public void initDatabase() throws Exception {
debug("Initializing database in " + databaseDirectory);
CryptoManager.InitializationValues vals =
new CryptoManager.InitializationValues(databaseDirectory, "", "", "secmod.db");
CryptoManager.initialize(vals);
CryptoManager cm = CryptoManager.getInstance();
CryptoToken token = cm.getInternalKeyStorageToken();
debug("Reading database password from " + databasePasswordFilename);
String line;
try (BufferedReader in = new BufferedReader(new FileReader(databasePasswordFilename))) {
line = in.readLine();
if (line == null) {
line = "";
}
}
Password password = new Password(line.toCharArray());
debug("Logging into security token");
try {
token.login(password);
} finally {
password.clear();
}
}
byte[] getEncodedKey(org.mozilla.jss.crypto.PrivateKey pkey) throws Exception {
CryptoManager cm = CryptoManager.getInstance();
CryptoToken token = cm.getInternalKeyStorageToken();
KeyGenerator kg = token.getKeyGenerator(KeyGenAlgorithm.DES3);
SymmetricKey sk = kg.generate();
KeyWrapper wrapper = token.getKeyWrapper(KeyWrapAlgorithm.DES3_CBC_PAD);
byte iv[] = {0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1};
IVParameterSpec param = new IVParameterSpec(iv);
wrapper.initWrap(sk, param);
byte[] enckey = wrapper.wrap(pkey);
Cipher c = token.getCipherContext(EncryptionAlgorithm.DES3_CBC_PAD);
c.initDecrypt(sk, param);
return c.doFinal(enckey);
}
public byte[] generatePKCS12Data(Password password) throws Exception {
debug("Generating PKCS #12 data");
CryptoManager cm = CryptoManager.getInstance();
CryptoToken token = cm.getInternalKeyStorageToken();
CryptoStore store = token.getCryptoStore();
X509Certificate[] certs = store.getCertificates();
SEQUENCE encSafeContents = new SEQUENCE();
SEQUENCE safeContents = new SEQUENCE();
for (int i = 0; i < certs.length; i++) {
String nickname = certs[i].getNickname();
debug(" * Certificate: " + nickname);
try {
org.mozilla.jss.crypto.PrivateKey prikey = cm.findPrivKeyByCert(certs[i]);
debug(" Private key exists");
byte localKeyId[] = addCertBag(certs[i], nickname, safeContents);
addKeyBag(prikey, certs[i], password, localKeyId, encSafeContents);
} catch (org.mozilla.jss.crypto.ObjectNotFoundException e) {
debug(" Private key does not exist");
addCertBag(certs[i], null, safeContents);
}
}
AuthenticatedSafes authSafes = new AuthenticatedSafes();
authSafes.addSafeContents(safeContents);
authSafes.addSafeContents(encSafeContents);
PFX pfx = new PFX(authSafes);
pfx.computeMacData(password, null, 5);
ByteArrayOutputStream bos = new ByteArrayOutputStream();
pfx.encode(bos);
return bos.toByteArray();
}
public static void main(String args[]) {
try {
if (args.length < 2) {
System.out.println(
"Usage: FipsTest <dbdir> <fipsmode enter: "
+ "enable OR disable OR chkfips > <password file>");
return;
}
String dbdir = args[0];
String fipsmode = args[1];
String password = "";
if (args.length == 3) {
password = args[2];
System.out.println("The password file " + password);
}
CryptoManager.InitializationValues vals = new CryptoManager.InitializationValues(dbdir);
System.out.println("output of Initilization values ");
System.out.println("Manufacturer ID: " + vals.getManufacturerID());
System.out.println("Library: " + vals.getLibraryDescription());
System.out.println("Internal Slot: " + vals.getInternalSlotDescription());
System.out.println("Internal Token: " + vals.getInternalTokenDescription());
System.out.println("Key Storage Slot: " + vals.getFIPSKeyStorageSlotDescription());
System.out.println("Key Storage Token: " + vals.getInternalKeyStorageTokenDescription());
System.out.println("FIPS Slot: " + vals.getFIPSSlotDescription());
System.out.println("FIPS Key Storage: " + vals.getFIPSKeyStorageSlotDescription());
if (fipsmode.equalsIgnoreCase("enable")) {
vals.fipsMode = CryptoManager.InitializationValues.FIPSMode.ENABLED;
} else if (fipsmode.equalsIgnoreCase("disable")) {
vals.fipsMode = CryptoManager.InitializationValues.FIPSMode.DISABLED;
} else {
vals.fipsMode = CryptoManager.InitializationValues.FIPSMode.UNCHANGED;
}
CryptoManager.initialize(vals);
CryptoManager cm = CryptoManager.getInstance();
if (cm.FIPSEnabled() == true) {
System.out.println("\n\t\tFIPS enabled\n");
} else {
System.out.println("\n\t\tFIPS not enabled\n");
}
java.util.Enumeration items;
items = cm.getModules();
System.out.println("\nListing of Modules:");
while (items.hasMoreElements()) {
System.out.println("\t" + ((PK11Module) items.nextElement()).getName());
}
CryptoToken tok;
String tokenName;
items = cm.getAllTokens();
System.out.println("\nAll Tokens:");
while (items.hasMoreElements()) {
tok = (CryptoToken) items.nextElement();
System.out.print("\t" + tok.getName());
if (tok.needsLogin() == true) {
System.out.println("\t - Needs login.\n");
} else {
System.out.println("\t - Does not need login.\n");
}
}
items = cm.getExternalTokens();
System.out.println("\nExternal Tokens:");
while (items.hasMoreElements()) {
System.out.println("\t" + ((CryptoToken) items.nextElement()).getName());
}
/* find the Internal Key Storage token */
if (cm.FIPSEnabled() == true) {
tokenName = vals.getFIPSSlotDescription();
} else {
tokenName = vals.getInternalKeyStorageTokenDescription();
}
/* truncate to 32 bytes and remove trailing white space*/
tokenName = tokenName.substring(0, 32);
tokenName = tokenName.trim();
System.out.println("\nFinding the Internal Key Storage token: " + tokenName);
tok = cm.getTokenByName(tokenName);
if (((PK11Token) tok).isInternalKeyStorageToken()
&& tok.equals(cm.getInternalKeyStorageToken())) {
System.out.println(
"Good, " + tok.getName() + ", knows it is " + "the internal Key Storage Token");
} else {
System.out.println(
"ERROR: " + tok.getName() + ", doesn't know" + " it is the internal key storage token");
}
if (!password.equals("")) {
System.out.println("logging in to the Token: " + tok.getName());
PasswordCallback cb = new FilePasswordCallback(password);
tok.login(cb);
System.out.println("logged in to the Token: " + tok.getName());
}
/* find the Internal Crypto token */
if (cm.FIPSEnabled() == true) {
tokenName = vals.getFIPSSlotDescription();
} else {
tokenName = vals.getInternalTokenDescription();
}
/* truncate to 32 bytes and remove trailing white space*/
tokenName = tokenName.substring(0, 32);
tokenName = tokenName.trim();
System.out.println("\nFinding the Internal Crypto token: " + tokenName);
tok = cm.getTokenByName(tokenName);
if (((PK11Token) tok).isInternalCryptoToken() && tok.equals(cm.getInternalCryptoToken())) {
System.out.println("Good, " + tok.getName() + ", knows it is the internal Crypto token");
} else {
System.out.println(
"ERROR: " + tok.getName() + ", doesn't know that it is the internal Crypto token");
}
System.exit(0);
} catch (Exception e) {
e.printStackTrace();
System.exit(1);
}
}
public static void main(String argv[]) {
try {
if (argv.length > 2 || argv.length < 1) {
System.out.println("Usage: CertificationRequest <dbdir> [<certfile>]");
System.exit(0);
}
CryptoManager.initialize(argv[0]);
CryptoManager cm = CryptoManager.getInstance();
// read in a cert
BufferedInputStream bis = new BufferedInputStream(new FileInputStream(argv[1]));
CertificationRequest cert =
(CertificationRequest) CertificationRequest.getTemplate().decode(bis);
CertificationRequestInfo info = cert.getInfo();
info.print(System.out);
// X509CertificationRequest hardcore = cm.findCertByNickname("Hardcore");
// PublicKey key = hardcore.getPublicKey();
cert.verify();
System.out.println("verified");
FileOutputStream fos = new FileOutputStream("certinfo.der");
info.encode(fos);
fos.close();
// make a new public key
CryptoToken token = cm.getInternalKeyStorageToken();
KeyPairGenerator kpg = token.getKeyPairGenerator(KeyPairAlgorithm.RSA);
kpg.initialize(512);
System.out.println("Generating a new key pair...");
KeyPair kp = kpg.genKeyPair();
System.out.println("Generated key pair");
// set the CertificationRequest's public key
info.setSubjectPublicKeyInfo(kp.getPublic());
// make new Name
Name name = new Name();
name.addCommonName("asldkj");
name.addCountryName("US");
name.addOrganizationName("Some Corp");
name.addOrganizationalUnitName("Some Org Unit");
name.addLocalityName("Silicon Valley");
name.addStateOrProvinceName("California");
info.setSubject(name);
System.out.println("About to create a new cert request...");
// create a new cert requestfrom this certReqinfo
CertificationRequest genCert =
new CertificationRequest(
info, kp.getPrivate(), SignatureAlgorithm.RSASignatureWithMD5Digest);
System.out.println("Created new cert request");
genCert.verify();
System.out.println("Cert verifies!");
fos = new FileOutputStream("gencert.der");
genCert.encode(fos);
fos.close();
} catch (Exception e) {
e.printStackTrace();
}
}