Skip to content

Commit d58ac49

Browse files
mwcwmwcw
committed
Added enforcement of key algorithm name during block cipher init.
Added tests.
1 parent 117b71c commit d58ac49

File tree

11 files changed

+325
-29
lines changed

11 files changed

+325
-29
lines changed

‎jostle/src/main/java/org/openssl/jostle/jcajce/provider/AESBlockCipherSpi.java‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,12 @@ class AESBlockCipherSpi extends BlockCipherSpi
2727

2828
AESBlockCipherSpi(OSSLCipher cipher)
2929
{
30-
super(cipher);
30+
super(cipher,"AES");
3131
}
3232

3333
AESBlockCipherSpi(OSSLCipher cipher, OSSLMode mode)
3434
{
35-
super(cipher, mode);
35+
super(cipher, mode,"AES");
3636
}
3737

3838
protected void determineOSSLCipher(int keySize) throws InvalidKeyException
@@ -65,20 +65,23 @@ protected void determineOSSLCipher(int keySize) throws InvalidKeyException
6565
@Override
6666
protected void engineInit(int opmode, Key key, SecureRandom random) throws InvalidKeyException
6767
{
68+
6869
determineOSSLCipher(key.getEncoded().length);
6970
super.engineInit(opmode, key, random);
7071
}
7172

7273
@Override
7374
protected void engineInit(int opmode, Key key, AlgorithmParameterSpec params, SecureRandom random) throws InvalidKeyException, InvalidAlgorithmParameterException
7475
{
76+
7577
determineOSSLCipher(key.getEncoded().length);
7678
super.engineInit(opmode, key, params, random);
7779
}
7880

7981
@Override
8082
protected void engineInit(int opmode, Key key, AlgorithmParameters params, SecureRandom random) throws InvalidKeyException, InvalidAlgorithmParameterException
8183
{
84+
8285
determineOSSLCipher(key.getEncoded().length);
8386
// TODO: we should have a list of ParameterSpec to try here.
8487
try

‎jostle/src/main/java/org/openssl/jostle/jcajce/provider/ARIABlockCipherSpi.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,15 +20,15 @@ class ARIABlockCipherSpi extends BlockCipherSpi
2020

2121
ARIABlockCipherSpi()
2222
{
23-
super(null);
23+
super(null,"ARIA");
2424
}
2525

2626
ARIABlockCipherSpi(OSSLCipher cipher) {
27-
super(cipher);
27+
super(cipher,"ARIA");
2828
}
2929

3030
ARIABlockCipherSpi(OSSLCipher cipher, OSSLMode mode) {
31-
super(cipher, mode);
31+
super(cipher, mode,"ARIA");
3232
}
3333

3434
protected void determineOSSLCipher(int keySize) throws InvalidKeyException

‎jostle/src/main/java/org/openssl/jostle/jcajce/provider/BlockCipherSpi.java‎

Lines changed: 20 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,8 @@ class BlockCipherSpi extends CipherSpi
2727
{
2828
final OSSLCipher mandatedCipher;
2929
final OSSLMode mandatedMode;
30+
final String keyAlgorithm;
31+
3032
OSSLCipher osslCipher;
3133
OSSLMode osslMode;
3234
int padding;
@@ -41,22 +43,25 @@ class BlockCipherSpi extends CipherSpi
4143
GCMParameterSpec.class,
4244
};
4345

44-
BlockCipherSpi(Object params)
46+
BlockCipherSpi(Object params, String expectedKeyAlgorithm)
4547
{
4648
mandatedCipher = null;
4749
mandatedMode = null;
50+
this.keyAlgorithm = expectedKeyAlgorithm;
4851
}
4952

50-
BlockCipherSpi(OSSLCipher osslCipher)
53+
BlockCipherSpi(OSSLCipher osslCipher, String expectedKeyAlgorithm)
5154
{
5255
mandatedCipher = osslCipher;
5356
mandatedMode = null;
57+
this.keyAlgorithm = expectedKeyAlgorithm;
5458
}
5559

56-
BlockCipherSpi(OSSLCipher osslCipher, OSSLMode osslMode)
60+
BlockCipherSpi(OSSLCipher osslCipher, OSSLMode osslMode, String expectedKeyAlgorithm)
5761
{
5862
mandatedCipher = osslCipher;
5963
mandatedMode = osslMode;
64+
this.keyAlgorithm = expectedKeyAlgorithm;
6065
}
6166

6267
@Override
@@ -126,6 +131,7 @@ protected AlgorithmParameters engineGetParameters()
126131
@Override
127132
protected void engineInit(int opmode, Key key, SecureRandom random) throws InvalidKeyException
128133
{
134+
validateKeyAlg(key);
129135
synchronized (this)
130136
{
131137
ensureNativeReference();
@@ -150,6 +156,7 @@ protected void engineInit(int opmode, Key key, SecureRandom random) throws Inval
150156
@Override
151157
protected void engineInit(int opmode, Key key, AlgorithmParameterSpec params, SecureRandom random) throws InvalidKeyException, InvalidAlgorithmParameterException
152158
{
159+
validateKeyAlg(key);
153160
synchronized (this)
154161
{
155162
ensureNativeReference();
@@ -197,6 +204,7 @@ protected void engineInit(int opmode, Key key, AlgorithmParameterSpec params, Se
197204
protected void engineInit(int opmode, Key key, AlgorithmParameters params, SecureRandom random) throws InvalidKeyException, InvalidAlgorithmParameterException
198205
{
199206

207+
validateKeyAlg(key);
200208
AlgorithmParameterSpec paramSpec = null;
201209

202210
if (params != null)
@@ -486,4 +494,13 @@ protected boolean overlap(int inputOffset, int inputLen, int outputOffset, int o
486494
return inputOffset == outputOffset || Math.max(inputOffset, outputOffset) <= Math.min(inputOffset + inputLen, outputOffset + outputLen);
487495
}
488496

497+
protected void validateKeyAlg(Key key) throws InvalidKeyException
498+
{
499+
if (keyAlgorithm.equals(key.getAlgorithm()))
500+
{
501+
return;
502+
}
503+
throw new InvalidKeyException("unsupported key algorithm " + key.getAlgorithm());
504+
}
505+
489506
}

‎jostle/src/main/java/org/openssl/jostle/jcajce/provider/CAMELLIABlockCipherSpi.java‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,15 +20,15 @@ class CAMELLIABlockCipherSpi extends BlockCipherSpi
2020

2121
CAMELLIABlockCipherSpi()
2222
{
23-
super(null);
23+
super(null,"CAMELLIA");
2424
}
2525

2626
CAMELLIABlockCipherSpi(OSSLCipher cipher) {
27-
super(cipher);
27+
super(cipher,"CAMELLIA");
2828
}
2929

3030
CAMELLIABlockCipherSpi(OSSLCipher cipher, OSSLMode mode) {
31-
super(cipher, mode);
31+
super(cipher, mode,"CAMELLIA");
3232
}
3333

3434
protected void determineOSSLCipher(int keySize) throws InvalidKeyException
@@ -77,6 +77,7 @@ protected void engineInit(int opmode, Key key, AlgorithmParameters params, Secur
7777
{
7878
determineOSSLCipher(key.getEncoded().length);
7979
// TODO: we should have a list of ParameterSpec to try here.
80+
8081
try
8182
{
8283
super.engineInit(opmode, key, params.getParameterSpec(IvParameterSpec.class), random);

‎jostle/src/main/java/org/openssl/jostle/jcajce/provider/SM4BlockCipherSpi.java‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,17 +20,17 @@ class SM4BlockCipherSpi extends BlockCipherSpi
2020

2121
SM4BlockCipherSpi()
2222
{
23-
super(null);
23+
super(null, "SM4");
2424
}
2525

2626
SM4BlockCipherSpi(OSSLCipher cipher)
2727
{
28-
super(cipher);
28+
super(cipher, "SM4");
2929
}
3030

3131
SM4BlockCipherSpi(OSSLCipher cipher, OSSLMode mode)
3232
{
33-
super(cipher, mode);
33+
super(cipher, mode, "SM4");
3434
}
3535

3636
protected void determineOSSLCipher(int keySize) throws InvalidKeyException
@@ -57,20 +57,29 @@ protected void determineOSSLCipher(int keySize) throws InvalidKeyException
5757
@Override
5858
protected void engineInit(int opmode, Key key, SecureRandom random) throws InvalidKeyException
5959
{
60+
validateKeyAlg(key);
6061
determineOSSLCipher(key.getEncoded().length);
6162
super.engineInit(opmode, key, random);
6263
}
6364

6465
@Override
6566
protected void engineInit(int opmode, Key key, AlgorithmParameterSpec params, SecureRandom random) throws InvalidKeyException, InvalidAlgorithmParameterException
6667
{
68+
if (!"SM4".equalsIgnoreCase(key.getAlgorithm()))
69+
{
70+
throw new InvalidKeyException("unsupported key algorithm " + key.getAlgorithm());
71+
}
6772
determineOSSLCipher(key.getEncoded().length);
6873
super.engineInit(opmode, key, params, random);
6974
}
7075

7176
@Override
7277
protected void engineInit(int opmode, Key key, AlgorithmParameters params, SecureRandom random) throws InvalidKeyException, InvalidAlgorithmParameterException
7378
{
79+
if (!"SM4".equalsIgnoreCase(key.getAlgorithm()))
80+
{
81+
throw new InvalidKeyException("unsupported key algorithm " + key.getAlgorithm());
82+
}
7483
determineOSSLCipher(key.getEncoded().length);
7584
// TODO: we should have a list of ParameterSpec to try here.
7685
try

‎jostle/src/main/java9/org/openssl/jostle/jcajce/provider/BlockCipherSpi.java‎

Lines changed: 20 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ class BlockCipherSpi extends CipherSpi
3434
OSSLBlockCipherRefWrapper refWrapper;
3535
int blockSize;
3636
int opMode;
37+
final String keyAlgorithm;
3738

3839
private static int BUF_SIZE = 1024;
3940

@@ -42,22 +43,25 @@ class BlockCipherSpi extends CipherSpi
4243
GCMParameterSpec.class,
4344
};
4445

45-
BlockCipherSpi(Object params)
46+
BlockCipherSpi(Object params, String keyAlgorithm)
4647
{
4748
mandatedCipher = null;
4849
mandatedMode = null;
50+
this.keyAlgorithm = keyAlgorithm;
4951
}
5052

51-
BlockCipherSpi(OSSLCipher osslCipher)
53+
BlockCipherSpi(OSSLCipher osslCipher, String keyAlgorithm)
5254
{
5355
mandatedCipher = osslCipher;
5456
mandatedMode = null;
57+
this.keyAlgorithm = keyAlgorithm;
5558
}
5659

57-
BlockCipherSpi(OSSLCipher osslCipher, OSSLMode osslMode)
60+
BlockCipherSpi(OSSLCipher osslCipher, OSSLMode osslMode, String keyAlgorithm)
5861
{
5962
mandatedCipher = osslCipher;
6063
mandatedMode = osslMode;
64+
this.keyAlgorithm = keyAlgorithm;
6165
}
6266

6367
@Override
@@ -133,6 +137,7 @@ protected AlgorithmParameters engineGetParameters()
133137
@Override
134138
protected void engineInit(int opmode, Key key, SecureRandom random) throws InvalidKeyException
135139
{
140+
validateKeyAlg(key);
136141
try
137142
{
138143
ensureNativeReference();
@@ -160,6 +165,7 @@ protected void engineInit(int opmode, Key key, SecureRandom random) throws Inval
160165
@Override
161166
protected void engineInit(int opmode, Key key, AlgorithmParameterSpec params, SecureRandom random) throws InvalidKeyException, InvalidAlgorithmParameterException
162167
{
168+
validateKeyAlg(key);
163169
try
164170
{
165171
ensureNativeReference();
@@ -209,7 +215,7 @@ protected void engineInit(int opmode, Key key, AlgorithmParameterSpec params, Se
209215
@Override
210216
protected void engineInit(int opmode, Key key, AlgorithmParameters params, SecureRandom random) throws InvalidKeyException, InvalidAlgorithmParameterException
211217
{
212-
218+
validateKeyAlg(key);
213219
AlgorithmParameterSpec paramSpec = null;
214220

215221
if (params != null)
@@ -243,6 +249,7 @@ protected void engineInit(int opmode, Key key, AlgorithmParameters params, Secur
243249
@Override
244250
protected void engineUpdateAAD(byte[] src, int offset, int len)
245251
{
252+
246253
try
247254
{
248255
len = NISelector.BlockCipherNI.updateAAD(
@@ -515,4 +522,13 @@ protected boolean overlap(int inputOffset, int inputLen, int outputOffset, int o
515522
return inputOffset == outputOffset || Math.max(inputOffset, outputOffset) <= Math.min(inputOffset + inputLen, outputOffset + outputLen);
516523
}
517524

525+
protected void validateKeyAlg(Key key) throws InvalidKeyException
526+
{
527+
if (keyAlgorithm.equals(key.getAlgorithm()))
528+
{
529+
return;
530+
}
531+
throw new InvalidKeyException("unsupported key algorithm " + key.getAlgorithm());
532+
}
533+
518534
}

‎jostle/src/test/java/org/openssl/jostle/test/crypto/AESAgreementTest.java‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
import javax.crypto.spec.GCMParameterSpec;
1515
import javax.crypto.spec.IvParameterSpec;
1616
import javax.crypto.spec.SecretKeySpec;
17+
import java.security.InvalidKeyException;
1718
import java.security.SecureRandom;
1819
import java.security.Security;
1920
import java.util.ArrayList;
@@ -1127,6 +1128,52 @@ public void aesGCMWithTagLen() throws Exception
11271128
}
11281129
}
11291130

1131+
@Test
1132+
public void testRejectIncorrectKeyAlgorithm() throws Exception
1133+
{
1134+
SecretKeySpec wrongSpec = new SecretKeySpec(new byte[16], "ARIA");
1135+
1136+
try {
1137+
Cipher cipher = Cipher.getInstance("AES/ECB/NoPadding",JostleProvider.PROVIDER_NAME);
1138+
cipher.init(Cipher.ENCRYPT_MODE, wrongSpec);
1139+
Assertions.fail("Should have thrown an exception");
1140+
} catch (InvalidKeyException ikes) {
1141+
Assertions.assertEquals("unsupported key algorithm ARIA",ikes.getMessage());
1142+
}
1143+
1144+
try {
1145+
Cipher cipher = Cipher.getInstance("AES/CBC/NoPadding",JostleProvider.PROVIDER_NAME);
1146+
cipher.init(Cipher.ENCRYPT_MODE, wrongSpec, new IvParameterSpec(new byte[16]));
1147+
Assertions.fail("Should have thrown an exception");
1148+
} catch (InvalidKeyException ikes) {
1149+
Assertions.assertEquals("unsupported key algorithm ARIA",ikes.getMessage());
1150+
}
1151+
1152+
try {
1153+
Cipher cipher = Cipher.getInstance("AES/CBC/NoPadding",JostleProvider.PROVIDER_NAME);
1154+
org.openssl.jostle.test.crypto.DummyParams params = new org.openssl.jostle.test.crypto.DummyParams();
1155+
params.init(new byte[16]);
1156+
cipher.init(Cipher.ENCRYPT_MODE, wrongSpec, params);
1157+
Assertions.fail("Should have thrown an exception");
1158+
} catch (InvalidKeyException ikes) {
1159+
Assertions.assertEquals("unsupported key algorithm ARIA",ikes.getMessage());
1160+
}
1161+
1162+
1163+
// Correct spec
1164+
Cipher cipher = Cipher.getInstance("AES/ECB/NoPadding", JostleProvider.PROVIDER_NAME);
1165+
cipher.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(new byte[16], "AES"));
1166+
1167+
cipher = Cipher.getInstance("AES/CBC/NoPadding", JostleProvider.PROVIDER_NAME);
1168+
cipher.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(new byte[16], "AES"), new IvParameterSpec(new byte[16]));
1169+
1170+
cipher = Cipher.getInstance("AES/CBC/NoPadding", JostleProvider.PROVIDER_NAME);
1171+
org.openssl.jostle.test.crypto.DummyParams params = new org.openssl.jostle.test.crypto.DummyParams();
1172+
params.init(new byte[16]);
1173+
cipher.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(new byte[16], "AES"), params);
1174+
}
1175+
1176+
11301177
private String pad(int len)
11311178
{
11321179
char[] buf = new char[len];

0 commit comments

Comments
 (0)