Java ECKey類代碼示例

import java.security.interfaces.ECKey; //導入依賴的package包/類
/**
 * Gets the APK Signature Scheme v2 signature algorithms to be used for signing an APK using the
 * provided key.
 *
 * @param minSdkVersion minimum API Level of the platform on which the APK may be installed (see
 *        AndroidManifest.xml minSdkVersion attribute).
 *
 * @throws InvalidKeyException if the provided key is not suitable for signing APKs using
 *         APK Signature Scheme v2
 */
public static List<SignatureAlgorithm> getSuggestedSignatureAlgorithms(
        PublicKey signingKey, int minSdkVersion) throws InvalidKeyException {
    String keyAlgorithm = signingKey.getAlgorithm();
    if ("RSA".equalsIgnoreCase(keyAlgorithm)) {
        // Use RSASSA-PKCS1-v1_5 signature scheme instead of RSASSA-PSS to guarantee
        // deterministic signatures which make life easier for OTA updates (fewer files
        // changed when deterministic signature schemes are used).

        // Pick a digest which is no weaker than the key.
        int modulusLengthBits = ((RSAKey) signingKey).getModulus().bitLength();
        if (modulusLengthBits <= 3072) {
            // 3072-bit RSA is roughly 128-bit strong, meaning SHA-256 is a good fit.
            return Collections.singletonList(SignatureAlgorithm.RSA_PKCS1_V1_5_WITH_SHA256);
        } else {
            // Keys longer than 3072 bit need to be paired with a stronger digest to avoid the
            // digest being the weak link. SHA-512 is the next strongest supported digest.
            return Collections.singletonList(SignatureAlgorithm.RSA_PKCS1_V1_5_WITH_SHA512);
        }
    } else if ("DSA".equalsIgnoreCase(keyAlgorithm)) {
        // DSA is supported only with SHA-256.
        return Collections.singletonList(SignatureAlgorithm.DSA_WITH_SHA256);
    } else if ("EC".equalsIgnoreCase(keyAlgorithm)) {
        // Pick a digest which is no weaker than the key.
        int keySizeBits = ((ECKey) signingKey).getParams().getOrder().bitLength();
        if (keySizeBits <= 256) {
            // 256-bit Elliptic Curve is roughly 128-bit strong, meaning SHA-256 is a good fit.
            return Collections.singletonList(SignatureAlgorithm.ECDSA_WITH_SHA256);
        } else {
            // Keys longer than 256 bit need to be paired with a stronger digest to avoid the
            // digest being the weak link. SHA-512 is the next strongest supported digest.
            return Collections.singletonList(SignatureAlgorithm.ECDSA_WITH_SHA512);
        }
    } else {
        throw new InvalidKeyException("Unsupported key algorithm: " + keyAlgorithm);
    }
}
 

import java.security.interfaces.ECKey; //導入依賴的package包/類
@Test
public void shouldFailECDSA256VerificationOnInvalidJOSESignatureLength() throws Exception {
    exception.expect(SignatureVerificationException.class);
    exception.expectMessage("The Token's Signature resulted invalid when verified using the Algorithm: SHA256withECDSA");
    exception.expectCause(isA(SignatureException.class));
    exception.expectCause(hasMessage(is("Invalid JOSE signature format.")));

    byte[] bytes = new byte[63];
    new SecureRandom().nextBytes(bytes);
    String signature = Base64.encodeBase64URLSafeString(bytes);
    String token = "eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJhdXRoMCJ9." + signature;
    Algorithm algorithm = Algorithm.ECDSA256((ECKey) readPublicKeyFromFile(INVALID_PUBLIC_KEY_FILE_256, "EC"));
    JWT jwt = JWT.require(algorithm).withIssuer("auth0").build();
    DecodedJWT decoded = jwt.decode(token);
    algorithm.verify(decoded, EncodeType.Base64);
}
 

import java.security.interfaces.ECKey; //導入依賴的package包/類
@Test
public void shouldFailECDSA256VerificationOnInvalidJOSESignatureLength() throws Exception {
    exception.expect(SignatureVerificationException.class);
    exception.expectMessage("The Token's Signature resulted invalid when verified using the Algorithm: SHA256withECDSA");
    exception.expectCause(isA(SignatureException.class));
    exception.expectCause(hasMessage(is("Invalid JOSE signature format.")));

    byte[] bytes = new byte[63];
    new SecureRandom().nextBytes(bytes);
    String signature = Base64.encodeBase64URLSafeString(bytes);
    String token  = "eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJhdXRoMCJ9." + signature;
    Algorithm algorithm = Algorithm.ECDSA256((ECKey) readPublicKeyFromFile(INVALID_PUBLIC_KEY_FILE_256, "EC"));
    JWT jwt = JWT.require(algorithm).withIssuer("auth0").build();
    DecodedJWT decoded = jwt.decode(token);
    algorithm.verify(decoded, EncodeType.Base64);
}
 

import java.security.interfaces.ECKey; //導入依賴的package包/類
@Test
public void shouldFailECDSA384VerificationOnInvalidDERSignature() throws Exception {
    exception.expect(AlgorithmMismatchException.class);
    exception.expectMessage("The provided Algorithm doesn't match the one defined in the JWT's Header.");

    byte[] bytes = new byte[96];
    new SecureRandom().nextBytes(bytes);
    bytes[0] = 0x30;
    String signature = Base64.encodeBase64URLSafeString(bytes);
    String token  = "eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJhdXRoMCJ9." + signature;
    Algorithm algorithm = Algorithm.ECDSA384((ECKey) readPublicKeyFromFile(INVALID_PUBLIC_KEY_FILE_384, "EC"));
    JWT jwt = JWT.require(algorithm).withIssuer("auth0").build();
    DecodedJWT decoded = jwt.decode(token);
    algorithm.verify(decoded, EncodeType.Base64);
}
 

import java.security.interfaces.ECKey; //導入依賴的package包/類
/**
 * Wraps the provided private key for use in the TLS/SSL stack only. Sign/decrypt operations
 * using the key will be delegated to the {@code Signature}/{@code Cipher} implementation of the
 * provider which accepts the key.
 */
static OpenSSLKey wrapJCAPrivateKeyForTLSStackOnly(PrivateKey privateKey,
        ECParameterSpec params) throws InvalidKeyException {
    if (params == null) {
        if (privateKey instanceof ECKey) {
            params = ((ECKey) privateKey).getParams();
        }
    }
    if (params == null) {
        throw new InvalidKeyException("EC parameters not available: " + privateKey);
    }

    OpenSSLECGroupContext group;
    try {
        group = OpenSSLECGroupContext.getInstance(params);
    } catch (InvalidAlgorithmParameterException e) {
        throw new InvalidKeyException("Invalid EC parameters: " + params);
    }

    return new OpenSSLKey(
            NativeCrypto.getECPrivateKeyWrapper(privateKey, group.getNativeRef()), true);
}
 

import java.security.interfaces.ECKey; //導入依賴的package包/類
/**
 * Get the key size of a public key.
 * 
 * @param pubKey The public key
 * @return The key size, {@link #UNKNOWN_KEY_SIZE} if not known
 */
public static int getKeyLength(PublicKey pubKey)
{
	if (pubKey instanceof RSAKey)
	{
		return ((RSAKey) pubKey).getModulus().bitLength();
	}
	else if (pubKey instanceof DSAKey)
	{
		return ((DSAKey) pubKey).getParams().getP().bitLength();
	}
	else if (pubKey instanceof DHKey)
	{
		return ((DHKey) pubKey).getParams().getP().bitLength();
	}
	else if (pubKey instanceof ECKey)
	{
		// TODO: how to get key size from these?
		return UNKNOWN_KEY_SIZE;
	}

	LOG.warning("Don't know how to get key size from key " + pubKey);
	return UNKNOWN_KEY_SIZE;
}
 

import java.security.interfaces.ECKey; //導入依賴的package包/類
/**
 * 初始化密鑰協商算法的乙方密鑰對
 *
 * @param publicKey 甲方公鑰的二進製形式
 * @return 乙方密鑰對
 */
public Map<String, Key> initKey(byte[] publicKey) {
    PublicKey pubKey = this.toPublicKey(publicKey);
    KeyPairGenerator keyPairGenerator = getKeyPairGenerator();
    AlgorithmParameterSpec algorithmParameterSpec = null;
    if (pubKey instanceof DHKey) {
        algorithmParameterSpec = ((DHKey) pubKey).getParams();
    } else if (pubKey instanceof ECKey) {
        algorithmParameterSpec = ((ECKey) pubKey).getParams();
    } else {
        throw new CryptographyException(ExceptionInfo.NO_SUCH_ALGORITHM_EXCEPTION_INFO + getConfiguration().getKeyAlgorithm());
    }
    try {
        keyPairGenerator.initialize(algorithmParameterSpec);
    } catch (InvalidAlgorithmParameterException e) {
        throw new CryptographyException(ExceptionInfo.NO_SUCH_ALGORITHM_EXCEPTION_INFO + getConfiguration().getKeyAlgorithm(), e);
    }
    KeyPair keyPair = keyPairGenerator.generateKeyPair();
    Map<String, Key> keyMap = new HashMap<String, Key>();
    keyMap.put(PRIVATE_KEY, keyPair.getPrivate());
    keyMap.put(PUBLIC_KEY, keyPair.getPublic());
    return keyMap;
}
 

import java.security.interfaces.ECKey; //導入依賴的package包/類
/**
 * Determines the name of the domain parameters that were used for generating the key.
 *
 * @param key An EC key
 * @return The name of the domain parameters that were used for the EC key,
 *         or an empty string if curve is unknown.
 */
public static String getNamedCurve(Key key) {

	if (!(key instanceof ECKey)) {
		throw new InvalidParameterException("Not a EC private key.");
	}

	ECKey ecKey = (ECKey) key;
	ECParameterSpec params = ecKey.getParams();
	if (!(params instanceof ECNamedCurveSpec)) {
		return "";
	}

	ECNamedCurveSpec ecPrivateKeySpec = (ECNamedCurveSpec) params;
	String namedCurve = ecPrivateKeySpec.getName();
	return namedCurve;
}
 

import java.security.interfaces.ECKey; //導入依賴的package包/類
private EcData(ECKey key, ECPoint q, BigInteger x) {
    ECParameterSpec params = key.getParams();
    EllipticCurve curve = params.getCurve();
    curveModulus = ((ECFieldFp) curve.getField()).getP().toByteArray();
    curveA = curve.getA().toByteArray();
    curveB = curve.getB().toByteArray();
    gX = params.getGenerator().getAffineX().toByteArray();
    gY = params.getGenerator().getAffineY().toByteArray();
    n = params.getOrder().toByteArray();
    if (q == null) {
        qX = null;
        qY = null;
    } else {
        qX = q.getAffineX().toByteArray();
        qY = q.getAffineY().toByteArray();
    }
    this.x = x == null ? null : x.toByteArray();
}
 

import java.security.interfaces.ECKey; //導入依賴的package包/類
/**
 * Returns the 'order' parameter of a given ECDSA private key as a
 * a byte buffer.
 * @param privateKey A PrivateKey instance. Must implement ECKey.
 * @return A byte buffer corresponding to the 'order' parameter.
 * This is a big-endian representation of a BigInteger.
 */
@CalledByNative
private static byte[] getECKeyOrder(PrivateKey privateKey) {
    if (privateKey instanceof ECKey) {
        ECParameterSpec params = ((ECKey) privateKey).getParams();
        return params.getOrder().toByteArray();
    }
    Log.w(TAG, "Not an ECKey instance!");
    return null;
}
 

import java.security.interfaces.ECKey; //導入依賴的package包/類
private static Algorithm getAlgorithm(String algo, String key, boolean IsKeyASignerKey)
		throws IllegalArgumentException, UnsupportedEncodingException {
	if (algo.equals(HS256.getAlgorithm())) {
		return Algorithm.HMAC256(key);
	}
	if (algo.equals(HS384.getAlgorithm())) {
		return Algorithm.HMAC384(key);
	}
	if (algo.equals(HS512.getAlgorithm())) {
		return Algorithm.HMAC512(key);
	}
	if (algo.equals(ES256.getAlgorithm())) {
		return Algorithm.ECDSA256((ECKey) getKeyInstance(key, "EC", IsKeyASignerKey));
	}
	if (algo.equals(ES384.getAlgorithm())) {
		return Algorithm.ECDSA384((ECKey) getKeyInstance(key, "EC", IsKeyASignerKey));
	}
	if (algo.equals(ES512.getAlgorithm())) {
		return Algorithm.ECDSA512((ECKey) getKeyInstance(key, "EC",IsKeyASignerKey));
	}
	if (algo.equals(RS256.getAlgorithm())) {
		return Algorithm.RSA256((RSAKey) getKeyInstance(key, "RSA", IsKeyASignerKey));
	}
	if (algo.equals(RS384.getAlgorithm())) {
		return Algorithm.RSA384((RSAKey) getKeyInstance(key, "RSA", IsKeyASignerKey));
	}
	if (algo.equals(RS512.getAlgorithm())) {
		return Algorithm.RSA512((RSAKey) getKeyInstance(key, "RSA", IsKeyASignerKey));
	}

	return Algorithm.none();
}
 

import java.security.interfaces.ECKey; //導入依賴的package包/類
@Test
public void shouldPassECDSA256VerificationWithJOSESignature() throws Exception {
    String token = "eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJhdXRoMCJ9.4iVk3-Y0v4RT4_9IaQlp-8dZ_4fsTzIylgrPTDLrEvTHBTyVS3tgPbr2_IZfLETtiKRqCg0aQ5sh9eIsTTwB1g";
    ECKey key = (ECKey) readPublicKeyFromFile(PUBLIC_KEY_FILE_256, "EC");
    Algorithm algorithm = Algorithm.ECDSA256(key);
    JWT jwt = JWT.require(algorithm).withIssuer("auth0").build();
    DecodedJWT decoded = jwt.decode(token);
    algorithm.verify(decoded, EncodeType.Base64);
}
 

import java.security.interfaces.ECKey; //導入依賴的package包/類
@Test
public void shouldThrowOnECDSA256VerificationWithDERSignature() throws Exception {
    exception.expect(SignatureVerificationException.class);
    exception.expectMessage("The Token's Signature resulted invalid when verified using the Algorithm: SHA256withECDSA");
    exception.expectCause(isA(SignatureException.class));
    exception.expectCause(hasMessage(is("Invalid JOSE signature format.")));

    String token = "eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJhdXRoMCJ9.MEYCIQDiJWTf5jS/hFPj/0hpCWn7x1n/h+xPMjKWCs9MMusS9AIhAMcFPJVLe2A9uvb8hl8sRO2IpGoKDRpDmyH14ixNPAHW";
    ECKey key = (ECKey) readPublicKeyFromFile(PUBLIC_KEY_FILE_256, "EC");
    Algorithm algorithm = Algorithm.ECDSA256(key);
    JWT jwt = JWT.require(algorithm).withIssuer("auth0").build();
    DecodedJWT decoded = jwt.decode(token);
    algorithm.verify(decoded, EncodeType.Base64);
}
 

import java.security.interfaces.ECKey; //導入依賴的package包/類
@Test
public void shouldFailECDSA256VerificationWithInvalidPublicKey() throws Exception {
    exception.expect(SignatureVerificationException.class);
    exception.expectMessage("The Token's Signature resulted invalid when verified using the Algorithm: SHA256withECDSA");
    String token = "eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJhdXRoMCJ9.W9qfN1b80B9hnMo49WL8THrOsf1vEjOhapeFemPMGySzxTcgfyudS5esgeBTO908X5SLdAr5jMwPUPBs9b6nNg";
    Algorithm algorithm = Algorithm.ECDSA256((ECKey) readPublicKeyFromFile(INVALID_PUBLIC_KEY_FILE_256, "EC"));
    JWT jwt = JWT.require(algorithm).withIssuer("auth0").build();
    DecodedJWT decoded = jwt.decode(token);
    algorithm.verify(decoded, EncodeType.Base64);
}
 

import java.security.interfaces.ECKey; //導入依賴的package包/類
@Test
public void shouldFailECDSA256VerificationWhenUsingPrivateKey() throws Exception {
    exception.expect(SignatureVerificationException.class);
    exception.expectMessage("The Token's Signature resulted invalid when verified using the Algorithm: SHA256withECDSA");
    exception.expectCause(isA(IllegalStateException.class));
    exception.expectCause(hasMessage(is("The given Public Key is null.")));
    String token = "eyJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJhdXRoMCJ9.W9qfN1b80B9hnMo49WL8THrOsf1vEjOhapeFemPMGySzxTcgfyudS5esgeBTO908X5SLdAr5jMwPUPBs9b6nNg";
    Algorithm algorithm = Algorithm.ECDSA256((ECKey) readPrivateKeyFromFile(PRIVATE_KEY_FILE_256, "EC"));
    JWT jwt = JWT.require(algorithm).withIssuer("auth0").build();
    DecodedJWT decoded = jwt.decode(token);
    algorithm.verify(decoded, EncodeType.Base64);
}