Skip to content

Commit 8d0ff57

Browse files
peterdettmanpeterdettman
committed
Followup alt provider changes
1 parent 7626743 commit 8d0ff57

File tree

5 files changed

+68
-61
lines changed

5 files changed

+68
-61
lines changed

‎tls/src/main/java/org/bouncycastle/tls/crypto/impl/jcajce/JcaTlsCrypto.java‎

Lines changed: 27 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,8 @@ protected JcaTlsCrypto(JcaJceHelper helper, SecureRandom entropySource, SecureRa
113113
* @param entropySource primary entropy source, used for key generation.
114114
* @param nonceEntropySource secondary entropy source, used for nonce and IV generation.
115115
*/
116-
protected JcaTlsCrypto(JcaJceHelper helper, JcaJceHelper altHelper, SecureRandom entropySource, SecureRandom nonceEntropySource)
116+
protected JcaTlsCrypto(JcaJceHelper helper, JcaJceHelper altHelper, SecureRandom entropySource,
117+
SecureRandom nonceEntropySource)
117118
{
118119
this.helper = helper;
119120
this.altHelper = altHelper;
@@ -572,7 +573,7 @@ public boolean hasCryptoSignatureAlgorithm(int cryptoSignatureAlgorithm)
572573
case CryptoSignatureAlgorithm.gostr34102012_256:
573574
case CryptoSignatureAlgorithm.gostr34102012_512:
574575

575-
// TODO[RFC 8998]
576+
// TODO[RFC 8998]
576577
case CryptoSignatureAlgorithm.sm2:
577578

578579
default:
@@ -754,7 +755,7 @@ public boolean hasSignatureAlgorithm(short signatureAlgorithm)
754755
case SignatureAlgorithm.gostr34102012_256:
755756
case SignatureAlgorithm.gostr34102012_512:
756757

757-
// TODO[RFC 8998]
758+
// TODO[RFC 8998]
758759
// case SignatureAlgorithm.sm2:
759760

760761
default:
@@ -783,7 +784,7 @@ public boolean hasSignatureScheme(int signatureScheme)
783784
switch (signatureScheme)
784785
{
785786
case SignatureScheme.sm2sig_sm3:
786-
// TODO[tls] Implement before adding
787+
// TODO[tls] Implement before adding
787788
case SignatureScheme.DRAFT_mldsa44:
788789
case SignatureScheme.DRAFT_mldsa65:
789790
case SignatureScheme.DRAFT_mldsa87:
@@ -902,8 +903,7 @@ protected TlsAEADCipherImpl createAEADCipher(String cipherName, String algorithm
902903
* @throws GeneralSecurityException in case of failure.
903904
*/
904905
protected TlsBlockCipherImpl createBlockCipher(String cipherName, String algorithm, int keySize,
905-
boolean isEncrypting)
906-
throws GeneralSecurityException
906+
boolean isEncrypting) throws GeneralSecurityException
907907
{
908908
return new JceBlockCipherImpl(this, helper.createCipher(cipherName), algorithm, keySize, isEncrypting);
909909
}
@@ -919,8 +919,7 @@ protected TlsBlockCipherImpl createBlockCipher(String cipherName, String algorit
919919
* @throws GeneralSecurityException in case of failure.
920920
*/
921921
protected TlsBlockCipherImpl createBlockCipherWithCBCImplicitIV(String cipherName, String algorithm, int keySize,
922-
boolean isEncrypting)
923-
throws GeneralSecurityException
922+
boolean isEncrypting) throws GeneralSecurityException
924923
{
925924
return new JceBlockCipherWithCBCImplicitIVImpl(this, helper.createCipher(cipherName), algorithm, isEncrypting);
926925
}
@@ -954,17 +953,15 @@ protected TlsNullCipher createNullCipher(TlsCryptoParameters cryptoParams, int m
954953
}
955954

956955
protected TlsStreamSigner createStreamSigner(SignatureAndHashAlgorithm algorithm, PrivateKey privateKey,
957-
boolean needsRandom)
958-
throws IOException
956+
boolean needsRandom) throws IOException
959957
{
960958
String algorithmName = JcaUtils.getJcaAlgorithmName(algorithm);
961959

962960
return createStreamSigner(algorithmName, null, privateKey, needsRandom);
963961
}
964962

965963
protected TlsStreamSigner createStreamSigner(String algorithmName, AlgorithmParameterSpec parameter,
966-
PrivateKey privateKey, boolean needsRandom)
967-
throws IOException
964+
PrivateKey privateKey, boolean needsRandom) throws IOException
968965
{
969966
SecureRandom random = needsRandom ? getSecureRandom() : null;
970967

@@ -976,14 +973,13 @@ protected TlsStreamSigner createStreamSigner(String algorithmName, AlgorithmPara
976973
}
977974
catch (InvalidKeyException e)
978975
{
979-
if (altHelper != null)
980-
{
981-
return createStreamSigner(altHelper, algorithmName, parameter, privateKey, random);
982-
}
983-
else
976+
JcaJceHelper altHelper = getAltHelper();
977+
if (altHelper == null)
984978
{
985979
throw e;
986980
}
981+
982+
return createStreamSigner(altHelper, algorithmName, parameter, privateKey, random);
987983
}
988984
}
989985
catch (GeneralSecurityException e)
@@ -992,38 +988,36 @@ protected TlsStreamSigner createStreamSigner(String algorithmName, AlgorithmPara
992988
}
993989
}
994990

995-
private TlsStreamSigner createStreamSigner(JcaJceHelper helper, String algorithmName, AlgorithmParameterSpec parameter,
996-
PrivateKey privateKey, SecureRandom random)
997-
throws GeneralSecurityException
991+
protected TlsStreamSigner createStreamSigner(JcaJceHelper helper, String algorithmName,
992+
AlgorithmParameterSpec parameter, PrivateKey privateKey, SecureRandom random) throws GeneralSecurityException
998993
{
999994
try
1000995
{
1001996
if (null != parameter)
1002997
{
998+
Signature dummySigner;
1003999
try
10041000
{
1005-
Signature dummySigner = helper.createSignature(algorithmName);
1006-
dummySigner.initSign(privateKey, random);
1007-
helper = new ProviderJcaJceHelper(dummySigner.getProvider());
1001+
dummySigner = helper.createSignature(algorithmName);
10081002
}
10091003
catch (NoSuchAlgorithmException e)
10101004
{
10111005
// more PKCS#11 mischief
10121006
String upperAlg = Strings.toUpperCase(algorithmName);
1013-
if (upperAlg.endsWith("MGF1"))
1007+
if (upperAlg.endsWith("ANDMGF1"))
10141008
{
10151009
// ANDMGF1 has vanished from the Sun PKCS11 provider.
10161010
algorithmName = upperAlg.replace("ANDMGF1", "SSA-PSS");
1017-
Signature dummySigner = helper.createSignature(algorithmName);
1018-
1019-
dummySigner.initSign(privateKey, random);
1020-
helper = new ProviderJcaJceHelper(dummySigner.getProvider());
1011+
dummySigner = helper.createSignature(algorithmName);
10211012
}
10221013
else
10231014
{
10241015
throw e;
10251016
}
10261017
}
1018+
1019+
dummySigner.initSign(privateKey, random);
1020+
helper = new ProviderJcaJceHelper(dummySigner.getProvider());
10271021
}
10281022

10291023
Signature signer = helper.createSignature(algorithmName);
@@ -1037,7 +1031,7 @@ private TlsStreamSigner createStreamSigner(JcaJceHelper helper, String algorithm
10371031
catch (InvalidKeyException e)
10381032
{
10391033
String upperAlg = Strings.toUpperCase(algorithmName);
1040-
if (upperAlg.endsWith("MGF1"))
1034+
if (upperAlg.endsWith("ANDMGF1"))
10411035
{
10421036
// ANDMGF1 has vanished from the Sun PKCS11 provider.
10431037
algorithmName = upperAlg.replace("ANDMGF1", "SSA-PSS");
@@ -1059,8 +1053,7 @@ protected TlsStreamVerifier createStreamVerifier(DigitallySigned digitallySigned
10591053
}
10601054

10611055
protected TlsStreamVerifier createStreamVerifier(String algorithmName, AlgorithmParameterSpec parameter,
1062-
byte[] signature, PublicKey publicKey)
1063-
throws IOException
1056+
byte[] signature, PublicKey publicKey) throws IOException
10641057
{
10651058
try
10661059
{
@@ -1087,8 +1080,7 @@ protected TlsStreamVerifier createStreamVerifier(String algorithmName, Algorithm
10871080
}
10881081

10891082
protected Tls13Verifier createTls13Verifier(String algorithmName, AlgorithmParameterSpec parameter,
1090-
PublicKey publicKey)
1091-
throws IOException
1083+
PublicKey publicKey) throws IOException
10921084
{
10931085
try
10941086
{
@@ -1268,8 +1260,7 @@ public JcaJceHelper getAltHelper()
12681260
}
12691261

12701262
protected TlsBlockCipherImpl createCBCBlockCipherImpl(TlsCryptoParameters cryptoParams, String algorithm,
1271-
int cipherKeySize, boolean forEncryption)
1272-
throws GeneralSecurityException
1263+
int cipherKeySize, boolean forEncryption) throws GeneralSecurityException
12731264
{
12741265
String cipherName = algorithm + "/CBC/NoPadding";
12751266

@@ -1324,8 +1315,7 @@ private TlsAEADCipher createCipher_Camellia_GCM(TlsCryptoParameters cryptoParams
13241315
}
13251316

13261317
protected TlsCipher createCipher_CBC(TlsCryptoParameters cryptoParams, String algorithm, int cipherKeySize,
1327-
int macAlgorithm)
1328-
throws GeneralSecurityException, IOException
1318+
int macAlgorithm) throws GeneralSecurityException, IOException
13291319
{
13301320
TlsBlockCipherImpl encrypt = createCBCBlockCipherImpl(cryptoParams, algorithm, cipherKeySize, true);
13311321
TlsBlockCipherImpl decrypt = createCBCBlockCipherImpl(cryptoParams, algorithm, cipherKeySize, false);

‎tls/src/main/java/org/bouncycastle/tls/crypto/impl/jcajce/JcaTlsCryptoProvider.java‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ public class JcaTlsCryptoProvider
2020
implements TlsCryptoProvider
2121
{
2222
private JcaJceHelper helper = new DefaultJcaJceHelper();
23-
private JcaJceHelper altHelper = helper;
23+
private JcaJceHelper altHelper = null;
2424

2525
public JcaTlsCryptoProvider()
2626
{
@@ -34,7 +34,8 @@ public JcaTlsCryptoProvider()
3434
*/
3535
public JcaTlsCryptoProvider setProvider(Provider provider)
3636
{
37-
this.helper = this.altHelper = new ProviderJcaJceHelper(provider);
37+
this.helper = new ProviderJcaJceHelper(provider);
38+
this.altHelper = null;
3839

3940
return this;
4041
}
@@ -61,7 +62,8 @@ public JcaTlsCryptoProvider setAlternateProvider(Provider provider)
6162
*/
6263
public JcaTlsCryptoProvider setProvider(String providerName)
6364
{
64-
this.helper = this.altHelper = new NamedJcaJceHelper(providerName);
65+
this.helper = new NamedJcaJceHelper(providerName);
66+
this.altHelper = null;
6567

6668
return this;
6769
}
@@ -120,19 +122,19 @@ public JcaTlsCrypto create(SecureRandom random)
120122
*/
121123
public JcaTlsCrypto create(SecureRandom keyRandom, SecureRandom nonceRandom)
122124
{
123-
if (helper != altHelper)
124-
{
125-
return new JcaTlsCrypto(getHelper(), altHelper, keyRandom, nonceRandom);
126-
}
127-
128-
return new JcaTlsCrypto(getHelper(), keyRandom, nonceRandom);
125+
return new JcaTlsCrypto(getHelper(), getAltHelper(), keyRandom, nonceRandom);
129126
}
130127

131128
public JcaJceHelper getHelper()
132129
{
133130
return helper;
134131
}
135132

133+
public JcaJceHelper getAltHelper()
134+
{
135+
return altHelper;
136+
}
137+
136138
@SuppressWarnings("serial")
137139
private static class NonceEntropySource
138140
extends SecureRandom

‎tls/src/main/java/org/bouncycastle/tls/crypto/impl/jcajce/JcaTlsECDSA13Signer.java‎

Lines changed: 23 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,10 @@
44
import java.security.GeneralSecurityException;
55
import java.security.InvalidKeyException;
66
import java.security.PrivateKey;
7+
import java.security.SecureRandom;
78
import java.security.Signature;
89

10+
import org.bouncycastle.jcajce.util.JcaJceHelper;
911
import org.bouncycastle.tls.AlertDescription;
1012
import org.bouncycastle.tls.SignatureAndHashAlgorithm;
1113
import org.bouncycastle.tls.SignatureScheme;
@@ -51,26 +53,24 @@ public byte[] generateRawSignature(SignatureAndHashAlgorithm algorithm, byte[] h
5153
throw new IllegalStateException("Invalid algorithm: " + algorithm);
5254
}
5355

56+
SecureRandom random = crypto.getSecureRandom();
57+
5458
try
5559
{
56-
Signature signer = crypto.getHelper().createSignature("NoneWithECDSA");
57-
signer.initSign(privateKey, crypto.getSecureRandom());
58-
signer.update(hash, 0, hash.length);
59-
return signer.sign();
60-
}
61-
catch (InvalidKeyException e)
62-
{
63-
// try with PKCS#11 (usually) alternative provider
6460
try
6561
{
66-
Signature signer = crypto.getAltHelper().createSignature("NoneWithECDSA");
67-
signer.initSign(privateKey, crypto.getSecureRandom());
68-
signer.update(hash, 0, hash.length);
69-
return signer.sign();
62+
return implGenerateRawSignature(crypto.getHelper(), privateKey, random, hash);
7063
}
71-
catch (GeneralSecurityException ex)
64+
catch (InvalidKeyException e)
7265
{
73-
throw new TlsFatalAlert(AlertDescription.internal_error, ex);
66+
// try with PKCS#11 (usually) alternative provider
67+
JcaJceHelper altHelper = crypto.getAltHelper();
68+
if (altHelper == null)
69+
{
70+
throw e;
71+
}
72+
73+
return implGenerateRawSignature(altHelper, privateKey, random, hash);
7474
}
7575
}
7676
catch (GeneralSecurityException e)
@@ -84,4 +84,13 @@ public TlsStreamSigner getStreamSigner(SignatureAndHashAlgorithm algorithm)
8484
{
8585
return null;
8686
}
87+
88+
private static byte[] implGenerateRawSignature(JcaJceHelper helper, PrivateKey privateKey, SecureRandom random,
89+
byte[] hash) throws GeneralSecurityException
90+
{
91+
Signature signer = helper.createSignature("NoneWithECDSA");
92+
signer.initSign(privateKey, random);
93+
signer.update(hash, 0, hash.length);
94+
return signer.sign();
95+
}
8796
}

‎tls/src/test/java/org/bouncycastle/jsse/provider/test/FipsJcaTlsCrypto.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,12 @@ public FipsJcaTlsCrypto(JcaJceHelper helper, SecureRandom entropySource, SecureR
1414
super(helper, entropySource, nonceEntropySource);
1515
}
1616

17+
public FipsJcaTlsCrypto(JcaJceHelper helper, JcaJceHelper altHelper, SecureRandom entropySource,
18+
SecureRandom nonceEntropySource)
19+
{
20+
super(helper, altHelper, entropySource, nonceEntropySource);
21+
}
22+
1723
@Override
1824
public AEADNonceGeneratorFactory getFipsGCMNonceGeneratorFactory()
1925
{

‎tls/src/test/java/org/bouncycastle/jsse/provider/test/FipsJcaTlsCryptoProvider.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,6 @@ public class FipsJcaTlsCryptoProvider extends JcaTlsCryptoProvider
1010
@Override
1111
public JcaTlsCrypto create(SecureRandom keyRandom, SecureRandom nonceRandom)
1212
{
13-
return new FipsJcaTlsCrypto(getHelper(), keyRandom, nonceRandom);
13+
return new FipsJcaTlsCrypto(getHelper(), getAltHelper(), keyRandom, nonceRandom);
1414
}
1515
}

0 commit comments

Comments
 (0)