Class SecurityUtils

java.lang.Object

org.apache.sshd.common.util.security.SecurityUtils

public final class SecurityUtils
extends Object

Specific security providers related code

Author:

Apache MINA SSHD Project

Field Summary

Fields

Modifier and Type	Field	Description
static final String	BOUNCY_CASTLE	Bouncy Castle SecurityProviderRegistrar name.
static final List<String>	DEFAULT_SECURITY_PROVIDER_REGISTRARS
static final String	ED25519	Key and signature algorithm name for ed25519.
static final String	EDDSA	EDDSA (net.i2p) SecurityProviderRegistrar name.
static final String	FIPS_ENABLED	A boolean system property that can be set to "true" to enable FIPS mode.
static final int	MAX_DHGEX_KEY_SIZE
static final String	MAX_DHGEX_KEY_SIZE_PROP	System property used to configure the value for the maximum supported Diffie-Hellman Group Exchange key size.
static final int	MIN_DHGEX_KEY_SIZE	The min. key size value used for testing whether Diffie-Hellman Group Exchange is supported or not.
static final String	MIN_DHGEX_KEY_SIZE_PROP	System property used to configure the value for the minimum supported Diffie-Hellman Group Exchange key size.
static final int	PREFERRED_DHGEX_KEY_SIZE
static final String	PROP_DEFAULT_SECURITY_PROVIDER
static final String	SECURITY_PROVIDER_REGISTRARS	Comma separated list of fully qualified SecurityProviderRegistrars to automatically register

Method Summary

Modifier and Type	Method	Description
static boolean	compareEDDSAPPublicKeys(PublicKey k1, PublicKey k2)
static boolean	compareEDDSAPrivateKeys(PrivateKey k1, PrivateKey k2)
static AbstractGeneratorHostKeyProvider	createGeneratorHostKeyProvider(Path path)
static SecurityEntityFactory	createSecurityEntityFactory(Predicate<? super SecurityProviderRegistrar> entitySelector)
static KeyPair	extractEDDSAKeyPair(Buffer buffer, String keyType)
static AlgorithmParameters	getAlgorithmParameters(String algorithm)
static Set<String>	getAPrioriDisabledProviders()
static Decryptor	getBouncycastleEncryptedPrivateKeyInfoDecryptor()
static KeyPairResourceParser	getBouncycastleKeyPairResourceParser()
static CertificateFactory	getCertificateFactory(String type)
static Cipher	getCipher(String transformation)
static SecurityProviderChoice	getDefaultProviderChoice()
static KEM	getKEM(String algorithm)
static KeyAgreement	getKeyAgreement(String algorithm)
static KeyFactory	getKeyFactory(String algorithm)
static KeyPairGenerator	getKeyPairGenerator(String algorithm)
static KeyPairResourceParser	getKeyPairResourceParser()	///////////////////////////////////////////////////////////////////////
static Mac	getMac(String algorithm)
static int	getMaxDHGroupExchangeKeySize()
static MessageDigest	getMessageDigest(String algorithm)
static int	getMinDHGroupExchangeKeySize()
static PrivateKeyEntryDecoder	getOpenSSHEDDSAPrivateKeyEntryDecoder()
static RandomFactory	getRandomFactory()
static SecurityProviderRegistrar	getRegisteredProvider(String provider)
static Set<String>	getRegisteredProviders()
static SecurityEntityFactory	getSecurityEntityProvider(SecurityProviderRegistrar registrar, SecurityProviderChoice defaultProvider)
static Signature	getSignature(String algorithm)
static boolean	isAPrioriDisabledProvider(String name)
static boolean	isBouncyCastleRegistered()
static boolean	isDHGroupExchangeSupported()
static boolean	isDHGroupExchangeSupported(int maxKeySize)
static boolean	isDHOakelyGroupSupported(int keySize)
static boolean	isEDDSACurveSupported()
static boolean	isFipsMode()	Tells whether FIPS mode is enabled, either through the system property FIPS_ENABLED or via setFipsMode().
static boolean	isProviderRegistered(String provider)
static boolean	isRegistrationCompleted()
static Iterable<KeyPair>	loadKeyPairIdentities(SessionContext session, NamedResource resourceKey, InputStream inputStream, FilePasswordProvider provider)
static PublicKey	recoverEDDSAPublicKey(PrivateKey key)
static SecurityProviderRegistrar	registerSecurityProvider(SecurityProviderRegistrar registrar)
static SecurityEntityFactory	resolveSecurityEntityFactory(Class<?> entityType, String algorithm, Predicate<? super SecurityProviderRegistrar> entitySelector)	///////////////////////// Security entities factories /////////////////////////////
static void	setAPrioriDisabledProvider(String name, boolean disabled)	Marks a provider's registrar as "a-priori" programatically so that when its SecurityProviderRegistrar.isEnabled() is eventually consulted it will return false regardless of the configured value for the specific provider registrar instance.
static void	setDefaultProviderChoice(SecurityProviderChoice choice)
static void	setFipsMode()	Unconditionally set FIPS mode, overriding the FIPS_ENABLED system property.
static void	setKeyPairResourceParser(KeyPairResourceParser parser)
static void	setMaxDHGroupExchangeKeySize(int keySize)	Set programmatically the reported value for getMaxDHGroupExchangeKeySize()
static void	setMinDHGroupExchangeKeySize(int keySize)	Set programmatically the reported value for getMinDHGroupExchangeKeySize()

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

BOUNCY_CASTLE

public static final String BOUNCY_CASTLE

Bouncy Castle SecurityProviderRegistrar name.

See Also:

• Constant Field Values

EDDSA

public static final String EDDSA

EDDSA (net.i2p) SecurityProviderRegistrar name. Also the algorithm name that Key.getAlgorithm() returns for ed25519 keys generated by net.i2p or by SunEC.

See Also:

• Constant Field Values

ED25519

public static final String ED25519

Key and signature algorithm name for ed25519. A Bouncy Castle Ed25519 key returns this as Key.getAlgorithm().

See Also:

• Constant Field Values

MIN_DHGEX_KEY_SIZE_PROP

public static final String MIN_DHGEX_KEY_SIZE_PROP

System property used to configure the value for the minimum supported Diffie-Hellman Group Exchange key size. If not set, then an internal auto-discovery mechanism is employed. If set to negative value then Diffie-Hellman Group Exchange is disabled. If set to a negative value then Diffie-Hellman Group Exchange is disabled

See Also:

• Constant Field Values

MAX_DHGEX_KEY_SIZE_PROP

public static final String MAX_DHGEX_KEY_SIZE_PROP

System property used to configure the value for the maximum supported Diffie-Hellman Group Exchange key size. If not set, then an internal auto-discovery mechanism is employed. If set to negative value then Diffie-Hellman Group Exchange is disabled. If set to a negative value then Diffie-Hellman Group Exchange is disabled

See Also:

• Constant Field Values

MIN_DHGEX_KEY_SIZE

public static final int MIN_DHGEX_KEY_SIZE

The min. key size value used for testing whether Diffie-Hellman Group Exchange is supported or not. According to RFC 4419 section 3: Servers and clients SHOULD support groups with a modulus length of k bits, where 1024 <= k <= 8192. Note: this has been amended by RFC 8270

See Also:

• Constant Field Values

PREFERRED_DHGEX_KEY_SIZE

public static final int PREFERRED_DHGEX_KEY_SIZE

See Also:

• Constant Field Values

MAX_DHGEX_KEY_SIZE

public static final int MAX_DHGEX_KEY_SIZE

See Also:

• Constant Field Values

SECURITY_PROVIDER_REGISTRARS

public static final String SECURITY_PROVIDER_REGISTRARS

Comma separated list of fully qualified SecurityProviderRegistrars to automatically register

See Also:

• Constant Field Values

DEFAULT_SECURITY_PROVIDER_REGISTRARS

public static final List<String> DEFAULT_SECURITY_PROVIDER_REGISTRARS

PROP_DEFAULT_SECURITY_PROVIDER

public static final String PROP_DEFAULT_SECURITY_PROVIDER

See Also:

• Constant Field Values

FIPS_ENABLED

public static final String FIPS_ENABLED

A boolean system property that can be set to "true" to enable FIPS mode. In FIPS mode, crypto-algorithms not approved in FIPS-140 will not be available.

Note: if this system property is not "true", it can be overridden via setFipsMode().

See Also:

• Constant Field Values

Method Details

setFipsMode

public static void setFipsMode()

Unconditionally set FIPS mode, overriding the FIPS_ENABLED system property.

Throws:

IllegalStateException - if a call to isFipsMode() had already occurred and returned false.

isFipsMode

public static boolean isFipsMode()

Tells whether FIPS mode is enabled, either through the system property FIPS_ENABLED or via setFipsMode().

Returns:

true if FIPS mode is enabled, false otherwise.

isAPrioriDisabledProvider

public static boolean isAPrioriDisabledProvider(String name)

Parameters:

name - The provider's name - never null/empty

Returns:

true if the provider is marked as disabled a-priori

See Also:

• setAPrioriDisabledProvider(String, boolean)

setAPrioriDisabledProvider

public static void setAPrioriDisabledProvider(String name,
 boolean disabled)

Marks a provider's registrar as "a-priori" programatically so that when its SecurityProviderRegistrar.isEnabled() is eventually consulted it will return false regardless of the configured value for the specific provider registrar instance. Note: has no effect if the provider has already been registered.

Parameters:

name - The provider's name - never null/empty

disabled - true whether to disable it a-priori

See Also:

• isAPrioriDisabledProvider(String)

getAPrioriDisabledProviders

public static Set<String> getAPrioriDisabledProviders()

Returns:

A copy if the current a-priori disabled providers names

isDHGroupExchangeSupported

public static boolean isDHGroupExchangeSupported()

Returns:

true if Diffie-Hellman Group Exchange is supported

See Also:

• getMinDHGroupExchangeKeySize()
• getMaxDHGroupExchangeKeySize()

isDHOakelyGroupSupported

public static boolean isDHOakelyGroupSupported(int keySize)

Parameters:

keySize - The expected key size

Returns:

true if Oakely Diffie-Hellman Group Exchange is supported for the specified key size

See Also:

• isDHGroupExchangeSupported()
• getMaxDHGroupExchangeKeySize()

getMinDHGroupExchangeKeySize

public static int getMinDHGroupExchangeKeySize()

Returns:

The minimum supported Diffie-Hellman Group Exchange key size, or non-positive if not supported

setMinDHGroupExchangeKeySize

public static void setMinDHGroupExchangeKeySize(int keySize)

Set programmatically the reported value for getMinDHGroupExchangeKeySize()

Parameters:

keySize - The reported key size - if zero, then it will be auto-detected, if negative then DH group exchange will be disabled

getMaxDHGroupExchangeKeySize

public static int getMaxDHGroupExchangeKeySize()

Returns:

The maximum supported Diffie-Hellman Group Exchange key size, or non-positive if not supported

setMaxDHGroupExchangeKeySize

public static void setMaxDHGroupExchangeKeySize(int keySize)

Set programmatically the reported value for getMaxDHGroupExchangeKeySize()

Parameters:

keySize - The reported key size - if zero, then it will be auto-detected, if negative then DH group exchange will be disabled

isDHGroupExchangeSupported

public static boolean isDHGroupExchangeSupported(int maxKeySize)

getDefaultProviderChoice

public static SecurityProviderChoice getDefaultProviderChoice()

setDefaultProviderChoice

public static void setDefaultProviderChoice(SecurityProviderChoice choice)

getRegisteredProviders

public static Set<String> getRegisteredProviders()

Returns:

A copy of the currently registered security providers

isBouncyCastleRegistered

public static boolean isBouncyCastleRegistered()

isProviderRegistered

public static boolean isProviderRegistered(String provider)

getRegisteredProvider

public static SecurityProviderRegistrar getRegisteredProvider(String provider)

isRegistrationCompleted

public static boolean isRegistrationCompleted()

registerSecurityProvider

public static SecurityProviderRegistrar registerSecurityProvider(SecurityProviderRegistrar registrar)

Parameters:

registrar - The registrar instance to register

Returns:

The registered instance - may be different than required if already registered. Returns null if not already registered and not enabled or not supported registrar.

loadKeyPairIdentities

public static Iterable<KeyPair> loadKeyPairIdentities(SessionContext session,
 NamedResource resourceKey,
 InputStream inputStream,
 FilePasswordProvider provider)
                                               throws IOException,
GeneralSecurityException

Parameters:

session - The SessionContext for invoking this load command - may be null if not invoked within a session context (e.g., offline tool).

resourceKey - An identifier of the key being loaded - used as argument to the FilePasswordProvider#getPassword invocation

inputStream - The InputStream for the private key

provider - A FilePasswordProvider - may be null if the loaded key is guaranteed not to be encrypted

Returns:

The loaded KeyPair-s - or null if none loaded

Throws:

IOException - If failed to read/parse the input stream

GeneralSecurityException - If failed to generate the keys

createGeneratorHostKeyProvider

public static AbstractGeneratorHostKeyProvider createGeneratorHostKeyProvider(Path path)

getBouncycastleKeyPairResourceParser

public static KeyPairResourceParser getBouncycastleKeyPairResourceParser()

getBouncycastleEncryptedPrivateKeyInfoDecryptor

public static Decryptor getBouncycastleEncryptedPrivateKeyInfoDecryptor()

getRandomFactory

public static RandomFactory getRandomFactory()

Returns:

If isBouncyCastleRegistered() then a BouncyCastleRandomFactory instance, otherwise a JceRandomFactory one

isEDDSACurveSupported

public static boolean isEDDSACurveSupported()

Returns:

true if EDDSA curves (e.g., ed25519) are supported

getOpenSSHEDDSAPrivateKeyEntryDecoder

public static PrivateKeyEntryDecoder getOpenSSHEDDSAPrivateKeyEntryDecoder()

compareEDDSAPPublicKeys

public static boolean compareEDDSAPPublicKeys(PublicKey k1,
 PublicKey k2)

compareEDDSAPrivateKeys

public static boolean compareEDDSAPrivateKeys(PrivateKey k1,
 PrivateKey k2)

recoverEDDSAPublicKey

public static PublicKey recoverEDDSAPublicKey(PrivateKey key)
                                       throws GeneralSecurityException

Throws:

GeneralSecurityException

extractEDDSAKeyPair

public static KeyPair extractEDDSAKeyPair(Buffer buffer,
 String keyType)
                                   throws GeneralSecurityException

Throws:

GeneralSecurityException

getKeyPairResourceParser

public static KeyPairResourceParser getKeyPairResourceParser()

///////////////////////////////////////////////////////////////////////

setKeyPairResourceParser

public static void setKeyPairResourceParser(KeyPairResourceParser parser)

Parameters:

parser - The system-wide KeyPairResourceParser to use. If set to null, then the default parser will be re-constructed on next call to getKeyPairResourceParser()

resolveSecurityEntityFactory

public static SecurityEntityFactory resolveSecurityEntityFactory(Class<?> entityType,
 String algorithm,
 Predicate<? super SecurityProviderRegistrar> entitySelector)

///////////////////////// Security entities factories /////////////////////////////

createSecurityEntityFactory

public static SecurityEntityFactory createSecurityEntityFactory(Predicate<? super SecurityProviderRegistrar> entitySelector)

getSecurityEntityProvider

public static SecurityEntityFactory getSecurityEntityProvider(SecurityProviderRegistrar registrar,
 SecurityProviderChoice defaultProvider)

getAlgorithmParameters

public static AlgorithmParameters getAlgorithmParameters(String algorithm)
                                                  throws GeneralSecurityException

Throws:

GeneralSecurityException

getKeyFactory

public static KeyFactory getKeyFactory(String algorithm)
                                throws GeneralSecurityException

Throws:

GeneralSecurityException

getCipher

public static Cipher getCipher(String transformation)
                        throws GeneralSecurityException

Throws:

GeneralSecurityException

getMessageDigest

public static MessageDigest getMessageDigest(String algorithm)
                                      throws GeneralSecurityException

Throws:

GeneralSecurityException

getKeyPairGenerator

public static KeyPairGenerator getKeyPairGenerator(String algorithm)
                                            throws GeneralSecurityException

Throws:

GeneralSecurityException

getKeyAgreement

public static KeyAgreement getKeyAgreement(String algorithm)
                                    throws GeneralSecurityException

Throws:

GeneralSecurityException

getMac

public static Mac getMac(String algorithm)
                  throws GeneralSecurityException

Throws:

GeneralSecurityException

getSignature

public static Signature getSignature(String algorithm)
                              throws GeneralSecurityException

Throws:

GeneralSecurityException

getCertificateFactory

public static CertificateFactory getCertificateFactory(String type)
                                                throws GeneralSecurityException

Throws:

GeneralSecurityException

getKEM

public static KEM getKEM(String algorithm)
                  throws GeneralSecurityException

Throws:

GeneralSecurityException