public ASN1Value decode(Tag implicitTag, InputStream istream)
throws InvalidBERException, IOException {
SEQUENCE seq = (SEQUENCE) seqt.decode(implicitTag, istream);
// ANY infoAny = (ANY)seq.elementAt(0);
// byte[] infoEncoding = infoAny.getEncoded();
/*CertificationRequestInfo info = (CertificationRequestInfo) infoAny.decodeWith(
CertificationRequestInfo.getTemplate() );
*/
CertificationRequestInfo info = (CertificationRequestInfo) seq.elementAt(0);
// although signature is a bit string, all algorithms we use
// will produce an octet string.
BIT_STRING bs = (BIT_STRING) seq.elementAt(2);
if (bs.getPadCount() != 0) {
throw new InvalidBERException(
"signature does not fall into" + " an integral number of bytes");
}
byte[] signature = bs.getBits();
return new CertificationRequest(
info,
// infoEncoding,
(AlgorithmIdentifier) seq.elementAt(1),
signature);
}
/**
* Constructs a new <code>GetCert</code> from its components. Neither component may be <code>null
* </code>.
*/
public GetCert(ANY issuerName, INTEGER serialNumber) {
if (issuerName == null || serialNumber == null) {
throw new IllegalArgumentException("parameter to GetCert constructor is null");
}
sequence = new SEQUENCE();
this.issuerName = issuerName;
sequence.addElement(issuerName);
this.serialNumber = serialNumber;
sequence.addElement(serialNumber);
}
CertificationRequest(
CertificationRequestInfo info,
// byte[] infoEncoding,
AlgorithmIdentifier algId,
byte[] signature)
throws IOException {
this.info = info;
// this.infoEncoding = infoEncoding;
this.algId = algId;
this.signature = signature;
// bundle everything into a SEQUENCE
sequence = new SEQUENCE();
sequence.addElement(info);
sequence.addElement(algId);
sequence.addElement(new BIT_STRING(signature, 0));
}
/**
* Creates and signs an X.509 CertificationRequest.
*
* @param info A CertificationRequestInfo (TBSCertificationRequest), which specifies the actual
* information of the CertificationRequest.
* @param privKey The private key with which to sign the certificat.
* @param signingAlg The algorithm to use to sign the CertificationRequest. It must match the
* algorithm specified in the CertificationRequestInfo.
* @exception IOException If an error occurred while encoding the CertificationRequest.
* @exception CryptoManager.NotInitializedException Because this operation involves cryptography
* (signing), CryptoManager must be initialized before calling it.
* @exception TokenException If an error occurs on a PKCS #11 token.
* @exception NoSuchAlgorithmException If the OID for the signing algorithm cannot be located.
* @exception CertificateException If the signing algorithm specified as a parameter does not
* match the one in the CertificationRequest info.
* @exception InvalidKeyException If the key does not match the signing algorithm.
* @exception SignatureException If an error occurs while signing the CertificationRequest.
*/
public CertificationRequest(
CertificationRequestInfo info,
java.security.PrivateKey privKey,
SignatureAlgorithm signingAlg)
throws IOException, CryptoManager.NotInitializedException, TokenException,
NoSuchAlgorithmException, CertificateException, InvalidKeyException, SignatureException {
// make sure key is a Ninja private key
if (!(privKey instanceof PrivateKey)) {
throw new InvalidKeyException("Private Key is does not belong to" + " this provider");
}
PrivateKey priv = (PrivateKey) privKey;
// create algId
if (signingAlg.getSigningAlg() == SignatureAlgorithm.RSASignature) {
algId = new AlgorithmIdentifier(signingAlg.toOID(), null);
} else {
algId = new AlgorithmIdentifier(signingAlg.toOID());
}
// encode the cert info
this.info = info;
infoEncoding = ASN1Util.encode(info);
// sign the info encoding
CryptoManager cm = CryptoManager.getInstance();
CryptoToken token = priv.getOwningToken();
Signature sig = token.getSignatureContext(signingAlg);
sig.initSign(priv);
sig.update(infoEncoding);
signature = sig.sign();
// bundle everything into a SEQUENCE
sequence = new SEQUENCE();
sequence.addElement(info);
sequence.addElement(algId);
sequence.addElement(new BIT_STRING(signature, 0));
}
byte[] addCertBag(X509Certificate x509cert, String nickname, SEQUENCE safeContents)
throws Exception {
ASN1Value cert = new OCTET_STRING(x509cert.getEncoded());
byte[] localKeyId = createLocalKeyId(x509cert);
SET certAttrs = null;
if (nickname != null) certAttrs = createBagAttrs(nickname, localKeyId);
SafeBag certBag =
new SafeBag(SafeBag.CERT_BAG, new CertBag(CertBag.X509_CERT_TYPE, cert), certAttrs);
safeContents.addElement(certBag);
return localKeyId;
}
void addKeyBag(
org.mozilla.jss.crypto.PrivateKey pkey,
X509Certificate x509cert,
Password pass,
byte[] localKeyId,
SEQUENCE safeContents)
throws Exception {
PasswordConverter passConverter = new PasswordConverter();
byte salt[] = {0x01, 0x01, 0x01, 0x01};
byte[] priData = getEncodedKey(pkey);
PrivateKeyInfo pki = (PrivateKeyInfo) ASN1Util.decode(PrivateKeyInfo.getTemplate(), priData);
ASN1Value key =
EncryptedPrivateKeyInfo.createPBE(
PBEAlgorithm.PBE_SHA1_DES3_CBC, pass, salt, 1, passConverter, pki);
SET keyAttrs = createBagAttrs(x509cert.getSubjectDN().toString(), localKeyId);
SafeBag keyBag = new SafeBag(SafeBag.PKCS8_SHROUDED_KEY_BAG, key, keyAttrs);
safeContents.addElement(keyBag);
}
SET createBagAttrs(String nickName, byte localKeyId[]) throws Exception {
SET attrs = new SET();
SEQUENCE nickNameAttr = new SEQUENCE();
nickNameAttr.addElement(SafeBag.FRIENDLY_NAME);
SET nickNameSet = new SET();
nickNameSet.addElement(new BMPString(nickName));
nickNameAttr.addElement(nickNameSet);
attrs.addElement(nickNameAttr);
SEQUENCE localKeyAttr = new SEQUENCE();
localKeyAttr.addElement(SafeBag.LOCAL_KEY_ID);
SET localKeySet = new SET();
localKeySet.addElement(new OCTET_STRING(localKeyId));
localKeyAttr.addElement(localKeySet);
attrs.addElement(localKeyAttr);
return attrs;
}
public void encode(Tag implicitTag, OutputStream ostream) throws IOException {
sequence.encode(implicitTag, ostream);
}
public void encode(OutputStream ostream) throws IOException {
sequence.encode(ostream);
}
public ASN1Value decode(Tag implicitTag, InputStream istream)
throws InvalidBERException, IOException {
SEQUENCE seq = (SEQUENCE) seqt.decode(implicitTag, istream);
return new GetCert((ANY) seq.elementAt(0), (INTEGER) seq.elementAt(1));
}
public static void main(String[] args) {
try {
// Read arguments
if (args.length != 3) {
System.out.println("Usage: PFX <dbdir> <infile> <outfile>");
System.exit(-1);
}
// open input file for reading
FileInputStream infile = null;
try {
infile = new FileInputStream(args[1]);
} catch (FileNotFoundException f) {
System.out.println("Cannot open file " + args[1] + " for reading: " + f.getMessage());
return;
}
int certfile = 0;
// initialize CryptoManager. This is necessary because there is
// crypto involved with decoding a PKCS #12 file
CryptoManager.initialize(args[0]);
CryptoManager manager = CryptoManager.getInstance();
// Decode the P12 file
PFX.Template pfxt = new PFX.Template();
PFX pfx = (PFX) pfxt.decode(new BufferedInputStream(infile, 2048));
System.out.println("Decoded PFX");
// print out information about the top-level PFX structure
System.out.println("Version: " + pfx.getVersion());
AuthenticatedSafes authSafes = pfx.getAuthSafes();
SEQUENCE safeContentsSequence = authSafes.getSequence();
System.out.println("AuthSafes has " + safeContentsSequence.size() + " SafeContents");
// Get the password for the old file
System.out.println("Enter password: "******"Enter new password:"******"AuthSafes verifies correctly.");
} else {
System.out.println("AuthSafes failed to verify because: " + sb);
}
// Create a new AuthenticatedSafes. As we read the contents of the
// old authSafes, we will store them into the new one. After we have
// cycled through all the contents, they will all have been copied into
// the new authSafes.
AuthenticatedSafes newAuthSafes = new AuthenticatedSafes();
// Loop over contents of the old authenticated safes
// for(int i=0; i < asSeq.size(); i++) {
for (int i = 0; i < safeContentsSequence.size(); i++) {
// The safeContents may or may not be encrypted. We always send
// the password in. It will get used if it is needed. If the
// decryption of the safeContents fails for some reason (like
// a bad password), then this method will throw an exception
SEQUENCE safeContents = authSafes.getSafeContentsAt(pass, i);
System.out.println("\n\nSafeContents #" + i + " has " + safeContents.size() + " bags");
// Go through all the bags in this SafeContents
for (int j = 0; j < safeContents.size(); j++) {
SafeBag safeBag = (SafeBag) safeContents.elementAt(j);
// The type of the bag is an OID
System.out.println("\nBag " + j + " has type " + safeBag.getBagType());
// look for bag attributes
SET attribs = safeBag.getBagAttributes();
if (attribs == null) {
System.out.println("Bag has no attributes");
} else {
for (int b = 0; b < attribs.size(); b++) {
Attribute a = (Attribute) attribs.elementAt(b);
if (a.getType().equals(SafeBag.FRIENDLY_NAME)) {
// the friendly name attribute is a nickname
BMPString bs =
(BMPString)
((ANY) a.getValues().elementAt(0)).decodeWith(BMPString.getTemplate());
System.out.println("Friendly Name: " + bs);
} else if (a.getType().equals(SafeBag.LOCAL_KEY_ID)) {
// the local key id is used to match a key
// to its cert. The key id is the SHA-1 hash of
// the DER-encoded cert.
OCTET_STRING os =
(OCTET_STRING)
((ANY) a.getValues().elementAt(0)).decodeWith(OCTET_STRING.getTemplate());
System.out.println("LocalKeyID:");
/*
AuthenticatedSafes.
print_byte_array(os.toByteArray());
*/
} else {
System.out.println("Unknown attribute type: " + a.getType().toString());
}
}
}
// now look at the contents of the bag
ASN1Value val = safeBag.getInterpretedBagContent();
if (val instanceof PrivateKeyInfo) {
// A PrivateKeyInfo contains an unencrypted private key
System.out.println("content is PrivateKeyInfo");
} else if (val instanceof EncryptedPrivateKeyInfo) {
// An EncryptedPrivateKeyInfo is, well, an encrypted
// PrivateKeyInfo. Usually, strong crypto is used in
// an EncryptedPrivateKeyInfo.
EncryptedPrivateKeyInfo epki = ((EncryptedPrivateKeyInfo) val);
System.out.println(
"content is EncryptedPrivateKeyInfo, algoid:"
+ epki.getEncryptionAlgorithm().getOID());
// Because we are in a PKCS #12 file, the passwords are
// char-to-byte converted in a special way. We have to
// use the special converter class instead of the default.
PrivateKeyInfo pki = epki.decrypt(pass, new org.mozilla.jss.pkcs12.PasswordConverter());
// import the key into the key3.db
CryptoToken tok = manager.getTokenByName("Internal Key Storage Token");
CryptoStore store = tok.getCryptoStore();
tok.login(new ConsolePasswordCallback());
ByteArrayOutputStream baos = new ByteArrayOutputStream();
pki.encode(baos);
store.importPrivateKey(baos.toByteArray(), PrivateKey.RSA);
// re-encrypt the PrivateKeyInfo with the new password
// and random salt
byte[] salt = new byte[PBEAlgorithm.PBE_SHA1_DES3_CBC.getSaltLength()];
JSSSecureRandom rand = CryptoManager.getInstance().getSecureRNG();
rand.nextBytes(salt);
epki =
EncryptedPrivateKeyInfo.createPBE(
PBEAlgorithm.PBE_SHA1_DES3_CBC, newPass, salt, 1, new PasswordConverter(), pki);
// Overwrite the previous EncryptedPrivateKeyInfo with
// this new one we just created using the new password.
// This is what will get put in the new PKCS #12 file
// we are creating.
safeContents.insertElementAt(
new SafeBag(safeBag.getBagType(), epki, safeBag.getBagAttributes()), i);
safeContents.removeElementAt(i + 1);
} else if (val instanceof CertBag) {
System.out.println("content is CertBag");
CertBag cb = (CertBag) val;
if (cb.getCertType().equals(CertBag.X509_CERT_TYPE)) {
// this is an X.509 certificate
OCTET_STRING os = (OCTET_STRING) cb.getInterpretedCert();
Certificate cert =
(Certificate) ASN1Util.decode(Certificate.getTemplate(), os.toByteArray());
cert.getInfo().print(System.out);
} else {
System.out.println("Unrecognized cert type");
}
} else {
System.out.println("content is ANY");
}
}
// Add the new safe contents to the new authsafes
if (authSafes.safeContentsIsEncrypted(i)) {
newAuthSafes.addEncryptedSafeContents(
authSafes.DEFAULT_KEY_GEN_ALG,
newPass,
null,
authSafes.DEFAULT_ITERATIONS,
safeContents);
} else {
newAuthSafes.addSafeContents(safeContents);
}
}
// Create new PFX from the new authsafes
PFX newPfx = new PFX(newAuthSafes);
// Add a MAC to the new PFX
newPfx.computeMacData(newPass, null, PFX.DEFAULT_ITERATIONS);
// write the new PFX out to a file
FileOutputStream fos = new FileOutputStream(args[2]);
newPfx.encode(fos);
fos.close();
} catch (Exception e) {
e.printStackTrace();
}
}