/*
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation. Oracle designates this
* particular file as subject to the "Classpath" exception as provided
* by Oracle in the LICENSE file that accompanied this code.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* This is the Kerberos premaster secret in the Kerberos client key
* exchange message (CLIENT --> SERVER); it holds the
* Kerberos-encrypted pre-master secret. The secret is encrypted using the
* Kerberos session key. The padding and size of the resulting message
* depends on the session key type, but the pre-master secret is
* always exactly 48 bytes.
*
*/
final class KerberosPreMasterSecret {
private byte encrypted[];
/**
* Constructor used by client to generate premaster secret.
*
* Client randomly creates a pre-master secret and encrypts it
* using the Kerberos session key; only the server can decrypt
* it, using the session key available in the service ticket.
*
* @param protocolVersion used to set preMaster[0,1]
* @param generator random number generator for generating premaster secret
* @param sessionKey Kerberos session key for encrypting premaster secret
*/
if (sessionKey.getEType() ==
throw new IOException(
"session keys with des3-cbc-hmac-sha1-kd encryption type " +
"are not supported for TLS Kerberos cipher suites");
}
this.protocolVersion = protocolVersion;
// Encrypt premaster secret
try {
} catch (KrbException e) {
throw (SSLKeyException)new SSLKeyException
("Kerberos premaster secret error").initCause(e);
}
}
/*
* Constructor used by server to decrypt encrypted premaster secret.
* The protocol version in preMaster[0,1] must match either currentVersion
* or clientVersion, otherwise, the premaster secret is set to
* a random one to foil possible attack.
*
* @param currentVersion version of protocol being used
* @param clientVersion version requested by client
* @param generator random number generator used to generate
* bogus premaster secret if premaster secret verification fails
* @param input input stream from which to read the encrypted
* premaster secret
* @param sessionKey Kerberos session key to be used for decryption
*/
// Extract encrypted premaster secret from message
"encrypted premaster secret", encrypted);
}
}
if (sessionKey.getEType() ==
throw new IOException(
"session keys with des3-cbc-hmac-sha1-kd encryption type " +
"are not supported for TLS Kerberos cipher suites");
}
// Decrypt premaster secret
try {
"decrypted premaster secret", temp);
}
}
// Remove padding bytes after decryption. Only DES and DES3 have
// paddings and we don't support DES3 in TLS (see above)
// For des-cbc-crc, 4 paddings. Value can be 0x04 or 0x00.
}
// For des-cbc-md5, 8 paddings with 0x08, or no padding
}
}
preMaster[1]);
+ protocolVersion);
}
} catch (Exception e) {
// catch exception & process below
}
// check if the premaster secret version is ok
// the specification says that it must be the maximum version supported
// by the client from its ClientHello message. However, many
// old implementations send the negotiated version, so accept both
// for SSL v3.0 and TLS v1.0.
// NOTE that we may be comparing two unsupported version numbers in
// the second case, which is why we cannot use object references
// equality in this special case
/*
* we never checked the client_version in server side
* for TLS v1.0 and SSL v3.0. For compatibility, we
* maintain this behavior.
*/
}
/*
* Bogus decrypted ClientKeyExchange? If so, conjure a
* a random preMaster secret that will fail later during
* Finished message processing. This is a countermeasure against
* the "interactive RSA PKCS#1 encryption envelop attack" reported
* in June 1998. Preserving the executation path will
* mitigate timing attacks and force consistent error handling
* that will prevent an attacking client from differentiating
* different kinds of decrypted ClientKeyExchange bogosities.
*/
|| versionMismatch) {
+ "generating random secret");
}
}
/*
* Randomize the preMaster secret with the
* ClientHello.client_version, as will produce invalid master
* secret to prevent the attacks.
*/
}
}
/**
* Checks if all paddings of data are b
* @param data the block with padding
* @param len length of data, >= 48
* @param b expected padding byte
*/
for (int i=48; i<len; i++) {
if (data[i] != b) return false;
}
return true;
}
/*
* Used by server to generate premaster secret in case of
* problem decoding ticket.
*
* @param protocolVersion used for preMaster[0,1]
* @param generator random number generator to use for generating secret.
*/
this.protocolVersion = protocolVersion;
}
byte[] pm = new byte[48];
return pm;
}
// Clone not needed; internal use only
byte[] getUnencrypted() {
return preMaster;
}
// Clone not needed; internal use only
byte[] getEncrypted() {
return encrypted;
}
}