/* * Copyright (c) 1997, 2006, Oracle and/or its affiliates. All rights reserved. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * * This code is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License version 2 only, as * published by the Free Software Foundation.  Oracle designates this * particular file as subject to the "Classpath" exception as provided * by Oracle in the LICENSE file that accompanied this code. * * This code is distributed in the hope that it will be useful, but WITHOUT * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License * version 2 for more details (a copy is included in the LICENSE file that * accompanied this code). * * You should have received a copy of the GNU General Public License version * 2 along with this work; if not, write to the Free Software Foundation, * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. * * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA * or visit www.oracle.com if you need additional information or have any * questions. */ package sun.security.provider; import java.io.IOException;import java.io.UnsupportedEncodingException;import java.security.Key;import java.security.KeyStoreException;import java.security.MessageDigest;import java.security.NoSuchAlgorithmException;import java.security.SecureRandom;import java.security.UnrecoverableKeyException;import java.util.*; import sun.security.pkcs.PKCS8Key;import sun.security.pkcs.EncryptedPrivateKeyInfo;import sun.security.x509.AlgorithmId;import sun.security.util.ObjectIdentifier;import sun.security.util.DerValue; /** * This is an implementation of a Sun proprietary, exportable algorithm * intended for use when protecting (or recovering the cleartext version of) * sensitive keys. * This algorithm is not intended as a general purpose cipher. * * This is how the algorithm works for key protection: * * p - user password * s - random salt * X - xor key * P - to-be-protected key * Y - protected key * R - what gets stored in the keystore * * Step 1: * Take the user's password, append a random salt (of fixed size) to it, * and hash it: d1 = digest(p, s) * Store d1 in X. * * Step 2: * Take the user's password, append the digest result from the previous step, * and hash it: dn = digest(p, dn-1). * Store dn in X (append it to the previously stored digests). * Repeat this step until the length of X matches the length of the private key * P. * * Step 3: * XOR X and P, and store the result in Y: Y = X XOR P. * * Step 4: * Store s, Y, and digest(p, P) in the result buffer R: * R = s + Y + digest(p, P), where "+" denotes concatenation. * (NOTE: digest(p, P) is stored in the result buffer, so that when the key is * recovered, we can check if the recovered key indeed matches the original * key.) R is stored in the keystore. * * The protected key is recovered as follows: * * Step1 and Step2 are the same as above, except that the salt is not randomly * generated, but taken from the result R of step 4 (the first length(s) * bytes). * * Step 3 (XOR operation) yields the plaintext key. * * Then concatenate the password with the recovered key, and compare with the * last length(digest(p, P)) bytes of R. If they match, the recovered key is * indeed the same key as the original key. * * @author Jan Luehe * * * @see java.security.KeyStore * @see JavaKeyStore * @see KeyTool * * @since 1.2 */ final class KeyProtector {     private static final int SALT_LEN = 20; // the salt length    private static final String DIGEST_ALG = "SHA";    private static final int DIGEST_LEN = 20;     // defined by JavaSoft    private static final String KEY_PROTECTOR_OID = "1.3.6.1.4.1.42.2.17.1.1";     // The password used for protecting/recovering keys passed through this    // key protector. We store it as a byte array, so that we can digest it.    private byte[] passwdBytes;     private MessageDigest md;      /**     * Creates an instance of this class, and initializes it with the given     * password.     *     * <p>The password is expected to be in printable ASCII.     * Normal rules for good password selection apply: at least     * seven characters, mixed case, with punctuation encouraged.     * Phrases or words which are easily guessed, for example by     * being found in dictionaries, are bad.     */    public KeyProtector(char[] password)        throws NoSuchAlgorithmException    {        int i, j;         if (password == null) {           throw new IllegalArgumentException("password can't be null");        }        md = MessageDigest.getInstance(DIGEST_ALG);        // Convert password to byte array, so that it can be digested        passwdBytes = new byte[password.length * 2];        for (i=0, j=0; i<password.length; i++) {            passwdBytes[j++] = (byte)(password[i] >> 8);            passwdBytes[j++] = (byte)password[i];        }    }     /**     * Ensures that the password bytes of this key protector are     * set to zero when there are no more references to it.     */    protected void finalize() {        if (passwdBytes != null) {            Arrays.fill(passwdBytes, (byte)0x00);            passwdBytes = null;        }    }     /*     * Protects the given plaintext key, using the password provided at     * construction time.     */    public byte[] protect(Key key) throws KeyStoreException    {        int i;        int numRounds;        byte[] digest;        int xorOffset; // offset in xorKey where next digest will be stored        int encrKeyOffset = 0;         if (key == null) {            throw new IllegalArgumentException("plaintext key can't be null");        }         if (!"PKCS#8".equalsIgnoreCase(key.getFormat())) {            throw new KeyStoreException(                "Cannot get key bytes, not PKCS#8 encoded");        }         byte[] plainKey = key.getEncoded();        if (plainKey == null) {            throw new KeyStoreException(                "Cannot get key bytes, encoding not supported");        }         // Determine the number of digest rounds        numRounds = plainKey.length / DIGEST_LEN;        if ((plainKey.length % DIGEST_LEN) != 0)            numRounds++;         // Create a random salt        byte[] salt = new byte[SALT_LEN];        SecureRandom random = new SecureRandom();        random.nextBytes(salt);         // Set up the byte array which will be XORed with "plainKey"        byte[] xorKey = new byte[plainKey.length];         // Compute the digests, and store them in "xorKey"        for (i = 0, xorOffset = 0, digest = salt;             i < numRounds;             i++, xorOffset += DIGEST_LEN) {            md.update(passwdBytes);            md.update(digest);            digest = md.digest();            md.reset();            // Copy the digest into "xorKey"            if (i < numRounds - 1) {                System.arraycopy(digest, 0, xorKey, xorOffset,                                 digest.length);            } else {                System.arraycopy(digest, 0, xorKey, xorOffset,                                 xorKey.length - xorOffset);            }        }         // XOR "plainKey" with "xorKey", and store the result in "tmpKey"        byte[] tmpKey = new byte[plainKey.length];        for (i = 0; i < tmpKey.length; i++) {            tmpKey[i] = (byte)(plainKey[i] ^ xorKey[i]);        }         // Store salt and "tmpKey" in "encrKey"        byte[] encrKey = new byte[salt.length + tmpKey.length + DIGEST_LEN];        System.arraycopy(salt, 0, encrKey, encrKeyOffset, salt.length);        encrKeyOffset += salt.length;        System.arraycopy(tmpKey, 0, encrKey, encrKeyOffset, tmpKey.length);        encrKeyOffset += tmpKey.length;         // Append digest(password, plainKey) as an integrity check to "encrKey"        md.update(passwdBytes);        Arrays.fill(passwdBytes, (byte)0x00);        passwdBytes = null;        md.update(plainKey);        digest = md.digest();        md.reset();        System.arraycopy(digest, 0, encrKey, encrKeyOffset, digest.length);         // wrap the protected private key in a PKCS#8-style        // EncryptedPrivateKeyInfo, and returns its encoding        AlgorithmId encrAlg;        try {            encrAlg = new AlgorithmId(new ObjectIdentifier(KEY_PROTECTOR_OID));            return new EncryptedPrivateKeyInfo(encrAlg,encrKey).getEncoded();        } catch (IOException ioe) {            throw new KeyStoreException(ioe.getMessage());        }    }     /*     * Recovers the plaintext version of the given key (in protected format),     * using the password provided at construction time.     */    public Key recover(EncryptedPrivateKeyInfo encrInfo)        throws UnrecoverableKeyException    {        int i;        byte[] digest;        int numRounds;        int xorOffset; // offset in xorKey where next digest will be stored        int encrKeyLen; // the length of the encrpyted key         // do we support the algorithm?        AlgorithmId encrAlg = encrInfo.getAlgorithm();        if (!(encrAlg.getOID().toString().equals(KEY_PROTECTOR_OID))) {            throw new UnrecoverableKeyException("Unsupported key protection "                                                + "algorithm");        }         byte[] protectedKey = encrInfo.getEncryptedData();         /*         * Get the salt associated with this key (the first SALT_LEN bytes of         * <code>protectedKey</code>)         */        byte[] salt = new byte[SALT_LEN];        System.arraycopy(protectedKey, 0, salt, 0, SALT_LEN);         // Determine the number of digest rounds        encrKeyLen = protectedKey.length - SALT_LEN - DIGEST_LEN;        numRounds = encrKeyLen / DIGEST_LEN;        if ((encrKeyLen % DIGEST_LEN) != 0) numRounds++;         // Get the encrypted key portion and store it in "encrKey"        byte[] encrKey = new byte[encrKeyLen];        System.arraycopy(protectedKey, SALT_LEN, encrKey, 0, encrKeyLen);         // Set up the byte array which will be XORed with "encrKey"        byte[] xorKey = new byte[encrKey.length];         // Compute the digests, and store them in "xorKey"        for (i = 0, xorOffset = 0, digest = salt;             i < numRounds;             i++, xorOffset += DIGEST_LEN) {            md.update(passwdBytes);            md.update(digest);            digest = md.digest();            md.reset();            // Copy the digest into "xorKey"            if (i < numRounds - 1) {                System.arraycopy(digest, 0, xorKey, xorOffset,                                 digest.length);            } else {                System.arraycopy(digest, 0, xorKey, xorOffset,                                 xorKey.length - xorOffset);            }        }         // XOR "encrKey" with "xorKey", and store the result in "plainKey"        byte[] plainKey = new byte[encrKey.length];        for (i = 0; i < plainKey.length; i++) {            plainKey[i] = (byte)(encrKey[i] ^ xorKey[i]);        }         /*         * Check the integrity of the recovered key by concatenating it with         * the password, digesting the concatenation, and comparing the         * result of the digest operation with the digest provided at the end         * of <code>protectedKey</code>. If the two digest values are         * different, throw an exception.         */        md.update(passwdBytes);        Arrays.fill(passwdBytes, (byte)0x00);        passwdBytes = null;        md.update(plainKey);        digest = md.digest();        md.reset();        for (i = 0; i < digest.length; i++) {            if (digest[i] != protectedKey[SALT_LEN + encrKeyLen + i]) {                throw new UnrecoverableKeyException("Cannot recover key");            }        }         // The parseKey() method of PKCS8Key parses the key        // algorithm and instantiates the appropriate key factory,        // which in turn parses the key material.        try {            return PKCS8Key.parseKey(new DerValue(plainKey));        } catch (IOException ioe) {            throw new UnrecoverableKeyException(ioe.getMessage());        }    }}