Move DigestAlgorithms and OID to kernel, merge SecurityIDs into OID

DEVSIX-8565

Author: introfog

kernel/src/main/java/com/itextpdf/kernel/crypto/CryptoUtil.java

@@ -31,6 +31,9 @@ This file is part of the iText (R) project.
 
 import java.io.InputStream;
 import java.io.OutputStream;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.NoSuchProviderException;
 import java.security.cert.Certificate;
 import java.security.cert.CertificateException;
 import java.security.cert.CertificateFactory;
@@ -69,4 +72,13 @@ public static IASN1OutputStream createAsn1OutputStream(OutputStream outputStream
         }
         return BOUNCY_CASTLE_FACTORY.createASN1OutputStream(outputStream, asn1Encoding);
     }
+
+    static MessageDigest getMessageDigest(String hashAlgorithm, String provider)
+            throws NoSuchAlgorithmException, NoSuchProviderException {
+        if (provider == null || provider.startsWith("SunPKCS11") || provider.startsWith("SunMSCAPI")) {
+            return MessageDigest.getInstance(DigestAlgorithms.normalizeDigestName(hashAlgorithm));
+        } else {
+            return MessageDigest.getInstance(hashAlgorithm, provider);
+        }
+    }
 }

sign/src/main/java/com/itextpdf/signatures/DigestAlgorithms.java renamed to kernel/src/main/java/com/itextpdf/kernel/crypto/DigestAlgorithms.java

@@ -20,14 +20,12 @@ This file is part of the iText (R) project.
     You should have received a copy of the GNU Affero General Public License
     along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-package com.itextpdf.signatures;
+package com.itextpdf.kernel.crypto;
 
 import com.itextpdf.bouncycastleconnector.BouncyCastleFactoryCreator;
 import com.itextpdf.commons.bouncycastle.IBouncyCastleFactory;
-import com.itextpdf.signatures.exceptions.SignExceptionMessageConstant;
-import com.itextpdf.signatures.logs.SignLogMessageConstant;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
+import com.itextpdf.kernel.exceptions.KernelExceptionMessageConstant;
+import com.itextpdf.kernel.logs.KernelLogMessageConstant;
 
 import java.io.IOException;
 import java.io.InputStream;
@@ -37,6 +35,8 @@ This file is part of the iText (R) project.
 import java.security.NoSuchProviderException;
 import java.util.HashMap;
 import java.util.Map;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 /**
  * Class that contains a map with the different message digest algorithms.
@@ -123,10 +123,10 @@ public class DigestAlgorithms {
         digestNames.put("1.2.840.113549.2.5", "MD5");
         digestNames.put("1.2.840.113549.2.2", "MD2");
         digestNames.put("1.3.14.3.2.26", "SHA1");
-        digestNames.put("2.16.840.1.101.3.4.2.4", "SHA224");
-        digestNames.put("2.16.840.1.101.3.4.2.1", "SHA256");
-        digestNames.put("2.16.840.1.101.3.4.2.2", "SHA384");
-        digestNames.put("2.16.840.1.101.3.4.2.3", "SHA512");
+        digestNames.put(OID.SHA_224, "SHA224");
+        digestNames.put(OID.SHA_256, "SHA256");
+        digestNames.put(OID.SHA_384, "SHA384");
+        digestNames.put(OID.SHA_512, "SHA512");
         digestNames.put("1.3.36.3.2.2", "RIPEMD128");
         digestNames.put("1.3.36.3.2.1", "RIPEMD160");
         digestNames.put("1.3.36.3.2.3", "RIPEMD256");
@@ -137,8 +137,6 @@ public class DigestAlgorithms {
         digestNames.put("1.2.840.113549.1.1.11", "SHA256");
         digestNames.put("1.2.840.113549.1.1.12", "SHA384");
         digestNames.put("1.2.840.113549.1.1.13", "SHA512");
-        digestNames.put("1.2.840.113549.2.5", "MD5");
-        digestNames.put("1.2.840.113549.2.2", "MD2");
         digestNames.put("1.2.840.10040.4.3", "SHA1");
         digestNames.put("2.16.840.1.101.3.4.3.1", "SHA224");
         digestNames.put("2.16.840.1.101.3.4.3.2", "SHA256");
@@ -148,11 +146,11 @@ public class DigestAlgorithms {
         digestNames.put("1.3.36.3.3.1.2", "RIPEMD160");
         digestNames.put("1.3.36.3.3.1.4", "RIPEMD256");
         digestNames.put("1.2.643.2.2.9", "GOST3411");
-        digestNames.put("2.16.840.1.101.3.4.2.7", "SHA3-224");
-        digestNames.put("2.16.840.1.101.3.4.2.8", "SHA3-256");
-        digestNames.put("2.16.840.1.101.3.4.2.9", "SHA3-384");
-        digestNames.put("2.16.840.1.101.3.4.2.10", "SHA3-512");
-        digestNames.put("2.16.840.1.101.3.4.2.12", "SHAKE256");
+        digestNames.put(OID.SHA3_224, "SHA3-224");
+        digestNames.put(OID.SHA3_256, "SHA3-256");
+        digestNames.put(OID.SHA3_384, "SHA3-384");
+        digestNames.put(OID.SHA3_512, "SHA3-512");
+        digestNames.put(OID.SHAKE_256, "SHAKE256");
 
         fixNames.put("SHA256", SHA256);
         fixNames.put("SHA384", SHA384);
@@ -164,26 +162,26 @@ public class DigestAlgorithms {
         allowedDigests.put("MD-5", "1.2.840.113549.2.5");
         allowedDigests.put("SHA1", "1.3.14.3.2.26");
         allowedDigests.put("SHA-1", "1.3.14.3.2.26");
-        allowedDigests.put("SHA224", "2.16.840.1.101.3.4.2.4");
-        allowedDigests.put("SHA-224", "2.16.840.1.101.3.4.2.4");
-        allowedDigests.put("SHA256", "2.16.840.1.101.3.4.2.1");
-        allowedDigests.put("SHA-256", "2.16.840.1.101.3.4.2.1");
-        allowedDigests.put("SHA384", "2.16.840.1.101.3.4.2.2");
-        allowedDigests.put("SHA-384", "2.16.840.1.101.3.4.2.2");
-        allowedDigests.put("SHA512", "2.16.840.1.101.3.4.2.3");
-        allowedDigests.put("SHA-512", "2.16.840.1.101.3.4.2.3");
+        allowedDigests.put("SHA224", OID.SHA_224);
+        allowedDigests.put("SHA-224", OID.SHA_224);
+        allowedDigests.put("SHA256", OID.SHA_256);
+        allowedDigests.put("SHA-256", OID.SHA_256);
+        allowedDigests.put("SHA384", OID.SHA_384);
+        allowedDigests.put("SHA-384", OID.SHA_384);
+        allowedDigests.put("SHA512", OID.SHA_512);
+        allowedDigests.put("SHA-512", OID.SHA_512);
         allowedDigests.put("RIPEMD128", "1.3.36.3.2.2");
         allowedDigests.put("RIPEMD-128", "1.3.36.3.2.2");
         allowedDigests.put("RIPEMD160", "1.3.36.3.2.1");
         allowedDigests.put("RIPEMD-160", "1.3.36.3.2.1");
         allowedDigests.put("RIPEMD256", "1.3.36.3.2.3");
         allowedDigests.put("RIPEMD-256", "1.3.36.3.2.3");
         allowedDigests.put("GOST3411", "1.2.643.2.2.9");
-        allowedDigests.put("SHA3-224", "2.16.840.1.101.3.4.2.7");
-        allowedDigests.put("SHA3-256", "2.16.840.1.101.3.4.2.8");
-        allowedDigests.put("SHA3-384", "2.16.840.1.101.3.4.2.9");
-        allowedDigests.put("SHA3-512", "2.16.840.1.101.3.4.2.10");
-        allowedDigests.put("SHAKE256", "2.16.840.1.101.3.4.2.12");
+        allowedDigests.put("SHA3-224", OID.SHA3_224);
+        allowedDigests.put("SHA3-256", OID.SHA3_256);
+        allowedDigests.put("SHA3-384", OID.SHA3_384);
+        allowedDigests.put("SHA3-512", OID.SHA3_512);
+        allowedDigests.put("SHAKE256", OID.SHAKE_256);
 
         bitLengths.put("MD2", 128);
         bitLengths.put("MD-2", 128);
@@ -217,7 +215,9 @@ public class DigestAlgorithms {
      *
      * @param digestOid oid of the digest algorithm
      * @param provider the provider you want to use to create the hash
+     *
      * @return MessageDigest object
+     *
      * @throws NoSuchAlgorithmException thrown when a particular cryptographic algorithm is
      * requested but is not available in the environment
      * @throws NoSuchProviderException thrown when a particular security provider is
@@ -233,15 +233,17 @@ public static MessageDigest getMessageDigestFromOid(String digestOid, String pro
      *
      * @param hashAlgorithm	the algorithm you want to use to create a hash
      * @param provider	the provider you want to use to create the hash
+     *
      * @return	a MessageDigest object
+     *
      * @throws NoSuchAlgorithmException thrown when a particular cryptographic algorithm is
      * requested but is not available in the environment
      * @throws NoSuchProviderException thrown when a particular security provider is
      * requested but is not available in the environment
      */
     public static MessageDigest getMessageDigest(String hashAlgorithm, String provider)
             throws NoSuchAlgorithmException, NoSuchProviderException {
-        return SignUtils.getMessageDigest(hashAlgorithm, provider);
+        return CryptoUtil.getMessageDigest(hashAlgorithm, provider);
     }
 
     /**
@@ -250,7 +252,9 @@ public static MessageDigest getMessageDigest(String hashAlgorithm, String provid
      * @param data	the message of which you want to create a hash
      * @param hashAlgorithm	the algorithm used to create the hash
      * @param provider	the provider used to create the hash
+     *
      * @return	the hash
+     *
      * @throws GeneralSecurityException when requested cryptographic algorithm or security provider
      * is not available
      * @throws IOException signals that an I/O exception has occurred
@@ -262,11 +266,13 @@ public static byte[] digest(InputStream data, String hashAlgorithm, String provi
     }
 
     /**
-     * Create a digest based on the inputstream.
+     * Create a digest based on the input stream.
      *
      * @param data data to be digested
      * @param messageDigest algorithm to be used
+     *
      * @return digest of the data
+     *
      * @throws IOException signals that an I/O exception has occurred
      */
     public static byte[] digest(InputStream data, MessageDigest messageDigest)
@@ -291,7 +297,7 @@ public static String getDigest(String oid) {
         if (ret == null) {
             try {
                 String digest = getMessageDigest(oid, BOUNCY_CASTLE_FACTORY.getProviderName()).getAlgorithm();
-                LOGGER.warn(SignLogMessageConstant.ALGORITHM_NOT_FROM_SPEC);
+                LOGGER.warn(KernelLogMessageConstant.ALGORITHM_NOT_FROM_SPEC);
                 return digest;
             } catch (Exception e) {
                 return oid;
@@ -305,6 +311,7 @@ public static String getDigest(String oid) {
      * Normalize the digest name.
      *
      * @param algo the name to be normalized
+     *
      * @return normalized name
      */
     public static String normalizeDigestName(String algo) {
@@ -318,21 +325,22 @@ public static String normalizeDigestName(String algo) {
      * Returns the id of a digest algorithms that is allowed in PDF,
      * or null if it isn't allowed.
      *
-     * @param name	The name of the digest algorithm.
-     * @return	An oid.
+     * @param name the name of the digest algorithm
+     *
+     * @return an oid
      */
     public static String getAllowedDigest(String name) {
         if (name == null) {
             throw new IllegalArgumentException(
-                    SignExceptionMessageConstant.THE_NAME_OF_THE_DIGEST_ALGORITHM_IS_NULL);
+                    KernelExceptionMessageConstant.THE_NAME_OF_THE_DIGEST_ALGORITHM_IS_NULL);
         }
         String allowedDigest = allowedDigests.get(name.toUpperCase());
         if (allowedDigest != null) {
             return allowedDigest;
         }
         allowedDigest = BOUNCY_CASTLE_FACTORY.getDigestAlgorithmOid(name.toUpperCase());
         if (allowedDigest != null) {
-            LOGGER.warn(SignLogMessageConstant.ALGORITHM_NOT_FROM_SPEC);
+            LOGGER.warn(KernelLogMessageConstant.ALGORITHM_NOT_FROM_SPEC);
         }
         return allowedDigest;
     }
@@ -341,12 +349,13 @@ public static String getAllowedDigest(String name) {
      * Retrieve the output length in bits of the given digest algorithm.
      *
      * @param name the name of the digest algorithm
+     *
      * @return the length of the output of the algorithm in bits
      */
     public static int getOutputBitLength(String name) {
         if (name == null) {
             throw new IllegalArgumentException(
-                    SignExceptionMessageConstant.THE_NAME_OF_THE_DIGEST_ALGORITHM_IS_NULL);
+                    KernelExceptionMessageConstant.THE_NAME_OF_THE_DIGEST_ALGORITHM_IS_NULL);
         }
         return bitLengths.get(name).intValue();
     }

sign/src/main/java/com/itextpdf/signatures/OID.java renamed to kernel/src/main/java/com/itextpdf/kernel/crypto/OID.java

@@ -20,7 +20,7 @@ This file is part of the iText (R) project.
     You should have received a copy of the GNU Affero General Public License
     along with this program.  If not, see <https://www.gnu.org/licenses/>.
  */
-package com.itextpdf.signatures;
+package com.itextpdf.kernel.crypto;
 
 import java.util.Arrays;
 import java.util.Collections;
@@ -31,6 +31,45 @@ This file is part of the iText (R) project.
  * Class containing all the OID values used by iText.
  */
 public final class OID {
+    public static final String PKCS7_DATA = "1.2.840.113549.1.7.1";
+    public static final String PKCS7_SIGNED_DATA = "1.2.840.113549.1.7.2";
+    public static final String RSA = "1.2.840.113549.1.1.1";
+    public static final String RSASSA_PSS = "1.2.840.113549.1.1.10";
+    public static final String RSA_WITH_SHA256 = "1.2.840.113549.1.1.11";
+    public static final String AA_SIGNING_CERTIFICATE_V1 = "1.2.840.113549.1.9.16.2.12";
+    public static final String AA_SIGNING_CERTIFICATE_V2 = "1.2.840.113549.1.9.16.2.47";
+    public static final String MGF1 = "1.2.840.113549.1.1.8";
+    public static final String AA_TIME_STAMP_TOKEN = "1.2.840.113549.1.9.16.2.14";
+    public static final String AUTHENTICATED_DATA = "1.2.840.113549.1.9.16.1.2";
+    public static final String CONTENT_TYPE = "1.2.840.113549.1.9.3";
+    public static final String MESSAGE_DIGEST = "1.2.840.113549.1.9.4";
+    public static final String SIGNING_TIME = "1.2.840.113549.1.9.5";
+    public static final String CMS_ALGORITHM_PROTECTION = "1.2.840.113549.1.9.52";
+    public static final String DSA = "1.2.840.10040.4.1";
+    public static final String ECDSA = "1.2.840.10045.2.1";
+    public static final String ADBE_REVOCATION = "1.2.840.113583.1.1.8";
+    public static final String TSA = "1.2.840.113583.1.1.9.1";
+
+    public static final String RSA_WITH_SHA3_512 = "2.16.840.1.101.3.4.3.16";
+    public static final String SHA_224 = "2.16.840.1.101.3.4.2.4";
+    public static final String SHA_256 = "2.16.840.1.101.3.4.2.1";
+    public static final String SHA_384 = "2.16.840.1.101.3.4.2.2";
+    public static final String SHA_512 = "2.16.840.1.101.3.4.2.3";
+    public static final String SHA3_224 = "2.16.840.1.101.3.4.2.7";
+    public static final String SHA3_256 = "2.16.840.1.101.3.4.2.8";
+    public static final String SHA3_384 = "2.16.840.1.101.3.4.2.9";
+    public static final String SHA3_512 = "2.16.840.1.101.3.4.2.10";
+    public static final String SHAKE_256 = "2.16.840.1.101.3.4.2.12";
+
+    public static final String ED25519 = "1.3.101.112";
+    public static final String ED448 = "1.3.101.113";
+    public static final String OCSP = "1.3.6.1.5.5.7.48.1";
+    public static final String CA_ISSUERS = "1.3.6.1.5.5.7.48.2";
+    public static final String RI_OCSP_RESPONSE = "1.3.6.1.5.5.7.16.2";
+
+    public static final String KDF_PDF_MAC_WRAP_KDF = "1.0.32004.1.1";
+    public static final String CT_PDF_MAC_INTEGRITY_INFO = "1.0.32004.1.0";
+
 
     private OID() {
         // Empty on purpose. Avoiding instantiation of this class.

kernel/src/main/java/com/itextpdf/kernel/exceptions/KernelExceptionMessageConstant.java

@@ -371,6 +371,7 @@ public final class KernelExceptionMessageConstant {
             + "TagTreePointer is in invalid state: it points at removed element use TagTreePointer#moveToRoot.";
     public static final String THERE_IS_NO_ASSOCIATE_PDF_WRITER_FOR_MAKING_INDIRECTS = "There is no associate "
             + "PdfWriter for making indirects.";
+    public static final String THE_NAME_OF_THE_DIGEST_ALGORITHM_IS_NULL = "The name of the digest algorithm is null.";
     public static final String THIS_DECODE_PARAMETER_TYPE_IS_NOT_SUPPORTED = "Decode parameter type {0} is not "
             + "supported.";
     public static final String THIS_FILTER_IS_NOT_SUPPORTED = "Filter {0} is not supported.";

kernel/src/main/java/com/itextpdf/kernel/logs/KernelLogMessageConstant.java

@@ -104,6 +104,8 @@ public final class KernelLogMessageConstant {
 
     public static final String FINGERPRINT_DISABLED_BUT_NO_REQUIRED_LICENCE = "Fingerprint disabling is only " +
             "available in non AGPL mode. Fingerprint will be added at the end of the document.";
+    public static final String ALGORITHM_NOT_FROM_SPEC =
+            "Requested algorithm might not be supported by the pdf specification.";
 
     private KernelLogMessageConstant() {
         //Private constructor will prevent the instantiation of this class directly