| /* DSSKeyPairGenerator.java -- |
| Copyright 2001, 2002, 2003, 2006 Free Software Foundation, Inc. |
| |
| This file is a part of GNU Classpath. |
| |
| GNU Classpath is free software; you can redistribute it and/or modify |
| it under the terms of the GNU General Public License as published by |
| the Free Software Foundation; either version 2 of the License, or (at |
| your option) any later version. |
| |
| GNU Classpath is distributed in the hope that it will be useful, but |
| WITHOUT ANY WARRANTY; without even the implied warranty of |
| MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
| General Public License for more details. |
| |
| You should have received a copy of the GNU General Public License |
| along with GNU Classpath; if not, write to the Free Software |
| Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 |
| USA |
| |
| Linking this library statically or dynamically with other modules is |
| making a combined work based on this library. Thus, the terms and |
| conditions of the GNU General Public License cover the whole |
| combination. |
| |
| As a special exception, the copyright holders of this library give you |
| permission to link this library with independent modules to produce an |
| executable, regardless of the license terms of these independent |
| modules, and to copy and distribute the resulting executable under |
| terms of your choice, provided that you also meet, for each linked |
| independent module, the terms and conditions of the license of that |
| module. An independent module is a module which is not derived from |
| or based on this library. If you modify this library, you may extend |
| this exception to your version of the library, but you are not |
| obligated to do so. If you do not wish to do so, delete this |
| exception statement from your version. */ |
| |
| |
| package gnu.java.security.key.dss; |
| |
| import gnu.java.security.Configuration; |
| import gnu.java.security.Registry; |
| import gnu.java.security.hash.Sha160; |
| import gnu.java.security.key.IKeyPairGenerator; |
| import gnu.java.security.util.PRNG; |
| |
| import java.math.BigInteger; |
| import java.security.KeyPair; |
| import java.security.PrivateKey; |
| import java.security.PublicKey; |
| import java.security.SecureRandom; |
| import java.security.spec.DSAParameterSpec; |
| import java.util.Map; |
| import java.util.logging.Logger; |
| |
| /** |
| * A key-pair generator for asymetric keys to use in conjunction with the DSS |
| * (Digital Signature Standard). |
| * <p> |
| * References: |
| * <p> |
| * <a href="http://www.itl.nist.gov/fipspubs/fip186.htm">Digital Signature |
| * Standard (DSS)</a>, Federal Information Processing Standards Publication |
| * 186. National Institute of Standards and Technology. |
| */ |
| public class DSSKeyPairGenerator |
| implements IKeyPairGenerator |
| { |
| private static final Logger log = Logger.getLogger(DSSKeyPairGenerator.class.getName()); |
| |
| /** The BigInteger constant 2. */ |
| private static final BigInteger TWO = BigInteger.valueOf(2L); |
| |
| /** Property name of the length (Integer) of the modulus (p) of a DSS key. */ |
| public static final String MODULUS_LENGTH = "gnu.crypto.dss.L"; |
| |
| /** |
| * Property name of the Boolean indicating wether or not to use default pre- |
| * computed values of <code>p</code>, <code>q</code> and <code>g</code> |
| * for a given modulus length. The ultimate behaviour of this generator with |
| * regard to using pre-computed parameter sets will depend on the value of |
| * this property and of the following one {@link #STRICT_DEFAULTS}: |
| * <ol> |
| * <li>If this property is {@link Boolean#FALSE} then this generator will |
| * accept being setup for generating parameters for any modulus length |
| * provided the modulus length is between <code>512</code> and |
| * <code>1024</code>, and is of the form <code>512 + 64 * n</code>. In |
| * addition, a new paramter set will always be generated; i.e. no pre- |
| * computed values are used.</li> |
| * <li>If this property is {@link Boolean#TRUE} and the value of |
| * {@link #STRICT_DEFAULTS} is also {@link Boolean#TRUE} then this generator |
| * will only accept being setup for generating parameters for modulus lengths |
| * of <code>512</code>, <code>768</code> and <code>1024</code>. Any |
| * other value, of the modulus length, even if between <code>512</code> and |
| * <code>1024</code>, and of the form <code>512 + 64 * n</code>, will |
| * cause an {@link IllegalArgumentException} to be thrown. When those modulus |
| * length (<code>512</code>, <code>768</code>, and <code>1024</code>) |
| * are specified, the paramter set is always the same.</li> |
| * <li>Finally, if this property is {@link Boolean#TRUE} and the value of |
| * {@link #STRICT_DEFAULTS} is {@link Boolean#FALSE} then this generator will |
| * behave as in point 1 above, except that it will use pre-computed values |
| * when possible; i.e. the modulus length is one of <code>512</code>, |
| * <code>768</code>, or <code>1024</code>.</li> |
| * </ol> |
| * The default value of this property is {@link Boolean#TRUE}. |
| */ |
| public static final String USE_DEFAULTS = "gnu.crypto.dss.use.defaults"; |
| |
| /** |
| * Property name of the Boolean indicating wether or not to generate new |
| * parameters, even if the modulus length <i>L</i> is not one of the pre- |
| * computed defaults (value {@link Boolean#FALSE}), or throw an exception |
| * (value {@link Boolean#TRUE}) -- the exception in this case is an |
| * {@link IllegalArgumentException}. The default value for this property is |
| * {@link Boolean#FALSE}. The ultimate behaviour of this generator will |
| * depend on the values of this and {@link #USE_DEFAULTS} properties -- see |
| * {@link #USE_DEFAULTS} for more information. |
| */ |
| public static final String STRICT_DEFAULTS = "gnu.crypto.dss.strict.defaults"; |
| |
| /** |
| * Property name of an optional {@link SecureRandom} instance to use. The |
| * default is to use a classloader singleton from {@link PRNG}. |
| */ |
| public static final String SOURCE_OF_RANDOMNESS = "gnu.crypto.dss.prng"; |
| |
| /** |
| * Property name of an optional {@link DSAParameterSpec} instance to use for |
| * this generator's <code>p</code>, <code>q</code>, and <code>g</code> |
| * values. The default is to generate these values or use pre-computed ones, |
| * depending on the value of the <code>USE_DEFAULTS</code> attribute. |
| */ |
| public static final String DSS_PARAMETERS = "gnu.crypto.dss.params"; |
| |
| /** |
| * Property name of the preferred encoding format to use when externalizing |
| * generated instance of key-pairs from this generator. The property is taken |
| * to be an {@link Integer} that encapsulates an encoding format identifier. |
| */ |
| public static final String PREFERRED_ENCODING_FORMAT = "gnu.crypto.dss.encoding"; |
| |
| /** Default value for the modulus length. */ |
| public static final int DEFAULT_MODULUS_LENGTH = 1024; |
| |
| /** Default encoding format to use when none was specified. */ |
| private static final int DEFAULT_ENCODING_FORMAT = Registry.RAW_ENCODING_ID; |
| |
| /** Initial SHS context. */ |
| private static final int[] T_SHS = new int[] { |
| 0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476, 0xC3D2E1F0 |
| }; |
| |
| // from jdk1.3.1/docs/guide/security/CryptoSpec.html#AppB |
| public static final DSAParameterSpec KEY_PARAMS_512 = new DSAParameterSpec( |
| new BigInteger( |
| "fca682ce8e12caba26efccf7110e526db078b05edecbcd1eb4a208f3ae1617ae" |
| + "01f35b91a47e6df63413c5e12ed0899bcd132acd50d99151bdc43ee737592e17", 16), |
| new BigInteger("962eddcc369cba8ebb260ee6b6a126d9346e38c5", 16), |
| new BigInteger( |
| "678471b27a9cf44ee91a49c5147db1a9aaf244f05a434d6486931d2d14271b9e" |
| + "35030b71fd73da179069b32e2935630e1c2062354d0da20a6c416e50be794ca4", 16)); |
| public static final DSAParameterSpec KEY_PARAMS_768 = new DSAParameterSpec( |
| new BigInteger( |
| "e9e642599d355f37c97ffd3567120b8e25c9cd43e927b3a9670fbec5d8901419" |
| + "22d2c3b3ad2480093799869d1e846aab49fab0ad26d2ce6a22219d470bce7d77" |
| + "7d4a21fbe9c270b57f607002f3cef8393694cf45ee3688c11a8c56ab127a3daf", 16), |
| new BigInteger("9cdbd84c9f1ac2f38d0f80f42ab952e7338bf511", 16), |
| new BigInteger( |
| "30470ad5a005fb14ce2d9dcd87e38bc7d1b1c5facbaecbe95f190aa7a31d23c4" |
| + "dbbcbe06174544401a5b2c020965d8c2bd2171d3668445771f74ba084d2029d8" |
| + "3c1c158547f3a9f1a2715be23d51ae4d3e5a1f6a7064f316933a346d3f529252", 16)); |
| public static final DSAParameterSpec KEY_PARAMS_1024 = new DSAParameterSpec( |
| new BigInteger( |
| "fd7f53811d75122952df4a9c2eece4e7f611b7523cef4400c31e3f80b6512669" |
| + "455d402251fb593d8d58fabfc5f5ba30f6cb9b556cd7813b801d346ff26660b7" |
| + "6b9950a5a49f9fe8047b1022c24fbba9d7feb7c61bf83b57e7c6a8a6150f04fb" |
| + "83f6d3c51ec3023554135a169132f675f3ae2b61d72aeff22203199dd14801c7", 16), |
| new BigInteger("9760508f15230bccb292b982a2eb840bf0581cf5", 16), |
| new BigInteger( |
| "f7e1a085d69b3ddecbbcab5c36b857b97994afbbfa3aea82f9574c0b3d078267" |
| + "5159578ebad4594fe67107108180b449167123e84c281613b7cf09328cc8a6e1" |
| + "3c167a8b547c8d28e0a3ae1e2bb3a675916ea37f0bfa213562f1fb627a01243b" |
| + "cca4f1bea8519089a883dfe15ae59f06928b665e807b552564014c3bfecf492a", 16)); |
| |
| private static final BigInteger TWO_POW_160 = TWO.pow(160); |
| |
| /** The length of the modulus of DSS keys generated by this instance. */ |
| private int L; |
| |
| /** The optional {@link SecureRandom} instance to use. */ |
| private SecureRandom rnd = null; |
| |
| private BigInteger seed; |
| |
| private BigInteger counter; |
| |
| private BigInteger p; |
| |
| private BigInteger q; |
| |
| private BigInteger e; |
| |
| private BigInteger g; |
| |
| private BigInteger XKEY; |
| |
| /** Our default source of randomness. */ |
| private PRNG prng = null; |
| |
| /** Preferred encoding format of generated keys. */ |
| private int preferredFormat; |
| |
| public String name() |
| { |
| return Registry.DSS_KPG; |
| } |
| |
| /** |
| * Configures this instance. |
| * |
| * @param attributes the map of name/value pairs to use. |
| * @exception IllegalArgumentException if the designated MODULUS_LENGTH value |
| * is not greater than 512, less than 1024 and not of the form |
| * <code>512 + 64j</code>. |
| */ |
| public void setup(Map attributes) |
| { |
| // find out the modulus length |
| Integer l = (Integer) attributes.get(MODULUS_LENGTH); |
| L = (l == null ? DEFAULT_MODULUS_LENGTH : l.intValue()); |
| if ((L % 64) != 0 || L < 512 || L > 1024) |
| throw new IllegalArgumentException(MODULUS_LENGTH); |
| |
| // should we use the default pre-computed params? |
| Boolean useDefaults = (Boolean) attributes.get(USE_DEFAULTS); |
| if (useDefaults == null) |
| useDefaults = Boolean.TRUE; |
| |
| Boolean strictDefaults = (Boolean) attributes.get(STRICT_DEFAULTS); |
| if (strictDefaults == null) |
| strictDefaults = Boolean.FALSE; |
| |
| // are we given a set of DSA params or we shall use/generate our own? |
| DSAParameterSpec params = (DSAParameterSpec) attributes.get(DSS_PARAMETERS); |
| if (params != null) |
| { |
| p = params.getP(); |
| q = params.getQ(); |
| g = params.getG(); |
| } |
| else if (useDefaults.equals(Boolean.TRUE)) |
| { |
| switch (L) |
| { |
| case 512: |
| p = KEY_PARAMS_512.getP(); |
| q = KEY_PARAMS_512.getQ(); |
| g = KEY_PARAMS_512.getG(); |
| break; |
| case 768: |
| p = KEY_PARAMS_768.getP(); |
| q = KEY_PARAMS_768.getQ(); |
| g = KEY_PARAMS_768.getG(); |
| break; |
| case 1024: |
| p = KEY_PARAMS_1024.getP(); |
| q = KEY_PARAMS_1024.getQ(); |
| g = KEY_PARAMS_1024.getG(); |
| break; |
| default: |
| if (strictDefaults.equals(Boolean.TRUE)) |
| throw new IllegalArgumentException( |
| "Does not provide default parameters for " + L |
| + "-bit modulus length"); |
| else |
| { |
| p = null; |
| q = null; |
| g = null; |
| } |
| } |
| } |
| else |
| { |
| p = null; |
| q = null; |
| g = null; |
| } |
| // do we have a SecureRandom, or should we use our own? |
| rnd = (SecureRandom) attributes.get(SOURCE_OF_RANDOMNESS); |
| // what is the preferred encoding format |
| Integer formatID = (Integer) attributes.get(PREFERRED_ENCODING_FORMAT); |
| preferredFormat = formatID == null ? DEFAULT_ENCODING_FORMAT |
| : formatID.intValue(); |
| // set the seed-key |
| byte[] kb = new byte[20]; // we need 160 bits of randomness |
| nextRandomBytes(kb); |
| XKEY = new BigInteger(1, kb).setBit(159).setBit(0); |
| } |
| |
| public KeyPair generate() |
| { |
| if (p == null) |
| { |
| BigInteger[] params = new FIPS186(L, rnd).generateParameters(); |
| seed = params[FIPS186.DSA_PARAMS_SEED]; |
| counter = params[FIPS186.DSA_PARAMS_COUNTER]; |
| q = params[FIPS186.DSA_PARAMS_Q]; |
| p = params[FIPS186.DSA_PARAMS_P]; |
| e = params[FIPS186.DSA_PARAMS_E]; |
| g = params[FIPS186.DSA_PARAMS_G]; |
| if (Configuration.DEBUG) |
| { |
| log.fine("seed: " + seed.toString(16)); |
| log.fine("counter: " + counter.intValue()); |
| log.fine("q: " + q.toString(16)); |
| log.fine("p: " + p.toString(16)); |
| log.fine("e: " + e.toString(16)); |
| log.fine("g: " + g.toString(16)); |
| } |
| } |
| BigInteger x = nextX(); |
| BigInteger y = g.modPow(x, p); |
| PublicKey pubK = new DSSPublicKey(preferredFormat, p, q, g, y); |
| PrivateKey secK = new DSSPrivateKey(preferredFormat, p, q, g, x); |
| return new KeyPair(pubK, secK); |
| } |
| |
| /** |
| * This method applies the following algorithm described in 3.1 of FIPS-186: |
| * <ol> |
| * <li>XSEED = optional user input.</li> |
| * <li>XVAL = (XKEY + XSEED) mod 2<sup>b</sup>.</li> |
| * <li>x = G(t, XVAL) mod q.</li> |
| * <li>XKEY = (1 + XKEY + x) mod 2<sup>b</sup>.</li> |
| * </ol> |
| * <p> |
| * Where <code>b</code> is the length of a secret b-bit seed-key (XKEY). |
| * <p> |
| * Note that in this implementation, XSEED, the optional user input, is always |
| * zero. |
| */ |
| private synchronized BigInteger nextX() |
| { |
| byte[] xk = XKEY.toByteArray(); |
| byte[] in = new byte[64]; // 512-bit block for SHS |
| System.arraycopy(xk, 0, in, 0, xk.length); |
| int[] H = Sha160.G(T_SHS[0], T_SHS[1], T_SHS[2], T_SHS[3], T_SHS[4], in, 0); |
| byte[] h = new byte[20]; |
| for (int i = 0, j = 0; i < 5; i++) |
| { |
| h[j++] = (byte)(H[i] >>> 24); |
| h[j++] = (byte)(H[i] >>> 16); |
| h[j++] = (byte)(H[i] >>> 8); |
| h[j++] = (byte) H[i]; |
| } |
| BigInteger result = new BigInteger(1, h).mod(q); |
| XKEY = XKEY.add(result).add(BigInteger.ONE).mod(TWO_POW_160); |
| return result; |
| } |
| |
| /** |
| * Fills the designated byte array with random data. |
| * |
| * @param buffer the byte array to fill with random data. |
| */ |
| private void nextRandomBytes(byte[] buffer) |
| { |
| if (rnd != null) |
| rnd.nextBytes(buffer); |
| else |
| getDefaultPRNG().nextBytes(buffer); |
| } |
| |
| private PRNG getDefaultPRNG() |
| { |
| if (prng == null) |
| prng = PRNG.getInstance(); |
| |
| return prng; |
| } |
| } |
