PTBSignatureVerifier | Line # 79 | 38 | 8 | 36.7% |
0.36734694
|
No Tests | |||
1 | /* | |
2 | * Copyright (c) 2006, University of Kent | |
3 | * All rights reserved. | |
4 | * | |
5 | * Redistribution and use in source and binary forms, with or without | |
6 | * modification, are permitted provided that the following conditions are met: | |
7 | * | |
8 | * Redistributions of source code must retain the above copyright notice, this | |
9 | * list of conditions and the following disclaimer. | |
10 | * | |
11 | * Redistributions in binary form must reproduce the above copyright notice, | |
12 | * this list of conditions and the following disclaimer in the documentation | |
13 | * and/or other materials provided with the distribution. | |
14 | * | |
15 | * 1. Neither the name of the University of Kent nor the names of its | |
16 | * contributors may be used to endorse or promote products derived from this | |
17 | * software without specific prior written permission. | |
18 | * | |
19 | * 2. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS | |
20 | * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, | |
21 | * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR | |
22 | * PURPOSE ARE DISCLAIMED. | |
23 | * | |
24 | * 3. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE | |
25 | * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR | |
26 | * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF | |
27 | * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS | |
28 | * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN | |
29 | * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) | |
30 | * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE | |
31 | * POSSIBILITY OF SUCH DAMAGE. | |
32 | * | |
33 | * 4. YOU AGREE THAT THE EXCLUSIONS IN PARAGRAPHS 2 AND 3 ABOVE ARE REASONABLE | |
34 | * IN THE CIRCUMSTANCES. IN PARTICULAR, YOU ACKNOWLEDGE (1) THAT THIS | |
35 | * SOFTWARE HAS BEEN MADE AVAILABLE TO YOU FREE OF CHARGE, (2) THAT THIS | |
36 | * SOFTWARE IS NOT "PRODUCT" QUALITY, BUT HAS BEEN PRODUCED BY A RESEARCH | |
37 | * GROUP WHO DESIRE TO MAKE THIS SOFTWARE FREELY AVAILABLE TO PEOPLE WHO WISH | |
38 | * TO USE IT, AND (3) THAT BECAUSE THIS SOFTWARE IS NOT OF "PRODUCT" QUALITY | |
39 | * IT IS INEVITABLE THAT THERE WILL BE BUGS AND ERRORS, AND POSSIBLY MORE | |
40 | * SERIOUS FAULTS, IN THIS SOFTWARE. | |
41 | * | |
42 | * 5. This license is governed, except to the extent that local laws | |
43 | * necessarily apply, by the laws of England and Wales. | |
44 | */ | |
45 | package issrg.test.ptb; | |
46 | ||
47 | ||
48 | import iaik.x509.X509Certificate; | |
49 | import iaik.asn1.ObjectID; | |
50 | import iaik.security.rsa.Md5RSASignature; | |
51 | import iaik.security.rsa.ShaRSASignature; | |
52 | ||
53 | import java.util.Hashtable; | |
54 | import java.io.FileInputStream; | |
55 | ||
56 | /** | |
57 | * This class implements the SignatureVerifier interface and provides the following mechanisms: | |
58 | * <p> | |
59 | * <ul> | |
60 | * <li> Verification of the self-signed CA certificate | |
61 | * <li> Veritication of the X.509 identity certificates related to the different SOAs involved in | |
62 | * the application scenario | |
63 | * <li> Verification of the digital signature of the different attribute certificates related to | |
64 | * end users. Those certificates are checked using the public key contained in the X.509 identity certificate | |
65 | * related to the corresponding SOA. | |
66 | * </ul> | |
67 | * <p> | |
68 | * This class assumes that: | |
69 | * <p> | |
70 | * <ul> | |
71 | * <li> Identity certificates of the different SOAs are issued by the self-signed CA (no subordinate CAs are used) | |
72 | * <li> SOAs are the only issuers of the ACs (no subordinate AAs are used) | |
73 | * </ul> | |
74 | * | |
75 | * @author O Canovas | |
76 | * @author O Otenko | |
77 | * @version 0.1 | |
78 | */ | |
79 | public class PTBSignatureVerifier implements issrg.pba.rbac.SignatureVerifier { | |
80 | ||
81 | protected X509Certificate caCertificate = null; | |
82 | protected Hashtable soaCerts = null; //Hash table containing the identity certificates of the SOAs | |
83 | ||
84 | /** | |
85 | * Constructs a PTBSignatureVerifier. It has no parameters, and | |
86 | * its main function is to initialise the hash table. | |
87 | */ | |
88 | 2 | public PTBSignatureVerifier() { |
89 | 2 | soaCerts = new Hashtable(); |
90 | } | |
91 | ||
92 | /** | |
93 | * Gets the CA certificate and validates the signature. | |
94 | * @param file is the file containing the certificate | |
95 | * @return true if the certificate was successfully read and validated | |
96 | */ | |
97 | 2 | public boolean setCACertificate(String file) { |
98 | 2 | try { |
99 | 2 | FileInputStream fis = new FileInputStream(file); |
100 | 1 | caCertificate = new iaik.x509.X509Certificate(fis); |
101 | 1 | caCertificate.verify(); |
102 | 1 | return true; |
103 | } | |
104 | catch (Exception e) { | |
105 | 1 | e.printStackTrace(); |
106 | 1 | return false; |
107 | } | |
108 | } | |
109 | ||
110 | /** | |
111 | * Gets a new SOA certificate and inserts it in the hash table. | |
112 | * @param file is the file containing the certificate | |
113 | * @return true if the certificate was successfully read and validated | |
114 | */ | |
115 | 3 | public boolean addSOACertificate(String file) { |
116 | 3 | X509Certificate soaCert; |
117 | 3 | try { |
118 | 3 | soaCert = new X509Certificate(new FileInputStream(file)); |
119 | 3 | try { |
120 | 3 | soaCert.verify(caCertificate.getPublicKey()); |
121 | } | |
122 | catch (Exception e) { | |
123 | 0 | e.printStackTrace(); |
124 | 0 | System.out.println("The certificate contained in " + file + " cannot be validated"); |
125 | 0 | return true; |
126 | } | |
127 | //Indexed by subject DN | |
128 | 3 | soaCerts.put(soaCert.getSubjectDN().getName(),soaCert); |
129 | 3 | return true; |
130 | } | |
131 | catch (Exception e) { | |
132 | 0 | e.printStackTrace(); |
133 | 0 | return false; |
134 | } | |
135 | } | |
136 | ||
137 | ||
138 | /** | |
139 | * Checks if the <code>signature</code> for the given <code>value</code> has been signed by | |
140 | * the <code>signer</code>. This method does not perform any kind of verification related to revocations | |
141 | * (CRLs, OCSP queries). This method fetches the public key certificate of the signer, and follows | |
142 | * the certification path back to its root of trust, that is, Signer -> SOA -> CA. | |
143 | * | |
144 | * @param value is the byte array that had been signed | |
145 | * @param signature is the byte array of the resulting signature | |
146 | * @param algorithmID is the String representation (dotted form) of the | |
147 | * object identifier of the algorithm used for signing | |
148 | * @param signer is the Principal of the signer | |
149 | * | |
150 | * @return true, if there is a valid PKI token, which proves the | |
151 | * signature is valid; false otherwise | |
152 | */ | |
153 | 0 | public boolean checkSignature(byte[] value, byte[] signature, |
154 | String algorithmID, issrg.utils.repository.TokenLocator signer) { | |
155 | 0 | boolean signatureVerified = false; |
156 | 0 | java.security.Signature verificator = null; |
157 | //First, we get the name related to the Algorithm identifier | |
158 | 0 | String name = ObjectID.getRegisteredName(algorithmID).intern(); |
159 | //Then, we check the name in order to instantiate the right class | |
160 | 0 | if (name == "md5WithRSAEncryption") |
161 | 0 | verificator = new Md5RSASignature(); |
162 | 0 | else if (name == "sha1WithRSAEncryption") |
163 | 0 | verificator = new ShaRSASignature(); |
164 | //Next, we obtain the SOA's certificate | |
165 | 0 | X509Certificate soa = (X509Certificate) soaCerts.get(signer.getEntry().getEntryName().getName()); |
166 | 0 | if (soa == null) return false; |
167 | 0 | try { |
168 | //Finally, we verify the digital signature... | |
169 | 0 | verificator.initVerify(soa); |
170 | 0 | verificator.update(value); |
171 | 0 | signatureVerified = verificator.verify(signature); |
172 | } | |
173 | catch (Exception e) | |
174 | { | |
175 | 0 | e.printStackTrace(); |
176 | 0 | signatureVerified = false; |
177 | } | |
178 | //...and the result is returned. | |
179 | 0 | return signatureVerified; |
180 | } | |
181 | ||
182 | 0 | public boolean referenceValidation(byte[] value, byte[] digest, String method) { |
183 | 0 | return true; |
184 | } | |
185 | } |
|