| /* |
| * Copyright (c) 2010, 2016, Oracle and/or its affiliates. All rights reserved. |
| * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. |
| * |
| * This code is free software; you can redistribute it and/or modify it |
| * under the terms of the GNU General Public License version 2 only, as |
| * published by the Free Software Foundation. Oracle designates this |
| * particular file as subject to the "Classpath" exception as provided |
| * by Oracle in the LICENSE file that accompanied this code. |
| * |
| * This code is distributed in the hope that it will be useful, but WITHOUT |
| * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
| * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License |
| * version 2 for more details (a copy is included in the LICENSE file that |
| * accompanied this code). |
| * |
| * You should have received a copy of the GNU General Public License version |
| * 2 along with this work; if not, write to the Free Software Foundation, |
| * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. |
| * |
| * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA |
| * or visit www.oracle.com if you need additional information or have any |
| * questions. |
| */ |
| |
| package sun.security.ssl; |
| |
| import java.security.AlgorithmConstraints; |
| import java.security.CryptoPrimitive; |
| import java.security.PrivateKey; |
| import java.security.Security; |
| |
| import java.util.Set; |
| import java.util.HashSet; |
| import java.util.Map; |
| import java.util.EnumSet; |
| import java.util.TreeMap; |
| import java.util.Collection; |
| import java.util.Collections; |
| import java.util.ArrayList; |
| |
| import sun.security.util.KeyUtil; |
| |
| /** |
| * Signature and hash algorithm. |
| * |
| * [RFC5246] The client uses the "signature_algorithms" extension to |
| * indicate to the server which signature/hash algorithm pairs may be |
| * used in digital signatures. The "extension_data" field of this |
| * extension contains a "supported_signature_algorithms" value. |
| * |
| * enum { |
| * none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5), |
| * sha512(6), (255) |
| * } HashAlgorithm; |
| * |
| * enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) } |
| * SignatureAlgorithm; |
| * |
| * struct { |
| * HashAlgorithm hash; |
| * SignatureAlgorithm signature; |
| * } SignatureAndHashAlgorithm; |
| */ |
| final class SignatureAndHashAlgorithm { |
| |
| // minimum priority for default enabled algorithms |
| static final int SUPPORTED_ALG_PRIORITY_MAX_NUM = 0x00F0; |
| |
| // performance optimization |
| private static final Set<CryptoPrimitive> SIGNATURE_PRIMITIVE_SET = |
| Collections.unmodifiableSet(EnumSet.of(CryptoPrimitive.SIGNATURE)); |
| |
| // supported pairs of signature and hash algorithm |
| private static final Map<Integer, SignatureAndHashAlgorithm> supportedMap; |
| private static final Map<Integer, SignatureAndHashAlgorithm> priorityMap; |
| |
| // the hash algorithm |
| private HashAlgorithm hash; |
| |
| // id in 16 bit MSB format, i.e. 0x0603 for SHA512withECDSA |
| private int id; |
| |
| // the standard algorithm name, for example "SHA512withECDSA" |
| private String algorithm; |
| |
| // Priority for the preference order. The lower the better. |
| // |
| // If the algorithm is unsupported, its priority should be bigger |
| // than SUPPORTED_ALG_PRIORITY_MAX_NUM. |
| private int priority; |
| |
| // constructor for supported algorithm |
| private SignatureAndHashAlgorithm(HashAlgorithm hash, |
| SignatureAlgorithm signature, String algorithm, int priority) { |
| this.hash = hash; |
| this.algorithm = algorithm; |
| this.id = ((hash.value & 0xFF) << 8) | (signature.value & 0xFF); |
| this.priority = priority; |
| } |
| |
| // constructor for unsupported algorithm |
| private SignatureAndHashAlgorithm(String algorithm, int id, int sequence) { |
| this.hash = HashAlgorithm.valueOf((id >> 8) & 0xFF); |
| this.algorithm = algorithm; |
| this.id = id; |
| |
| // add one more to the sequence number, in case that the number is zero |
| this.priority = SUPPORTED_ALG_PRIORITY_MAX_NUM + sequence + 1; |
| } |
| |
| // Note that we do not use the sequence argument for supported algorithms, |
| // so please don't sort by comparing the objects read from handshake |
| // messages. |
| static SignatureAndHashAlgorithm valueOf(int hash, |
| int signature, int sequence) { |
| hash &= 0xFF; |
| signature &= 0xFF; |
| |
| int id = (hash << 8) | signature; |
| SignatureAndHashAlgorithm signAlg = supportedMap.get(id); |
| if (signAlg == null) { |
| // unsupported algorithm |
| signAlg = new SignatureAndHashAlgorithm( |
| "Unknown (hash:0x" + Integer.toString(hash, 16) + |
| ", signature:0x" + Integer.toString(signature, 16) + ")", |
| id, sequence); |
| } |
| |
| return signAlg; |
| } |
| |
| int getHashValue() { |
| return (id >> 8) & 0xFF; |
| } |
| |
| int getSignatureValue() { |
| return id & 0xFF; |
| } |
| |
| String getAlgorithmName() { |
| return algorithm; |
| } |
| |
| // return the size of a SignatureAndHashAlgorithm structure in TLS record |
| static int sizeInRecord() { |
| return 2; |
| } |
| |
| // Get local supported algorithm collection complying to |
| // algorithm constraints |
| static Collection<SignatureAndHashAlgorithm> |
| getSupportedAlgorithms(AlgorithmConstraints constraints) { |
| |
| Collection<SignatureAndHashAlgorithm> supported = new ArrayList<>(); |
| for (SignatureAndHashAlgorithm sigAlg : priorityMap.values()) { |
| if (sigAlg.priority <= SUPPORTED_ALG_PRIORITY_MAX_NUM && |
| constraints.permits(SIGNATURE_PRIMITIVE_SET, |
| sigAlg.algorithm, null)) { |
| supported.add(sigAlg); |
| } |
| } |
| |
| return supported; |
| } |
| |
| // Get supported algorithm collection from an untrusted collection |
| static Collection<SignatureAndHashAlgorithm> getSupportedAlgorithms( |
| AlgorithmConstraints constraints, |
| Collection<SignatureAndHashAlgorithm> algorithms ) { |
| Collection<SignatureAndHashAlgorithm> supported = new ArrayList<>(); |
| for (SignatureAndHashAlgorithm sigAlg : algorithms) { |
| if (sigAlg.priority <= SUPPORTED_ALG_PRIORITY_MAX_NUM && |
| constraints.permits(SIGNATURE_PRIMITIVE_SET, |
| sigAlg.algorithm, null)) { |
| supported.add(sigAlg); |
| } |
| } |
| |
| return supported; |
| } |
| |
| static String[] getAlgorithmNames( |
| Collection<SignatureAndHashAlgorithm> algorithms) { |
| ArrayList<String> algorithmNames = new ArrayList<>(); |
| if (algorithms != null) { |
| for (SignatureAndHashAlgorithm sigAlg : algorithms) { |
| algorithmNames.add(sigAlg.algorithm); |
| } |
| } |
| |
| String[] array = new String[algorithmNames.size()]; |
| return algorithmNames.toArray(array); |
| } |
| |
| static Set<String> getHashAlgorithmNames( |
| Collection<SignatureAndHashAlgorithm> algorithms) { |
| Set<String> algorithmNames = new HashSet<>(); |
| if (algorithms != null) { |
| for (SignatureAndHashAlgorithm sigAlg : algorithms) { |
| if (sigAlg.hash.value > 0) { |
| algorithmNames.add(sigAlg.hash.standardName); |
| } |
| } |
| } |
| |
| return algorithmNames; |
| } |
| |
| static String getHashAlgorithmName(SignatureAndHashAlgorithm algorithm) { |
| return algorithm.hash.standardName; |
| } |
| |
| private static void supports(HashAlgorithm hash, |
| SignatureAlgorithm signature, String algorithm, int priority) { |
| |
| SignatureAndHashAlgorithm pair = |
| new SignatureAndHashAlgorithm(hash, signature, algorithm, priority); |
| if (supportedMap.put(pair.id, pair) != null) { |
| throw new RuntimeException( |
| "Duplicate SignatureAndHashAlgorithm definition, id: " + |
| pair.id); |
| } |
| if (priorityMap.put(pair.priority, pair) != null) { |
| throw new RuntimeException( |
| "Duplicate SignatureAndHashAlgorithm definition, priority: " + |
| pair.priority); |
| } |
| } |
| |
| static SignatureAndHashAlgorithm getPreferableAlgorithm( |
| Collection<SignatureAndHashAlgorithm> algorithms, String expected) { |
| |
| return SignatureAndHashAlgorithm.getPreferableAlgorithm( |
| algorithms, expected, null); |
| } |
| |
| static SignatureAndHashAlgorithm getPreferableAlgorithm( |
| Collection<SignatureAndHashAlgorithm> algorithms, |
| String expected, PrivateKey signingKey) { |
| |
| int maxDigestLength = getMaxDigestLength(signingKey); |
| for (SignatureAndHashAlgorithm algorithm : algorithms) { |
| int signValue = algorithm.id & 0xFF; |
| if ((expected == null) || |
| (expected.equalsIgnoreCase("rsa") && |
| signValue == SignatureAlgorithm.RSA.value) || |
| (expected.equalsIgnoreCase("dsa") && |
| signValue == SignatureAlgorithm.DSA.value) || |
| (expected.equalsIgnoreCase("ecdsa") && |
| signValue == SignatureAlgorithm.ECDSA.value) || |
| (expected.equalsIgnoreCase("ec") && |
| signValue == SignatureAlgorithm.ECDSA.value)) { |
| |
| if (algorithm.priority <= SUPPORTED_ALG_PRIORITY_MAX_NUM && |
| algorithm.hash.length <= maxDigestLength) { |
| |
| return algorithm; |
| } |
| } |
| } |
| |
| return null; |
| } |
| |
| /* |
| * Need to check key length to match the length of hash value |
| */ |
| private static int getMaxDigestLength(PrivateKey signingKey) { |
| int maxDigestLength = Integer.MAX_VALUE; |
| |
| // only need to check RSA algorithm at present. |
| if (signingKey != null && |
| "rsa".equalsIgnoreCase(signingKey.getAlgorithm())) { |
| /* |
| * RSA keys of 512 bits have been shown to be practically |
| * breakable, it does not make much sense to use the strong |
| * hash algorithm for keys whose key size less than 512 bits. |
| * So it is not necessary to caculate the required max digest |
| * length exactly. |
| * |
| * If key size is greater than or equals to 768, there is no max |
| * digest length limitation in currect implementation. |
| * |
| * If key size is greater than or equals to 512, but less than |
| * 768, the digest length should be less than or equal to 32 bytes. |
| * |
| * If key size is less than 512, the digest length should be |
| * less than or equal to 20 bytes. |
| */ |
| int keySize = KeyUtil.getKeySize(signingKey); |
| if (keySize >= 768) { |
| maxDigestLength = HashAlgorithm.SHA512.length; |
| } else if ((keySize >= 512) && (keySize < 768)) { |
| maxDigestLength = HashAlgorithm.SHA256.length; |
| } else if ((keySize > 0) && (keySize < 512)) { |
| maxDigestLength = HashAlgorithm.SHA1.length; |
| } // Otherwise, cannot determine the key size, prefer the most |
| // preferable hash algorithm. |
| } |
| |
| return maxDigestLength; |
| } |
| |
| static enum HashAlgorithm { |
| UNDEFINED("undefined", "", -1, -1), |
| NONE( "none", "NONE", 0, -1), |
| MD5( "md5", "MD5", 1, 16), |
| SHA1( "sha1", "SHA-1", 2, 20), |
| SHA224( "sha224", "SHA-224", 3, 28), |
| SHA256( "sha256", "SHA-256", 4, 32), |
| SHA384( "sha384", "SHA-384", 5, 48), |
| SHA512( "sha512", "SHA-512", 6, 64); |
| |
| final String name; // not the standard signature algorithm name |
| // except the UNDEFINED, other names are defined |
| // by TLS 1.2 protocol |
| final String standardName; // the standard MessageDigest algorithm name |
| final int value; |
| final int length; // digest length in bytes, -1 means not applicable |
| |
| private HashAlgorithm(String name, String standardName, |
| int value, int length) { |
| this.name = name; |
| this.standardName = standardName; |
| this.value = value; |
| this.length = length; |
| } |
| |
| static HashAlgorithm valueOf(int value) { |
| HashAlgorithm algorithm = UNDEFINED; |
| switch (value) { |
| case 0: |
| algorithm = NONE; |
| break; |
| case 1: |
| algorithm = MD5; |
| break; |
| case 2: |
| algorithm = SHA1; |
| break; |
| case 3: |
| algorithm = SHA224; |
| break; |
| case 4: |
| algorithm = SHA256; |
| break; |
| case 5: |
| algorithm = SHA384; |
| break; |
| case 6: |
| algorithm = SHA512; |
| break; |
| } |
| |
| return algorithm; |
| } |
| } |
| |
| static enum SignatureAlgorithm { |
| UNDEFINED("undefined", -1), |
| ANONYMOUS("anonymous", 0), |
| RSA( "rsa", 1), |
| DSA( "dsa", 2), |
| ECDSA( "ecdsa", 3); |
| |
| final String name; // not the standard signature algorithm name |
| // except the UNDEFINED, other names are defined |
| // by TLS 1.2 protocol |
| final int value; |
| |
| private SignatureAlgorithm(String name, int value) { |
| this.name = name; |
| this.value = value; |
| } |
| |
| static SignatureAlgorithm valueOf(int value) { |
| SignatureAlgorithm algorithm = UNDEFINED; |
| switch (value) { |
| case 0: |
| algorithm = ANONYMOUS; |
| break; |
| case 1: |
| algorithm = RSA; |
| break; |
| case 2: |
| algorithm = DSA; |
| break; |
| case 3: |
| algorithm = ECDSA; |
| break; |
| } |
| |
| return algorithm; |
| } |
| } |
| |
| static { |
| supportedMap = Collections.synchronizedSortedMap( |
| new TreeMap<Integer, SignatureAndHashAlgorithm>()); |
| priorityMap = Collections.synchronizedSortedMap( |
| new TreeMap<Integer, SignatureAndHashAlgorithm>()); |
| |
| synchronized (supportedMap) { |
| int p = SUPPORTED_ALG_PRIORITY_MAX_NUM; |
| supports(HashAlgorithm.MD5, SignatureAlgorithm.RSA, |
| "MD5withRSA", --p); |
| supports(HashAlgorithm.SHA1, SignatureAlgorithm.DSA, |
| "SHA1withDSA", --p); |
| supports(HashAlgorithm.SHA1, SignatureAlgorithm.RSA, |
| "SHA1withRSA", --p); |
| supports(HashAlgorithm.SHA1, SignatureAlgorithm.ECDSA, |
| "SHA1withECDSA", --p); |
| |
| if (Security.getProvider("SunMSCAPI") == null) { |
| supports(HashAlgorithm.SHA224, SignatureAlgorithm.DSA, |
| "SHA224withDSA", --p); |
| supports(HashAlgorithm.SHA224, SignatureAlgorithm.RSA, |
| "SHA224withRSA", --p); |
| supports(HashAlgorithm.SHA224, SignatureAlgorithm.ECDSA, |
| "SHA224withECDSA", --p); |
| } |
| |
| supports(HashAlgorithm.SHA256, SignatureAlgorithm.DSA, |
| "SHA256withDSA", --p); |
| supports(HashAlgorithm.SHA256, SignatureAlgorithm.RSA, |
| "SHA256withRSA", --p); |
| supports(HashAlgorithm.SHA256, SignatureAlgorithm.ECDSA, |
| "SHA256withECDSA", --p); |
| supports(HashAlgorithm.SHA384, SignatureAlgorithm.RSA, |
| "SHA384withRSA", --p); |
| supports(HashAlgorithm.SHA384, SignatureAlgorithm.ECDSA, |
| "SHA384withECDSA", --p); |
| supports(HashAlgorithm.SHA512, SignatureAlgorithm.RSA, |
| "SHA512withRSA", --p); |
| supports(HashAlgorithm.SHA512, SignatureAlgorithm.ECDSA, |
| "SHA512withECDSA", --p); |
| } |
| } |
| } |
| |