org.argeo.cms/src/org/argeo/cms/internal/kernel/PkiUtils.java

   1 package org.argeo.cms.internal.kernel;
   2
   3 import java.io.File;
   4 import java.io.FileInputStream;
   5 import java.io.FileOutputStream;
   6 import java.math.BigInteger;
   7 import java.security.KeyPair;
   8 import java.security.KeyPairGenerator;
   9 import java.security.KeyStore;
  10 import java.security.SecureRandom;
  11 import java.security.Security;
  12 import java.security.cert.Certificate;
  13 import java.security.cert.X509Certificate;
  14 import java.util.Date;
  15
  16 import javax.security.auth.x500.X500Principal;
  17
  18 import org.argeo.cms.CmsException;
  19 import org.bouncycastle.cert.X509v3CertificateBuilder;
  20 import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
  21 import org.bouncycastle.cert.jcajce.JcaX509v3CertificateBuilder;
  22 import org.bouncycastle.jce.provider.BouncyCastleProvider;
  23 import org.bouncycastle.operator.ContentSigner;
  24 import org.bouncycastle.operator.jcajce.JcaContentSignerBuilder;
  25
  26 /**
  27  * Utilities around private keys and certificate, mostly wrapping BouncyCastle
  28  * implementations.
  29  */
  30 class PkiUtils {
  31         private final static String SECURITY_PROVIDER;
  32         static {
  33                 Security.addProvider(new BouncyCastleProvider());
  34                 SECURITY_PROVIDER = "BC";
  35         }
  36
  37         public static X509Certificate generateSelfSignedCertificate(KeyStore keyStore, X500Principal x500Principal,
  38                         int keySize, char[] keyPassword) {
  39                 try {
  40                         KeyPairGenerator kpGen = KeyPairGenerator.getInstance("RSA", SECURITY_PROVIDER);
  41                         kpGen.initialize(keySize, new SecureRandom());
  42                         KeyPair pair = kpGen.generateKeyPair();
  43                         Date notBefore = new Date(System.currentTimeMillis() - 10000);
  44                         Date notAfter = new Date(System.currentTimeMillis() + 24L * 3600 * 1000);
  45                         BigInteger serial = BigInteger.valueOf(System.currentTimeMillis());
  46                         X509v3CertificateBuilder certGen = new JcaX509v3CertificateBuilder(x500Principal, serial, notBefore,
  47                                         notAfter, x500Principal, pair.getPublic());
  48                         ContentSigner sigGen = new JcaContentSignerBuilder("SHA256WithRSAEncryption").setProvider(SECURITY_PROVIDER)
  49                                         .build(pair.getPrivate());
  50                         X509Certificate cert = new JcaX509CertificateConverter().setProvider(SECURITY_PROVIDER)
  51                                         .getCertificate(certGen.build(sigGen));
  52                         cert.checkValidity(new Date());
  53                         cert.verify(cert.getPublicKey());
  54
  55                         keyStore.setKeyEntry(x500Principal.getName(), pair.getPrivate(), keyPassword, new Certificate[] { cert });
  56                         return cert;
  57                 } catch (Exception e) {
  58                         throw new CmsException("Cannot generate self-signed certificate", e);
  59                 }
  60         }
  61
  62         public static KeyStore getKeyStore(File keyStoreFile, char[] keyStorePassword) {
  63                 try {
  64                         KeyStore store = KeyStore.getInstance("PKCS12", SECURITY_PROVIDER);
  65                         if (keyStoreFile.exists()) {
  66                                 try (FileInputStream fis = new FileInputStream(keyStoreFile)) {
  67                                         store.load(fis, keyStorePassword);
  68                                 }
  69                         } else {
  70                                 store.load(null);
  71                         }
  72                         return store;
  73                 } catch (Exception e) {
  74                         throw new CmsException("Cannot load keystore " + keyStoreFile, e);
  75                 }
  76         }
  77
  78         public static void saveKeyStore(File keyStoreFile, char[] keyStorePassword, KeyStore keyStore) {
  79                 try {
  80                         try (FileOutputStream fis = new FileOutputStream(keyStoreFile)) {
  81                                 keyStore.store(fis, keyStorePassword);
  82                         }
  83                 } catch (Exception e) {
  84                         throw new CmsException("Cannot save keystore " + keyStoreFile, e);
  85                 }
  86         }
  87
  88         public static void main(String[] args) {
  89                 final String ALGORITHM = "RSA";
  90                 final String provider = "BC";
  91                 SecureRandom secureRandom = new SecureRandom();
  92                 long begin = System.currentTimeMillis();
  93                 for (int i = 512; i < 1024; i = i + 2) {
  94                         try {
  95                                 KeyPairGenerator keyGen = KeyPairGenerator.getInstance(ALGORITHM,provider);
  96                                 keyGen.initialize(i, secureRandom);
  97                                 keyGen.generateKeyPair();
  98                         } catch (Exception e) {
  99                                 System.err.println(i + " : " + e.getMessage());
 100                         }
 101                 }
 102                 System.out.println( (System.currentTimeMillis() - begin) + " ms");
 103
 104 //              // String text = "a";
 105 //              String text = "testtesttesttesttesttesttesttesttesttesttesttesttesttesttest";
 106 //              try {
 107 //                      System.out.println(text);
 108 //                      PrivateKey privateKey;
 109 //                      PublicKey publicKey;
 110 //                      char[] password = "changeit".toCharArray();
 111 //                      String alias = "CN=test";
 112 //                      KeyStore keyStore = KeyStore.getInstance("pkcs12");
 113 //                      File p12file = new File("test.p12");
 114 //                      p12file.delete();
 115 //                      if (!p12file.exists()) {
 116 //                              keyStore.load(null);
 117 //                              generateSelfSignedCertificate(keyStore, new X500Principal(alias), 513, password);
 118 //                              try (OutputStream out = new FileOutputStream(p12file)) {
 119 //                                      keyStore.store(out, password);
 120 //                              }
 121 //                      }
 122 //                      try (InputStream in = new FileInputStream(p12file)) {
 123 //                              keyStore.load(in, password);
 124 //                              privateKey = (PrivateKey) keyStore.getKey(alias, password);
 125 //                              publicKey = keyStore.getCertificateChain(alias)[0].getPublicKey();
 126 //                      }
 127 //                      // KeyPair key;
 128 //                      // final KeyPairGenerator keyGen =
 129 //                      // KeyPairGenerator.getInstance(ALGORITHM);
 130 //                      // keyGen.initialize(4096, new SecureRandom());
 131 //                      // long begin = System.currentTimeMillis();
 132 //                      // key = keyGen.generateKeyPair();
 133 //                      // System.out.println((System.currentTimeMillis() - begin) + " ms");
 134 //                      // keyStore.load(null);
 135 //                      // keyStore.setKeyEntry("test", key.getPrivate(), password, null);
 136 //                      // try(OutputStream out=new FileOutputStream(p12file)) {
 137 //                      // keyStore.store(out, password);
 138 //                      // }
 139 //                      // privateKey = key.getPrivate();
 140 //                      // publicKey = key.getPublic();
 141 //
 142 //                      Cipher encrypt = Cipher.getInstance(ALGORITHM);
 143 //                      encrypt.init(Cipher.ENCRYPT_MODE, publicKey);
 144 //                      byte[] encrypted = encrypt.doFinal(text.getBytes());
 145 //                      String encryptedBase64 = Base64.getEncoder().encodeToString(encrypted);
 146 //                      System.out.println(encryptedBase64);
 147 //                      byte[] encryptedFromBase64 = Base64.getDecoder().decode(encryptedBase64);
 148 //
 149 //                      Cipher decrypt = Cipher.getInstance(ALGORITHM);
 150 //                      decrypt.init(Cipher.DECRYPT_MODE, privateKey);
 151 //                      byte[] decrypted = decrypt.doFinal(encryptedFromBase64);
 152 //                      System.out.println(new String(decrypted));
 153 //              } catch (Exception e) {
 154 //                      e.printStackTrace();
 155 //              }
 156
 157         }
 158
 159 }