Skip to content

Commit 637f3e6

Browse files
AnhelinaMAnhelinaM
committed
Update bouncycastle fips java version to 1.0.2.4
DEVSIX-7962
1 parent c3befa7 commit 637f3e6

File tree

8 files changed

+200
-11
lines changed

8 files changed

+200
-11
lines changed

‎bouncy-castle-fips-adapter/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
<url>https://itextpdf.com/</url>
1212

1313
<properties>
14-
<bouncycastleFips.version>1.0.2.3</bouncycastleFips.version>
14+
<bouncycastleFips.version>1.0.2.4</bouncycastleFips.version>
1515
<bouncycastlePkixFips.version>1.0.6</bouncycastlePkixFips.version>
1616
<sonar.coverage.exclusions>**/*</sonar.coverage.exclusions>
1717
<sonar.cpd.exclusions>**/*</sonar.cpd.exclusions>

‎bouncy-castle-fips-adapter/src/main/java/com/itextpdf/bouncycastlefips/BouncyCastleFipsFactory.java‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,7 @@ This file is part of the iText (R) project.
112112
import com.itextpdf.bouncycastlefips.cms.jcajce.JcaSimpleSignerInfoVerifierBuilderBCFips;
113113
import com.itextpdf.bouncycastlefips.cms.jcajce.JceKeyAgreeEnvelopedRecipientBCFips;
114114
import com.itextpdf.bouncycastlefips.cms.jcajce.JceKeyTransEnvelopedRecipientBCFips;
115+
import com.itextpdf.bouncycastlefips.crypto.fips.FipsUnapprovedOperationErrorBCFips;
115116
import com.itextpdf.bouncycastlefips.openssl.PEMParserBCFips;
116117
import com.itextpdf.bouncycastlefips.openssl.jcajce.JcaPEMKeyConverterBCFips;
117118
import com.itextpdf.bouncycastlefips.openssl.jcajce.JceOpenSSLPKCS8DecryptorProviderBuilderBCFips;
@@ -310,6 +311,7 @@ This file is part of the iText (R) project.
310311
import org.bouncycastle.cms.jcajce.JceKeyAgreeEnvelopedRecipient;
311312
import org.bouncycastle.cms.jcajce.JceKeyTransEnvelopedRecipient;
312313
import org.bouncycastle.crypto.CryptoServicesRegistrar;
314+
import org.bouncycastle.crypto.fips.FipsUnapprovedOperationError;
313315
import org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider;
314316
import org.bouncycastle.openssl.PEMParser;
315317
import org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter;
@@ -1741,7 +1743,11 @@ public byte[] createCipherBytes(X509Certificate x509certificate, byte[] abyte0,
17411743
} catch (NoSuchAlgorithmException ignored) {
17421744
cipher = Cipher.getInstance("RSA", PROVIDER);
17431745
}
1744-
cipher.init(Cipher.WRAP_MODE, x509certificate.getPublicKey());
1746+
try {
1747+
cipher.init(Cipher.WRAP_MODE, x509certificate.getPublicKey());
1748+
} catch (FipsUnapprovedOperationError e) {
1749+
throw new FipsUnapprovedOperationErrorBCFips(e);
1750+
}
17451751
return cipher.wrap(new SecretKeySpec(abyte0, "AES"));
17461752
}
17471753

‎bouncy-castle-fips-adapter/src/main/java/com/itextpdf/bouncycastlefips/crypto/fips/FipsUnapprovedOperationErrorBCFips.java‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
/*
2+
This file is part of the iText (R) project.
3+
Copyright (c) 1998-2024 Apryse Group NV
4+
Authors: Apryse Software.
5+
6+
This program is offered under a commercial and under the AGPL license.
7+
For commercial licensing, contact us at https://itextpdf.com/sales. For AGPL licensing, see below.
8+
9+
AGPL licensing:
10+
This program is free software: you can redistribute it and/or modify
11+
it under the terms of the GNU Affero General Public License as published by
12+
the Free Software Foundation, either version 3 of the License, or
13+
(at your option) any later version.
14+
15+
This program is distributed in the hope that it will be useful,
16+
but WITHOUT ANY WARRANTY; without even the implied warranty of
17+
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18+
GNU Affero General Public License for more details.
19+
20+
You should have received a copy of the GNU Affero General Public License
21+
along with this program. If not, see <https://www.gnu.org/licenses/>.
22+
*/
23+
package com.itextpdf.bouncycastlefips.crypto.fips;
24+
25+
import com.itextpdf.commons.bouncycastle.crypto.fips.AbstractFipsUnapprovedOperationError;
26+
import org.bouncycastle.crypto.fips.FipsUnapprovedOperationError;
27+
28+
import java.util.Objects;
29+
30+
/**
31+
* Wrapper class for {@link FipsUnapprovedOperationError}.
32+
*/
33+
public class FipsUnapprovedOperationErrorBCFips extends AbstractFipsUnapprovedOperationError {
34+
private final FipsUnapprovedOperationError error;
35+
36+
/**
37+
* Creates new wrapper instance for {@link FipsUnapprovedOperationError}.
38+
*
39+
* @param error {@link FipsUnapprovedOperationError} to be wrapped
40+
*/
41+
public FipsUnapprovedOperationErrorBCFips(FipsUnapprovedOperationError error) {
42+
this.error = error;
43+
}
44+
45+
/**
46+
* Gets actual org.bouncycastle object being wrapped.
47+
*
48+
* @return wrapped {@link FipsUnapprovedOperationError}.
49+
*/
50+
public FipsUnapprovedOperationError getError() {
51+
return error;
52+
}
53+
54+
/**
55+
* Indicates whether some other object is "equal to" this one. Compares wrapped objects.
56+
*/
57+
@Override
58+
public boolean equals(Object o) {
59+
if (this == o) {
60+
return true;
61+
}
62+
if (o == null || getClass() != o.getClass()) {
63+
return false;
64+
}
65+
FipsUnapprovedOperationErrorBCFips that = (FipsUnapprovedOperationErrorBCFips) o;
66+
return Objects.equals(error, that.error);
67+
}
68+
69+
/**
70+
* Returns a hash code value based on the wrapped object.
71+
*/
72+
@Override
73+
public int hashCode() {
74+
return Objects.hash(error);
75+
}
76+
77+
/**
78+
* Delegates {@code toString} method call to the wrapped object.
79+
*/
80+
@Override
81+
public String toString() {
82+
return error.toString();
83+
}
84+
85+
/**
86+
* Delegates {@code getMessage} method call to the wrapped exception.
87+
*/
88+
@Override
89+
public String getMessage() {
90+
return error.getMessage();
91+
}
92+
}

‎commons/pom.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212

1313
<properties>
1414
<jackson.core.version>2.16.1</jackson.core.version>
15+
<sonar.coverage.exclusions>**/com/itextpdf/commons/bouncycastle/**</sonar.coverage.exclusions>
1516
</properties>
1617

1718
<dependencies>

‎commons/src/main/java/com/itextpdf/commons/bouncycastle/crypto/fips/AbstractFipsUnapprovedOperationError.java‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
/*
2+
This file is part of the iText (R) project.
3+
Copyright (c) 1998-2024 Apryse Group NV
4+
Authors: Apryse Software.
5+
6+
This program is offered under a commercial and under the AGPL license.
7+
For commercial licensing, contact us at https://itextpdf.com/sales. For AGPL licensing, see below.
8+
9+
AGPL licensing:
10+
This program is free software: you can redistribute it and/or modify
11+
it under the terms of the GNU Affero General Public License as published by
12+
the Free Software Foundation, either version 3 of the License, or
13+
(at your option) any later version.
14+
15+
This program is distributed in the hope that it will be useful,
16+
but WITHOUT ANY WARRANTY; without even the implied warranty of
17+
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18+
GNU Affero General Public License for more details.
19+
20+
You should have received a copy of the GNU Affero General Public License
21+
along with this program. If not, see <https://www.gnu.org/licenses/>.
22+
*/
23+
package com.itextpdf.commons.bouncycastle.crypto.fips;
24+
25+
/**
26+
* This class represents the wrapper for FipsUnapprovedOperationError used in bouncy-castle FIPS implementation.
27+
* That wrapper provides the ability to switch between bouncy-castle and bouncy-castle FIPS implementations.
28+
*/
29+
public abstract class AbstractFipsUnapprovedOperationError extends Error {
30+
}

‎kernel/src/test/java/com/itextpdf/kernel/crypto/PdfEncryptingTest.java‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ This file is part of the iText (R) project.
2323
package com.itextpdf.kernel.crypto;
2424

2525
import com.itextpdf.bouncycastleconnector.BouncyCastleFactoryCreator;
26+
import com.itextpdf.commons.bouncycastle.crypto.fips.AbstractFipsUnapprovedOperationError;
2627
import com.itextpdf.commons.utils.Base64;
2728
import com.itextpdf.commons.utils.MessageFormatUtil;
2829
import com.itextpdf.io.font.constants.StandardFonts;
@@ -119,7 +120,13 @@ public void encryptWithPasswordAes256Pdf2() throws IOException, InterruptedExcep
119120
@Test
120121
@LogMessages(messages = @LogMessage(messageTemplate = KernelLogMessageConstant.MD5_IS_NOT_FIPS_COMPLIANT), ignore = true)
121122
public void encryptWithCertificateAes256Rsa() throws GeneralSecurityException, IOException, InterruptedException {
122-
encryptWithCertificate("encryptWithCertificateAes256Rsa.pdf", "SHA256withRSA.crt");
123+
if (BouncyCastleFactoryCreator.getFactory().isInApprovedOnlyMode()) {
124+
// RSA PKCS1.5 encryption disallowed
125+
Assert.assertThrows(AbstractFipsUnapprovedOperationError.class,
126+
() -> encryptWithCertificate("encryptWithCertificateAes256Rsa.pdf", "SHA256withRSA.crt"));
127+
} else {
128+
encryptWithCertificate("encryptWithCertificateAes256Rsa.pdf", "SHA256withRSA.crt");
129+
}
123130
}
124131

125132
@Test

‎kernel/src/test/java/com/itextpdf/kernel/crypto/PdfEncryptionManuallyPortedTest.java‎

Lines changed: 57 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ This file is part of the iText (R) project.
2424

2525
import com.itextpdf.bouncycastleconnector.BouncyCastleFactoryCreator;
2626
import com.itextpdf.commons.bouncycastle.IBouncyCastleFactory;
27+
import com.itextpdf.commons.bouncycastle.crypto.fips.AbstractFipsUnapprovedOperationError;
2728
import com.itextpdf.commons.bouncycastle.operator.AbstractOperatorCreationException;
2829
import com.itextpdf.commons.bouncycastle.pkcs.AbstractPKCSException;
2930
import com.itextpdf.io.font.constants.StandardFonts;
@@ -116,7 +117,13 @@ public void encryptWithCertificateStandard128() throws IOException, InterruptedE
116117
AbstractPKCSException, AbstractOperatorCreationException {
117118
String filename = "encryptWithCertificateStandard128.pdf";
118119
int encryptionType = EncryptionConstants.STANDARD_ENCRYPTION_128;
119-
encryptWithCertificate(filename, encryptionType, CompressionConstants.DEFAULT_COMPRESSION);
120+
if (FACTORY.isInApprovedOnlyMode()) {
121+
// RSA PKCS1.5 encryption disallowed
122+
Assert.assertThrows(AbstractFipsUnapprovedOperationError.class,
123+
() -> encryptWithCertificate(filename, encryptionType, CompressionConstants.DEFAULT_COMPRESSION));
124+
} else {
125+
encryptWithCertificate(filename, encryptionType, CompressionConstants.DEFAULT_COMPRESSION);
126+
}
120127
}
121128

122129
@Test
@@ -126,7 +133,13 @@ public void encryptWithCertificateStandard40() throws IOException, InterruptedEx
126133
AbstractPKCSException, AbstractOperatorCreationException {
127134
String filename = "encryptWithCertificateStandard40.pdf";
128135
int encryptionType = EncryptionConstants.STANDARD_ENCRYPTION_40;
129-
encryptWithCertificate(filename, encryptionType, CompressionConstants.DEFAULT_COMPRESSION);
136+
if (FACTORY.isInApprovedOnlyMode()) {
137+
// RSA PKCS1.5 encryption disallowed
138+
Assert.assertThrows(AbstractFipsUnapprovedOperationError.class,
139+
() -> encryptWithCertificate(filename, encryptionType, CompressionConstants.DEFAULT_COMPRESSION));
140+
} else {
141+
encryptWithCertificate(filename, encryptionType, CompressionConstants.DEFAULT_COMPRESSION);
142+
}
130143
}
131144

132145
@Test
@@ -136,7 +149,13 @@ public void encryptWithCertificateStandard128NoCompression() throws IOException,
136149
GeneralSecurityException, AbstractPKCSException, AbstractOperatorCreationException {
137150
String filename = "encryptWithCertificateStandard128NoCompression.pdf";
138151
int encryptionType = EncryptionConstants.STANDARD_ENCRYPTION_128;
139-
encryptWithCertificate(filename, encryptionType, CompressionConstants.NO_COMPRESSION);
152+
if (FACTORY.isInApprovedOnlyMode()) {
153+
// RSA PKCS1.5 encryption disallowed
154+
Assert.assertThrows(AbstractFipsUnapprovedOperationError.class,
155+
() -> encryptWithCertificate(filename, encryptionType, CompressionConstants.NO_COMPRESSION));
156+
} else {
157+
encryptWithCertificate(filename, encryptionType, CompressionConstants.NO_COMPRESSION);
158+
}
140159
}
141160

142161
@Test
@@ -146,7 +165,13 @@ public void encryptWithCertificateStandard40NoCompression() throws IOException,
146165
GeneralSecurityException, AbstractPKCSException, AbstractOperatorCreationException {
147166
String filename = "encryptWithCertificateStandard40NoCompression.pdf";
148167
int encryptionType = EncryptionConstants.STANDARD_ENCRYPTION_40;
149-
encryptWithCertificate(filename, encryptionType, CompressionConstants.NO_COMPRESSION);
168+
if (FACTORY.isInApprovedOnlyMode()) {
169+
// RSA PKCS1.5 encryption disallowed
170+
Assert.assertThrows(AbstractFipsUnapprovedOperationError.class,
171+
() -> encryptWithCertificate(filename, encryptionType, CompressionConstants.NO_COMPRESSION));
172+
} else {
173+
encryptWithCertificate(filename, encryptionType, CompressionConstants.NO_COMPRESSION);
174+
}
150175
}
151176

152177
@Test
@@ -156,7 +181,13 @@ public void encryptWithCertificateAes128() throws IOException, InterruptedExcept
156181
AbstractPKCSException, AbstractOperatorCreationException {
157182
String filename = "encryptWithCertificateAes128.pdf";
158183
int encryptionType = EncryptionConstants.ENCRYPTION_AES_128;
159-
encryptWithCertificate(filename, encryptionType, CompressionConstants.DEFAULT_COMPRESSION);
184+
if (FACTORY.isInApprovedOnlyMode()) {
185+
// RSA PKCS1.5 encryption disallowed
186+
Assert.assertThrows(AbstractFipsUnapprovedOperationError.class,
187+
() -> encryptWithCertificate(filename, encryptionType, CompressionConstants.DEFAULT_COMPRESSION));
188+
} else {
189+
encryptWithCertificate(filename, encryptionType, CompressionConstants.DEFAULT_COMPRESSION);
190+
}
160191
}
161192

162193
@Test
@@ -166,7 +197,13 @@ public void encryptWithCertificateAes256() throws IOException, InterruptedExcept
166197
AbstractPKCSException, AbstractOperatorCreationException {
167198
String filename = "encryptWithCertificateAes256.pdf";
168199
int encryptionType = EncryptionConstants.ENCRYPTION_AES_256;
169-
encryptWithCertificate(filename, encryptionType, CompressionConstants.DEFAULT_COMPRESSION);
200+
if (FACTORY.isInApprovedOnlyMode()) {
201+
// RSA PKCS1.5 encryption disallowed
202+
Assert.assertThrows(AbstractFipsUnapprovedOperationError.class,
203+
() -> encryptWithCertificate(filename, encryptionType, CompressionConstants.DEFAULT_COMPRESSION));
204+
} else {
205+
encryptWithCertificate(filename, encryptionType, CompressionConstants.DEFAULT_COMPRESSION);
206+
}
170207
}
171208

172209
@Test
@@ -176,7 +213,13 @@ public void encryptWithCertificateAes128NoCompression() throws IOException, Inte
176213
GeneralSecurityException, AbstractPKCSException, AbstractOperatorCreationException {
177214
String filename = "encryptWithCertificateAes128NoCompression.pdf";
178215
int encryptionType = EncryptionConstants.ENCRYPTION_AES_128;
179-
encryptWithCertificate(filename, encryptionType, CompressionConstants.NO_COMPRESSION);
216+
if (FACTORY.isInApprovedOnlyMode()) {
217+
// RSA PKCS1.5 encryption disallowed
218+
Assert.assertThrows(AbstractFipsUnapprovedOperationError.class,
219+
() -> encryptWithCertificate(filename, encryptionType, CompressionConstants.NO_COMPRESSION));
220+
} else {
221+
encryptWithCertificate(filename, encryptionType, CompressionConstants.NO_COMPRESSION);
222+
}
180223
}
181224

182225
@Test
@@ -186,7 +229,13 @@ public void encryptWithCertificateAes256NoCompression() throws IOException, Inte
186229
GeneralSecurityException, AbstractPKCSException, AbstractOperatorCreationException {
187230
String filename = "encryptWithCertificateAes256NoCompression.pdf";
188231
int encryptionType = EncryptionConstants.ENCRYPTION_AES_256;
189-
encryptWithCertificate(filename, encryptionType, CompressionConstants.NO_COMPRESSION);
232+
if (FACTORY.isInApprovedOnlyMode()) {
233+
// RSA PKCS1.5 encryption disallowed
234+
Assert.assertThrows(AbstractFipsUnapprovedOperationError.class,
235+
() -> encryptWithCertificate(filename, encryptionType, CompressionConstants.NO_COMPRESSION));
236+
} else {
237+
encryptWithCertificate(filename, encryptionType, CompressionConstants.NO_COMPRESSION);
238+
}
190239
}
191240

192241
@Test

‎sharpenConfiguration.xml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -337,6 +337,10 @@
337337
<file path="com/itextpdf/commons/bouncycastle/tsp/ITimeStampToken.java"/>
338338
<file path="com/itextpdf/commons/bouncycastle/tsp/ITimeStampTokenGenerator.java"/>
339339
</fileset>
340+
<fileset reason="These classes are used only in Java.">
341+
<file path="com/itextpdf/commons/bouncycastle/crypto/fips/AbstractFipsUnapprovedOperationError.java"/>
342+
<file path="com/itextpdf/bouncycastlefips/crypto/fips/FipsUnapprovedOperationErrorBCFips.java"/>
343+
</fileset>
340344
<!-- kernel -->
341345
<file path="com/itextpdf/kernel/pdf/CountOutputStream.java"/>
342346
<file path="com/itextpdf/kernel/crypto/securityhandler/EncryptionUtils.java"/>

0 commit comments

Comments
 (0)