Java PBEKeySpec.getPassword方法代碼示例

import javax.crypto.spec.PBEKeySpec; //導入方法依賴的package包/類
/**
 * Gets the secret password stored in keystore under given alias.
 * @param alias
 * @param entryPassword entry password to access the secret password stored in keystore
 * @return the secret password or null if secret password does not exists in keystore
 * @throws KeyStoreProviderException
 */
public String getPassword(String alias, String entryPassword) throws KeyStoreProviderException {
    try {
        LOG.info(String.format("Getting password with alias %s from keystore ...", alias));

        SecretKeyFactory factory = SecretKeyFactory.getInstance(SECRET_KEY_PASSWORD_ALGORITHM);

        Optional<KeyStore.SecretKeyEntry> ske = Optional.fromNullable((KeyStore.SecretKeyEntry) this.keystore.getEntry(alias, new KeyStore.PasswordProtection(entryPassword.toCharArray())));

        if(!ske.isPresent()) {
            return null;
        }

        PBEKeySpec keySpec = (PBEKeySpec)factory.getKeySpec(ske.get().getSecretKey(),PBEKeySpec.class);
        char[] password = keySpec.getPassword();

        if(ArrayUtils.isEmpty(password)) {
            throw new KeyStoreProviderException("Recovered password is blank.");
        }

        return new String(password);
    } catch (NoSuchAlgorithmException nsae) {
        throw new KeyStoreProviderException("Algorithm used to create PBE secret cannot be found.", nsae);
    } catch (UnrecoverableEntryException uee) {
        throw new KeyStoreProviderException("Invalid entry password to recover secret.", uee);
    } catch (KeyStoreException kse) {
        throw new KeyStoreProviderException("Failed to get PBE secret to keystore.", kse);
    } catch (InvalidKeySpecException ikse) {
        throw new KeyStoreProviderException("Failed to get key spec from PBE secret.", ikse);
    } catch (Exception e) {
        throw new KeyStoreProviderException("Failed to get PBE secret.", e);
    }
}
 

import javax.crypto.spec.PBEKeySpec; //導入方法依賴的package包/類
/**
 * Creates a PBE key from a given PBE key specification.
 *
 * @param key the given PBE key specification
 */
PBEKey(PBEKeySpec keySpec, String keytype) throws InvalidKeySpecException {
    char[] passwd = keySpec.getPassword();
    if (passwd == null) {
        // Should allow an empty password.
        passwd = new char[0];
    }
    // Accept "\0" to signify "zero-length password with no terminator".
    if (!(passwd.length == 1 && passwd[0] == 0)) {
        for (int i=0; i<passwd.length; i++) {
            if ((passwd[i] < '\u0020') || (passwd[i] > '\u007E')) {
                throw new InvalidKeySpecException("Password is not ASCII");
            }
        }
    }
    this.key = new byte[passwd.length];
    for (int i=0; i<passwd.length; i++)
        this.key[i] = (byte) (passwd[i] & 0x7f);
    java.util.Arrays.fill(passwd, ' ');
    type = keytype;
}
 

import javax.crypto.spec.PBEKeySpec; //導入方法依賴的package包/類
/**
 * Creates a PBE key from a given PBE key specification.
 *
 * @param keytype the given PBE key specification
 */
PBEKey(PBEKeySpec keySpec, String keytype) throws InvalidKeySpecException {
    char[] passwd = keySpec.getPassword();
    if (passwd == null) {
        // Should allow an empty password.
        passwd = new char[0];
    }
    // Accept "\0" to signify "zero-length password with no terminator".
    if (!(passwd.length == 1 && passwd[0] == 0)) {
        for (int i=0; i<passwd.length; i++) {
            if ((passwd[i] < '\u0020') || (passwd[i] > '\u007E')) {
                throw new InvalidKeySpecException("Password is not ASCII");
            }
        }
    }
    this.key = new byte[passwd.length];
    for (int i=0; i<passwd.length; i++)
        this.key[i] = (byte) (passwd[i] & 0x7f);
    java.util.Arrays.fill(passwd, ' ');
    type = keytype;

    // Use the cleaner to zero the key when no longer referenced
    final byte[] k = this.key;
    CleanerFactory.cleaner().register(this,
            () -> java.util.Arrays.fill(k, (byte)0x00));
}
 

import javax.crypto.spec.PBEKeySpec; //導入方法依賴的package包/類
protected SecretKey engineGenerateSecret(
    KeySpec keySpec)
    throws InvalidKeySpecException
{
    if (keySpec instanceof PBEKeySpec)
    {
        PBEKeySpec pbeSpec = (PBEKeySpec)keySpec;

        if (pbeSpec.getSalt() == null)
        {
            throw new InvalidKeySpecException("missing required salt");
        }

        if (pbeSpec.getIterationCount() <= 0)
        {
            throw new InvalidKeySpecException("positive iteration count required: "
                + pbeSpec.getIterationCount());
        }

        if (pbeSpec.getKeyLength() <= 0)
        {
            throw new InvalidKeySpecException("positive key length required: "
                + pbeSpec.getKeyLength());
        }

        if (pbeSpec.getPassword().length == 0)
        {
            throw new IllegalArgumentException("password empty");
        }

        int digest = SHA1;
        int keySize = pbeSpec.getKeyLength();
        int ivSize = -1;    // JDK 1,2 and earlier does not understand simplified version.
        CipherParameters param = PBE.Util.makePBEMacParameters(pbeSpec, scheme, digest, keySize);

        return new BCPBEKey(this.algName, this.algOid, scheme, digest, keySize, ivSize, pbeSpec, param);
    }

    throw new InvalidKeySpecException("Invalid KeySpec");
}
 

import javax.crypto.spec.PBEKeySpec; //導入方法依賴的package包/類
/** Retrieve a string setting. The {@link SecureString} should be closed once it is used. */
@Override
public SecureString getString(String setting) throws GeneralSecurityException {
    KeyStore.Entry entry = keystore.get().getEntry(setting, keystorePassword.get());
    if (entry instanceof KeyStore.SecretKeyEntry == false) {
        throw new IllegalStateException("Secret setting " + setting + " is not a string");
    }
    // TODO: only allow getting a setting once?
    KeyStore.SecretKeyEntry secretKeyEntry = (KeyStore.SecretKeyEntry) entry;
    PBEKeySpec keySpec = (PBEKeySpec) secretFactory.getKeySpec(secretKeyEntry.getSecretKey(), PBEKeySpec.class);
    SecureString value = new SecureString(keySpec.getPassword());
    keySpec.clearPassword();
    return value;
}
 

import javax.crypto.spec.PBEKeySpec; //導入方法依賴的package包/類
/**
 * Creates a PBE key from a given PBE key specification.
 *
 * @param key the given PBE key specification
 */
PBKDF2KeyImpl(PBEKeySpec keySpec, String prfAlgo)
    throws InvalidKeySpecException {
    char[] passwd = keySpec.getPassword();
    if (passwd == null) {
        // Should allow an empty password.
        this.passwd = new char[0];
    } else {
        this.passwd = passwd.clone();
    }
    // Convert the password from char[] to byte[]
    byte[] passwdBytes = getPasswordBytes(this.passwd);

    this.salt = keySpec.getSalt();
    if (salt == null) {
        throw new InvalidKeySpecException("Salt not found");
    }
    this.iterCount = keySpec.getIterationCount();
    if (iterCount == 0) {
        throw new InvalidKeySpecException("Iteration count not found");
    } else if (iterCount < 0) {
        throw new InvalidKeySpecException("Iteration count is negative");
    }
    int keyLength = keySpec.getKeyLength();
    if (keyLength == 0) {
        throw new InvalidKeySpecException("Key length not found");
    } else if (keyLength < 0) {
        throw new InvalidKeySpecException("Key length is negative");
    }
    try {
        this.prf = Mac.getInstance(prfAlgo, SunJCE.getInstance());
    } catch (NoSuchAlgorithmException nsae) {
        // not gonna happen; re-throw just in case
        InvalidKeySpecException ike = new InvalidKeySpecException();
        ike.initCause(nsae);
        throw ike;
    }
    this.key = deriveKey(prf, passwdBytes, salt, iterCount, keyLength);
}
 

import javax.crypto.spec.PBEKeySpec; //導入方法依賴的package包/類
/**
 * Creates a PBE key from a given PBE key specification.
 *
 * @param keySpec the given PBE key specification
 * @param prfAlgo the given PBE key algorithm
 */
PBKDF2KeyImpl(PBEKeySpec keySpec, String prfAlgo)
    throws InvalidKeySpecException {
    char[] passwd = keySpec.getPassword();
    if (passwd == null) {
        // Should allow an empty password.
        this.passwd = new char[0];
    } else {
        this.passwd = passwd.clone();
    }
    // Convert the password from char[] to byte[]
    byte[] passwdBytes = getPasswordBytes(this.passwd);

    this.salt = keySpec.getSalt();
    if (salt == null) {
        throw new InvalidKeySpecException("Salt not found");
    }
    this.iterCount = keySpec.getIterationCount();
    if (iterCount == 0) {
        throw new InvalidKeySpecException("Iteration count not found");
    } else if (iterCount < 0) {
        throw new InvalidKeySpecException("Iteration count is negative");
    }
    int keyLength = keySpec.getKeyLength();
    if (keyLength == 0) {
        throw new InvalidKeySpecException("Key length not found");
    } else if (keyLength < 0) {
        throw new InvalidKeySpecException("Key length is negative");
    }
    try {
        this.prf = Mac.getInstance(prfAlgo);
        // SunPKCS11 requires a non-empty PBE password
        if (passwdBytes.length == 0 &&
            this.prf.getProvider().getName().startsWith("SunPKCS11")) {
            this.prf = Mac.getInstance(prfAlgo, SunJCE.getInstance());
        }
    } catch (NoSuchAlgorithmException nsae) {
        // not gonna happen; re-throw just in case
        InvalidKeySpecException ike = new InvalidKeySpecException();
        ike.initCause(nsae);
        throw ike;
    }
    this.key = deriveKey(prf, passwdBytes, salt, iterCount, keyLength);

    // Use the cleaner to zero the key when no longer referenced
    final byte[] k = this.key;
    final char[] p = this.passwd;
    CleanerFactory.cleaner().register(this,
            () -> {
                java.util.Arrays.fill(k, (byte)0x00);
                java.util.Arrays.fill(p, '0');
            });
}