aes256")) { + result = Checksum.CKSUMTYPE_HMAC_SHA384_192_AES256; } else if (input.equalsIgnoreCase("hmac-md5-rc4") || input.equalsIgnoreCase("hmac-md5-arcfour") || input.equalsIgnoreCase("hmac-md5-enc")) { diff --git a/jdk/src/share/classes/sun/security/krb5/EncryptedData.java b/jdk/src/share/classes/sun/security/krb5/EncryptedData.java index 7f93db2b9..91bb519aa 100644 --- a/jdk/src/share/classes/sun/security/krb5/EncryptedData.java +++ b/jdk/src/share/classes/sun/security/krb5/EncryptedData.java @@ -1,5 +1,5 @@ /* - * Copyright (c) 2000, 2012, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -79,6 +79,12 @@ public class EncryptedData implements Cloneable { public static final int ETYPE_AES256_CTS_HMAC_SHA1_96 = 18; // 16 0 16 + // rfc8009 + public static final int + ETYPE_AES128_CTS_HMAC_SHA256_128 = 19; // 16 0 16 + public static final int + ETYPE_AES256_CTS_HMAC_SHA384_192 = 20; // 16 0 16 + /* used by self */ private EncryptedData() { } diff --git a/jdk/src/share/classes/sun/security/krb5/EncryptionKey.java b/jdk/src/share/classes/sun/security/krb5/EncryptionKey.java index d484d7c55..627168e70 100644 --- a/jdk/src/share/classes/sun/security/krb5/EncryptionKey.java +++ b/jdk/src/share/classes/sun/security/krb5/EncryptionKey.java @@ -1,5 +1,5 @@ /* - * Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2000, 2017, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -252,6 +252,12 @@ public class EncryptionKey case EncryptedData.ETYPE_AES256_CTS_HMAC_SHA1_96: return Aes256.stringToKey(password, salt, s2kparams); + case EncryptedData.ETYPE_AES128_CTS_HMAC_SHA256_128: + return Aes128Sha2.stringToKey(password, salt, s2kparams); + + case EncryptedData.ETYPE_AES256_CTS_HMAC_SHA384_192: + return Aes256Sha2.stringToKey(password, salt, s2kparams); + default: throw new IllegalArgumentException("encryption type " + EType.toString(keyType) + " not supported"); @@ -293,6 +299,15 @@ public class EncryptionKey throw new IllegalArgumentException("Algorithm " + algorithm + " not enabled"); } + } else if (algorithm.equalsIgnoreCase("aes128-cts-hmac-sha256-128")) { + keyType = EncryptedData.ETYPE_AES128_CTS_HMAC_SHA256_128; + } else if (algorithm.equalsIgnoreCase("aes256-cts-hmac-sha384-192")) { + keyType = EncryptedData.ETYPE_AES256_CTS_HMAC_SHA384_192; + // validate if AES256 is enabled + if (!EType.isSupported(keyType)) { + throw new IllegalArgumentException("Algorithm " + algorithm + + " not enabled"); + } } else { throw new IllegalArgumentException("Algorithm " + algorithm + " not supported"); diff --git a/jdk/src/share/classes/sun/security/krb5/internal/crypto/Aes128CtsHmacSha2EType.java b/jdk/src/share/classes/sun/security/krb5/internal/crypto/Aes128CtsHmacSha2EType.java new file mode 100644 index 000000000..cbd26ce34 --- /dev/null +++ b/jdk/src/share/classes/sun/security/krb5/internal/crypto/Aes128CtsHmacSha2EType.java @@ -0,0 +1,112 @@ +/* + * Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as + * published by the Free Software Foundation. Oracle designates this + * particular file as subject to the "Classpath" exception as provided + * by Oracle in the LICENSE file that accompanied this code. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * version 2 for more details (a copy is included in the LICENSE file that + * accompanied this code). + * + * You should have received a copy of the GNU General Public License version + * 2 along with this work; if not, write to the Free Software Foundation, + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. + * + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA + * or visit www.oracle.com if you need additional information or have any + * questions. + */ + +package sun.security.krb5.internal.crypto; + +import sun.security.krb5.KrbCryptoException; +import sun.security.krb5.internal.*; +import java.security.GeneralSecurityException; +import sun.security.krb5.EncryptedData; +import sun.security.krb5.Checksum; + +/* + * This class encapsulates the encryption type for aes128-cts-hmac-sha256-128 + */ + +public final class Aes128CtsHmacSha2EType extends EType { + + public int eType() { + return EncryptedData.ETYPE_AES128_CTS_HMAC_SHA256_128; + } + + public int minimumPadSize() { + return 0; + } + + public int confounderSize() { + return blockSize(); + } + + public int checksumType() { + return Checksum.CKSUMTYPE_HMAC_SHA256_128_AES128; + } + + public int checksumSize() { + return Aes128Sha2.getChecksumLength(); + } + + public int blockSize() { + return 16; + } + + public int keyType() { + return Krb5.KEYTYPE_AES; + } + + public int keySize() { + return 16; // bytes + } + + public byte[] encrypt(byte[] data, byte[] key, int usage) + throws KrbCryptoException { + byte[] ivec = new byte[blockSize()]; + return encrypt(data, key, ivec, usage); + } + + public byte[] encrypt(byte[] data, byte[] key, byte[] ivec, int usage) + throws KrbCryptoException { + try { + return Aes128Sha2.encrypt(key, usage, ivec, data, 0, data.length); + } catch (GeneralSecurityException e) { + KrbCryptoException ke = new KrbCryptoException(e.getMessage()); + ke.initCause(e); + throw ke; + } + } + + public byte[] decrypt(byte[] cipher, byte[] key, int usage) + throws KrbApErrException, KrbCryptoException { + byte[] ivec = new byte[blockSize()]; + return decrypt(cipher, key, ivec, usage); + } + + public byte[] decrypt(byte[] cipher, byte[] key, byte[] ivec, int usage) + throws KrbApErrException, KrbCryptoException { + try { + return Aes128Sha2.decrypt(key, usage, ivec, cipher, 0, cipher.length); + } catch (GeneralSecurityException e) { + KrbCryptoException ke = new KrbCryptoException(e.getMessage()); + ke.initCause(e); + throw ke; + } + } + + // Override default, because our decrypted data does not return confounder + // Should eventually get rid of EType.decryptedData and + // EncryptedData.decryptedData altogether + public byte[] decryptedData(byte[] data) { + return data; + } +} diff --git a/jdk/src/share/classes/sun/security/krb5/internal/crypto/Aes128Sha2.java b/jdk/src/share/classes/sun/security/krb5/internal/crypto/Aes128Sha2.java new file mode 100644 index 000000000..7941993c6 --- /dev/null +++ b/jdk/src/share/classes/sun/security/krb5/internal/crypto/Aes128Sha2.java @@ -0,0 +1,83 @@ +/* + * Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as + * published by the Free Software Foundation. Oracle designates this + * particular file as subject to the "Classpath" exception as provided + * by Oracle in the LICENSE file that accompanied this code. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * version 2 for more details (a copy is included in the LICENSE file that + * accompanied this code). + * + * You should have received a copy of the GNU General Public License version + * 2 along with this work; if not, write to the Free Software Foundation, + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. + * + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA + * or visit www.oracle.com if you need additional information or have any + * questions. + */ + +package sun.security.krb5.internal.crypto; + +import sun.security.krb5.internal.crypto.dk.AesSha2DkCrypto; +import sun.security.krb5.KrbCryptoException; +import java.security.GeneralSecurityException; + +/** + * Class with static methods for doing aes128-cts-hmac-sha256-128 operations. + */ + +public class Aes128Sha2 { + private static final AesSha2DkCrypto CRYPTO = new AesSha2DkCrypto(128); + + private Aes128Sha2() { + } + + public static byte[] stringToKey(char[] password, String salt, byte[] params) + throws GeneralSecurityException { + return CRYPTO.stringToKey(password, salt, params); + } + + // in bytes + public static int getChecksumLength() { + return CRYPTO.getChecksumLength(); + } + + public static byte[] calculateChecksum(byte[] baseKey, int usage, + byte[] input, int start, int len) throws GeneralSecurityException { + return CRYPTO.calculateChecksum(baseKey, usage, input, start, len); + } + + public static byte[] encrypt(byte[] baseKey, int usage, + byte[] ivec, byte[] plaintext, int start, int len) + throws GeneralSecurityException, KrbCryptoException { + return CRYPTO.encrypt(baseKey, usage, ivec, null /* new_ivec */, + plaintext, start, len); + } + + /* Encrypt plaintext; do not add confounder, or checksum */ + public static byte[] encryptRaw(byte[] baseKey, int usage, + byte[] ivec, byte[] plaintext, int start, int len) + throws GeneralSecurityException, KrbCryptoException { + return CRYPTO.encryptRaw(baseKey, usage, ivec, plaintext, start, len); + } + + public static byte[] decrypt(byte[] baseKey, int usage, byte[] ivec, + byte[] ciphertext, int start, int len) + throws GeneralSecurityException { + return CRYPTO.decrypt(baseKey, usage, ivec, ciphertext, start, len); + } + + /* Decrypt ciphertext; do not remove confounder, or check checksum */ + public static byte[] decryptRaw(byte[] baseKey, int usage, byte[] ivec, + byte[] ciphertext, int start, int len) + throws GeneralSecurityException { + return CRYPTO.decryptRaw(baseKey, usage, ivec, ciphertext, start, len); + } +}; diff --git a/jdk/src/share/classes/sun/security/krb5/internal/crypto/Aes256CtsHmacSha2EType.java b/jdk/src/share/classes/sun/security/krb5/internal/crypto/Aes256CtsHmacSha2EType.java new file mode 100644 index 000000000..2ab783d08 --- /dev/null +++ b/jdk/src/share/classes/sun/security/krb5/internal/crypto/Aes256CtsHmacSha2EType.java @@ -0,0 +1,112 @@ +/* + * Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as + * published by the Free Software Foundation. Oracle designates this + * particular file as subject to the "Classpath" exception as provided + * by Oracle in the LICENSE file that accompanied this code. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * version 2 for more details (a copy is included in the LICENSE file that + * accompanied this code). + * + * You should have received a copy of the GNU General Public License version + * 2 along with this work; if not, write to the Free Software Foundation, + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. + * + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA + * or visit www.oracle.com if you need additional information or have any + * questions. + */ + +package sun.security.krb5.internal.crypto; + +import sun.security.krb5.KrbCryptoException; +import sun.security.krb5.internal.*; +import java.security.GeneralSecurityException; +import sun.security.krb5.EncryptedData; +import sun.security.krb5.Checksum; + +/* + * This class encapsulates the encryption type for aes256-cts-hmac-sha384-192 + */ + +public final class Aes256CtsHmacSha2EType extends EType { + + public int eType() { + return EncryptedData.ETYPE_AES256_CTS_HMAC_SHA384_192; + } + + public int minimumPadSize() { + return 0; + } + + public int confounderSize() { + return blockSize(); + } + + public int checksumType() { + return Checksum.CKSUMTYPE_HMAC_SHA384_192_AES256; + } + + public int checksumSize() { + return Aes256Sha2.getChecksumLength(); + } + + public int blockSize() { + return 16; + } + + public int keyType() { + return Krb5.KEYTYPE_AES; + } + + public int keySize() { + return 32; // bytes + } + + public byte[] encrypt(byte[] data, byte[] key, int usage) + throws KrbCryptoException { + byte[] ivec = new byte[blockSize()]; + return encrypt(data, key, ivec, usage); + } + + public byte[] encrypt(byte[] data, byte[] key, byte[] ivec, int usage) + throws KrbCryptoException { + try { + return Aes256Sha2.encrypt(key, usage, ivec, data, 0, data.length); + } catch (GeneralSecurityException e) { + KrbCryptoException ke = new KrbCryptoException(e.getMessage()); + ke.initCause(e); + throw ke; + } + } + + public byte[] decrypt(byte[] cipher, byte[] key, int usage) + throws KrbApErrException, KrbCryptoException { + byte[] ivec = new byte[blockSize()]; + return decrypt(cipher, key, ivec, usage); + } + + public byte[] decrypt(byte[] cipher, byte[] key, byte[] ivec, int usage) + throws KrbApErrException, KrbCryptoException { + try { + return Aes256Sha2.decrypt(key, usage, ivec, cipher, 0, cipher.length); + } catch (GeneralSecurityException e) { + KrbCryptoException ke = new KrbCryptoException(e.getMessage()); + ke.initCause(e); + throw ke; + } + } + + // Override default, because our decrypted data does not return confounder + // Should eventually get rid of EType.decryptedData and + // EncryptedData.decryptedData altogether + public byte[] decryptedData(byte[] data) { + return data; + } +} diff --git a/jdk/src/share/classes/sun/security/krb5/internal/crypto/Aes256Sha2.java b/jdk/src/share/classes/sun/security/krb5/internal/crypto/Aes256Sha2.java new file mode 100644 index 000000000..434611662 --- /dev/null +++ b/jdk/src/share/classes/sun/security/krb5/internal/crypto/Aes256Sha2.java @@ -0,0 +1,86 @@ +/* + * Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as + * published by the Free Software Foundation. Oracle designates this + * particular file as subject to the "Classpath" exception as provided + * by Oracle in the LICENSE file that accompanied this code. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * version 2 for more details (a copy is included in the LICENSE file that + * accompanied this code). + * + * You should have received a copy of the GNU General Public License version + * 2 along with this work; if not, write to the Free Software Foundation, + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. + * + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA + * or visit www.oracle.com if you need additional information or have any + * questions. + */ + +package sun.security.krb5.internal.crypto; + +import sun.security.krb5.internal.crypto.dk.AesSha2DkCrypto; +import sun.security.krb5.KrbCryptoException; +import java.security.GeneralSecurityException; + +/** + * Class with static methods for doing aes256-cts-hmac-sha384-192 operations. + */ + +public class Aes256Sha2 { + private static final AesSha2DkCrypto CRYPTO = new AesSha2DkCrypto(256); + + private Aes256Sha2() { + } + + public static byte[] stringToKey(char[] password, String salt, byte[] params) + throws GeneralSecurityException { + return CRYPTO.stringToKey(password, salt, params); + } + + // in bytes + public static int getChecksumLength() { + return CRYPTO.getChecksumLength(); + } + + public static byte[] calculateChecksum(byte[] baseKey, int usage, + byte[] input, int start, int len) throws GeneralSecurityException { + return CRYPTO.calculateChecksum(baseKey, usage, input, start, len); + } + + public static byte[] encrypt(byte[] baseKey, int usage, + byte[] ivec, byte[] plaintext, int start, int len) + throws GeneralSecurityException, KrbCryptoException { + return CRYPTO.encrypt(baseKey, usage, ivec, null /* new_ivec */, + plaintext, start, len); + } + + /* Encrypt plaintext; do not add confounder, padding, or checksum */ + public static byte[] encryptRaw(byte[] baseKey, int usage, + byte[] ivec, byte[] plaintext, int start, int len) + throws GeneralSecurityException, KrbCryptoException { + return CRYPTO.encryptRaw(baseKey, usage, ivec, plaintext, start, len); + } + + public static byte[] decrypt(byte[] baseKey, int usage, byte[] ivec, + byte[] ciphertext, int start, int len) + throws GeneralSecurityException { + return CRYPTO.decrypt(baseKey, usage, ivec, ciphertext, start, len); + } + + /* + * Decrypt ciphertext; do not remove confounder, padding, or check + * checksum + */ + public static byte[] decryptRaw(byte[] baseKey, int usage, byte[] ivec, + byte[] ciphertext, int start, int len) + throws GeneralSecurityException { + return CRYPTO.decryptRaw(baseKey, usage, ivec, ciphertext, start, len); + } +}; diff --git a/jdk/src/share/classes/sun/security/krb5/internal/crypto/CksumType.java b/jdk/src/share/classes/sun/security/krb5/internal/crypto/CksumType.java index b7b06a99d..a437db94c 100644 --- a/jdk/src/share/classes/sun/security/krb5/internal/crypto/CksumType.java +++ b/jdk/src/share/classes/sun/security/krb5/internal/crypto/CksumType.java @@ -85,6 +85,18 @@ public abstract class CksumType { "sun.security.krb5.internal.crypto.HmacSha1Aes256CksumType"; break; + case Checksum.CKSUMTYPE_HMAC_SHA256_128_AES128: + cksumType = new HmacSha2Aes128CksumType(); + cksumTypeName = + "sun.security.krb5.internal.crypto.HmacSha2Aes128CksumType"; + break; + + case Checksum.CKSUMTYPE_HMAC_SHA384_192_AES256: + cksumType = new HmacSha2Aes256CksumType(); + cksumTypeName = + "sun.security.krb5.internal.crypto.HmacSha2Aes256CksumType"; + break; + case Checksum.CKSUMTYPE_HMAC_MD5_ARCFOUR: cksumType = new HmacMd5ArcFourCksumType(); cksumTypeName = diff --git a/jdk/src/share/classes/sun/security/krb5/internal/crypto/EType.java b/jdk/src/share/classes/sun/security/krb5/internal/crypto/EType.java index ee59d2150..99dc65f1a 100644 --- a/jdk/src/share/classes/sun/security/krb5/internal/crypto/EType.java +++ b/jdk/src/share/classes/sun/security/krb5/internal/crypto/EType.java @@ -106,7 +106,19 @@ public abstract class EType { "sun.security.krb5.internal.crypto.Aes256CtsHmacSha1EType"; break; - case EncryptedData.ETYPE_ARCFOUR_HMAC: + case EncryptedData.ETYPE_AES128_CTS_HMAC_SHA256_128: + eType = new Aes128CtsHmacSha2EType(); + eTypeName = + "sun.security.krb5.internal.crypto.Aes128CtsHmacSha2EType"; + break; + + case EncryptedData.ETYPE_AES256_CTS_HMAC_SHA384_192: + eType = new Aes256CtsHmacSha2EType(); + eTypeName = + "sun.security.krb5.internal.crypto.Aes256CtsHmacSha2EType"; + break; + + case EncryptedData.ETYPE_ARCFOUR_HMAC: eType = new ArcFourHmacEType(); eTypeName = "sun.security.krb5.internal.crypto.ArcFourHmacEType"; break; @@ -189,20 +201,23 @@ public abstract class EType { // is set to false. private static final int[] BUILTIN_ETYPES = new int[] { - EncryptedData.ETYPE_AES256_CTS_HMAC_SHA1_96, - EncryptedData.ETYPE_AES128_CTS_HMAC_SHA1_96, - EncryptedData.ETYPE_DES3_CBC_HMAC_SHA1_KD, - EncryptedData.ETYPE_ARCFOUR_HMAC, - EncryptedData.ETYPE_DES_CBC_CRC, - EncryptedData.ETYPE_DES_CBC_MD5, + EncryptedData.ETYPE_AES256_CTS_HMAC_SHA1_96, + EncryptedData.ETYPE_AES128_CTS_HMAC_SHA1_96, + EncryptedData.ETYPE_AES256_CTS_HMAC_SHA384_192, + EncryptedData.ETYPE_AES128_CTS_HMAC_SHA256_128, + EncryptedData.ETYPE_DES3_CBC_HMAC_SHA1_KD, + EncryptedData.ETYPE_ARCFOUR_HMAC, + EncryptedData.ETYPE_DES_CBC_CRC, + EncryptedData.ETYPE_DES_CBC_MD5, }; private static final int[] BUILTIN_ETYPES_NOAES256 = new int[] { - EncryptedData.ETYPE_AES128_CTS_HMAC_SHA1_96, - EncryptedData.ETYPE_DES3_CBC_HMAC_SHA1_KD, - EncryptedData.ETYPE_ARCFOUR_HMAC, - EncryptedData.ETYPE_DES_CBC_CRC, - EncryptedData.ETYPE_DES_CBC_MD5, + EncryptedData.ETYPE_AES128_CTS_HMAC_SHA1_96, + EncryptedData.ETYPE_AES128_CTS_HMAC_SHA256_128, + EncryptedData.ETYPE_DES3_CBC_HMAC_SHA1_KD, + EncryptedData.ETYPE_ARCFOUR_HMAC, + EncryptedData.ETYPE_DES_CBC_CRC, + EncryptedData.ETYPE_DES_CBC_MD5, }; @@ -363,7 +378,10 @@ public abstract class EType { return "RC4 with HMAC"; case 24: return "RC4 with HMAC EXP"; - + case EncryptedData.ETYPE_AES128_CTS_HMAC_SHA256_128: + return "AES128 CTS mode with HMAC SHA256-128"; + case EncryptedData.ETYPE_AES256_CTS_HMAC_SHA384_192: + return "AES256 CTS mode with HMAC SHA384-192"; } return "Unknown (" + type + ")"; } diff --git a/jdk/src/share/classes/sun/security/krb5/internal/crypto/HmacSha2Aes128CksumType.java b/jdk/src/share/classes/sun/security/krb5/internal/crypto/HmacSha2Aes128CksumType.java new file mode 100644 index 000000000..68b841e6d --- /dev/null +++ b/jdk/src/share/classes/sun/security/krb5/internal/crypto/HmacSha2Aes128CksumType.java @@ -0,0 +1,106 @@ +/* + * Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as + * published by the Free Software Foundation. Oracle designates this + * particular file as subject to the "Classpath" exception as provided + * by Oracle in the LICENSE file that accompanied this code. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * version 2 for more details (a copy is included in the LICENSE file that + * accompanied this code). + * + * You should have received a copy of the GNU General Public License version + * 2 along with this work; if not, write to the Free Software Foundation, + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. + * + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA + * or visit www.oracle.com if you need additional information or have any + * questions. + */ + +package sun.security.krb5.internal.crypto; + +import sun.security.krb5.Checksum; +import sun.security.krb5.KrbCryptoException; +import sun.security.krb5.internal.*; +import java.security.GeneralSecurityException; + +/* + * This class encapsulates the checksum type for aes128-cts-sha256 + */ + +public class HmacSha2Aes128CksumType extends CksumType { + + public HmacSha2Aes128CksumType() { + } + + public int confounderSize() { + return 16; + } + + public int cksumType() { + return Checksum.CKSUMTYPE_HMAC_SHA256_128_AES128; + } + + public boolean isKeyed() { + return true; + } + + public int cksumSize() { + return 16; // bytes + } + + public int keyType() { + return Krb5.KEYTYPE_AES; + } + + public int keySize() { + return 16; // bytes + } + + /** + * Calculates keyed checksum. + * @param data the data used to generate the checksum. + * @param size length of the data. + * @param key the key used to encrypt the checksum. + * @return keyed checksum. + */ + public byte[] calculateChecksum(byte[] data, int size, byte[] key, + int usage) throws KrbCryptoException { + + try { + return Aes128Sha2.calculateChecksum(key, usage, data, 0, size); + } catch (GeneralSecurityException e) { + KrbCryptoException ke = new KrbCryptoException(e.getMessage()); + ke.initCause(e); + throw ke; + } + } + + /** + * Verifies keyed checksum. + * @param data the data. + * @param size the length of data. + * @param key the key used to encrypt the checksum. + * @param checksum the checksum. + * @return true if verification is successful. + */ + public boolean verifyChecksum(byte[] data, int size, + byte[] key, byte[] checksum, int usage) throws KrbCryptoException { + + try { + byte[] newCksum = Aes128Sha2.calculateChecksum(key, usage, + data, 0, size); + return isChecksumEqual(checksum, newCksum); + } catch (GeneralSecurityException e) { + KrbCryptoException ke = new KrbCryptoException(e.getMessage()); + ke.initCause(e); + throw ke; + } + } +} diff --git a/jdk/src/share/classes/sun/security/krb5/internal/crypto/HmacSha2Aes256CksumType.java b/jdk/src/share/classes/sun/security/krb5/internal/crypto/HmacSha2Aes256CksumType.java new file mode 100644 index 000000000..23772205c --- /dev/null +++ b/jdk/src/share/classes/sun/security/krb5/internal/crypto/HmacSha2Aes256CksumType.java @@ -0,0 +1,106 @@ +/* + * Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as + * published by the Free Software Foundation. Oracle designates this + * particular file as subject to the "Classpath" exception as provided + * by Oracle in the LICENSE file that accompanied this code. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * version 2 for more details (a copy is included in the LICENSE file that + * accompanied this code). + * + * You should have received a copy of the GNU General Public License version + * 2 along with this work; if not, write to the Free Software Foundation, + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. + * + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA + * or visit www.oracle.com if you need additional information or have any + * questions. + */ + +package sun.security.krb5.internal.crypto; + +import sun.security.krb5.Checksum; +import sun.security.krb5.KrbCryptoException; +import sun.security.krb5.internal.*; +import java.security.GeneralSecurityException; + +/* + * This class encapsulates the checksum type for aes256-cts-sha384 + */ + +public class HmacSha2Aes256CksumType extends CksumType { + + public HmacSha2Aes256CksumType() { + } + + public int confounderSize() { + return 16; + } + + public int cksumType() { + return Checksum.CKSUMTYPE_HMAC_SHA384_192_AES256; + } + + public boolean isKeyed() { + return true; + } + + public int cksumSize() { + return 24; // bytes + } + + public int keyType() { + return Krb5.KEYTYPE_AES; + } + + public int keySize() { + return 32; // bytes + } + + /** + * Calculates keyed checksum. + * @param data the data used to generate the checksum. + * @param size length of the data. + * @param key the key used to encrypt the checksum. + * @return keyed checksum. + */ + public byte[] calculateChecksum(byte[] data, int size, byte[] key, + int usage) throws KrbCryptoException { + + try { + return Aes256Sha2.calculateChecksum(key, usage, data, 0, size); + } catch (GeneralSecurityException e) { + KrbCryptoException ke = new KrbCryptoException(e.getMessage()); + ke.initCause(e); + throw ke; + } + } + + /** + * Verifies keyed checksum. + * @param data the data. + * @param size the length of data. + * @param key the key used to encrypt the checksum. + * @param checksum the checksum. + * @return true if verification is successful. + */ + public boolean verifyChecksum(byte[] data, int size, + byte[] key, byte[] checksum, int usage) throws KrbCryptoException { + + try { + byte[] newCksum = Aes256Sha2.calculateChecksum(key, usage, data, + 0, size); + return isChecksumEqual(checksum, newCksum); + } catch (GeneralSecurityException e) { + KrbCryptoException ke = new KrbCryptoException(e.getMessage()); + ke.initCause(e); + throw ke; + } + } +} diff --git a/jdk/src/share/classes/sun/security/krb5/internal/crypto/dk/AesSha2DkCrypto.java b/jdk/src/share/classes/sun/security/krb5/internal/crypto/dk/AesSha2DkCrypto.java new file mode 100644 index 000000000..f46e18509 --- /dev/null +++ b/jdk/src/share/classes/sun/security/krb5/internal/crypto/dk/AesSha2DkCrypto.java @@ -0,0 +1,541 @@ +/* + * Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as + * published by the Free Software Foundation. Oracle designates this + * particular file as subject to the "Classpath" exception as provided + * by Oracle in the LICENSE file that accompanied this code. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * version 2 for more details (a copy is included in the LICENSE file that + * accompanied this code). + * + * You should have received a copy of the GNU General Public License version + * 2 along with this work; if not, write to the Free Software Foundation, + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. + * + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA + * or visit www.oracle.com if you need additional information or have any + * questions. + */ + +/* + */ + +package sun.security.krb5.internal.crypto.dk; + +import javax.crypto.Cipher; +import javax.crypto.Mac; +import javax.crypto.SecretKeyFactory; +import javax.crypto.SecretKey; +import javax.crypto.spec.SecretKeySpec; +import javax.crypto.spec.IvParameterSpec; +import javax.crypto.spec.PBEKeySpec; +import java.security.GeneralSecurityException; +import sun.security.krb5.KrbCryptoException; +import sun.security.krb5.Confounder; +import sun.security.krb5.internal.crypto.KeyUsage; +import java.util.Arrays; + +/** + * This class provides the implementation of AES Encryption with + * HMAC-SHA2 for Kerberos 5 + * https://tools.ietf.org/html/rfc8009 + * + * Algorithm profile described in [KCRYPTO]: + * +--------------------------------------------------------------------+ + * | protocol key format 128- or 256-bit string | + * | | + * | string-to-key function PBKDF2+DK with variable | + * | iteration count (see | + * | above) | + * | | + * | default string-to-key parameters 00 00 80 00 | + * | | + * | key-generation seed length key size | + * | | + * | random-to-key function identity function | + * | | + * | hash function, H SHA-256 / SHA-384 | + * | | + * | HMAC output size, h 16/24 octets | + * | | + * | message block size, m 1 octet | + * | | + * | encryption/decryption functions, AES in CBC-CTS mode | + * | E and D (cipher block size 16 | + * | octets), with next to | + * | last block as CBC-style | + * | ivec | + * +--------------------------------------------------------------------+ + * + * Supports aes128-cts-hmac-sha256-128 and aes256-cts-hmac-sha384-192 + */ + +public class AesSha2DkCrypto extends DkCrypto { + + private static final boolean debug = false; + + private static final int BLOCK_SIZE = 16; + private static final int DEFAULT_ITERATION_COUNT = 32768; + private static final byte[] ZERO_IV = new byte[] { 0, 0, 0, 0, 0, 0, 0, 0, + 0, 0, 0, 0, 0, 0, 0, 0 }; + + private static final byte[] ETYPE_NAME_128 = + "aes128-cts-hmac-sha256-128".getBytes(); + private static final byte[] ETYPE_NAME_256 = + "aes256-cts-hmac-sha384-192".getBytes(); + + private final int hashSize; + private final int keyLength; + + public AesSha2DkCrypto(int length) { + keyLength = length; + hashSize = (length == 128?128:192)/8; + } + + protected int getKeySeedLength() { + return keyLength; // bits; AES key material + } + + public byte[] stringToKey(char[] password, String salt, byte[] s2kparams) + throws GeneralSecurityException { + + byte[] saltUtf8 = null; + try { + saltUtf8 = salt.getBytes("UTF-8"); + return stringToKey(password, saltUtf8, s2kparams); + } catch (Exception e) { + return null; + } finally { + if (saltUtf8 != null) { + Arrays.fill(saltUtf8, (byte)0); + } + } + } + + // https://tools.ietf.org/html/rfc8009#section-4 + private byte[] stringToKey(char[] secret, byte[] salt, byte[] params) + throws GeneralSecurityException { + + int iter_count = DEFAULT_ITERATION_COUNT; + if (params != null) { + if (params.length != 4) { + throw new RuntimeException("Invalid parameter to stringToKey"); + } + iter_count = readBigEndian(params, 0, 4); + } + + byte[] saltp = new byte[26 + 1 + salt.length]; + if (keyLength == 128) { + System.arraycopy(ETYPE_NAME_128, 0, saltp, 0, 26); + } else { + System.arraycopy(ETYPE_NAME_256, 0, saltp, 0, 26); + } + System.arraycopy(salt, 0, saltp, 27, salt.length); + byte[] tmpKey = randomToKey(PBKDF2(secret, saltp, iter_count, + getKeySeedLength())); + byte[] result = dk(tmpKey, KERBEROS_CONSTANT); + return result; + } + + protected byte[] randomToKey(byte[] in) { + // simple identity operation + return in; + } + + /* + * https://tools.ietf.org/html/rfc8009#section-3 defines + * a new key derivation function: + * + * KDF-HMAC-SHA2(key, label, k) = k-truncate(K1) + * K1 = HMAC-SHA-256(key, 0x00000001 | label | 0x00 | k) or + * K1 = HMAC-SHA-384(key, 0x00000001 | label | 0x00 | k) + * + * where label is constant below. + */ + protected byte[] dr(byte[] key, byte[] constant) + throws GeneralSecurityException { + byte[] result; + byte[] input = new byte[constant.length + 9]; + // 0x00000001 at the beginning + input[3] = 1; + // label follows + System.arraycopy(constant, 0, input, 4, constant.length); + SecretKeySpec tkey = new SecretKeySpec(key, "HMAC"); + Mac mac = Mac.getInstance( + keyLength == 128? "HmacSHA256": "HmacSHA384"); + mac.init(tkey); + + int k; + if (keyLength == 128) { + // key length for enc and hmac both 128 + k = 128; + } else { + byte last = constant[constant.length-1]; + if (last == (byte)0x99 || last == (byte)0x55) { + // 192 for hmac + k = 192; + } else { + // 256 for enc + k = 256; + } + } + // 0x00 and k at the end + input[input.length - 1] = (byte)(k); + input[input.length - 2] = (byte)(k / 256); + + result = mac.doFinal(input); + return Arrays.copyOf(result, k / 8); + } + + protected Cipher getCipher(byte[] key, byte[] ivec, int mode) + throws GeneralSecurityException { + + // IV + if (ivec == null) { + ivec = ZERO_IV; + } + SecretKeySpec secretKey = new SecretKeySpec(key, "AES"); + Cipher cipher = Cipher.getInstance("AES/CBC/NoPadding"); + IvParameterSpec encIv = new IvParameterSpec(ivec, 0, ivec.length); + cipher.init(mode, secretKey, encIv); + return cipher; + } + + // get an instance of the AES Cipher in CTS mode + public int getChecksumLength() { + return hashSize; // bytes + } + + /** + * Get the truncated HMAC + */ + protected byte[] getHmac(byte[] key, byte[] msg) + throws GeneralSecurityException { + + SecretKey keyKi = new SecretKeySpec(key, "HMAC"); + Mac m = Mac.getInstance(keyLength == 128 ? "HmacSHA256" : "HmacSHA384"); + m.init(keyKi); + + // generate hash + byte[] hash = m.doFinal(msg); + + // truncate hash + byte[] output = new byte[hashSize]; + System.arraycopy(hash, 0, output, 0, hashSize); + return output; + } + + private byte[] deriveKey(byte[] baseKey, int usage, byte type) + throws GeneralSecurityException { + byte[] constant = new byte[5]; + constant[0] = (byte) ((usage>>24)&0xff); + constant[1] = (byte) ((usage>>16)&0xff); + constant[2] = (byte) ((usage>>8)&0xff); + constant[3] = (byte) (usage&0xff); + constant[4] = type; + return dk(baseKey, constant); + } + + /** + * Calculate the checksum + */ + public byte[] calculateChecksum(byte[] baseKey, int usage, byte[] input, + int start, int len) throws GeneralSecurityException { + + if (!KeyUsage.isValid(usage)) { + throw new GeneralSecurityException("Invalid key usage number: " + + usage); + } + + byte[] Kc = deriveKey(baseKey, usage, (byte) 0x99); // Checksum key + if (debug) { + System.err.println("usage: " + usage); + traceOutput("input", input, start, Math.min(len, 32)); + traceOutput("baseKey", baseKey, 0, baseKey.length); + traceOutput("Kc", Kc, 0, Kc.length); + } + + try { + // Generate checksum + // H1 = HMAC(Kc, input) + byte[] hmac = getHmac(Kc, input); + if (debug) { + traceOutput("hmac", hmac, 0, hmac.length); + } + if (hmac.length == getChecksumLength()) { + return hmac; + } else if (hmac.length > getChecksumLength()) { + byte[] buf = new byte[getChecksumLength()]; + System.arraycopy(hmac, 0, buf, 0, buf.length); + return buf; + } else { + throw new GeneralSecurityException("checksum size too short: " + + hmac.length + "; expecting : " + getChecksumLength()); + } + } finally { + Arrays.fill(Kc, 0, Kc.length, (byte)0); + } + } + + /** + * Performs encryption using derived key; adds confounder. + */ + public byte[] encrypt(byte[] baseKey, int usage, + byte[] ivec, byte[] new_ivec, byte[] plaintext, int start, int len) + throws GeneralSecurityException, KrbCryptoException { + + if (!KeyUsage.isValid(usage)) { + throw new GeneralSecurityException("Invalid key usage number: " + + usage); + } + byte[] output = encryptCTS(baseKey, usage, ivec, new_ivec, plaintext, + start, len, true); + return output; + } + + /** + * Performs encryption using derived key; does not add confounder. + */ + public byte[] encryptRaw(byte[] baseKey, int usage, + byte[] ivec, byte[] plaintext, int start, int len) + throws GeneralSecurityException, KrbCryptoException { + + if (!KeyUsage.isValid(usage)) { + throw new GeneralSecurityException("Invalid key usage number: " + + usage); + } + byte[] output = encryptCTS(baseKey, usage, ivec, null, plaintext, + start, len, false); + return output; + } + + /** + * @param baseKey key from which keys are to be derived using usage + * @param ciphertext E(Ke, conf | plaintext | padding, ivec) | H1[1..h] + */ + public byte[] decrypt(byte[] baseKey, int usage, byte[] ivec, + byte[] ciphertext, int start, int len) throws GeneralSecurityException { + + if (!KeyUsage.isValid(usage)) { + throw new GeneralSecurityException("Invalid key usage number: " + + usage); + } + byte[] output = decryptCTS(baseKey, usage, ivec, ciphertext, + start, len, true); + return output; + } + + /** + * Decrypts data using specified key and initial vector. + * @param baseKey encryption key to use + * @param ciphertext encrypted data to be decrypted + * @param usage ignored + */ + public byte[] decryptRaw(byte[] baseKey, int usage, byte[] ivec, + byte[] ciphertext, int start, int len) + throws GeneralSecurityException { + + if (!KeyUsage.isValid(usage)) { + throw new GeneralSecurityException("Invalid key usage number: " + + usage); + } + byte[] output = decryptCTS(baseKey, usage, ivec, ciphertext, + start, len, false); + return output; + } + + /** + * Encrypt AES in CBC-CTS mode using derived keys. + */ + private byte[] encryptCTS(byte[] baseKey, int usage, byte[] ivec, + byte[] new_ivec, byte[] plaintext, int start, int len, + boolean confounder_exists) + throws GeneralSecurityException, KrbCryptoException { + + byte[] Ke = null; + byte[] Ki = null; + + if (debug) { + System.err.println("usage: " + usage); + if (ivec != null) { + traceOutput("old_state.ivec", ivec, 0, ivec.length); + } + traceOutput("plaintext", plaintext, start, Math.min(len, 32)); + traceOutput("baseKey", baseKey, 0, baseKey.length); + } + + try { + Ke = deriveKey(baseKey, usage, (byte) 0xaa); // Encryption key + + byte[] toBeEncrypted = null; + if (confounder_exists) { + byte[] confounder = Confounder.bytes(BLOCK_SIZE); + toBeEncrypted = new byte[confounder.length + len]; + System.arraycopy(confounder, 0, toBeEncrypted, + 0, confounder.length); + System.arraycopy(plaintext, start, toBeEncrypted, + confounder.length, len); + } else { + toBeEncrypted = new byte[len]; + System.arraycopy(plaintext, start, toBeEncrypted, 0, len); + } + + // encryptedData + HMAC + byte[] output = new byte[toBeEncrypted.length + hashSize]; + + // AES in JCE + Cipher cipher = Cipher.getInstance("AES/CTS/NoPadding"); + SecretKeySpec secretKey = new SecretKeySpec(Ke, "AES"); + IvParameterSpec encIv = new IvParameterSpec(ivec, 0, ivec.length); + cipher.init(Cipher.ENCRYPT_MODE, secretKey, encIv); + cipher.doFinal(toBeEncrypted, 0, toBeEncrypted.length, output); + + Ki = deriveKey(baseKey, usage, (byte) 0x55); + if (debug) { + traceOutput("Ki", Ki, 0, Ke.length); + } + + // Generate checksum + // H = HMAC(Ki, IV | C) + byte[] msg = Arrays.copyOf(ivec, ivec.length + toBeEncrypted.length); + System.arraycopy(output, 0, msg, ivec.length, toBeEncrypted.length); + byte[] hmac = getHmac(Ki, msg); + + // encryptedData + HMAC + System.arraycopy(hmac, 0, output, toBeEncrypted.length, + hmac.length); + return output; + } finally { + if (Ke != null) { + Arrays.fill(Ke, 0, Ke.length, (byte) 0); + } + if (Ki != null) { + Arrays.fill(Ki, 0, Ki.length, (byte) 0); + } + } + } + + /** + * Decrypt AES in CBC-CTS mode using derived keys. + */ + private byte[] decryptCTS(byte[] baseKey, int usage, byte[] ivec, + byte[] ciphertext, int start, int len, boolean confounder_exists) + throws GeneralSecurityException { + + byte[] Ke = null; + byte[] Ki = null; + + try { + Ke = deriveKey(baseKey, usage, (byte) 0xaa); // Encryption key + + if (debug) { + System.err.println("usage: " + usage); + if (ivec != null) { + traceOutput("old_state.ivec", ivec, 0, ivec.length); + } + traceOutput("ciphertext", ciphertext, start, Math.min(len, 32)); + traceOutput("baseKey", baseKey, 0, baseKey.length); + traceOutput("Ke", Ke, 0, Ke.length); + } + + // Decrypt [confounder | plaintext ] (without checksum) + + // AES in JCE + Cipher cipher = Cipher.getInstance("AES/CTS/NoPadding"); + SecretKeySpec secretKey = new SecretKeySpec(Ke, "AES"); + IvParameterSpec encIv = new IvParameterSpec(ivec, 0, ivec.length); + cipher.init(Cipher.DECRYPT_MODE, secretKey, encIv); + byte[] plaintext = cipher.doFinal(ciphertext, start, len-hashSize); + + if (debug) { + traceOutput("AES PlainText", plaintext, 0, + Math.min(plaintext.length, 32)); + } + + Ki = deriveKey(baseKey, usage, (byte) 0x55); // Integrity key + if (debug) { + traceOutput("Ki", Ki, 0, Ke.length); + } + + // Verify checksum + // H = HMAC(Ki, IV | C) + byte[] msg = Arrays.copyOf(ivec, ivec.length + len-hashSize); + System.arraycopy(ciphertext, start, msg, ivec.length, len-hashSize); + byte[] calculatedHmac = getHmac(Ki, msg); + int hmacOffset = start + len - hashSize; + if (debug) { + traceOutput("calculated Hmac", calculatedHmac, + 0, calculatedHmac.length); + traceOutput("message Hmac", ciphertext, hmacOffset, hashSize); + } + boolean cksumFailed = false; + if (calculatedHmac.length >= hashSize) { + for (int i = 0; i < hashSize; i++) { + if (calculatedHmac[i] != ciphertext[hmacOffset+i]) { + cksumFailed = true; + if (debug) { + System.err.println("Checksum failed !"); + } + break; + } + } + } + if (cksumFailed) { + throw new GeneralSecurityException("Checksum failed"); + } + + if (confounder_exists) { + // Get rid of confounder + // [ confounder | plaintext ] + byte[] output = new byte[plaintext.length - BLOCK_SIZE]; + System.arraycopy(plaintext, BLOCK_SIZE, output, + 0, output.length); + return output; + } else { + return plaintext; + } + } finally { + if (Ke != null) { + Arrays.fill(Ke, 0, Ke.length, (byte) 0); + } + if (Ki != null) { + Arrays.fill(Ki, 0, Ki.length, (byte) 0); + } + } + } + + /* + * Invoke the PKCS#5 PBKDF2 algorithm + */ + private static byte[] PBKDF2(char[] secret, byte[] salt, + int count, int keyLength) throws GeneralSecurityException { + + PBEKeySpec keySpec = new PBEKeySpec(secret, salt, count, keyLength); + SecretKeyFactory skf = + SecretKeyFactory.getInstance(keyLength == 128 ? + "PBKDF2WithHmacSHA256" : "PBKDF2WithHmacSHA384"); + SecretKey key = skf.generateSecret(keySpec); + byte[] result = key.getEncoded(); + + return result; + } + + public static final int readBigEndian(byte[] data, int pos, int size) { + int retVal = 0; + int shifter = (size-1)*8; + while (size > 0) { + retVal += (data[pos] & 0xff) << shifter; + shifter -= 8; + pos++; + size--; + } + return retVal; + } + +} diff --git a/jdk/src/share/classes/sun/security/krb5/internal/crypto/dk/DkCrypto.java b/jdk/src/share/classes/sun/security/krb5/internal/crypto/dk/DkCrypto.java index 506d8749c..e0d8bca0e 100644 --- a/jdk/src/share/classes/sun/security/krb5/internal/crypto/dk/DkCrypto.java +++ b/jdk/src/share/classes/sun/security/krb5/internal/crypto/dk/DkCrypto.java @@ -1,5 +1,5 @@ /* - * Copyright (c) 2004, 2007, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2004, 2017, Oracle and/or its affiliates. All rights reserved. */ /* @@ -478,7 +478,7 @@ public abstract class DkCrypto { * * DR(Key, Constant) = k-truncate(K1 | K2 | K3 | K4 ...) */ - private byte[] dr(byte[] key, byte[] constant) + protected byte[] dr(byte[] key, byte[] constant) throws GeneralSecurityException { Cipher encCipher = getCipher(key, null, Cipher.ENCRYPT_MODE); @@ -668,7 +668,7 @@ public abstract class DkCrypto { new HexDumpEncoder().encodeBuffer( new ByteArrayInputStream(output, offset, len), out); - System.err.println(traceTag + ":" + out.toString()); + System.err.println(traceTag + ":\n" + out.toString()); } catch (Exception e) { } } diff --git a/jdk/test/sun/security/krb5/auto/BasicKrb5Test.java b/jdk/test/sun/security/krb5/auto/BasicKrb5Test.java index f18ae1642..63b5a9f07 100644 --- a/jdk/test/sun/security/krb5/auto/BasicKrb5Test.java +++ b/jdk/test/sun/security/krb5/auto/BasicKrb5Test.java @@ -1,5 +1,5 @@ /* - * Copyright (c) 2008, 2013, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2008, 2017, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -23,44 +23,50 @@ /* * @test - * @bug 6706974 + * @bug 6706974 8014628 * @summary Add krb5 test infrastructure * @compile -XDignore.symbol.file BasicKrb5Test.java * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test des-cbc-crc * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test des-cbc-md5 * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test des3-cbc-sha1 - * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test aes128-cts - * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test aes256-cts + * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test aes128-sha1 + * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test aes256-sha1 + * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test aes128-sha2 + * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test aes256-sha2 * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test rc4-hmac * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test -s * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test des-cbc-crc -s * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test des-cbc-md5 -s * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test des3-cbc-sha1 -s - * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test aes128-cts -s - * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test aes256-cts -s + * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test aes128-sha1 -s + * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test aes256-sha1 -s + * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test aes128-sha2 -s + * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test aes256-sha2 -s * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test rc4-hmac -s * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test -C * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test des-cbc-crc -C * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test des-cbc-md5 -C * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test des3-cbc-sha1 -C - * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test aes128-cts -C - * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test aes256-cts -C + * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test aes128-sha1 -C + * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test aes256-sha1 -C + * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test aes128-sha2 -C + * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test aes256-sha2 -C * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test rc4-hmac -C * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test -s -C * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test des-cbc-crc -s -C * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test des-cbc-md5 -s -C * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test des3-cbc-sha1 -s -C - * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test aes128-cts -s -C - * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test aes256-cts -s -C + * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test aes128-sha1 -s -C + * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test aes256-sha1 -s -C + * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test aes128-sha2 -s -C + * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test aes256-sha2 -s -C * @run main/othervm -Dsun.net.spi.nameservice.provider.1=ns,mock BasicKrb5Test rc4-hmac -s -C */ import org.ietf.jgss.GSSName; import sun.security.jgss.GSSUtil; -import sun.security.krb5.Config; import sun.security.krb5.KrbException; -import sun.security.krb5.internal.crypto.EType; /** * Basic JGSS/krb5 test with 3 parties: client, server, backend server. Each diff --git a/jdk/test/sun/security/krb5/auto/KDC.java b/jdk/test/sun/security/krb5/auto/KDC.java index 34dd482a2..b60bc0609 100644 --- a/jdk/test/sun/security/krb5/auto/KDC.java +++ b/jdk/test/sun/security/krb5/auto/KDC.java @@ -633,19 +633,7 @@ public class KDC { */ private static EncryptionKey generateRandomKey(int eType) throws KrbException { - // Is 32 enough for AES256? I should have generated the keys directly - // but different cryptos have different rules on what keys are valid. - char[] pass = randomPassword(); - String algo; - switch (eType) { - case EncryptedData.ETYPE_DES_CBC_MD5: algo = "DES"; break; - case EncryptedData.ETYPE_DES3_CBC_HMAC_SHA1_KD: algo = "DESede"; break; - case EncryptedData.ETYPE_AES128_CTS_HMAC_SHA1_96: algo = "AES128"; break; - case EncryptedData.ETYPE_ARCFOUR_HMAC: algo = "ArcFourHMAC"; break; - case EncryptedData.ETYPE_AES256_CTS_HMAC_SHA1_96: algo = "AES256"; break; - default: algo = "DES"; break; - } - return new EncryptionKey(pass, "NOTHING", algo); // Silly + return genKey0(randomPassword(), "NOTHING", null, eType, null); } /** @@ -709,6 +697,8 @@ public class KDC { switch (etype) { case EncryptedData.ETYPE_AES128_CTS_HMAC_SHA1_96: case EncryptedData.ETYPE_AES256_CTS_HMAC_SHA1_96: + case EncryptedData.ETYPE_AES128_CTS_HMAC_SHA256_128: + case EncryptedData.ETYPE_AES256_CTS_HMAC_SHA384_192: String pn = p.toString(); if (p.getRealmString() == null) { pn = pn + "@" + getRealm(); @@ -716,7 +706,11 @@ public class KDC { if (s2kparamses.containsKey(pn)) { return s2kparamses.get(pn); } - return new byte[] {0, 0, 0x10, 0}; + if (etype < EncryptedData.ETYPE_AES128_CTS_HMAC_SHA256_128) { + return new byte[]{0, 0, 0x10, 0}; + } else { + return new byte[]{0, 0, (byte) 0x80, 0}; + } default: return null; } @@ -744,9 +738,8 @@ public class KDC { kvno = pass[pass.length-1] - '0'; } } - return new EncryptionKey(EncryptionKeyDotStringToKey( - getPassword(p, server), getSalt(p), getParams(p, etype), etype), - etype, kvno); + return genKey0(getPassword(p, server), getSalt(p), + getParams(p, etype), etype, kvno); } catch (KrbException ke) { throw ke; } catch (Exception e) { @@ -763,6 +756,17 @@ public class KDC { return new KerberosTime(new Date().getTime() + offset * 1000L); } + /** + * Generates key from password. + */ + private static EncryptionKey genKey0( + char[] pass, String salt, byte[] s2kparams, + int etype, Integer kvno) throws KrbException { + return new EncryptionKey(EncryptionKeyDotStringToKey( + pass, salt, s2kparams, etype), + etype, kvno); + } + /** * Processes an incoming request and generates a response. * @param in the request @@ -1258,8 +1262,8 @@ public class KDC { } boolean allOld = true; for (int i: eTypes) { - if (i == EncryptedData.ETYPE_AES128_CTS_HMAC_SHA1_96 || - i == EncryptedData.ETYPE_AES256_CTS_HMAC_SHA1_96) { + if (i >= EncryptedData.ETYPE_AES128_CTS_HMAC_SHA1_96 && + i != EncryptedData.ETYPE_ARCFOUR_HMAC) { allOld = false; break; } diff --git a/jdk/test/sun/security/krb5/auto/ReplayCacheTestProc.java b/jdk/test/sun/security/krb5/auto/ReplayCacheTestProc.java index 6413e155b..b59832f73 100644 --- a/jdk/test/sun/security/krb5/auto/ReplayCacheTestProc.java +++ b/jdk/test/sun/security/krb5/auto/ReplayCacheTestProc.java @@ -1,5 +1,5 @@ /* - * Copyright (c) 2013, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2013, 2017, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -23,7 +23,7 @@ /* * @test - * @bug 7152176 + * @bug 7152176 8014628 * @summary More krb5 tests * @library ../../../../java/security/testlibrary/ * @compile -XDignore.symbol.file ReplayCacheTestProc.java @@ -95,8 +95,13 @@ public class ReplayCacheTestProc { kdc.addPrincipalRandKey(peer(i)); } + // Native lib might not support aes-sha2 + KDC.saveConfig(OneKDC.KRB5_CONF, kdc, + "default_tkt_enctypes = aes128-cts", + "default_tgs_enctypes = aes128-cts"); + + // Write KTAB after krb5.conf so it contains no aes-sha2 keys kdc.writeKtab(OneKDC.KTAB); - KDC.saveConfig(OneKDC.KRB5_CONF, kdc); if (mode != -1) { // A special native server to check basic sanity diff --git a/jdk/test/sun/security/krb5/etype/ETypeOrder.java b/jdk/test/sun/security/krb5/etype/ETypeOrder.java index 9437b16ed..be36d6372 100644 --- a/jdk/test/sun/security/krb5/etype/ETypeOrder.java +++ b/jdk/test/sun/security/krb5/etype/ETypeOrder.java @@ -1,5 +1,5 @@ /* - * Copyright (c) 2010, 2011, Oracle and/or its affiliates. All rights reserved. + * Copyright (c) 2010, 2017, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it @@ -37,7 +37,7 @@ public class ETypeOrder { int[] etypes = EType.getBuiltInDefaults(); // Reference order, note that 2 is not implemented in Java - int correct[] = { 18, 17, 16, 23, 1, 3, 2 }; + int correct[] = { 18, 17, 20, 19, 16, 23, 1, 3, 2 }; int match = 0; loopi: for (int i=0; i<etypes.length; i++) { diff --git a/jdk/test/sun/security/krb5/etype/KerberosAesSha2.java b/jdk/test/sun/security/krb5/etype/KerberosAesSha2.java new file mode 100644 index 000000000..bb2b31886 --- /dev/null +++ b/jdk/test/sun/security/krb5/etype/KerberosAesSha2.java @@ -0,0 +1,209 @@ +/* + * Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as + * published by the Free Software Foundation. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * version 2 for more details (a copy is included in the LICENSE file that + * accompanied this code). + * + * You should have received a copy of the GNU General Public License version + * 2 along with this work; if not, write to the Free Software Foundation, + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. + * + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA + * or visit www.oracle.com if you need additional information or have any + * questions. + */ +/* + * @test + * @bug 8014628 + * @modules java.base/sun.security.util + * java.security.jgss/sun.security.krb5.internal.crypto.dk:+open + * @summary https://tools.ietf.org/html/rfc8009 Test Vectors + */ + +import javax.crypto.Cipher; +import java.lang.reflect.Method; +import java.util.Arrays; + +import sun.security.krb5.internal.crypto.dk.AesSha2DkCrypto; +import sun.misc.HexDumpEncoder; + +public class KerberosAesSha2 { + + public static void main(String[] args) throws Exception { + + AesSha2DkCrypto dk128 = new AesSha2DkCrypto(128); + AesSha2DkCrypto dk256 = new AesSha2DkCrypto(256); + + boolean aes256ok = Cipher.getMaxAllowedKeyLength("AES") >= 256; + + // Sample results for string-to-key conversion: + char[] pass = "password".toCharArray(); + byte[] salt = cat( + hex("10 DF 9D D7 83 E5 BC 8A CE A1 73 0E 74 35 5F 61"), + "ATHENA.MIT.EDUraeburn".getBytes()); + + check(stringToKey(dk128, pass, salt, null), + hex("08 9B CA 48 B1 05 EA 6E A7 7C A5 D2 F3 9D C5 E7")); + + check(stringToKey(dk256, pass, salt, null), + hex("45 BD 80 6D BF 6A 83 3A 9C FF C1 C9 45 89 A2 22\n" + + "36 7A 79 BC 21 C4 13 71 89 06 E9 F5 78 A7 84 67")); + + // Sample results for key derivation: + byte[] bk16 = hex("37 05 D9 60 80 C1 77 28 A0 E8 00 EA B6 E0 D2 3C"); + + check(deriveKey(dk128, bk16, 2, (byte) 0x99), + hex("B3 1A 01 8A 48 F5 47 76 F4 03 E9 A3 96 32 5D C3")); + check(deriveKey(dk128, bk16, 2, (byte) 0xaa), + hex("9B 19 7D D1 E8 C5 60 9D 6E 67 C3 E3 7C 62 C7 2E")); + check(deriveKey(dk128, bk16, 2, (byte) 0x55), + hex("9F DA 0E 56 AB 2D 85 E1 56 9A 68 86 96 C2 6A 6C")); + + byte[] bk32 = hex( + "6D 40 4D 37 FA F7 9F 9D F0 D3 35 68 D3 20 66 98\n" + + "00 EB 48 36 47 2E A8 A0 26 D1 6B 71 82 46 0C 52"); + + check(deriveKey(dk256, bk32, 2, (byte) 0x99), hex( + "EF 57 18 BE 86 CC 84 96 3D 8B BB 50 31 E9 F5 C4\n" + + "BA 41 F2 8F AF 69 E7 3D")); + check(deriveKey(dk256, bk32, 2, (byte) 0xaa), hex( + "56 AB 22 BE E6 3D 82 D7 BC 52 27 F6 77 3F 8E A7\n" + + "A5 EB 1C 82 51 60 C3 83 12 98 0C 44 2E 5C 7E 49")); + check(deriveKey(dk256, bk32, 2, (byte) 0x55), hex( + "69 B1 65 14 E3 CD 8E 56 B8 20 10 D5 C7 30 12 B6\n" + + "22 C4 D0 0F FC 23 ED 1F")); + + // Sample encryptions (all using the default cipher state): + + check(enc(dk128, hex("7E 58 95 EA F2 67 24 35 BA D8 17 F5 45 A3 71 48"), + bk16, hex("")), + hex("EF 85 FB 89 0B B8 47 2F 4D AB 20 39 4D CA 78 1D\n" + + "AD 87 7E DA 39 D5 0C 87 0C 0D 5A 0A 8E 48 C7 18")); + + check(enc(dk128, hex("7B CA 28 5E 2F D4 13 0F B5 5B 1A 5C 83 BC 5B 24"), + bk16, hex("00 01 02 03 04 05")), + hex("84 D7 F3 07 54 ED 98 7B AB 0B F3 50 6B EB 09 CF\n" + + "B5 54 02 CE F7 E6 87 7C E9 9E 24 7E 52 D1 6E D4\n" + + "42 1D FD F8 97 6C")); + + check(enc(dk128, hex("56 AB 21 71 3F F6 2C 0A 14 57 20 0F 6F A9 94 8F"), + bk16, hex("00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F")), + hex("35 17 D6 40 F5 0D DC 8A D3 62 87 22 B3 56 9D 2A\n" + + "E0 74 93 FA 82 63 25 40 80 EA 65 C1 00 8E 8F C2\n" + + "95 FB 48 52 E7 D8 3E 1E 7C 48 C3 7E EB E6 B0 D3")); + + check(enc(dk128, hex("A7 A4 E2 9A 47 28 CE 10 66 4F B6 4E 49 AD 3F AC"), + bk16, hex("00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F\n" + + "10 11 12 13 14")), + hex("72 0F 73 B1 8D 98 59 CD 6C CB 43 46 11 5C D3 36\n" + + "C7 0F 58 ED C0 C4 43 7C 55 73 54 4C 31 C8 13 BC\n" + + "E1 E6 D0 72 C1 86 B3 9A 41 3C 2F 92 CA 9B 83 34\n" + + "A2 87 FF CB FC\n")); + + if (aes256ok) { + check(enc(dk256, hex("F7 64 E9 FA 15 C2 76 47 8B 2C 7D 0C 4E 5F 58 E4"), + bk32, hex("")), + hex("41 F5 3F A5 BF E7 02 6D 91 FA F9 BE 95 91 95 A0\n" + + "58 70 72 73 A9 6A 40 F0 A0 19 60 62 1A C6 12 74\n" + + "8B 9B BF BE 7E B4 CE 3C\n")); + + check(enc(dk256, hex("B8 0D 32 51 C1 F6 47 14 94 25 6F FE 71 2D 0B 9A"), + bk32, hex("00 01 02 03 04 05")), + hex("4E D7 B3 7C 2B CA C8 F7 4F 23 C1 CF 07 E6 2B C7\n" + + "B7 5F B3 F6 37 B9 F5 59 C7 F6 64 F6 9E AB 7B 60\n" + + "92 23 75 26 EA 0D 1F 61 CB 20 D6 9D 10 F2\n")); + + check(enc(dk256, hex("53 BF 8A 0D 10 52 65 D4 E2 76 42 86 24 CE 5E 63"), + bk32, hex("00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F")), + hex("BC 47 FF EC 79 98 EB 91 E8 11 5C F8 D1 9D AC 4B\n" + + "BB E2 E1 63 E8 7D D3 7F 49 BE CA 92 02 77 64 F6\n" + + "8C F5 1F 14 D7 98 C2 27 3F 35 DF 57 4D 1F 93 2E\n" + + "40 C4 FF 25 5B 36 A2 66\n")); + + check(enc(dk256, hex("76 3E 65 36 7E 86 4F 02 F5 51 53 C7 E3 B5 8A F1"), + bk32, hex("00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F\n" + + "10 11 12 13 14")), + hex("40 01 3E 2D F5 8E 87 51 95 7D 28 78 BC D2 D6 FE\n" + + "10 1C CF D5 56 CB 1E AE 79 DB 3C 3E E8 64 29 F2\n" + + "B2 A6 02 AC 86 FE F6 EC B6 47 D6 29 5F AE 07 7A\n" + + "1F EB 51 75 08 D2 C1 6B 41 92 E0 1F 62\n")); + } + + // Sample checksums: + + byte[] msg = hex( + "00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F\n" + + "10 11 12 13 14"); + + check(checksum(dk128, bk16, msg), hex( + "D7 83 67 18 66 43 D6 7B 41 1C BA 91 39 FC 1D EE")); + + check(checksum(dk256, bk32, msg), hex( + "45 EE 79 15 67 EE FC A3 7F 4A C1 E0 22 2D E8 0D\n" + + "43 C3 BF A0 66 99 67 2A")); + + // Sample pseudorandom function (PRF) invocations: + // Java does not support PRF. Skipped. + } + + private static byte[] stringToKey(AesSha2DkCrypto dk, + char[] pass, byte[] salt, byte[] params) throws Exception { + Method m = AesSha2DkCrypto.class.getDeclaredMethod("stringToKey", + char[].class, byte[].class, byte[].class); + m.setAccessible(true); + return (byte[])m.invoke(dk, pass, salt, params); + } + + private static byte[] deriveKey(AesSha2DkCrypto dk, byte[] baseKey, + int usage, byte type) throws Exception { + Method m = AesSha2DkCrypto.class.getDeclaredMethod("deriveKey", + byte[].class, int.class, byte.class); + m.setAccessible(true); + return (byte[]) m.invoke(dk, baseKey, usage, type); + } + + private static byte[] cat(byte[] b1, byte[] b2) { + byte[] result = Arrays.copyOf(b1, b1.length + b2.length); + System.arraycopy(b2, 0, result, b1.length, b2.length); + return result; + } + + private static byte[] enc(AesSha2DkCrypto dk, byte[] confounder, + byte[] bk, byte[] text) throws Exception { + return dk.encryptRaw(bk, 2, new byte[16], cat(confounder, text), + 0, confounder.length + text.length); + } + + private static byte[] checksum(AesSha2DkCrypto dk, byte[] baseKey, byte[] text) + throws Exception { + return dk.calculateChecksum(baseKey, 2, text, 0, text.length); + } + + private static byte[] hex(String var) { + var = var.replaceAll("\\s", ""); + byte[] data = new byte[var.length()/2]; + for (int i=0; i<data.length; i++) { + data[i] = Integer.valueOf(var.substring(2*i,2*i+2), 16).byteValue(); + } + return data; + } + + private static void check(byte[] b1, byte[] b2) throws Exception { + if (!Arrays.equals(b1, b2)) { + dump(b1); dump(b2); + throw new Exception("Failure"); + } + } + + private static void dump(byte[] data) throws Exception { + new HexDumpEncoder().encodeBuffer(data, System.err); + } +} -- 2.19.1
Locations
Projects
Search
Status Monitor
Help
Open Build Service
OBS Manuals
API Documentation
OBS Portal
Reporting a Bug
Contact
Mailing List
Forums
Chat (IRC)
Twitter
Open Build Service (OBS)
is an
openSUSE project
.
浙ICP备2022010568号-2