untitled

Size: px

Start display at page:

Download "untitled"

ふみなみねむら
6 years ago
Views:

1 Java JCE JAVA API 1

2 2 java.seceurity.* javax.crypto.* / MAC (Message Authentication Code) ( ) java.security () javax.crypto 2004/8/26 Java JCE 3 getinstance() Provider Provider Provider Provider Security KeyAgreement Cipher KeyStore SecretKeyFactory Signature SecureRandom KeyGenerator KeyFactory Mac MessageDigest CertificateFactory ExemptionMechanism KeyPairGenerator 2004/8/26 Java JCE 4 2

3 API JAVA JCE Application 1 Application 2 Application n Cert Path API JAAS /API JCA SPI JCE JDK 1.4 Core API ( ) CSP 1 CSP 2 CSP 3 CSP n JCE CSP Provider( ) 2004/8/26 Java JCE 5 JDK 1.4 JCE / MAC (Message Authentication Code) Kerberos/ /X500 (Exemption Mechanism) 2004/8/26 Java JCE 6 3

4 AES Advanced Encryption StandardNIST FIPS Blowfish Bruce Schneier JDK 1.4 JDK 1.4 DES FIPS PUB 46-2 DESede DES 3 JDK 1.4 PBEWith<digest>And<encrypti on> RC2, RC4, RC5 RSA RSA Data Security / PKCS#1 JDK 1.4 JDK /8/26 Java JCE 7 NONE CBC Cipher Block Chaining CFB Cipher Feed Back ECB Electric Code Book OFB Output Feed Back PCBC Propagating CBC 2004/8/26 Java JCE 8 4

5 NoPadding OAEPWith<digest>And< mgf>padding PKCS#1 v2 PKCS5Padding SSL3Padding PKCS#5 SSL v3/tls v1 2004/8/26 Java JCE 9 MD2 RFC MD5 SHA-1 SHA-256, SHA-384, SHA-512 RFC FIPS MD5 FIPS SHA /8/26 Java JCE 10 5

6 Provider Provider Provider 2004/8/26 Java JCE 11 6

7 Example1 Exapmle1.java / 2004/8/26 Java JCE 13 javax.crypto.cipher / 2004/8/26 Java JCE 14 7

8 javax.crypto.cipher init update dofinal update() wrap wrap unwrap wrap 2004/8/26 Java JCE 15 IV / 2004/8/26 Java JCE 16 8

9 57: protected Example1( 58: String algorithm, 59: byte[] key, 60: byte[] iv, 61: String inpath, 62: String outpath) 63: throws NoSuchAlgorithmException, NoSuchPaddingException, InvalidKeySpecException, InvalidKeyException { 64: // 65: this.inpath = inpath; 66: this.outpath = outpath; 67: 68: // 69: this.cipher = Cipher.getInstance(algorithm); 2004/8/26 Java JCE 17 Provider Provider DES, RC2, RSA DES/CBC, RC2/ECB/NoPadding 2004/8/26 Java JCE 18 9

10 71: // 72: String name = cipher.getalgorithm(); 73: int offset = name.indexof('/'); 74: 75: if(offset >= 0) { Factory 76: name = name.substring(0, offset); 77: } 78: SecretKeyFactory factory = SecretKeyFactory.getInstance(name); 79: KeySpec spec = null; 80: if(name.startswith("des")) { 81: spec = new DESKeySpec(key); 82: } else if(name.startswith("tripledes") name.startswith("desede")) { 83: spec = new DESedeKeySpec(key); 84: } else { 85: spec = new SecretKeySpec(key, name); 86: } KeySpec Factory/Spec 87 this.secretkey = factory.generatesecret(spec); 2004/8/26 Java JCE 19 () SecretKeyFactory KeySpec SecretKeyFactory.generateSecret() SecreteKeyFactory / Cipher.getAlgorithm() SecretKeyFactory.getInstance() KeySpec 2004/8/26 Java JCE 20 10

11 () 93: /** 94: * 95: **/ 96: protected void doencryption() 97: throws InvalidKeyException, IOException, IllegalBlockSizeException, BadPaddingException, InvalidAlgorithmParameterException { 98: // 99: cipher.init(cipher.encrypt_mode, secretkey, algorithmspec); 100: 101: // 102: doprocess(); 103:} 2004/8/26 Java JCE 21 ( ) 105: /** 106: * 107: **/ 108: protected void dodecryption() 109: throws InvalidKeyException, IOException, IllegalBlockSizeException, BadPaddingException, InvalidAlgorithmParameterException { 110: // 111: cipher.init(cipher.decrypt_mode, secretkey, algorithmspec); 112: 113: // 114: doprocess(); 115: } 2004/8/26 Java JCE 22 11

12 / 130: while(true) { 131: // 132: int size = in.read(buffer); 133: if(size < 0) { 134: break; 135: } 136: byte[] processed = cipher.update(buffer, 0, size); 137: if(processed!= null && processed.length > 0) { 138: out.write(processed); 139: } 140: } 141: // 142: byte[] processed = cipher.dofinal(); 143: if(processed!= null && processed.length > 0) { 144: out.write(processed); 145 } 2004/8/26 Java JCE 23 cipher.update()/cipher.dofinal() cipher.dofinal() Cipher 2004/8/26 Java JCE 24 12

13 Example2 Example2.java 2004/8/26 Java JCE 26 13

14 java.security.messagedigest / /8/26 Java JCE 27 java.security.messagedigest reset update digest getdigestlength 2004/8/26 Java JCE 28 14

15 2004/8/26 Java JCE 29 36: public Example2( 37: String algorithm, 38: String inpath) 39: throws NoSuchAlgorithmException { 40: messagedigest = MessageDigest.getInstance(algorithm); 41: inpathname = inpath; 42: } 2004/8/26 Java JCE 30 15

16 Provider Provider MD5, SHA /8/26 Java JCE 31 54: messagedigest.reset(); 55: while(true) { 56: int size = in.read(buffer); 57: if(size < 0) { 58: break; 59: } 60: messagedigest.update(buffer, 0, size); 61: } 62: byte[] digest = messagedigest.digest(); 2004/8/26 Java JCE 32 16

17 MessageDigest.reset() MessageDigest.update() MessageDigest.digest() dofinal() byte[] getdigestlength() MessageDigest 2004/8/26 Java JCE 33 17

18 Example4 Example4.java 2004/8/26 Java JCE 35 java.security.signature 2004/8/26 Java JCE 36 18

19 java.security.signature initverify verify update initsign sign 2004/8/26 Java JCE /8/26 Java JCE 38 19

20 KeyStore? JCE KeyStore KeyStore 2004/8/26 Java JCE 39 KeyStore KeyStore KeyStore (load/store) 2004/8/26 Java JCE 40 20

21 (KeyStore ) 65: protected void loadkey( 66: String storetype, 67: String storefilename, 68: String entryname, 69: char[] passwd) 70: throws NoSuchAlgorithmException, KeyStoreException, IOException, CertificateException { KeyStore 71: // 72: KeyStore store = KeyStore.getInstance(storeType); 73: // 74: store.load(new FileInputStream(storeFileName), passwd); KeyStore KeyStore 2004/8/26 Java JCE 41 ( ) 65: protected void loadkey( 66: String storetype, 67: String storefilename, 68: String entryname, 69: char[] passwd) 76: // 77: try { 78: privatekey = (PrivateKey)(store.getKey(entryName, passwd)); 79: } catch(exception e) { 80: privatekey = null; 81: } 2004/8/26 Java JCE 42 21

22 (/ ) 68: protected void loadkey( String storetype,string storefilename,string entryname, char[] passwd) 82: // 83: try { 84: // 85: Certificate certificate = store.getcertificate(entryname); 86: if(certificate!= null) { 87: publickey = certificate.getpublickey(); 88: } else { 89: publickey = null; 90: } 91: } catch(exception e) { 92: publickey = null; 93: } 94: } 2004/8/26 Java JCE 43 KeyStore/ Example4KeyStore/ Provider KeyStore KeyStoreProvider 2004/8/26 Java JCE 44 22

23 57: // 58: String keyalgorithm = publickey.getalgorithm(); 59: signaturealgorithm = Signature.getInstance(hashAlgorith + 60: "with" + keyalgorithm); SHA1withRSA with 2004/8/26 Java JCE 45 Provider Provider <HashAlgorithm>with<KeyAlgorithm> MD5withRSA, SHA1withRSA DSA JDK MD2withRSA/MD5withRSA/SHA1withRSA/DSA 2004/8/26 Java JCE 46 23

24 106: // 107: signaturealgorithm.initsign(privatekey); 108: // 109: doupdate(targetfilename); 110: // 111: byte[] signature = signaturealgorithm.sign(); 2004/8/26 Java JCE 47 initsign() sign() byte[] RSA DSA 2 Signature 2004/8/26 Java JCE 48 24

25 164: // 165: signaturealgorithm.initverify(publickey); 166: // 167: doupdate(targetfilename); 168: // 169: if(signaturealgorithm.verify(signature)) { 170: System.out.println("Signature is valid"); 171: } else { 172: System.out.println("Signature is invalid"); 173: } 2004/8/26 Java JCE 49 initverify() verify() boolean Signature 2004/8/26 Java JCE 50 25

26 update() MessageDigest/Cipher update() 2004/8/26 Java JCE 51 26

27 Example5 Example5.java JCE /8/26 Java JCE 53 KeyStore Copy/Delete/List KeyStore Exampe5.java load/store 2004/8/26 Java JCE 54 27

28 load Example5.loadCertificate() : in = new FileInputStream(certificateFile); 344: CertificateFactory factory = CertificateFactory.getInstance("X.509"); 345: 346: return factory.generatecertificate(in); X509 Factory load CertificateFactory load 2004/8/26 Java JCE 55 store Example5.storeCertificate() : out = new FileOutputStream(certificateFile); 323: out.write(certificate.getencoded()); Certificate getencoded() 2004/8/26 Java JCE 56 28

29 load Example5.loadPrivateKey() DSA/RSA 065: static protected final String[] knownkeytype = {"DSA", "RSA" }; PKCS8 294: PKCS8EncodedKeySpec spec = new PKCS8EncodedKeySpec(encoded); 295: for(int i = 0 ; i < knownkeytype.length ; i++) { 296: try { 297: KeyFactory factory = KeyFactory.getInstance(knownKeyType[i]); 298: return factory.generateprivate(spec); 299: } catch(exception e) {} 300: } 2004/8/26 Java JCE 57 store Example5.storePrivateKey() KeyFactory 255: KeyFactory factory = KeyFactory.getInstance(key.getAlgorithm()); 256: KeySpec spec = factory.getkeyspec(key, PKCS8EncodedKeySpec.class); 257: 258: System.out.println("Store private key into " + privatekeyfile); PKCS8 259: out = new FileOutputStream(privateKeyFile); 260: out.write(((pkcs8encodedkeyspec)(spec)).getencoded()); getencoded() 2004/8/26 Java JCE 58 29

30 Example3 Example3.java 2004/8/26 Java JCE 60 30

31 java.security.cert.certpathvalidator java.security.cert.certpathbuilder 2004/8/26 Java JCE 61 InputStream CertificateFactory X509Certificate X509CRL CertSelector TrustAnchor PKIXBuilderParameters CertPathBuilder CertStore CertStore LDAP CertStore CertPathBuilderResult CertPath 2004/8/26 Java JCE 62 31

32 Example3.run : public void run() { 223: try { 224: CertPathBuilderResult result = builder.build(params); 225: printresult(result); 226: } catch(exception e) { 227: e.printstacktrace(); 228: System.exit(3); 229: } 230: } 2004/8/26 Java JCE 63 Example // PKIXBuilderParameters pkixparams = new PKIXBuilderParameters(trustAnchor, targetconstraint); // pkixparams.addcertstore(localstore); pkixparams.setrevocationenabled(false); params = pkixparams; // // CRL 2004/8/26 Java JCE 64 32

33 API CSP Application 1 Application 2 Application n Cert Path API JAAS JCE JCA SPI CSP 1 CSP 2 CSP 3 CSP n 2004/8/26 Java JCE 66 33

34 JAVA Signature.MD2withRSA=org.jnsa.ChallengePKI2003.signature.MD2withRSA Signature.MD4withRSA=org.jnsa.ChallengePKI2003.signature.MD4withRSA Signature.MD5withRSA=org.jnsa.ChallengePKI2003.signature.MD5withRSA Signature.SHA1withRSA=org.jnsa.ChallengePKI2003.signature.SHA1withRSA Cipher.RSA= org.jnsa.challengepki2003.cipher.rsa SPI SPI SPI 2004/8/26 Java JCE 67 SPI(Service Provider Interface) Java.security.Security Example6 MasterClass.java 2004/8/26 Java JCE 68 34

35 MasterClass.java 29: public MasterClass() { Provaider 30: super(provider_name, PROVIDER_VERSION, PROVIDER_INFO); 31: 32: AccessController.doPrivileged(new java.security.privilegedaction() { 33: public Object run() { 34: put("cipher.caesar", 35: 36: return null; 37: } 38: }); 39: 40: } "org.jnsa.challengepki2003.example6.caesarcipher"); 2004/8/26 Java JCE 69 MasterClass.java 21: public class MasterClass extends Provider { 22: static protected final String PROVIDER_NAME = "JNSA"; 23: static protected final double PROVIDER_VERSION = 1.0; 24: static protected final String PROVIDER_INFO = "This provider is sample implementation for ChallengePKI 2003"; Provider 30super()java.security.Provider Provider java.security.secuiry 2004/8/26 Java JCE 70 35

36 ASN.1 Standard DIGITAL SIGNATURE STANDARD(DSS) PKCS#1/5/7/8/12 Java 2 Platform, Standard Edition, API Java API Java Certification Path API e.html Java er.html Java (JCE) /8/26 Java JCE 71 RFC The MD2 Message-Digest Algorithm RFC The MD5 Message-Digest Algorithm RFC US Secure Hash Algorithm 1 (SHA1) RFC Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile 15 API Part 1 API Part 2 Java JCE Java Cryptographic Extensions 2004/8/26 Java JCE 72 36

untitled

untitled API API Part 1 10API 25 10API Part2 Copyright (c) 2004 NPO Page 2 Copyright (C) 2004 NPO JNSA 1 API API Wassenaar API Copyright (c) 2004 NPO Page 4 Copyright (C) 2004 NPO JNSA 2 56 512512 112 IC 1 I II