Java ContentEncryptionAlgorithmIdentifiers.AES_128_CBC_HMAC_SHA_256属性代码示例

public void testKdf2() throws Exception
{
    // test values produced from implementation found at http://stackoverflow.com/questions/10879658
    String derivedKey = "vphyobtvExGXF7TaOvAkx6CCjHQNYamP2ET8xkhTu-0";
    byte[] z = Base64Url.decode("LfkHot2nGTVlmfxbgxQfMg");  // ByteUtil.randomBytes(16);
    System.out.println(Base64Url.encode(z));
    KdfUtil kdfUtil = new KdfUtil(null);
    int keyDatalen = 256;
    String alg = ContentEncryptionAlgorithmIdentifiers.AES_128_CBC_HMAC_SHA_256;
    byte[] algId = kdfUtil.prependDatalen(StringUtil.getBytesUtf8(alg));
    byte[] partyU = new byte[] {0, 0, 0, 0};
    byte[] partyV = new byte[] {0, 0, 0, 0};
    byte[] pub = ByteUtil.getBytes(keyDatalen);
    byte[] priv = ByteUtil.EMPTY_BYTES;

    ConcatKeyDerivationFunction myConcatKdf = new ConcatKeyDerivationFunction("SHA-256", null);

    byte[] kdfed = myConcatKdf.kdf(z, keyDatalen, algId, partyU, partyV, pub, priv);
    assertEquals(derivedKey, Base64Url.encode(kdfed));
}
 

/**
     * JWT 生成 idToken+加密, 进行消费(consume)
     * 使用EC
     *
     * @throws Exception
     */
    @Test
    public void jwtECIdTokenConsumer() throws Exception {

//        String keyId = GuidGenerator.generate();
        EllipticCurveJsonWebKey sendJwk = EcJwkGenerator.generateJwk(EllipticCurves.P256);
        sendJwk.setKeyId(GuidGenerator.generate());

        final String publicKeyString = sendJwk.toJson(JsonWebKey.OutputControlLevel.PUBLIC_ONLY);
        final String privateKeyString = sendJwk.toJson(JsonWebKey.OutputControlLevel.INCLUDE_PRIVATE);
        System.out.println("publicKeyString: " + publicKeyString);
        System.out.println("privateKeyString: " + privateKeyString);

        //生成 idToken
        final JwtClaims jwtClaims = getJwtClaims();
        JsonWebSignature jws = new JsonWebSignature();
        jws.setPayload(jwtClaims.toJson());
        //私钥
        jws.setKey(sendJwk.getPrivateKey());
        jws.setKeyIdHeaderValue(sendJwk.getKeyId());
        jws.setAlgorithmHeaderValue(AlgorithmIdentifiers.ECDSA_USING_P256_CURVE_AND_SHA256);

        String innerIdToken = jws.getCompactSerialization();
        assertNotNull(innerIdToken);
        System.out.println("innerIdToken: " + innerIdToken);


        //对 idToken 进行加密
        JsonWebEncryption jwe = new JsonWebEncryption();
        jwe.setAlgorithmHeaderValue(KeyManagementAlgorithmIdentifiers.ECDH_ES_A128KW);
        String encAlg = ContentEncryptionAlgorithmIdentifiers.AES_128_CBC_HMAC_SHA_256;
        jwe.setEncryptionMethodHeaderParameter(encAlg);


        EllipticCurveJsonWebKey receiverJwk = EcJwkGenerator.generateJwk(EllipticCurves.P256);
        receiverJwk.setKeyId(GuidGenerator.generate());

        jwe.setKey(receiverJwk.getPublicKey());
        jwe.setKeyIdHeaderValue(receiverJwk.getKeyId());

        jwe.setContentTypeHeaderValue("JWT");
        jwe.setPayload(innerIdToken);

        String idToken = jwe.getCompactSerialization();
        assertNotNull(idToken);
        System.out.println("idToken: " + idToken);


        //解析idToken, 验签
        JwtConsumer jwtConsumer = new JwtConsumerBuilder()
                .setRequireExpirationTime() // the JWT must have an expiration time
                .setRequireSubject() // the JWT must have a subject claim
                .setExpectedIssuer("Issuer") // whom the JWT needs to have been issued by
                .setExpectedAudience("Audience") // to whom the JWT is intended for
                        //解密的私钥
                .setDecryptionKey(receiverJwk.getPrivateKey()) // decrypt with the receiver's private key
                        //验签的公钥
                .setVerificationKey(sendJwk.getPublicKey()) // verify the signature with the sender's public key
                .build(); // create the JwtConsumer instance

        final JwtClaims claims = jwtConsumer.processToClaims(idToken);
        assertNotNull(claims);
        System.out.println(claims);


    }
 

/**
     * JWT 生成 idToken+加密, 进行消费(consume)
     * 使用EC
     *
     * @throws Exception
     */
    @Test
    public void jwtECIdTokenConsumer() throws Exception {

//        String keyId = GuidGenerator.generate();
        EllipticCurveJsonWebKey sendJwk = EcJwkGenerator.generateJwk(EllipticCurves.P256);
        sendJwk.setKeyId(RandomUtils.randomText());

        final String publicKeyString = sendJwk.toJson(JsonWebKey.OutputControlLevel.PUBLIC_ONLY);
        final String privateKeyString = sendJwk.toJson(JsonWebKey.OutputControlLevel.INCLUDE_PRIVATE);
        System.out.println("publicKeyString: " + publicKeyString);
        System.out.println("privateKeyString: " + privateKeyString);

        //生成 idToken
        final JwtClaims jwtClaims = getJwtClaims();
        JsonWebSignature jws = new JsonWebSignature();
        jws.setPayload(jwtClaims.toJson());
        //私钥
        jws.setKey(sendJwk.getPrivateKey());
        jws.setKeyIdHeaderValue(sendJwk.getKeyId());
        jws.setAlgorithmHeaderValue(AlgorithmIdentifiers.ECDSA_USING_P256_CURVE_AND_SHA256);

        String innerIdToken = jws.getCompactSerialization();
        assertNotNull(innerIdToken);
        System.out.println("innerIdToken: " + innerIdToken);


        //对 idToken 进行加密
        JsonWebEncryption jwe = new JsonWebEncryption();
        jwe.setAlgorithmHeaderValue(KeyManagementAlgorithmIdentifiers.ECDH_ES_A128KW);
        String encAlg = ContentEncryptionAlgorithmIdentifiers.AES_128_CBC_HMAC_SHA_256;
        jwe.setEncryptionMethodHeaderParameter(encAlg);


        EllipticCurveJsonWebKey receiverJwk = EcJwkGenerator.generateJwk(EllipticCurves.P256);
        receiverJwk.setKeyId(RandomUtils.randomText());

        jwe.setKey(receiverJwk.getPublicKey());
        jwe.setKeyIdHeaderValue(receiverJwk.getKeyId());

        jwe.setContentTypeHeaderValue("JWT");
        jwe.setPayload(innerIdToken);

        String idToken = jwe.getCompactSerialization();
        assertNotNull(idToken);
        System.out.println("idToken: " + idToken);


        //解析idToken, 验签
        JwtConsumer jwtConsumer = new JwtConsumerBuilder()
                .setRequireExpirationTime() // the JWT must have an expiration time
                .setRequireSubject() // the JWT must have a subject claim
                .setExpectedIssuer("Issuer") // whom the JWT needs to have been issued by
                .setExpectedAudience("Audience") // to whom the JWT is intended for
                        //解密的私钥
                .setDecryptionKey(receiverJwk.getPrivateKey()) // decrypt with the receiver's private key
                        //验签的公钥
                .setVerificationKey(sendJwk.getPublicKey()) // verify the signature with the sender's public key
                .build(); // create the JwtConsumer instance

        final JwtClaims claims = jwtConsumer.processToClaims(idToken);
        assertNotNull(claims);
        System.out.println(claims);


    }
 

/**
 * Instantiates a new cipher.
 *
 * <p>Note that in order to customize the encryption algorithms,
 * you will need to download and install the JCE Unlimited Strength Jurisdiction
 * Policy File into your Java installation.</p>
 * @param secretKeyEncryption the secret key encryption; must be represented as a octet sequence JSON Web Key (JWK)
 * @param secretKeySigning the secret key signing; must be represented as a octet sequence JSON Web Key (JWK)
 */
public DefaultCipherExecutor(final String secretKeyEncryption,
                             final String secretKeySigning) {
    this(secretKeyEncryption, secretKeySigning,
            ContentEncryptionAlgorithmIdentifiers.AES_128_CBC_HMAC_SHA_256,
            AlgorithmIdentifiers.HMAC_SHA512);
}
 

/**
 * Instantiates a new cipher.
 * <p>Note that in order to customize the encryption algorithms,
 * you will need to download and install the JCE Unlimited Strength Jurisdiction
 * Policy File into your Java installation.</p>
 *
 * @param secretKeyEncryption the secret key encryption; must be represented as a octet sequence JSON Web Key (JWK)
 * @param secretKeySigning    the secret key signing; must be represented as a octet sequence JSON Web Key (JWK)
 */
public BaseStringCipherExecutor(final String secretKeyEncryption,
                                final String secretKeySigning) {
    this(secretKeyEncryption, secretKeySigning,
            ContentEncryptionAlgorithmIdentifiers.AES_128_CBC_HMAC_SHA_256);
}
 

/**
 * Instantiates a new cipher.
 *
 * <p>Note that in order to customize the encryption algorithms,
 * you will need to download and install the JCE Unlimited Strength Jurisdiction
 * Policy File into your Java installation.</p>
 * @param secretKeyEncryption the secret key encryption; must be represented as a octet sequence JSON Web Key (JWK)
 * @param secretKeySigning the secret key signing; must be represented as a octet sequence JSON Web Key (JWK)
 */
public DefaultCipherExecutor(final String secretKeyEncryption, final String secretKeySigning) {
    this(secretKeyEncryption, secretKeySigning, ContentEncryptionAlgorithmIdentifiers.AES_128_CBC_HMAC_SHA_256, AlgorithmIdentifiers.HMAC_SHA512);
}