/**
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
*
* Copyright (c) 2007 Sun Microsystems Inc. All Rights Reserved
*
* The contents of this file are subject to the terms
* of the Common Development and Distribution License
* (the License). You may not use this file except in
* compliance with the License.
*
* You can obtain a copy of the License at
* See the License for the specific language governing
* permission and limitations under the License.
*
* When distributing Covered Code, include this CDDL
* Header Notice in each file and include the License file
* at opensso/legal/CDDLv1.0.txt.
* If applicable, add the following below the CDDL Header,
* with the fields enclosed by brackets [] replaced by
* your own identifying information:
* "Portions Copyrighted [year] [name of copyright owner]"
*
* $Id: JSSEncryption.java,v 1.3 2009/01/23 22:16:26 beomsuk Exp $
*
*/
/**
* This class uses JSS symmetric algorithm for string encryption/decryption.
* The encrypted string contains BASE64 Characters as specified
* in RFC1521.
* The format of the encoded byte before BASE64 encoding is
* byte[0] = crypt version number. This version is 1.
* byte[1]=keyGenAlg
* bype[2]=EncrytionAlg
* byte[3-10]=IV for encryption/decryption
* The rest is the encoded bytes.
*
* subnote:
* This is initially intended to replace SessionID
* encryption/decryption (xor). And is pulled to the DAI space at the
* last minutes. Since the requirement and restrictions are different,
* It needs adjustment later.
*
* for furtue "enhancement" (adopted form the old Password.java):
* 1. Use an array of pins to be randomly picked. Add the index as a
* prefix of the encrypted string.
*
* Aravindan's thought:
* 1. From the password, generate the key multiple times, put the
* number of times as a prefix of the encrypted string.
* 2. Random generated a pwd and build a key from it. Put the pwd
* encrypted somehow as a prefix of the encrypted string.
* 3. put pwd in a class and embeded in a jar file, so that it's not
* in "plain text", somewhat.
* The class can be replaced at installation time by taking a
* pwd from user and dynamically created and replaced in the jar.
* (mzhao: And it should be able to be replaced by customer
* periodically. However if it's used for password encryption. The
* encrypted version of pwds should be changed simultaneously.)
*
* mzhao thought:
* 1. There is known problem in this framework that we need to store
* the password securely in some way. Hardcoding it is not considered
* secure, putting it in a file is not either.
* 2. Client Auth can be used for web based SSO.
*
* Borrowed from CMS:
* 2. A password cache can be used to store all passwords, such as
* puser, daiuser, amadmin password, and ssl password. A SSO
* password is used to encryt them. When server restarts, this SSO
* password must be asked.
* 3. A watchdog may be needed to auto restart the server.
*
* @author mzhao
* @version $Revision: 1.3 $, $Date: 2009/01/23 22:16:26 $
**/
static {
try {
/* if FIPS is enabled, configure only FIPS ciphersuites */
if (cm.FIPSEnabled()) {
DEFAULT_KEYGEN_ALG = "PBE_SHA1_DES3_CBC";
DEFAULT_ENCYPTION_ALG = "DES3_CBC_PAD";
}
} catch (Exception e) {
}
}
}
"PBE_SHA1_DES3_CBC",
"PBE_MD2_DES_CBC",
"PBE_MD5_DES_CBC",
"PBE_SHA1_DES_CBC",
"PBE_SHA1_RC2_128_CBC",
"PBE_SHA1_RC2_40_CBC",
"PBE_SHA1_RC4_128",
"PBE_SHA1_RC4_40"};
"DES3_CBC_PAD",
"DES_CBC",
"DES_CBC_PAD",
"DES_ECB",
"DES3_CBC",
"DES3_ECB",
"RC2_CBC",
"RC4"};
static {
try {
try {
} catch (Exception e) {
}
}
}
}
/**
* Default constructor
*/
JSSEncryption() {
}
throws CryptoManager.NotInitializedException {
// This crypto token has to support encryption algorithm
// and all the key generation algorithms in KEYGEN_ALGS.
// CryptoManager returns "Internal Key Storage Token" at least.
while (e.hasMoreElements()) {
boolean foundToken = true;
for (int i = 0; i<NUM_KEYGEN_ALG; i++) {
foundToken = false;
break;
}
}
if (foundToken) {
return tok;
}
}
return null;
}
/**
* Sets password-based key to use
*/
}
for (int i=0; i<NUM_KEYGEN_ALG; i++) {
try {
if (debug.messageEnabled()) {
KEYGEN_ALGS[i]);
}
} catch (Exception e) {
}
}
}
else
return null;
}
return ivParamSpecs[type];
else
return null;
}
/**
* <p>Encrypt a String.</p>
* @param clearText The string to be encoded.
* @return The encoded string.
*/
}
/**
* <p>Decrypt a String.</p>
* @param encoded The string to be decoded.
* @return The decoded string.
*/
}
/**
* <p>Encrypt a String.</p>
* @param clearText The string to be encoded.
* @return The encoded string.
*/
return null;
try {
byte type[] = new byte[2];
int i = getEncryptionByte(encAlgString);
type[1] = (byte)i;
i = getKeyGenByte(keyA);
type[0] = (byte)i;
// bug in JSS: msg in stdout.
//secureRandom.nextBytes(iv);
return (enc);
} catch (Throwable e) {
}
return null;
}
}
/**
* Decode an encoded string
*
* @param encoded The encoded string.
* @return The decoded string.
**/
return null;
}
try {
}
return null;
}
// get the alg from the string
// get the encrypted data
+ (int)type[1]);
}
return null;
}
"In decode string: unsupported keygen bit:"
+ (int)type[0]);
}
return null;
}
return null;
}
return (dec);
} catch (Throwable e) {
}
return null;
}
}
for (int i = 0; i < 8; i++) {
}
}
return data;
}
byte type[] = new byte[2];
return type;
}
byte iv[] = new byte[8];
for (int i = 0; i < 8; i++) {
}
return iv;
}
}
return data;
}
for (int i = 0; i < NUM_KEYGEN_ALG; i++) {
return i;
}
}
}
// return the default
return 0;
}
return PBEAlgorithm.PBE_SHA1_DES3_CBC;
return PBEAlgorithm.PBE_MD2_DES_CBC;
return PBEAlgorithm.PBE_MD5_DES_CBC;
return PBEAlgorithm.PBE_SHA1_DES_CBC ;
return PBEAlgorithm.PBE_SHA1_RC2_128_CBC;
return PBEAlgorithm.PBE_SHA1_RC2_40_CBC;
return PBEAlgorithm.PBE_SHA1_RC4_128;
return PBEAlgorithm.PBE_SHA1_RC4_40;
} else {
}
return PBEAlgorithm.PBE_SHA1_DES3_CBC;
}
}
for (int i = 0; i < NUM_ENCRYPTION_ALG; i++) {
return i;
}
}
}
// return the default
return 0;
}
return EncryptionAlgorithm.DES3_CBC_PAD;
return EncryptionAlgorithm.DES3_CBC;
return EncryptionAlgorithm.DES3_ECB;
return EncryptionAlgorithm.DES_CBC;
return EncryptionAlgorithm.DES_CBC_PAD;
return EncryptionAlgorithm.DES_ECB;
return EncryptionAlgorithm.RC2_CBC;
return EncryptionAlgorithm.RC4;
} else {
}
return EncryptionAlgorithm.DES3_CBC_PAD;
}
}
}