1 /*
2 * Copyright (c) 2006, 2013, Oracle and/or its affiliates. All rights reserved.
3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4 *
5 * This code is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License version 2 only, as
7 * published by the Free Software Foundation. Oracle designates this
8 * particular file as subject to the "Classpath" exception as provided
9 * by Oracle in the LICENSE file that accompanied this code.
10 *
11 * This code is distributed in the hope that it will be useful, but WITHOUT
12 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14 * version 2 for more details (a copy is included in the LICENSE file that
15 * accompanied this code).
16 *
17 * You should have received a copy of the GNU General Public License version
18 * 2 along with this work; if not, write to the Free Software Foundation,
19 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20 *
21 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22 * or visit www.oracle.com if you need additional information or have any
23 * questions.
24 */
25
26 package sun.security.pkcs11;
27
28 import java.io.IOException;
29 import java.math.BigInteger;
30
31 import java.security.*;
32 import java.security.interfaces.*;
33 import java.security.spec.*;
34
35 import static sun.security.pkcs11.TemplateManager.*;
36 import sun.security.pkcs11.wrapper.*;
37 import static sun.security.pkcs11.wrapper.PKCS11Constants.*;
38
39 import sun.security.util.DerValue;
40 import sun.security.util.ECUtil;
41
42 /**
43 * EC KeyFactory implementation.
44 *
45 * @author Andreas Sterbenz
46 * @since 1.6
47 */
48 final class P11ECKeyFactory extends P11KeyFactory {
49 private static Provider sunECprovider;
50
51 private static Provider getSunECProvider() {
52 if (sunECprovider == null) {
53 sunECprovider = Security.getProvider("SunEC");
54 if (sunECprovider == null) {
55 throw new RuntimeException("Cannot load SunEC provider");
56 }
57 }
58
59 return sunECprovider;
60 }
61
62 P11ECKeyFactory(Token token, String algorithm) {
63 super(token, algorithm);
64 }
65
66 static ECParameterSpec getECParameterSpec(String name) {
67 return ECUtil.getECParameterSpec(getSunECProvider(), name);
68 }
69
70 static ECParameterSpec getECParameterSpec(int keySize) {
71 return ECUtil.getECParameterSpec(getSunECProvider(), keySize);
72 }
73
74 // Check that spec is a known supported curve and convert it to our
75 // ECParameterSpec subclass. If not possible, return null.
76 static ECParameterSpec getECParameterSpec(ECParameterSpec spec) {
77 return ECUtil.getECParameterSpec(getSunECProvider(), spec);
78 }
79
80 static ECParameterSpec decodeParameters(byte[] params) throws IOException {
81 return ECUtil.getECParameterSpec(getSunECProvider(), params);
82 }
83
84 static byte[] encodeParameters(ECParameterSpec params) {
85 return ECUtil.encodeECParameterSpec(getSunECProvider(), params);
86 }
87
88 static ECPoint decodePoint(byte[] encoded, EllipticCurve curve) throws IOException {
89 return ECUtil.decodePoint(encoded, curve);
90 }
91
92 // Used by ECDH KeyAgreement
93 static byte[] getEncodedPublicValue(PublicKey key) throws InvalidKeyException {
94 if (key instanceof ECPublicKey) {
95 ECPublicKey ecKey = (ECPublicKey)key;
96 ECPoint w = ecKey.getW();
97 ECParameterSpec params = ecKey.getParams();
98 return ECUtil.encodePoint(w, params.getCurve());
99 } else {
100 // should never occur
101 throw new InvalidKeyException
102 ("Key class not yet supported: " + key.getClass().getName());
103 }
104 }
105
106 PublicKey implTranslatePublicKey(PublicKey key) throws InvalidKeyException {
107 try {
108 if (key instanceof ECPublicKey) {
109 ECPublicKey ecKey = (ECPublicKey)key;
110 return generatePublic(
111 ecKey.getW(),
112 ecKey.getParams()
113 );
114 } else if ("X.509".equals(key.getFormat())) {
115 // let Sun provider parse for us, then recurse
116 byte[] encoded = key.getEncoded();
117
118 try {
119 key = ECUtil.decodeX509ECPublicKey(encoded);
120 } catch (InvalidKeySpecException ikse) {
121 throw new InvalidKeyException(ikse);
122 }
123
124 return implTranslatePublicKey(key);
125 } else {
126 throw new InvalidKeyException("PublicKey must be instance "
127 + "of ECPublicKey or have X.509 encoding");
128 }
129 } catch (PKCS11Exception e) {
130 throw new InvalidKeyException("Could not create EC public key", e);
131 }
132 }
133
134 PrivateKey implTranslatePrivateKey(PrivateKey key)
135 throws InvalidKeyException {
136 try {
137 if (key instanceof ECPrivateKey) {
138 ECPrivateKey ecKey = (ECPrivateKey)key;
139 return generatePrivate(
140 ecKey.getS(),
141 ecKey.getParams()
142 );
143 } else if ("PKCS#8".equals(key.getFormat())) {
144 // let Sun provider parse for us, then recurse
145 byte[] encoded = key.getEncoded();
146
147 try {
148 key = ECUtil.decodePKCS8ECPrivateKey(encoded);
149 } catch (InvalidKeySpecException ikse) {
150 throw new InvalidKeyException(ikse);
151 }
152
153 return implTranslatePrivateKey(key);
154 } else {
155 throw new InvalidKeyException("PrivateKey must be instance "
156 + "of ECPrivateKey or have PKCS#8 encoding");
157 }
158 } catch (PKCS11Exception e) {
159 throw new InvalidKeyException("Could not create EC private key", e);
160 }
161 }
162
163 // see JCA spec
164 protected PublicKey engineGeneratePublic(KeySpec keySpec)
165 throws InvalidKeySpecException {
166 token.ensureValid();
167 if (keySpec instanceof X509EncodedKeySpec) {
168 try {
169 byte[] encoded = ((X509EncodedKeySpec)keySpec).getEncoded();
170 PublicKey key = ECUtil.decodeX509ECPublicKey(encoded);
171 return implTranslatePublicKey(key);
172 } catch (InvalidKeyException e) {
173 throw new InvalidKeySpecException
174 ("Could not create EC public key", e);
175 }
176 }
177 if (keySpec instanceof ECPublicKeySpec == false) {
178 throw new InvalidKeySpecException("Only ECPublicKeySpec and "
179 + "X509EncodedKeySpec supported for EC public keys");
180 }
181 try {
182 ECPublicKeySpec ec = (ECPublicKeySpec)keySpec;
183 return generatePublic(
184 ec.getW(),
185 ec.getParams()
186 );
187 } catch (PKCS11Exception e) {
188 throw new InvalidKeySpecException
189 ("Could not create EC public key", e);
190 }
191 }
192
193 // see JCA spec
194 protected PrivateKey engineGeneratePrivate(KeySpec keySpec)
195 throws InvalidKeySpecException {
196 token.ensureValid();
197 if (keySpec instanceof PKCS8EncodedKeySpec) {
198 try {
199 byte[] encoded = ((PKCS8EncodedKeySpec)keySpec).getEncoded();
200 PrivateKey key = ECUtil.decodePKCS8ECPrivateKey(encoded);
201 return implTranslatePrivateKey(key);
202 } catch (GeneralSecurityException e) {
203 throw new InvalidKeySpecException
204 ("Could not create EC private key", e);
205 }
206 }
207 if (keySpec instanceof ECPrivateKeySpec == false) {
208 throw new InvalidKeySpecException("Only ECPrivateKeySpec and "
209 + "PKCS8EncodedKeySpec supported for EC private keys");
210 }
211 try {
212 ECPrivateKeySpec ec = (ECPrivateKeySpec)keySpec;
213 return generatePrivate(
214 ec.getS(),
215 ec.getParams()
216 );
217 } catch (PKCS11Exception e) {
218 throw new InvalidKeySpecException
219 ("Could not create EC private key", e);
220 }
221 }
222
223 private PublicKey generatePublic(ECPoint point, ECParameterSpec params)
224 throws PKCS11Exception {
225 byte[] encodedParams =
226 ECUtil.encodeECParameterSpec(getSunECProvider(), params);
227 byte[] encodedPoint =
228 ECUtil.encodePoint(point, params.getCurve());
229
230 // Check whether the X9.63 encoding of an EC point shall be wrapped
231 // in an ASN.1 OCTET STRING
232 if (!token.config.getUseEcX963Encoding()) {
233 try {
234 encodedPoint =
235 new DerValue(DerValue.tag_OctetString, encodedPoint)
236 .toByteArray();
237 } catch (IOException e) {
238 throw new
239 IllegalArgumentException("Could not DER encode point", e);
240 }
241 }
242
243 CK_ATTRIBUTE[] attributes = new CK_ATTRIBUTE[] {
244 new CK_ATTRIBUTE(CKA_CLASS, CKO_PUBLIC_KEY),
245 new CK_ATTRIBUTE(CKA_KEY_TYPE, CKK_EC),
246 new CK_ATTRIBUTE(CKA_EC_POINT, encodedPoint),
247 new CK_ATTRIBUTE(CKA_EC_PARAMS, encodedParams),
248 };
249 attributes = token.getAttributes
250 (O_IMPORT, CKO_PUBLIC_KEY, CKK_EC, attributes);
251 Session session = null;
252 try {
253 session = token.getObjSession();
254 long keyID = token.p11.C_CreateObject(session.id(), attributes);
255 return P11Key.publicKey
256 (session, keyID, "EC", params.getCurve().getField().getFieldSize(), attributes);
257 } finally {
258 token.releaseSession(session);
259 }
260 }
261
262 private PrivateKey generatePrivate(BigInteger s, ECParameterSpec params)
263 throws PKCS11Exception {
264 byte[] encodedParams =
265 ECUtil.encodeECParameterSpec(getSunECProvider(), params);
266 CK_ATTRIBUTE[] attributes = new CK_ATTRIBUTE[] {
267 new CK_ATTRIBUTE(CKA_CLASS, CKO_PRIVATE_KEY),
268 new CK_ATTRIBUTE(CKA_KEY_TYPE, CKK_EC),
269 new CK_ATTRIBUTE(CKA_VALUE, s),
270 new CK_ATTRIBUTE(CKA_EC_PARAMS, encodedParams),
271 };
272 attributes = token.getAttributes
273 (O_IMPORT, CKO_PRIVATE_KEY, CKK_EC, attributes);
274 Session session = null;
275 try {
276 session = token.getObjSession();
277 long keyID = token.p11.C_CreateObject(session.id(), attributes);
278 return P11Key.privateKey
279 (session, keyID, "EC", params.getCurve().getField().getFieldSize(), attributes);
280 } finally {
281 token.releaseSession(session);
282 }
283 }
284
285 <T extends KeySpec> T implGetPublicKeySpec(P11Key key, Class<T> keySpec,
286 Session[] session) throws PKCS11Exception, InvalidKeySpecException {
287 if (ECPublicKeySpec.class.isAssignableFrom(keySpec)) {
288 session[0] = token.getObjSession();
289 CK_ATTRIBUTE[] attributes = new CK_ATTRIBUTE[] {
290 new CK_ATTRIBUTE(CKA_EC_POINT),
291 new CK_ATTRIBUTE(CKA_EC_PARAMS),
292 };
293 token.p11.C_GetAttributeValue(session[0].id(), key.keyID, attributes);
294 try {
295 ECParameterSpec params = decodeParameters(attributes[1].getByteArray());
296 ECPoint point = decodePoint(attributes[0].getByteArray(), params.getCurve());
297 return keySpec.cast(new ECPublicKeySpec(point, params));
298 } catch (IOException e) {
299 throw new InvalidKeySpecException("Could not parse key", e);
300 }
301 } else { // X.509 handled in superclass
302 throw new InvalidKeySpecException("Only ECPublicKeySpec and "
303 + "X509EncodedKeySpec supported for EC public keys");
304 }
305 }
306
307 <T extends KeySpec> T implGetPrivateKeySpec(P11Key key, Class<T> keySpec,
308 Session[] session) throws PKCS11Exception, InvalidKeySpecException {
309 if (ECPrivateKeySpec.class.isAssignableFrom(keySpec)) {
310 session[0] = token.getObjSession();
311 CK_ATTRIBUTE[] attributes = new CK_ATTRIBUTE[] {
312 new CK_ATTRIBUTE(CKA_VALUE),
313 new CK_ATTRIBUTE(CKA_EC_PARAMS),
314 };
315 token.p11.C_GetAttributeValue(session[0].id(), key.keyID, attributes);
316 try {
317 ECParameterSpec params = decodeParameters(attributes[1].getByteArray());
318 return keySpec.cast(
319 new ECPrivateKeySpec(attributes[0].getBigInteger(), params));
320 } catch (IOException e) {
321 throw new InvalidKeySpecException("Could not parse key", e);
322 }
323 } else { // PKCS#8 handled in superclass
324 throw new InvalidKeySpecException("Only ECPrivateKeySpec "
325 + "and PKCS8EncodedKeySpec supported for EC private keys");
326 }
327 }
328
329 KeyFactory implGetSoftwareFactory() throws GeneralSecurityException {
330 return KeyFactory.getInstance("EC", getSunECProvider());
331 }
332
333 }