Java KeyUsage类代码示例

import sun.security.krb5.internal.crypto.KeyUsage; //导入依赖的package包/类
/**
 * Constructor used by client to generate premaster secret.
 *
 * Client randomly creates a pre-master secret and encrypts it
 * using the Kerberos session key; only the server can decrypt
 * it, using the session key available in the service ticket.
 *
 * @param protocolVersion used to set preMaster[0,1]
 * @param generator random number generator for generating premaster secret
 * @param sessionKey Kerberos session key for encrypting premaster secret
 */
KerberosPreMasterSecret(ProtocolVersion protocolVersion,
    SecureRandom generator, EncryptionKey sessionKey) throws IOException {

    if (sessionKey.getEType() ==
        EncryptedData.ETYPE_DES3_CBC_HMAC_SHA1_KD) {
        throw new IOException(
           "session keys with des3-cbc-hmac-sha1-kd encryption type " +
           "are not supported for TLS Kerberos cipher suites");
    }

    this.protocolVersion = protocolVersion;
    preMaster = generatePreMaster(generator, protocolVersion);

    // Encrypt premaster secret
    try {
        EncryptedData eData = new EncryptedData(sessionKey, preMaster,
            KeyUsage.KU_UNKNOWN);
        encrypted = eData.getBytes();  // not ASN.1 encoded.

    } catch (KrbException e) {
        throw (SSLKeyException)new SSLKeyException
            ("Kerberos premaster secret error").initCause(e);
    }
}
 

import sun.security.krb5.internal.crypto.KeyUsage; //导入依赖的package包/类
private void createMessage(
                           EncryptionKey key,
                           KerberosTime ctime,
                           int cusec,
                           EncryptionKey subKey,
                           SeqNumber seqNumber)
    throws Asn1Exception, IOException,
           KdcErrException, KrbCryptoException {

    Integer seqno = null;

    if (seqNumber != null)
        seqno = new Integer(seqNumber.current());

    encPart = new EncAPRepPart(ctime,
                               cusec,
                               subKey,
                               seqno);

    byte[] encPartEncoding = encPart.asn1Encode();

    EncryptedData encEncPart = new EncryptedData(key, encPartEncoding,
        KeyUsage.KU_ENC_AP_REP_PART);

    apRepMessg = new APRep(encEncPart);
}
 

import sun.security.krb5.internal.crypto.KeyUsage; //导入依赖的package包/类
/**
 * Performs encryption of Sequence Number using derived key.
 */
public byte[] encryptSeq(byte[] baseKey, int usage,
    byte[] checksum, byte[] plaintext, int start, int len)
    throws GeneralSecurityException, KrbCryptoException {

    if (!KeyUsage.isValid(usage)) {
        throw new GeneralSecurityException("Invalid key usage number: "
                                            + usage);
    }
    // derive encryption for sequence number
    byte[] salt = new byte[4];
    byte[] kSeq = getHmac(baseKey, salt);

    // derive new encryption key salted with sequence number
    kSeq = getHmac(kSeq, checksum);

    Cipher cipher = Cipher.getInstance("ARCFOUR");
    SecretKeySpec secretKey = new SecretKeySpec(kSeq, "ARCFOUR");
    cipher.init(Cipher.ENCRYPT_MODE, secretKey);
    byte[] output = cipher.doFinal(plaintext, start, len);

    return output;
}
 

import sun.security.krb5.internal.crypto.KeyUsage; //导入依赖的package包/类
/**
 * Performs decryption of Sequence Number using derived key.
 */
public byte[] decryptSeq(byte[] baseKey, int usage,
    byte[] checksum, byte[] ciphertext, int start, int len)
    throws GeneralSecurityException, KrbCryptoException {

    if (!KeyUsage.isValid(usage)) {
        throw new GeneralSecurityException("Invalid key usage number: "
                                            + usage);
    }

    // derive decryption for sequence number
    byte[] salt = new byte[4];
    byte[] kSeq = getHmac(baseKey, salt);

    // derive new encryption key salted with sequence number
    kSeq = getHmac(kSeq, checksum);

    Cipher cipher = Cipher.getInstance("ARCFOUR");
    SecretKeySpec secretKey = new SecretKeySpec(kSeq, "ARCFOUR");
    cipher.init(Cipher.DECRYPT_MODE, secretKey);
    byte[] output = cipher.doFinal(ciphertext, start, len);

    return output;
}
 

import sun.security.krb5.internal.crypto.KeyUsage; //导入依赖的package包/类
private void createMessage(
                           EncryptionKey key,
                           KerberosTime ctime,
                           int cusec,
                           EncryptionKey subKey,
                           SeqNumber seqNumber)
    throws Asn1Exception, IOException,
           KdcErrException, KrbCryptoException {

    Integer seqno = null;

    if (seqNumber != null)
        seqno = seqNumber.current();

    encPart = new EncAPRepPart(ctime,
                               cusec,
                               subKey,
                               seqno);

    byte[] encPartEncoding = encPart.asn1Encode();

    EncryptedData encEncPart = new EncryptedData(key, encPartEncoding,
        KeyUsage.KU_ENC_AP_REP_PART);

    apRepMessg = new APRep(encEncPart);
}
 

import sun.security.krb5.internal.crypto.KeyUsage; //导入依赖的package包/类
/**
 * Constructor used by client to generate premaster secret.
 *
 * Client randomly creates a pre-master secret and encrypts it
 * using the Kerberos session key; only the server can decrypt
 * it, using the session key available in the service ticket.
 *
 * @param protocolVersion used to set preMaster[0,1]
 * @param generator random number generator for generating premaster secret
 * @param sessionKey Kerberos session key for encrypting premaster secret
 */
KerberosPreMasterSecret(ProtocolVersion protocolVersion,
        SecureRandom generator, EncryptionKey sessionKey) throws IOException {

    if (sessionKey.getEType() ==
            EncryptedData.ETYPE_DES3_CBC_HMAC_SHA1_KD) {
        throw new IOException(
                "session keys with des3-cbc-hmac-sha1-kd encryption type " +
                        "are not supported for TLS Kerberos cipher suites");
    }

    this.protocolVersion = protocolVersion;
    preMaster = generatePreMaster(generator, protocolVersion);

    // Encrypt premaster secret
    try {
        EncryptedData eData = new EncryptedData(sessionKey, preMaster,
                KeyUsage.KU_UNKNOWN);
        encrypted = eData.getBytes();  // not ASN.1 encoded.

    } catch (KrbException e) {
        throw (SSLKeyException)new SSLKeyException
                ("Kerberos premaster secret error").initCause(e);
    }
}
 

import sun.security.krb5.internal.crypto.KeyUsage; //导入依赖的package包/类
public static void main(String[] args) throws Exception {

        new OneKDC(null).writeJAASConf();

        Context c, s;
        c = Context.fromJAAS("client");
        s = Context.fromJAAS("server");

        c.startAsClient(OneKDC.SERVER, GSSUtil.GSS_KRB5_MECH_OID);
        s.startAsServer(GSSUtil.GSS_KRB5_MECH_OID);

        Context.handshake(c, s);

        ExtendedGSSContext ctxt = (ExtendedGSSContext)c.x();
        EncryptionKey key = (EncryptionKey)
                ctxt.inquireSecContext(InquireType.KRB5_GET_SESSION_KEY_EX);
        KerberosCredMessage cred = (KerberosCredMessage)
                ctxt.inquireSecContext(InquireType.KRB5_GET_KRB_CRED);
        c.status();

        // Confirm the KRB_CRED message is encrypted with the session key.
        new KRBCred(cred.getEncoded()).encPart.decrypt(
                new sun.security.krb5.EncryptionKey(key.getKeyType(), key.getEncoded()),
                KeyUsage.KU_ENC_KRB_CRED_PART);
    }
 

import sun.security.krb5.internal.crypto.KeyUsage; //导入依赖的package包/类
public byte[] asn1Encode() throws Asn1Exception, IOException {
    DerOutputStream bytes = new DerOutputStream();
    bytes.write(DerValue.createTag(DerValue.TAG_CONTEXT, true, (byte)0x00), name.asn1Encode());
    bytes.write(DerValue.createTag(DerValue.TAG_CONTEXT, true, (byte)0x01), name.getRealm().asn1Encode());

    try {
        Checksum cks = new Checksum(
                Checksum.CKSUMTYPE_HMAC_MD5_ARCFOUR,
                getS4UByteArray(),
                key,
                KeyUsage.KU_PA_FOR_USER_ENC_CKSUM);
        bytes.write(DerValue.createTag(DerValue.TAG_CONTEXT, true, (byte)0x02), cks.asn1Encode());
    } catch (KrbException ke) {
        throw new IOException(ke);
    }

    DerOutputStream temp = new DerOutputStream();
    temp.putDerValue(new KerberosString(AUTH_PACKAGE).toDerValue());
    bytes.write(DerValue.createTag(DerValue.TAG_CONTEXT, true, (byte)0x03), temp);

    temp = new DerOutputStream();
    temp.write(DerValue.tag_Sequence, bytes);
    return temp.toByteArray();
}