Refactoring in tls.crypto.impl

peterdettman · peterdettman · commit bee6734a7fda · 2025-01-29T19:04:39.000+07:00
diff --git a/tls/src/main/java/org/bouncycastle/tls/crypto/impl/PQCUtil.java b/tls/src/main/java/org/bouncycastle/tls/crypto/impl/PQCUtil.java
@@ -23,23 +23,6 @@ public static ASN1ObjectIdentifier getMLDSAObjectidentifier(int signatureScheme)
         }
     }
 
-    public static ASN1ObjectIdentifier getMLDSAObjectidentifier(MLDSAParameters parameters)
-    {
-        if (MLDSAParameters.ml_dsa_44 == parameters)
-        {
-            return NISTObjectIdentifiers.id_ml_dsa_44;
-        }
-        if (MLDSAParameters.ml_dsa_65 == parameters)
-        {
-            return NISTObjectIdentifiers.id_ml_dsa_65;
-        }
-        if (MLDSAParameters.ml_dsa_87 == parameters)
-        {
-            return NISTObjectIdentifiers.id_ml_dsa_87;
-        }
-        throw new IllegalArgumentException();
-    }
-
     public static int getMLDSASignatureScheme(MLDSAParameters parameters)
     {
         if (MLDSAParameters.ml_dsa_44 == parameters)
@@ -57,9 +40,9 @@ public static int getMLDSASignatureScheme(MLDSAParameters parameters)
         throw new IllegalArgumentException();
     }
 
-    public static boolean supportsMLDSA(AlgorithmIdentifier pubKeyAlgID, ASN1ObjectIdentifier algorithm)
+    public static boolean supportsMLDSA(AlgorithmIdentifier pubKeyAlgID, ASN1ObjectIdentifier mlDsaAlgOid)
     {
-        return pubKeyAlgID.getAlgorithm().equals(algorithm)
+        return pubKeyAlgID.getAlgorithm().equals(mlDsaAlgOid)
             && pubKeyAlgID.getParameters() == null;
     }
 }
diff --git a/tls/src/main/java/org/bouncycastle/tls/crypto/impl/bc/BcTlsEd25519Signer.java b/tls/src/main/java/org/bouncycastle/tls/crypto/impl/bc/BcTlsEd25519Signer.java
@@ -1,7 +1,5 @@
 package org.bouncycastle.tls.crypto.impl.bc;
 
-import java.io.IOException;
-
 import org.bouncycastle.crypto.params.Ed25519PrivateKeyParameters;
 import org.bouncycastle.crypto.signers.Ed25519Signer;
 import org.bouncycastle.tls.SignatureAndHashAlgorithm;
@@ -16,11 +14,6 @@ public BcTlsEd25519Signer(BcTlsCrypto crypto, Ed25519PrivateKeyParameters privat
         super(crypto, privateKey);
     }
 
-    public byte[] generateRawSignature(SignatureAndHashAlgorithm algorithm, byte[] hash) throws IOException
-    {
-        throw new UnsupportedOperationException();
-    }
-
     public TlsStreamSigner getStreamSigner(SignatureAndHashAlgorithm algorithm)
     {
         if (algorithm == null || SignatureScheme.from(algorithm) != SignatureScheme.ed25519)
diff --git a/tls/src/main/java/org/bouncycastle/tls/crypto/impl/bc/BcTlsEd448Signer.java b/tls/src/main/java/org/bouncycastle/tls/crypto/impl/bc/BcTlsEd448Signer.java
@@ -1,7 +1,5 @@
 package org.bouncycastle.tls.crypto.impl.bc;
 
-import java.io.IOException;
-
 import org.bouncycastle.crypto.params.Ed448PrivateKeyParameters;
 import org.bouncycastle.crypto.signers.Ed448Signer;
 import org.bouncycastle.tls.SignatureAndHashAlgorithm;
@@ -17,11 +15,6 @@ public BcTlsEd448Signer(BcTlsCrypto crypto, Ed448PrivateKeyParameters privateKey
         super(crypto, privateKey);
     }
 
-    public byte[] generateRawSignature(SignatureAndHashAlgorithm algorithm, byte[] hash) throws IOException
-    {
-        throw new UnsupportedOperationException();
-    }
-
     public TlsStreamSigner getStreamSigner(SignatureAndHashAlgorithm algorithm)
     {
         if (algorithm == null || SignatureScheme.from(algorithm) != SignatureScheme.ed448)
diff --git a/tls/src/main/java/org/bouncycastle/tls/crypto/impl/bc/BcTlsMLDSASigner.java b/tls/src/main/java/org/bouncycastle/tls/crypto/impl/bc/BcTlsMLDSASigner.java
@@ -1,7 +1,5 @@
 package org.bouncycastle.tls.crypto.impl.bc;
 
-import java.io.IOException;
-
 import org.bouncycastle.crypto.params.ParametersWithRandom;
 import org.bouncycastle.pqc.crypto.mldsa.MLDSAPrivateKeyParameters;
 import org.bouncycastle.pqc.crypto.mldsa.MLDSASigner;
@@ -32,11 +30,6 @@ private BcTlsMLDSASigner(BcTlsCrypto crypto, MLDSAPrivateKeyParameters privateKe
         this.signatureScheme = signatureScheme;
     }
 
-    public byte[] generateRawSignature(SignatureAndHashAlgorithm algorithm, byte[] hash) throws IOException
-    {
-        throw new UnsupportedOperationException();
-    }
-
     public TlsStreamSigner getStreamSigner(SignatureAndHashAlgorithm algorithm)
     {
         if (algorithm == null || SignatureScheme.from(algorithm) != signatureScheme)
diff --git a/tls/src/main/java/org/bouncycastle/tls/crypto/impl/bc/BcTlsRawKeyCertificate.java b/tls/src/main/java/org/bouncycastle/tls/crypto/impl/bc/BcTlsRawKeyCertificate.java
@@ -26,7 +26,6 @@
 import org.bouncycastle.crypto.signers.PSSSigner;
 import org.bouncycastle.crypto.signers.RSADigestSigner;
 import org.bouncycastle.crypto.util.PublicKeyFactory;
-import org.bouncycastle.pqc.crypto.mldsa.MLDSAParameters;
 import org.bouncycastle.pqc.crypto.mldsa.MLDSAPublicKeyParameters;
 import org.bouncycastle.pqc.crypto.mldsa.MLDSASigner;
 import org.bouncycastle.tls.AlertDescription;
@@ -255,16 +254,10 @@ public Tls13Verifier createVerifier(int signatureScheme) throws IOException
         case SignatureScheme.DRAFT_mldsa65:
         case SignatureScheme.DRAFT_mldsa87:
         {
-            ASN1ObjectIdentifier algorithm = PQCUtil.getMLDSAObjectidentifier(signatureScheme);
-            validateMLDSA(algorithm);
+            ASN1ObjectIdentifier mlDsaAlgOid = PQCUtil.getMLDSAObjectidentifier(signatureScheme);
+            validateMLDSA(mlDsaAlgOid);
 
             MLDSAPublicKeyParameters publicKey = getPubKeyMLDSA();
-            MLDSAParameters parameters = publicKey.getParameters();
-            if (!PQCUtil.getMLDSAObjectidentifier(parameters).equals(algorithm))
-            {
-                throw new TlsFatalAlert(AlertDescription.certificate_unknown,
-                    "ML-DSA public key not for " + SignatureScheme.getText(signatureScheme));
-            }
 
             MLDSASigner verifier = new MLDSASigner();
             verifier.init(false, publicKey);
@@ -485,10 +478,10 @@ protected boolean supportsKeyUsage(int keyUsageBit)
         return true;
     }
 
-    protected boolean supportsMLDSA(ASN1ObjectIdentifier algorithm)
+    protected boolean supportsMLDSA(ASN1ObjectIdentifier mlDsaAlgOid)
     {
         AlgorithmIdentifier pubKeyAlgID = keyInfo.getAlgorithm();
-        return PQCUtil.supportsMLDSA(pubKeyAlgID, algorithm);
+        return PQCUtil.supportsMLDSA(pubKeyAlgID, mlDsaAlgOid);
     }
 
     protected boolean supportsRSA_PKCS1()
@@ -582,10 +575,10 @@ public void validateKeyUsage(int keyUsageBit)
         }
     }
 
-    protected void validateMLDSA(ASN1ObjectIdentifier algorithm)
+    protected void validateMLDSA(ASN1ObjectIdentifier mlDsaAlgOid)
         throws IOException
     {
-        if (!supportsMLDSA(algorithm))
+        if (!supportsMLDSA(mlDsaAlgOid))
         {
             throw new TlsFatalAlert(AlertDescription.certificate_unknown, "No support for ML-DSA signature scheme");
         }
diff --git a/tls/src/main/java/org/bouncycastle/tls/crypto/impl/bc/BcTlsSM2Signer.java b/tls/src/main/java/org/bouncycastle/tls/crypto/impl/bc/BcTlsSM2Signer.java
@@ -1,7 +1,5 @@
 package org.bouncycastle.tls.crypto.impl.bc;
 
-import java.io.IOException;
-
 import org.bouncycastle.crypto.params.ECPrivateKeyParameters;
 import org.bouncycastle.crypto.params.ParametersWithID;
 import org.bouncycastle.crypto.params.ParametersWithRandom;
@@ -22,11 +20,6 @@ public BcTlsSM2Signer(BcTlsCrypto crypto, ECPrivateKeyParameters privateKey, byt
         this.identifier = Arrays.clone(identifier);
     }
 
-    public byte[] generateRawSignature(SignatureAndHashAlgorithm algorithm, byte[] hash) throws IOException
-    {
-        throw new UnsupportedOperationException();
-    }
-
     public TlsStreamSigner getStreamSigner(SignatureAndHashAlgorithm algorithm)
     {
         if (algorithm == null
diff --git a/tls/src/main/java/org/bouncycastle/tls/crypto/impl/bc/BcTlsSigner.java b/tls/src/main/java/org/bouncycastle/tls/crypto/impl/bc/BcTlsSigner.java
@@ -1,5 +1,7 @@
 package org.bouncycastle.tls.crypto.impl.bc;
 
+import java.io.IOException;
+
 import org.bouncycastle.crypto.params.AsymmetricKeyParameter;
 import org.bouncycastle.tls.SignatureAndHashAlgorithm;
 import org.bouncycastle.tls.crypto.TlsSigner;
@@ -30,6 +32,11 @@ protected BcTlsSigner(BcTlsCrypto crypto, AsymmetricKeyParameter privateKey)
         this.privateKey = privateKey;
     }
 
+    public byte[] generateRawSignature(SignatureAndHashAlgorithm algorithm, byte[] hash) throws IOException
+    {
+        throw new UnsupportedOperationException();
+    }
+
     public TlsStreamSigner getStreamSigner(SignatureAndHashAlgorithm algorithm)
     {
         return null;

Original file line number	Diff line number	Diff line change
`@@ -23,23 +23,6 @@ public static ASN1ObjectIdentifier getMLDSAObjectidentifier(int signatureScheme)`
`23`	`23`	`}`
`24`	`24`	`}`
`25`	`25`
`26`		`- public static ASN1ObjectIdentifier getMLDSAObjectidentifier(MLDSAParameters parameters)`
`27`		`- {`
`28`		`- if (MLDSAParameters.ml_dsa_44 == parameters)`
`29`		`- {`
`30`		`- return NISTObjectIdentifiers.id_ml_dsa_44;`
`31`		`- }`
`32`		`- if (MLDSAParameters.ml_dsa_65 == parameters)`
`33`		`- {`
`34`		`- return NISTObjectIdentifiers.id_ml_dsa_65;`
`35`		`- }`
`36`		`- if (MLDSAParameters.ml_dsa_87 == parameters)`
`37`		`- {`
`38`		`- return NISTObjectIdentifiers.id_ml_dsa_87;`
`39`		`- }`
`40`		`- throw new IllegalArgumentException();`
`41`		`- }`
`42`		`-`
`43`	`26`	`public static int getMLDSASignatureScheme(MLDSAParameters parameters)`
`44`	`27`	`{`
`45`	`28`	`if (MLDSAParameters.ml_dsa_44 == parameters)`
`@@ -57,9 +40,9 @@ public static int getMLDSASignatureScheme(MLDSAParameters parameters)`
`57`	`40`	`throw new IllegalArgumentException();`
`58`	`41`	`}`
`59`	`42`
`60`		`- public static boolean supportsMLDSA(AlgorithmIdentifier pubKeyAlgID, ASN1ObjectIdentifier algorithm)`
	`43`	`+ public static boolean supportsMLDSA(AlgorithmIdentifier pubKeyAlgID, ASN1ObjectIdentifier mlDsaAlgOid)`
`61`	`44`	`{`
`62`		`- return pubKeyAlgID.getAlgorithm().equals(algorithm)`
	`45`	`+ return pubKeyAlgID.getAlgorithm().equals(mlDsaAlgOid)`
`63`	`46`	`&& pubKeyAlgID.getParameters() == null;`
`64`	`47`	`}`
`65`	`48`	`}`
Original file line number	Diff line number	Diff line change
`@@ -26,7 +26,6 @@`
`26`	`26`	`import org.bouncycastle.crypto.signers.PSSSigner;`
`27`	`27`	`import org.bouncycastle.crypto.signers.RSADigestSigner;`
`28`	`28`	`import org.bouncycastle.crypto.util.PublicKeyFactory;`
`29`		`-import org.bouncycastle.pqc.crypto.mldsa.MLDSAParameters;`
`30`	`29`	`import org.bouncycastle.pqc.crypto.mldsa.MLDSAPublicKeyParameters;`
`31`	`30`	`import org.bouncycastle.pqc.crypto.mldsa.MLDSASigner;`
`32`	`31`	`import org.bouncycastle.tls.AlertDescription;`
`@@ -255,16 +254,10 @@ public Tls13Verifier createVerifier(int signatureScheme) throws IOException`
`255`	`254`	`case SignatureScheme.DRAFT_mldsa65:`
`256`	`255`	`case SignatureScheme.DRAFT_mldsa87:`
`257`	`256`	`{`
`258`		`- ASN1ObjectIdentifier algorithm = PQCUtil.getMLDSAObjectidentifier(signatureScheme);`
`259`		`- validateMLDSA(algorithm);`
	`257`	`+ ASN1ObjectIdentifier mlDsaAlgOid = PQCUtil.getMLDSAObjectidentifier(signatureScheme);`
	`258`	`+ validateMLDSA(mlDsaAlgOid);`
`260`	`259`
`261`	`260`	`MLDSAPublicKeyParameters publicKey = getPubKeyMLDSA();`
`262`		`- MLDSAParameters parameters = publicKey.getParameters();`
`263`		`- if (!PQCUtil.getMLDSAObjectidentifier(parameters).equals(algorithm))`
`264`		`- {`
`265`		`- throw new TlsFatalAlert(AlertDescription.certificate_unknown,`
`266`		`- "ML-DSA public key not for " + SignatureScheme.getText(signatureScheme));`
`267`		`- }`
`268`	`261`
`269`	`262`	`MLDSASigner verifier = new MLDSASigner();`
`270`	`263`	`verifier.init(false, publicKey);`
`@@ -485,10 +478,10 @@ protected boolean supportsKeyUsage(int keyUsageBit)`
`485`	`478`	`return true;`
`486`	`479`	`}`
`487`	`480`
`488`		`- protected boolean supportsMLDSA(ASN1ObjectIdentifier algorithm)`
	`481`	`+ protected boolean supportsMLDSA(ASN1ObjectIdentifier mlDsaAlgOid)`
`489`	`482`	`{`
`490`	`483`	`AlgorithmIdentifier pubKeyAlgID = keyInfo.getAlgorithm();`
`491`		`- return PQCUtil.supportsMLDSA(pubKeyAlgID, algorithm);`
	`484`	`+ return PQCUtil.supportsMLDSA(pubKeyAlgID, mlDsaAlgOid);`
`492`	`485`	`}`
`493`	`486`
`494`	`487`	`protected boolean supportsRSA_PKCS1()`
`@@ -582,10 +575,10 @@ public void validateKeyUsage(int keyUsageBit)`
`582`	`575`	`}`
`583`	`576`	`}`
`584`	`577`
`585`		`- protected void validateMLDSA(ASN1ObjectIdentifier algorithm)`
	`578`	`+ protected void validateMLDSA(ASN1ObjectIdentifier mlDsaAlgOid)`
`586`	`579`	`throws IOException`
`587`	`580`	`{`
`588`		`- if (!supportsMLDSA(algorithm))`
	`581`	`+ if (!supportsMLDSA(mlDsaAlgOid))`
`589`	`582`	`{`
`590`	`583`	`throw new TlsFatalAlert(AlertDescription.certificate_unknown, "No support for ML-DSA signature scheme");`
`591`	`584`	`}`