Skip to content

Add utility method to convert JKS/PKCS12 KeyStore streams to WKS type#108

Merged
douzzer merged 2 commits intowolfSSL:masterfrom
cconlon:convertKeyStoreToWKS
May 16, 2025
Merged

Add utility method to convert JKS/PKCS12 KeyStore streams to WKS type#108
douzzer merged 2 commits intowolfSSL:masterfrom
cconlon:convertKeyStoreToWKS

Conversation

@cconlon
Copy link
Member

@cconlon cconlon commented Mar 27, 2025

This PR adds a JCE-level utility method which can be used to convert existing JKS/PKCS12 KeyStore InputStream objects into a WKS (WolfSSLKeyStore) type:

public static InputStream convertKeyStoreToWKS(InputStream stream, 
    char[] oldPassword, char[] newPassword, boolean failOnInsertErrors)
    throws IOException, NoSuchProviderException {

This can be useful if WKS type KeyStores need to be used for FIPS compliance, but existing JKS/PKCS12 types need to be converted. This helper method itself will call Sun providers for reading the JKS/PKCS12 entries, before storing them back into a WKS KeyStore. Caution should be taken that calling this code can result in calling down to non-FIPS validated cryptography in those cases when using wolfCrypt FIPS underneath wolfJCE.

This PR also updates README_JCE.md with usage notes, and adds new JUnit tests for this utility method:

    [junit] JCE WolfCryptUtils Class
    [junit] 	testNullPassword
    [junit] 	testConvertP12ToWksWithoutMapping
    [junit] 	testConvertCacertsToWks
    [junit] 	testConvertWksToWks
    [junit] 	testConvertP12ToWksWithMapping
    [junit] 	testNullInputStream
    [junit] 	testConvertJksToWksWithoutMapping
    [junit] 	testConvertJksToWksWithMapping

This PR also contains one small fix to WolfSSLKeyStore.java, specifically:

  • Use the local KDF iterations inside an internal WKSPrivateKey when calling getDecryptedKey() instead of using the KDF iteration default set by the Security properties. When decrypting, we need to use the local set value, incase the KDF iterations have changed at the system level. The system level iteration count will still be used for the creation of any new key derivations.

ZD 17962

@cconlon cconlon force-pushed the convertKeyStoreToWKS branch 2 times, most recently from c61f09e to 8babef8 Compare March 27, 2025 22:30
@cconlon cconlon self-assigned this Mar 27, 2025
@cconlon cconlon force-pushed the convertKeyStoreToWKS branch from 8babef8 to 96af485 Compare March 27, 2025 23:06
@cconlon cconlon force-pushed the convertKeyStoreToWKS branch from 96af485 to 5dd856b Compare May 8, 2025 19:49
@cconlon cconlon requested a review from Copilot May 8, 2025 19:50
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR adds a new JCE-level utility method to convert JKS/PKCS12 KeyStore streams to the WKS format and includes associated tests, documentation updates, and a minor fix in WolfSSLKeyStore.

  • Introduces WolfCryptUtil.convertKeyStoreToWKS() for runtime KeyStore format conversion.
  • Updates the test suite to validate the new conversion method.
  • Fixes the usage of local KDF iterations in WolfSSLKeyStore and enhances log messaging.

Reviewed Changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file
File Description
src/test/java/com/wolfssl/provider/jce/test/WolfSSLKeyStoreTest.java Removed an extraneous comment.
src/test/java/com/wolfssl/provider/jce/test/WolfJCETestSuite.java Updated test suite to include new utility tests.
src/main/java/com/wolfssl/provider/jce/WolfSSLKeyStore.java Adjusted KDF iterations usage and added logging for null InputStreams.
src/main/java/com/wolfssl/provider/jce/WolfCryptUtil.java Added a new utility method for KeyStore conversion with comprehensive format detection.
scripts/infer.sh Updated static analysis configuration to include the new utility class.
README_JCE.md Revised documentation to include instructions and usage details for the new conversion method.
Comments suppressed due to low confidence (1)

src/test/java/com/wolfssl/provider/jce/test/WolfSSLKeyStoreTest.java:1432

  • [nitpick] It appears that an extraneous comment was removed. Ensure that any comments in test files are meaningful and align with the intended documentation for future maintainability.
//CHRIS

@cconlon cconlon force-pushed the convertKeyStoreToWKS branch from 5dd856b to bda62a8 Compare May 8, 2025 22:07
@cconlon cconlon assigned JacobBarthelmeh and wolfSSL-Bot and unassigned cconlon May 8, 2025
@douzzer douzzer merged commit ee709ed into wolfSSL:master May 16, 2025
41 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants