DSS and the type (the next parameter) is
* {@link Cipher#PUBLIC_KEY} then an attempt to construct a concrete
* instance of a {@link java.security.interfaces.DSAPublicKey},
* using the unwrapped key material, shall be made.
* @param wrappedKeyType the type of wrapped key-material. MUST be one of
* {@link Cipher#PRIVATE_KEY}, {@link Cipher#PUBLIC_KEY}, or
* {@link Cipher#SECRET_KEY}.
* @return the unwrapped key-material as an instance of {@link Key} or one of
* its subclasses.
* @throws InvalidKeyException If the key cannot be unwrapped, or if
* wrappedKeyType is an inappropriate type for the
* unwrapped key.
* @throws NoSuchAlgorithmException If the wrappedKeyAlgorithm
* is unknown to every currently installed Security Provider.
*/
protected Key engineUnwrap(byte[] wrappedKey, String wrappedKeyAlgorithm,
int wrappedKeyType)
throws InvalidKeyException, NoSuchAlgorithmException
{
byte[] keyBytes;
try
{
keyBytes = kwAlgorithm.unwrap(wrappedKey, 0, wrappedKey.length);
}
catch (KeyUnwrappingException x)
{
InvalidKeyException y = new InvalidKeyException("engineUnwrap()");
y.initCause(x);
throw y;
}
Key result;
switch (wrappedKeyType)
{
case Cipher.SECRET_KEY:
result = new SecretKeySpec(keyBytes, wrappedKeyAlgorithm);
break;
case Cipher.PRIVATE_KEY:
case Cipher.PUBLIC_KEY:
X509EncodedKeySpec keySpec = new X509EncodedKeySpec(keyBytes);
KeyFactory keyFactory = KeyFactory.getInstance(wrappedKeyAlgorithm);
try
{
if (wrappedKeyType == Cipher.PRIVATE_KEY)
result = keyFactory.generatePrivate(keySpec);
else
result = keyFactory.generatePublic(keySpec);
}
catch (InvalidKeySpecException x)
{
InvalidKeyException y = new InvalidKeyException("engineUnwrap()");
y.initCause(x);
throw y;
}
break;
default:
IllegalArgumentException x = new IllegalArgumentException("Invalid 'wrappedKeyType': "
+ wrappedKeyType);
InvalidKeyException y = new InvalidKeyException("engineUnwrap()");
y.initCause(x);
throw y;
}
return result;
}
protected int engineGetBlockSize()
{
return kwaBlockSize;
}
protected byte[] engineGetIV()
{
return iv == null ? null : (byte[]) iv.clone();
}
protected int engineGetOutputSize(int inputLength)
{
switch (opmode)
{
case Cipher.WRAP_MODE:
return getOutputSizeForWrap(inputLength);
case Cipher.UNWRAP_MODE:
return getOutputSizeForUnwrap(inputLength);
default:
throw new IllegalStateException();
}
}
protected AlgorithmParameters engineGetParameters()
{
BlockCipherParameterSpec spec = new BlockCipherParameterSpec(iv,
kwaBlockSize,
kwaKeySize);
AlgorithmParameters result = null;
try
{
result = AlgorithmParameters.getInstance("BlockCipherParameters");
result.init(spec);
}
catch (NoSuchAlgorithmException x)
{
if (Configuration.DEBUG)
log.fine("Unable to find BlockCipherParameters. Return null");
}
catch (InvalidParameterSpecException x)
{
if (Configuration.DEBUG)
log.fine("Unable to initialise BlockCipherParameters. Return null");
}
return result;
}
protected void engineInit(int opmode, Key key, SecureRandom random)
throws InvalidKeyException
{
checkOpMode(opmode);
byte[] kekBytes = checkAndGetKekBytes(key);
initAlgorithm(opmode, kekBytes, null, random);
}
protected void engineInit(int opmode, Key key, AlgorithmParameters params,
SecureRandom random)
throws InvalidAlgorithmParameterException, InvalidKeyException
{
AlgorithmParameterSpec spec = null;
try
{
if (params != null)
spec = params.getParameterSpec(BlockCipherParameterSpec.class);
}
catch (InvalidParameterSpecException x)
{
if (Configuration.DEBUG)
log.fine("Unable to translate algorithm parameters into an instance "
+ "of BlockCipherParameterSpec. Discard");
}
engineInit(opmode, key, spec, random);
}
protected void engineInit(int opmode, Key key, AlgorithmParameterSpec params,
SecureRandom random)
throws InvalidAlgorithmParameterException, InvalidKeyException
{
checkOpMode(opmode);
byte[] kekBytes = checkAndGetKekBytes(key);
byte[] ivBytes = null;
if (params instanceof BlockCipherParameterSpec)
ivBytes = ((BlockCipherParameterSpec) params).getIV();
else if (params instanceof IvParameterSpec)
ivBytes = ((IvParameterSpec) params).getIV();
initAlgorithm(opmode, kekBytes, ivBytes, random);
}
protected void engineSetMode(String mode) throws NoSuchAlgorithmException
{
if (! supportedMode.equalsIgnoreCase(mode))
throw new UnsupportedOperationException("Only " + supportedMode
+ " is supported");
}
/**
* NoPadding is the only padding algorithm supported by Key Wrapping Algorithm
* implementations in RI.
*/
protected void engineSetPadding(String padding) throws NoSuchPaddingException
{
if (! NO_PADDING.equalsIgnoreCase(padding))
throw new UnsupportedOperationException("Only NoPadding is supported");
}
protected byte[] engineUpdate(byte[] input, int inputOffset, int inputLength)
{
throw new UnsupportedOperationException();
}
protected int engineUpdate(byte[] input, int inputOffset, int inputLength,
byte[] output, int outputOffset)
throws ShortBufferException
{
throw new UnsupportedOperationException();
}
protected byte[] engineDoFinal(byte[] input, int inputOffset, int inputLength)
throws IllegalBlockSizeException, BadPaddingException
{
throw new UnsupportedOperationException();
}
protected int engineDoFinal(byte[] input, int inputOffset, int inputLength,
byte[] output, int outputOffset)
throws IllegalBlockSizeException, BadPaddingException, ShortBufferException
{
throw new UnsupportedOperationException();
}
/**
* Return the minimum size in bytes of a place holder large enough to receive
* the cipher text resulting from a wrap method with the designated size of
* the plain text.
*
* This default implementation ALWAYS returns the smallest multiple of the
* kwaBlockSize --passed to this method through its
* constructor-- greater than or equal to the designated
* inputLength.
*
* @param inputLength the size of a plain text.
* @return an estimate of the size, in bytes, of the place holder to receive
* the resulting bytes of a wrap method.
*/
protected int getOutputSizeForWrap(int inputLength)
{
return kwaBlockSize * (inputLength + kwaBlockSize - 1) / kwaBlockSize;
}
/**
* Return the minimum size in bytes of a place holder large enough to receive
* the plain text resulting from an unwrap method with the designated size of
* the cipher text.
*
* This default implementation ALWAYS returns the smallest multiple of the
* paddingBlockSize --passed to this method through its
* constructor-- greater than or equal to the designated
* inputLength.
*
* @param inputLength the size of a cipher text.
* @return an estimate of the size, in bytes, of the place holder to receive
* the resulting bytes of an uwrap method.
*/
protected int getOutputSizeForUnwrap(int inputLength)
{
return kwaBlockSize * (inputLength + kwaBlockSize - 1) / kwaBlockSize;
}
private void checkOpMode(int opmode)
{
switch (opmode)
{
case Cipher.WRAP_MODE:
case Cipher.UNWRAP_MODE:
return;
}
throw new IllegalArgumentException("Unsupported operational mode: " + opmode);
}
/**
* Returns the key bytes, iff it was in RAW format.
*
* @param key the opaque JCE secret key to use as the KEK.
* @return the bytes of the encoded form of the designated kek, iff it was in
* RAW format.
* @throws InvalidKeyException if the designated key is not in the RAW format.
*/
private byte[] checkAndGetKekBytes(Key key) throws InvalidKeyException
{
if (! Registry.RAW_ENCODING_SHORT_NAME.equalsIgnoreCase(key.getFormat()))
throw new InvalidKeyException("Only RAW key format is supported");
byte[] result = key.getEncoded();
int kekSize = result.length;
if (kekSize != kwaKeySize)
throw new InvalidKeyException("Invalid key material size. Expected "
+ kwaKeySize + " but found " + kekSize);
return result;
}
private void initAlgorithm(int opmode, byte[] kek, byte[] ivBytes,
SecureRandom rnd)
throws InvalidKeyException
{
this.opmode = opmode;
Map attributes = new HashMap();
attributes.put(IKeyWrappingAlgorithm.KEY_ENCRYPTION_KEY_MATERIAL, kek);
if (ivBytes != null)
{
this.iv = (byte[]) ivBytes.clone();
attributes.put(IKeyWrappingAlgorithm.INITIAL_VALUE, this.iv);
}
else
this.iv = null;
if (rnd != null)
attributes.put(IKeyWrappingAlgorithm.SOURCE_OF_RANDOMNESS, rnd);
kwAlgorithm.init(attributes);
}
}