public class ECCelerateProvider
extends iaik.security.ssl.IaikProvider
This iSaSiLk SecurityProvider implements some methods that are required for supporting elliptic curve cipher suites according to RFC 4492.
To install this security provider call:
// register IAIK ECCelerate provider iaik.security.ec.provider.ECCelerate.addAsProvider(); // install security provider SecurityProvider.setSecurityProvider(new ECCelerateProvider());
SecurityProvider
,
IaikProvider
Modifier and Type | Field and Description |
---|---|
static String |
EC_DEFAULT_BINARY
Default binary curve to be used if arbitrary char2 curves are suggested by
the client.
|
static String |
EC_DEFAULT_PRIME
Default prime curve to be used if arbitrary prime curves are suggested by
the client.
|
ALG_CIPHER_3DES, ALG_CIPHER_AES, ALG_CIPHER_AES_CCM, ALG_CIPHER_AES_GCM, ALG_CIPHER_AES_PKCS5, ALG_CIPHER_CAMELLIA, ALG_CIPHER_CAMELLIA_GCM, ALG_CIPHER_CHACHA20_POLY1305, ALG_CIPHER_DES, ALG_CIPHER_IDEA, ALG_CIPHER_RC2, ALG_CIPHER_RC4, ALG_CIPHER_RSA, ALG_CIPHER_RSA_DECRYPT, ALG_CIPHER_RSA_ENCRYPT, ALG_CIPHER_RSA_ENCRYPT_SSL2, ALG_CIPHER_RSA_SIGN, ALG_CIPHER_RSA_VERIFY, ALG_DIGEST_MD5, ALG_DIGEST_SHA, ALG_DIGEST_SHA1, ALG_DIGEST_SHA224, ALG_DIGEST_SHA256, ALG_DIGEST_SHA384, ALG_DIGEST_SHA512, ALG_HMAC_MD5, ALG_HMAC_SHA, ALG_HMAC_SHA256, ALG_HMAC_SHA384, ALG_HMAC_SHA512, ALG_KEYEX_DH, ALG_KEYEX_DSA, ALG_KEYEX_DSA_CLIENT, ALG_KEYEX_ECDH, ALG_KEYEX_ECDSA, ALG_KEYEX_ECDSA_CLIENT, ALG_KEYEX_RSA, ALG_KEYGEN_AES, ALG_KEYGEN_HMAC_SHA, ALG_KEYGEN_HMAC_SHA256, ALG_KEYGEN_PBKDF2, ALG_KEYPAIR_RSA, ALG_SIGNATURE_MD5RSA, ALG_SIGNATURE_RAWDSA, ALG_SIGNATURE_RAWECDSA, ALG_SIGNATURE_RAWRSAPSS, ALG_SIGNATURE_SHA1ECDSA, ALG_SIGNATURE_SHA1RSA, ALG_SIGNATURE_SHA224ECDSA, ALG_SIGNATURE_SHA224RSA, ALG_SIGNATURE_SHA256ECDSA, ALG_SIGNATURE_SHA256RSA, ALG_SIGNATURE_SHA384ECDSA, ALG_SIGNATURE_SHA384RSA, ALG_SIGNATURE_SHA512ECDSA, ALG_SIGNATURE_SHA512RSA, ALG_SIGNATURE_SHADSA, ALG_SIGNATURE_SHAECDSA, CIPHER_DECRYPT, CIPHER_ENCRYPT, CIPHER_NONE, configuration_, CONFIGURATION_PROPERTIES, KEYAGREEMENT_INIT, KEYAGREEMENT_NONE, provider, providerName, SIGNATURE_NONE, SIGNATURE_SIGN, SIGNATURE_VERIFY
Constructor and Description |
---|
ECCelerateProvider()
Default constructor.
|
Modifier and Type | Method and Description |
---|---|
boolean |
checkIfOnSameCurve(PublicKey ecdhServerPublicKey,
PublicKey ecdhClientPublicKey)
Checks if the given public server and client key are on the same elliptic
curve.
|
boolean |
checkKeyECPointFormat(PublicKey publicKey,
iaik.security.ssl.SupportedPointFormats supportedPointFormats)
Checks if the given public key complies with the given
SupportedPointFormats extension.
|
boolean |
checkKeyEllipticCurve(PublicKey publicKey,
iaik.security.ssl.SupportedEllipticCurves supportedEllipticCurves)
Checks if the given public key complies with the given
SupportedEllipticCurves extension.
|
PublicKey |
decodeECPublicKey(byte[] ecPoint,
PrivateKey privateKey,
iaik.security.ssl.SupportedPointFormats supportedPointFormats)
Decodes the given encoded EC PublicKey according to the
Octet-String-to-Point conversion of ANSI X9.62 (1998), section 4.3.7.
|
PublicKey |
decodeECPublicKey(byte[] ecPoint,
iaik.security.ssl.SupportedEllipticCurves.NamedCurve curve,
iaik.security.ssl.SupportedPointFormats supportedPointFormats,
iaik.security.ssl.SupportedEllipticCurves supportedEllipticCurves)
Decodes the given encoded EC PublicKey according to the
Octet-String-to-Point conversion of ANSI X9.62 (1998), section 4.3.7.
|
byte[] |
encodeECPublicKey(PublicKey publicKey,
iaik.security.ssl.SupportedPointFormats supportedPointFormats)
Encodes the given EC PublicKey according to the Point-To-Octet-String
conversion of ANSI X9.62 (1998), section 4.3.6.
|
KeyPair |
generateECKeyPair(PublicKey serverKey)
Generates a key pair with same domain parameters as the given public key
for the given key agreement method.
|
KeyPair |
generateECKeyPair(String name)
Generates an EC key pair for the given algorithm/curve name.
|
KeyPair |
generateECKeyPair(iaik.security.ssl.SupportedEllipticCurves supportedEllipticCurves,
iaik.security.ssl.SupportedPointFormats supportedPointFormats)
Generates a EC key pair according to the given list of supported curves.
|
iaik.security.ssl.SupportedEllipticCurves.NamedCurve |
getCurve(Key ecKey)
Gets the NamedCurve belonging to the given k EC key.
|
iaik.security.ssl.SupportedEllipticCurves.NamedCurve |
getCurve(PrivateKey ecPrivateKey)
Gets the NamedCurve belonging to the given private EC key.
|
iaik.security.ssl.SupportedEllipticCurves.NamedCurve |
getCurve(PublicKey ecPublicKey)
Gets the NamedCurve belonging to the given public EC key.
|
String |
getCurveName(PrivateKey ecPrivateKey)
Gets the curve name belonging to the given private EC key.
|
String |
getCurveName(PublicKey ecPublicKey)
Gets the curve name belonging to the given public EC key.
|
iaik.security.ssl.SupportedPointFormats.ECPointFormat |
getECPointFormat(PublicKey ecPublicKey)
Gets the ECPointFormat (uncompressed, compressed prime, compressed char2)
of the given public EC key.
|
KeyAgreement |
getKeyAgreement(String algorithm,
int mode,
Key key,
AlgorithmParameterSpec params,
SecureRandom random)
Gets a KeyAgreement object for the given algorithm.
|
int |
getKeyLength(PrivateKey privKey)
Calculates the length of the given private key.
|
int |
getKeyLength(PublicKey pubKey)
Calculates the length of the given public key.
|
protected KeyPairGenerator |
getKeyPairGenerator(String algorithm)
Returns a KeyPairGenerator for the requested algorithm.
|
protected Signature |
getSignature(String algorithm,
int mode,
Key key,
SecureRandom random)
Return a Signature implementation for the requested algorithm from the
IAIK_ECC provider.
|
boolean |
isBinary(PublicKey ecPublicKey)
Checks if the curve of the given EC Public Key is binary or prime.
|
boolean |
isNamedCurveSupported(iaik.security.ssl.SupportedEllipticCurves.NamedCurve curve)
Checks if the given NamedCurve is supported by this SecurityProvider.
|
boolean |
isPointFormatSupported(iaik.security.ssl.SupportedPointFormats.ECPointFormat pointFormat)
Checks if the given ECPointFormat is supported by this SecurityProvider.
|
aeadDecrypt, aeadEncrypt, calculateTrustedAuthorityIdentifier, canBeUsedWithKey, checkCreatedRSAServerKeyExchangeSignature, checkExtendedKeyUsage, createCertStatusRequest, createPkiPath, deriveKey, getCipher, getDHPrivateKey, getDHPublicKey, getEncodedPrincipal, getMessageDigest, getPrincipal, getRSAPssParameterSpec, getRSAPublicKey, getSecureRandom, getTLSServerName, getTLSServerName, getX509Certificate, getX509Certificate, getX509Certificates, loadKeyStore, loadKeyStore
calculateRawSignature, canBeUsedWithKey, canBeUsedWithKey, canBeUsedWithKey, checkCertSignatureAlgorithm, checkCertSignatureAlgorithm, checkCertSignatureAlgorithm, checkKeyLength, checkKeyLength, continueIfPeerDoesNotSupportSecureRenegotiation, createSharedECDHSecret, decodeURL, encodeURL, generateExtendedMasterSecret, generateMasterSecret, generateMasterSecret, getAlgorithmParameterGenerator, getDefaultCurve, getKeyGenerator, getKeyLength, getMac, getSecurityProvider, getSignature, getSignatureAlgorithms, getTLSServerName, getTLSServerName, isImplemented, isImplemented, isImplementedSignatureAlgorithm, isNamedGroupSupported, setSecurityProvider, validateDHPublicKey, verifyRawSignature
public static final String EC_DEFAULT_PRIME
public static final String EC_DEFAULT_BINARY
protected Signature getSignature(String algorithm, int mode, Key key, SecureRandom random) throws Exception
getSignature
in class iaik.security.ssl.IaikProvider
algorithm
- the name of the signature algorithmmode
- the mode deciding whether to initialize the Signature engine for
signing (SIGNATURE_SIGN
), for verification
( SIGNATURE_VERIFY
) or whether to do not
initialize the engine at all (SIGNATURE_NONE
)key
- the key with which to -- if requested -- init the Signature object
(if not null
)random
- the random generator with which to -- if requested -- init the
Signature object (if not null
) (ignored because of
JDK 1.1 compatibility; an application may override this method to
use signature.initSign(privateKey, random);
)Exception
public KeyAgreement getKeyAgreement(String algorithm, int mode, Key key, AlgorithmParameterSpec params, SecureRandom random) throws Exception
KeyAgreement
engine for ECDH based cipher suites.
If the mode parameter is KEYAGREEMENT_INIT
the KeyAgreement
object is to be initialized with the provided key, parameters (if not
null
) and random number generator (if not null
).
getKeyAgreement
in class iaik.security.ssl.SecurityProvider
algorithm
- the name of the KeyAgreement algorithm (e.g. "ECDH")mode
- the mode deciding whether to initialize (
KEYAGREEMENT_INIT
) the KeyAgreement or
not ( KEYAGREEMENT_NONE
)key
- the key with which to -- if requested -- init the KeyAgreement
object (if not null
)params
- the parameters with which to (-- if requested -- init the
KeyAgreement object (if not null
)random
- the random generator with which to -- if requested -- init the
KeyAgreement object (if not null
)Exception
- if no KeyAgreement instance for the required algorithm is
available or initialization of the KeyAgreement object failspublic int getKeyLength(PublicKey pubKey)
getKeyLength
in class iaik.security.ssl.SecurityProvider
pubKey
- the public key for which to calculate the lengthIllegalArgumentException
- if the public key algorithm is not supportedpublic int getKeyLength(PrivateKey privKey)
getKeyLength
in class iaik.security.ssl.SecurityProvider
privKey
- the public key for which to calculate the lengthIllegalArgumentException
- if the private key algorithm is not supportedpublic byte[] encodeECPublicKey(PublicKey publicKey, iaik.security.ssl.SupportedPointFormats supportedPointFormats) throws Exception
encodeECPublicKey
in class iaik.security.ssl.SecurityProvider
publicKey
- the public EC key to be encodedsupportedPointFormats
- the supported point formats of the peer; or null
if
the peer did not send a SupportedPointFormats
extension (in this case the uncompressed
format has to be used)Exception
- if an error occurs when encoding the keypublic PublicKey decodeECPublicKey(byte[] ecPoint, iaik.security.ssl.SupportedEllipticCurves.NamedCurve curve, iaik.security.ssl.SupportedPointFormats supportedPointFormats, iaik.security.ssl.SupportedEllipticCurves supportedEllipticCurves) throws Exception
This method is called on the client side to decode the public server key contained in an ECDH ServerKeyExchange message received from the server.
decodeECPublicKey
in class iaik.security.ssl.SecurityProvider
ecPoint
- the (client) public key ECPoint, encoded according to ANSI X9.62
(1998), section 4.3.6curve
- the curve of the keysupportedPointFormats
- the supported point formats sent to the server within the
SupportedPointFormats
extension; if
not null
check if the received key corresponds with
the supported point formatssupportedEllipticCurves
- the supported elliptic curves sent to the server within the
SupportedEllipticCurves
extension;
if not null
check if the received curve corresponds
with the supported curve listException
- if an error occurs when decoding the keypublic PublicKey decodeECPublicKey(byte[] ecPoint, PrivateKey privateKey, iaik.security.ssl.SupportedPointFormats supportedPointFormats) throws Exception
This method is called on the server side to decode the public client key contained in an ECDH ClientKeyExchange message received from the client.
decodeECPublicKey
in class iaik.security.ssl.SecurityProvider
ecPoint
- the (client) public key ECPoint, encoded according to ANSI X9.62
(1998), section 4.3.6privateKey
- the private (server) key containing the required domain parameterssupportedPointFormats
- the SupportedPointFormats
extension
sent to the client; if not null
check if the received
key corresponds with the supported point formatsException
- if an error occurs when decoding the keypublic KeyPair generateECKeyPair(PublicKey serverKey) throws Exception
This method is called by the library for creating the client key pair if ECDH or ECDHE ephemeral key exchange is used without fixed client authentication.
generateECKeyPair
in class iaik.security.ssl.SecurityProvider
serverKey
- the public key of the serverException
- if an error occurs when creating the key pairpublic KeyPair generateECKeyPair(iaik.security.ssl.SupportedEllipticCurves supportedEllipticCurves, iaik.security.ssl.SupportedPointFormats supportedPointFormats) throws Exception
generateECKeyPair
in class iaik.security.ssl.SecurityProvider
supportedEllipticCurves
- the supported elliptic curves, maybe null
if the
client has not sent a SupportedEllipticCurves extensionsupportedPointFormats
- the supported point formats; if not null
maybe used
to check if the peer may prefer a char2 curve (if no
SupportedEllipticCurves extension has been sent)Exception
- if an error occurs when generating the EC KeyPairpublic KeyPair generateECKeyPair(String name) throws Exception
generateECKeyPair
in class iaik.security.ssl.SecurityProvider
name
- the name of the algorithm/curveException
- if an error occurs when generating the EC KeyPairprotected KeyPairGenerator getKeyPairGenerator(String algorithm) throws Exception
This method is only called to generate temporary RSA keys of 512 or 1024 bit if those are required for an export cipher and you have not set any in the SSLServerContext.
getKeyPairGenerator
in class iaik.security.ssl.SecurityProvider
Exception
public iaik.security.ssl.SupportedEllipticCurves.NamedCurve getCurve(PublicKey ecPublicKey)
getCurve
in class iaik.security.ssl.SecurityProvider
ecPublicKey
- the public EC key to be encodednull
if the
curve of the key is not supportedpublic String getCurveName(PublicKey ecPublicKey)
getCurveName
in class iaik.security.ssl.SecurityProvider
ecPublicKey
- the public EC key for which to get the NamedCurvenull
if the
curve of the key is not supportedpublic iaik.security.ssl.SupportedEllipticCurves.NamedCurve getCurve(PrivateKey ecPrivateKey)
getCurve
in class iaik.security.ssl.SecurityProvider
ecPrivateKey
- the private EC key to be encodednull
if the
curve of the key is not supportedpublic String getCurveName(PrivateKey ecPrivateKey)
getCurveName
in class iaik.security.ssl.SecurityProvider
ecPrivateKey
- the private EC key for which to get the NamedCurvenull
if the
curve of the key is not supportedpublic iaik.security.ssl.SupportedEllipticCurves.NamedCurve getCurve(Key ecKey)
getCurve
in class iaik.security.ssl.SecurityProvider
ecKey
- the EC key to be encodednull
if the curve of
the key is not supportedpublic iaik.security.ssl.SupportedPointFormats.ECPointFormat getECPointFormat(PublicKey ecPublicKey)
getECPointFormat
in class iaik.security.ssl.SecurityProvider
ecPublicKey
- the public EC key for which to get the EC point formatnull
if the
point format cannot be checkedpublic boolean isBinary(PublicKey ecPublicKey) throws Exception
isBinary
in class iaik.security.ssl.SecurityProvider
ecPublicKey
- the EC public keyException
- if the key does not represent an EC key or it cannot be
determined if the underlying field is prime or binarypublic boolean checkIfOnSameCurve(PublicKey ecdhServerPublicKey, PublicKey ecdhClientPublicKey)
ECDSA_fixed_ECDH
and RSA_fixed_ECDH
.checkIfOnSameCurve
in class iaik.security.ssl.SecurityProvider
ecdhServerPublicKey
- the ECDH public key of the serverecdhClientPublicKey
- the ECDH public key of the clienttrue
if the two keys are on the same curve,
false
if notpublic boolean isPointFormatSupported(iaik.security.ssl.SupportedPointFormats.ECPointFormat pointFormat)
isPointFormatSupported
in class iaik.security.ssl.SecurityProvider
pointFormat
- the ECPointFormat to be checkedtrue
if the given ECPointFormat is supported,
false
if it is not supported.public boolean isNamedCurveSupported(iaik.security.ssl.SupportedEllipticCurves.NamedCurve curve)
isNamedCurveSupported
in class iaik.security.ssl.SecurityProvider
curve
- the NamedCurve to be checkedtrue
if the given NamedCurve is supported,
false
if it is not supported.public boolean checkKeyEllipticCurve(PublicKey publicKey, iaik.security.ssl.SupportedEllipticCurves supportedEllipticCurves)
checkKeyEllipticCurve
in class iaik.security.ssl.SecurityProvider
publicKey
- the public key used by the serversupportedEllipticCurves
- the SupportedEllipticCurves extension sent by the client; maybe
null
if the client has not sent a
SupportedEllipticCurves extensiontrue
if the public key complies with the
SupportedEllipticCurves extension, false
if it is does
not comply with it.public boolean checkKeyECPointFormat(PublicKey publicKey, iaik.security.ssl.SupportedPointFormats supportedPointFormats)
false
(since EC point format
check is not supported JDK- and provider independently).checkKeyECPointFormat
in class iaik.security.ssl.SecurityProvider
publicKey
- the public key used by the serversupportedPointFormats
- the SupportedPointFormats extension sent within the Hello message;
maybe null
if no SupportedPointFormats extension has
been sent to the peer (in this case the uncompressed format has to
be used!)true
if the public key complies with the
SupportedPointFormats extension, false
if it is does
not comply with it. By default this method returns
false
(since EC point format is not supported JDK- and
provider independently)Copyright © 2011–2022 Stiftung SIC. All rights reserved.