/*************************************************************************
* *
* EJBCA: The OpenSource Certificate Authority *
* *
* This software is free software; you can redistribute it and/or *
* modify it under the terms of the GNU Lesser General Public *
* License as published by the Free Software Foundation; either *
* version 2.1 of the License, or any later version. *
* *
* See terms of license at gnu.org. *
* *
*************************************************************************/
package org.ejbca.util;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.security.KeyFactory;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.KeyStore;
import java.security.PrivateKey;
import java.security.cert.Certificate;
import java.security.cert.X509Certificate;
import java.security.interfaces.ECPublicKey;
import java.security.spec.AlgorithmParameterSpec;
import java.security.spec.ECParameterSpec;
import java.security.spec.PKCS8EncodedKeySpec;
import junit.framework.TestCase;
import org.apache.log4j.Logger;
import org.bouncycastle.jce.ECNamedCurveTable;
import org.ejbca.core.model.AlgorithmConstants;
import org.ejbca.core.model.util.AlgorithmTools;
import org.ejbca.util.keystore.KeyTools;
/**
* Tests the CertTools class .
*
* @version $Id: KeyToolsTest.java 11068 2011-01-05 13:17:53Z anatom $
*/
public class KeyToolsTest extends TestCase {
private static Logger log = Logger.getLogger(KeyToolsTest.class);
static byte[] ks3 = Base64.decode(("MIACAQMwgAYJKoZIhvcNAQcBoIAkgASCAyYwgDCABgkqhkiG9w0BBwGggCSABIID"
+ "DjCCAwowggMGBgsqhkiG9w0BDAoBAqCCAqkwggKlMCcGCiqGSIb3DQEMAQMwGQQU"
+ "/h0pQXq7ZVjYWlDvzEwwmiJ8O8oCAWQEggJ4MZ12+kTVGd1w7SP4ZWlq0bCc4MsJ"
+ "O0FFSX3xeVp8Bx16io1WkEFOW3xfqjuxKOL6YN9atoOZdfhlOMhmbhglm2PJSzIg"
+ "JSDHvWk2xKels5vh4hY1iXWOh48077Us4wP4Qt94iKglCq4xwxYcSCW8BJwbu93F"
+ "uxE1twnWXbH192nMhaeIAy0v4COdduQamJEtHRmIJ4GZwIhH+lNHj/ARdIfNw0Dm"
+ "uPspuSu7rh6rQ8SrRsjg63EoxfSH4Lz6zIJKF0OjNX07T8TetFgznCdGCrqOZ1fK"
+ "5oRzXIA9hi6UICiuLSm4EoHzEpifCObpiApwNj3Kmp2uyz2uipU0UKhf/WqvmU96"
+ "yJj6j1JjZB6p+9sgecPFj1UMWhEFTwxMEwR7iZDvjkKDNWMit+0cQyeS7U0Lxn3u"
+ "m2g5e6C/1akwHZsioLC5OpFq/BkPtnbtuy4Kr5Kwb2y7vSiKpjFr7sKInjdAsgCi"
+ "8kyUV8MyaIfZdtREjwqBe0imfP+IPVqAsl1wGW95YXsLlK+4P1bspAgeHdDq7Q91"
+ "bJJQAS5OTD38i1NY6MRtt/fWsShVBLjf2FzNpw6siHHl2N7BDNyO3ALtgfp50e0Z"
+ "Dsw5WArgKLiXfwZIrIKbYA73RFc10ReDqnJSF+NXgBo1/i4WhZLHC1Osl5UoKt9q"
+ "UoXIUmYhAwdAT5ZKVw6A8yp4e270yZTXNsDz8u/onEwNc1iM0v0RnPQhNE5sKEZH"
+ "QrMxttiwbKe3YshCjbruz/27XnNA51t2p1M6eC1HRab4xSHAyH5NTxGJ8yKhOfiT"
+ "aBKqdTH3P7QzlcoCUDVDDe7aLMaZEf+a2Te63cZTuUVpkysxSjAjBgkqhkiG9w0B"
+ "CRQxFh4UAHAAcgBpAHYAYQB0AGUASwBlAHkwIwYJKoZIhvcNAQkVMRYEFCfeHSg6"
+ "EdeP5A1IC8ydjyrjyFSdAAQBAAQBAAQBAAQBAASCCBoAMIAGCSqGSIb3DQEHBqCA"
+ "MIACAQAwgAYJKoZIhvcNAQcBMCcGCiqGSIb3DQEMAQYwGQQURNy47tUcttscSleo"
+ "8gY6ZAPFOl0CAWSggASCB8jdZ+wffUP1B25Ys48OFBMg/itT0EBS6J+dYVofZ84c"
+ "x41q9U+CRMZJwVNZbkqfRZ+F3tLORSwuIcwyioa2/JUpv8uJCjQ2tru5+HtqCrzR"
+ "Huh7TfdiMqvjkKpnXi69DPPjQdCSPwYMy1ahZrP5KgEZg4S92xpU2unF1kKQ30Pq"
+ "PTEBueDlFC39rojp51Wsnqb1QzjPo53YvJQ8ztCoG0yk+0omELyPbc/qMKe5/g5h"
+ "Lx7Q+2D0PC/ZHtoDkCRfMDKwgwALFsSj2uWNJsCplspmc7YgIzSr/GqqeSXHp4Ue"
+ "dwVJAswrhpkXZTlp1rtl/lCSFl9akwjY1fI144zfpYKpLqfoHL1uI1c3OumrFzHd"
+ "ZldZYgsM/h3qjgu8qcXqI0sKVXsffcftCaVs+Bxmdu9vpY15rlx1e0an/O05nMKU"
+ "MBU2XpGkmWxuy0tOKs3QtGzHUJR5+RdEPURctRyZocEjJgTvaIMq1dy/FIaBhi+d"
+ "IeAbFmjBu7cv9C9v/jMuUjLroycmo7QW9jGgyTOQ68J+6w2/PtqiqIo3Ry9WC0SQ"
+ "8+fVNOGLr5O2YPpw17sDQa/+2gjozngvL0OHiABwQ3EbXAQLF046VYkTi5R+8iGV"
+ "3jlTvvStIKY06E/s/ih86bzwJWAQENCazXErN69JO+K3IUiwxac+1AOO5WyR9qyv"
+ "6m/yHdIdbOVE21M2RARbI8UiDpRihCzk4duPfj/x2bZyFqLclIMhbTd2UOQQvr+W"
+ "4etpMJRtyFGhdLmNgYAhYrbUgmdL1kRkzPzOs77PqleMpfkii7HPk3HlVkM7NIqd"
+ "dN0WQaQwGJuh5f1ynhyqtsaw6Gu/X56H7hpziAh0eSDQ5roRE7yy98h2Mcwb2wtY"
+ "PqVFTmoKuRWR2H5tT6gCaAM3xiSC7RLa5SF1hYQGaqunqBaNPYyUIg/r03dfwF9r"
+ "AkOhh6Mq7Z2ktzadWTxPl8OtIZFVeyqIOtSKBHhJyGDGiz3+SSnTnSX81NaTSJYZ"
+ "7YTiXkXvSYNpjpPckIKfjpBw0T4pOva3a6s1z5p94Dkl4kz/zOmgveGd3dal6wUV"
+ "n3TR+2cyv51WcnvB9RIp58SJOc+CvCvYTvkEdvE2QtRw3wt4ngGJ5pxmC+7+8fCf"
+ "hRDzw9LBNz/ry88y/0Bidpbhwr8gEkmHuaLp43WGQQsQ+cWYJ8AeLZMvKplbCWqy"
+ "iuks0MnKeaC5dcB+3BL55OvcTfGkMtz0oYBkcGBTbbR8BKJZgkIAx7Q+/rCaqv6H"
+ "HN/cH5p8iz5k+R3MkmR3gi6ktelQ2zx1pbPz3IqR67cTX3IyTX56F2aY54ueY17m"
+ "7hFwSy4aMen27EO06DXn/b6vPKj73ClE2B/IPHO/H2e8r04JWMltFWuStV0If5x0"
+ "5ZImXx068Xw34eqSWvoMzr97xDxUwdlFgrKrkMKNoTDhA4afrZ/lwHdUbNzh6cht"
+ "jHW/IfIaMo3NldN/ihO851D399FMsWZW7YA7//RrWzBDiLvh+RfwkMOfEpbujy0G"
+ "73rO/Feed2MoVXvmuKBRpTNyFuBVvFDwIzBT4m/RaVf5m1pvprSk3lo43aumdN9f"
+ "NDETktVZ/CYaKlYK8rLcNBKJicM5+maiQSTa06XZXDMY84Q0xtCqJ/aUH4sa/z8j"
+ "KukVUSyUZDJk/O82B3NA4+CoP3Xyc9LAUKucUvoOmGt2JCw6goB/vqeZEg9Tli0Q"
+ "+aRer720QdVRkPVXKSshL2FoXHWUMaBF8r//zT6HbjTNQEdxbRcBNvkUXUHzITfl"
+ "YjQcEn+FGrF8+HVdXCKzSXSgu7mSouYyJmZh42spUFCa4j60Ks1fhQb2H1p72nJD"
+ "n1mC5sZkU68ITVu1juVl/L2WJPmWfasb1Ihnm9caJ/mEE/i1iKp7qaY9DPTw5hw4"
+ "3QplYWFv47UA/sOmnWwupRuPk7ISdimuUnih8OYR75rJ0z6OYexvj/2svx9/O5Mw"
+ "654jFF2hAq69jt7GJo6VZaeCRCAxEU7N97l3EjqaKJVrpIPQ+3yLmqHit/CWxImB"
+ "iIl3sW7MDEHgPdQy3QiZmAYNLQ0Te0ygcIHwtPyzhFoFmjbQwib2vxDqWaMQpUM1"
+ "/W96R/vbCjA7tfKYchImwAPCyRM5Je2FHewErG413kZct5tJ1JqkcjPsP7Q8kmgw"
+ "Ec5QNq1/PZOzL1ZLr6ryfA4gLBXa6bJmf43TUkdFYTvIYbvH2jp4wpAtA152YgPI"
+ "FL19/Tv0B3Bmb1qaK+FKiiQmYfVOm/J86i/L3b8Z3jj8dRWEBztaI/KazZ/ZVcs/"
+ "50bF9jH7y5+2uZxByjkM/kM/Ov9zIHbYdxLw2KHnHsGKTCooSSWvPupQLBGgkd6P"
+ "M9mgE6MntS+lk9ucpP5j1LXo5zlZaLSwrvSzE3/bbWJKsJuomhRbKeZ+qSYOWvPl"
+ "/1RqREyZHbSDKzVk39oxH9EI9EWKlCbrz5EHWiSv0+9HPczxbO3q+YfqcY8plPYX"
+ "BvgxHUeDR+LxaAEcVEX6wd2Pky8pVwxQydU4cEgohrgZnKhxxLAvCp5sb9kgqCrh"
+ "luvBsHpmiUSCi/r0PNXDgApvTrVS/Yv0jTpX9u9IWMmNMrnskdcP7tpEdkw8/dpf"
+ "RFLLgqwmNEhCggfbyT0JIUxf2rldKwd6N1wZozaBg1uKjNmAhJc1RxsABAEABAEA"
+ "BAEABAEABAEABAEABAEABAEABAEABAEABAEAAAAAAAAAMDwwITAJBgUrDgMCGgUA"
+ "BBSS2GOUxqv3IT+aesPrMPNn9RQ//gQUYhjCLPh/h2ULjh+1L2s3f5JIZf0CAWQA"
+ "AA==").getBytes());
static byte[] keys1024bit = Base64.decode(("MIICeAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBAKA5rNhYbPuVcArT"
+ "mkthfrW2tX1Z7SkCD01sDYrkiwOcodFmS1cSyz8eHM51iwHA7CW0WFvfUjomBT5y"
+ "gRQfIsf5M5DUtYcKM1hmGKSPzvmF4nYv+3UBUesCvBXVRN/wFZ44SZZ3CVvpQUYb"
+ "GWjyC+Dgol5n8oKOC287rnZUPEW5AgMBAAECgYEAhMtoeyLGqLlRVFfOoL1cVGTr"
+ "BMp8ail/30435y7GHKc74p6iwLcd5uEhROhc3oYz8ogHV5W+w9zxKbGjU7b+jmh+"
+ "h/WFao+Gu3sSrZ7ieg95fSuQsBlJp3w+eCAOZwlEu/JQQHDtURui25SPVblZ9/41"
+ "u8VwFjk9YQx+nT6LclECQQDYlC9bOr1SWL8PBlipXB/UszMsTM5xEH920A+JPF4E"
+ "4tw+AHecanjr5bXSluRbWSWUjtl5LV2edqAP9EsH1/A1AkEAvWOctUvTlm6fWHJq"
+ "lZhsWVvOhDG7cn5gFu34J8JJd5QHov0469CpSamY0Q/mPE/y3kDllmyYvnQ+yobB"
+ "ZRg39QJBAINCM/0/eVQ58vlBKGTkL2pyfNYhapB9pjK04GWVD4o4j7CICfXjVYvq"
+ "eSq7RoTSX4NMnCLjyrRqQpHIxdxoE+0CQQCz7MzWWGF+Cz6LUrf7w0E8a8H5SR4i"
+ "GfnEDvSxIR2W4yWWLShEsIoEF4G9LHO5XOMJT3JOxIEgf2OgGQHmv2l5AkBThYUo"
+ "ni82jZuue3YqXXHY2lz3rVmooAv7LfQ63yzHECFsQz7kDwuRVWWRsoCOURtymAHp"
+ "La09g2BE+Q5oUUFx").getBytes());
/** self signed cert done with above private key */
static byte[] certbytes = Base64.decode(("MIICNzCCAaCgAwIBAgIIIOqiVwJHz+8wDQYJKoZIhvcNAQEFBQAwKzENMAsGA1UE"
+ "AxMEVGVzdDENMAsGA1UEChMEVGVzdDELMAkGA1UEBhMCU0UwHhcNMDQwNTA4MDkx"
+ "ODMwWhcNMDUwNTA4MDkyODMwWjArMQ0wCwYDVQQDEwRUZXN0MQ0wCwYDVQQKEwRU"
+ "ZXN0MQswCQYDVQQGEwJTRTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAgbf2"
+ "Sv34lsY43C8WJjbUd57TNuHJ6p2Es7ojS3D2yxtzQg/A8wL1OfXes344PPNGHkDd"
+ "QPBaaWYQrvLvqpjKwx/vA1835L3I92MsGs+uivq5L5oHfCxEh8Kwb9J2p3xjgeWX"
+ "YdZM5dBj3zzyu+Jer4iU4oCAnnyG+OlVnPsFt6ECAwEAAaNkMGIwDwYDVR0TAQH/"
+ "BAUwAwEB/zAPBgNVHQ8BAf8EBQMDBwYAMB0GA1UdDgQWBBQArVZXuGqbb9yhBLbu"
+ "XfzjSuXfHTAfBgNVHSMEGDAWgBQArVZXuGqbb9yhBLbuXfzjSuXfHTANBgkqhkiG"
+ "9w0BAQUFAAOBgQA1cB6wWzC2rUKBjFAzfkLvDUS3vEMy7ntYMqqQd6+5s1LHCoPw"
+ "eaR42kMWCxAbdSRgv5ATM0JU3Q9jWbLO54FkJDzq+vw2TaX+Y5T+UL1V0o4TPKxp"
+ "nKuay+xl5aoUcVEs3h3uJDjcpgMAtyusMEyv4d+RFYvWJWFzRTKDueyanw==").getBytes());
static String storepwd = "foo123";
static String pkAlias = "privateKey";
public KeyToolsTest(String name) {
super(name);
}
public void setUp() throws Exception {
// Install BouncyCastle provider
CryptoProviderTools.installBCProvider();
}
public void tearDown() throws Exception {
}
public void test01GetCertChain() throws Exception {
log.trace(">test01GetCertChain()");
KeyStore store = KeyStore.getInstance("PKCS12", "BC");
ByteArrayInputStream fis = new ByteArrayInputStream(ks3);
store.load(fis, storepwd.toCharArray());
Certificate[] certs = KeyTools.getCertChain(store, pkAlias);
log.debug("Number of certs: " + certs.length);
assertEquals("Wrong number of certs returned", 3, certs.length);
for (int i = 0; i < certs.length; i++) {
X509Certificate cert = (X509Certificate) certs[i];
log.debug("SubjectDN: " + cert.getSubjectDN().toString());
if (i == 0) {
assertEquals("Wrong subjectDN", cert.getSubjectDN().toString(), "CN=fooca,C=SE");
}
if (i == 1) {
assertEquals("Wrong subjectDN", cert.getSubjectDN().toString(), "CN=TestSubCA,O=AnaTom,C=SE");
}
if (i == 2) {
assertEquals("Wrong subjectDN", cert.getSubjectDN().toString(), "CN=TestCA,O=AnaTom,C=SE");
}
}
log.trace("<test01GetCertChain()");
}
public void test02GenKeysRSA() throws Exception {
log.trace(">test02GenKeysRSA()");
KeyPair keys = KeyTools.genKeys("512", AlgorithmConstants.KEYALGORITHM_RSA);
assertNotNull("keys must not be null", keys);
String b64private = new String(Base64.encode(keys.getPrivate().getEncoded()));
assertNotNull("b64private must not be null", b64private);
//log.debug(b64private);
X509Certificate cert = CertTools.genSelfCert("C=SE,O=Test,CN=Test", 365, null, keys.getPrivate(), keys.getPublic(), AlgorithmConstants.SIGALG_SHA1_WITH_RSA, true);
assertNotNull("cert must not be null", cert);
String b64cert = new String(Base64.encode(cert.getEncoded()));
assertNotNull("b64cert cannot be null", b64cert);
//log.debug(b64cert);
KeyTools.testKey(keys.getPrivate(), keys.getPublic(), "BC");
log.trace("<test02GenKeysRSA()");
}
public void test03CreateP12() throws Exception {
log.trace(">test03CreateP12()");
Certificate cert = CertTools.getCertfromByteArray(certbytes);
PKCS8EncodedKeySpec pkKeySpec = new PKCS8EncodedKeySpec(keys1024bit);
KeyFactory keyFactory = KeyFactory.getInstance("RSA");
PrivateKey pk = keyFactory.generatePrivate(pkKeySpec);
KeyStore ks = KeyTools.createP12("Foo", pk, cert, (X509Certificate) null);
assertNotNull("ks must not be null", ks);
ByteArrayOutputStream baos = new ByteArrayOutputStream();
// If password below is more than 7 chars, strong crypto is needed
ks.store(baos, "foo123".toCharArray());
assertTrue("baos size must not be 0", baos.size() > 0);
log.trace("<test03CreateP12()");
}
public void test03GenKeysECDSAx9() throws Exception {
log.trace(">test03GenKeysECDSA()");
KeyPair keys = KeyTools.genKeys("prime192v1", AlgorithmConstants.KEYALGORITHM_ECDSA);
assertNotNull("keys must not be null", keys);
String b64private = new String(Base64.encode(keys.getPrivate().getEncoded()));
assertNotNull("b64private must not be null", b64private);
//log.debug(b64private);
X509Certificate cert = CertTools.genSelfCert("C=SE,O=Test,CN=Test", 365, null, keys.getPrivate(), keys.getPublic(), AlgorithmConstants.SIGALG_SHA256_WITH_ECDSA, true);
//log.debug(cert);
assertNotNull("cert must not be null", cert);
String b64cert = new String(Base64.encode(cert.getEncoded()));
assertNotNull("b64cert cannot be null", b64cert);
//log.debug(b64cert);
KeyTools.testKey(keys.getPrivate(), keys.getPublic(), "BC");
log.trace("<test03GenKeysECDSA()");
}
public void test04GenKeysECDSANist() throws Exception {
log.trace(">test04GenKeysECDSANist()");
KeyPair keys = KeyTools.genKeys("secp384r1", AlgorithmConstants.KEYALGORITHM_ECDSA);
assertNotNull("keys must not be null", keys);
String b64private = new String(Base64.encode(keys.getPrivate().getEncoded()));
assertNotNull("b64private must not be null", b64private);
//log.debug(b64private);
X509Certificate cert = CertTools.genSelfCert("C=SE,O=Test,CN=Test", 365, null, keys.getPrivate(), keys.getPublic(), AlgorithmConstants.SIGALG_SHA256_WITH_ECDSA, true);
//log.debug(cert);
assertNotNull("cert must not be null", cert);
String b64cert = new String(Base64.encode(cert.getEncoded()));
assertNotNull("b64cert cannot be null", b64cert);
//log.info(b64cert);
KeyTools.testKey(keys.getPrivate(), keys.getPublic(), "BC");
log.trace("<test04GenKeysECDSANist()");
}
public void test05GenKeysECDSAImplicitlyCA() throws Exception {
log.trace(">test05GenKeysECDSAImplicitlyCA()");
KeyPair keys = KeyTools.genKeys("implicitlyCA", AlgorithmConstants.KEYALGORITHM_ECDSA);
assertNotNull("keys must not be null", keys);
String b64private = new String(Base64.encode(keys.getPrivate().getEncoded()));
assertNotNull("b64private must not be null", b64private);
//log.debug(b64private);
X509Certificate cert = CertTools.genSelfCert("C=SE,O=Test,CN=Test", 365, null, keys.getPrivate(), keys.getPublic(), AlgorithmConstants.SIGALG_SHA256_WITH_ECDSA, true);
//log.debug(cert);
assertNotNull("cert must not be null", cert);
String b64cert = new String(Base64.encode(cert.getEncoded()));
assertNotNull("b64cert cannot be null", b64cert);
//log.info(b64cert);
KeyTools.testKey(keys.getPrivate(), keys.getPublic(), "BC");
log.trace("<test05GenKeysECDSAImplicitlyCA()");
}
public void test06GenKeysDSA() throws Exception {
log.trace(">test06GenKeysDSA()");
KeyPair keys = KeyTools.genKeys("512", AlgorithmConstants.KEYALGORITHM_DSA);
assertNotNull("keys must not be null", keys);
String b64private = new String(Base64.encode(keys.getPrivate().getEncoded()));
assertNotNull("b64private must not be null", b64private);
//log.debug(b64private);
X509Certificate cert = CertTools.genSelfCert("C=SE,O=Test,CN=Test", 365, null, keys.getPrivate(), keys.getPublic(), AlgorithmConstants.SIGALG_SHA1_WITH_DSA, true);
assertNotNull("cert must not be null", cert);
String b64cert = new String(Base64.encode(cert.getEncoded()));
assertNotNull("b64cert cannot be null", b64cert);
//log.debug(b64cert);
KeyTools.testKey(keys.getPrivate(), keys.getPublic(), "BC");
log.trace("<test06GenKeysDSA()");
}
public void test07GenKeysECDSAAlgorithmSpec() throws Exception {
log.trace(">test07GenKeysECDSAAlgorithmSpec()");
KeyPairGenerator keygen = KeyPairGenerator.getInstance("EC", "BC");
AlgorithmParameterSpec ecSpec = ECNamedCurveTable.getParameterSpec("secp256r1");
keygen.initialize(ecSpec);
KeyPair keys = keygen.generateKeyPair();
assertEquals("EC", keys.getPublic().getAlgorithm());
String spec = AlgorithmTools.getKeySpecification(keys.getPublic());
assertEquals("secp256r1", spec);
AlgorithmParameterSpec paramspec = KeyTools.getKeyGenSpec(keys.getPublic());
KeyPair keys2 = KeyTools.genKeys(null, paramspec, AlgorithmConstants.KEYALGORITHM_ECDSA);
assertEquals("ECDSA", keys2.getPublic().getAlgorithm());
ECPublicKey pk1 = (ECPublicKey)keys.getPublic();
ECPublicKey pk2 = (ECPublicKey)keys2.getPublic();
// Verify that it's the same key size
int len1 = KeyTools.getKeyLength(pk1);
int len2 = KeyTools.getKeyLength(pk2);
assertEquals(len1, len2);
// Verify that the domain parameters are the same
ECParameterSpec ecs1 = pk1.getParams();
ECParameterSpec ecs2 = pk2.getParams();
assertEquals(ecs1.getCofactor(), ecs2.getCofactor());
assertEquals(ecs1.getOrder(), ecs2.getOrder());
assertEquals(ecs1.getCurve(), ecs2.getCurve());
// Verify that it is not the same key though
assertFalse(pk1.getW().equals(pk2.getW()));
KeyTools.testKey(keys.getPrivate(), keys.getPublic(), "BC");
log.trace("<test07GenKeysECDSAAlgorithmSpec()");
}
}