1 /*
2 * Licensed to the Apache Software Foundation (ASF) under one
3 * or more contributor license agreements. See the NOTICE file
4 * distributed with this work for additional information
5 * regarding copyright ownership. The ASF licenses this file
6 * to you under the Apache License, Version 2.0 (the
7 * "License"); you may not use this file except in compliance
8 * with the License. You may obtain a copy of the License at
9 *
10 * http://www.apache.org/licenses/LICENSE-2.0
11 *
12 * Unless required by applicable law or agreed to in writing,
13 * software distributed under the License is distributed on an
14 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15 * KIND, either express or implied. See the License for the
16 * specific language governing permissions and limitations
17 * under the License.
18 *
19 */
20
21 package org.apache.directory.server.kerberos.shared.crypto.encryption;
22
23
24 import java.util.Collections;
25 import java.util.EnumMap;
26 import java.util.Map;
27 import java.util.Set;
28
29 import javax.security.auth.kerberos.KerberosKey;
30 import javax.security.auth.kerberos.KerberosPrincipal;
31
32 import org.apache.directory.shared.kerberos.KerberosUtils;
33 import org.apache.directory.shared.kerberos.codec.types.EncryptionType;
34 import org.apache.directory.shared.kerberos.components.EncryptionKey;
35
36
37 /**
38 * A factory class for producing {@link KerberosKey}'s. For a list of desired cipher
39 * types, Kerberos string-to-key functions are used to derive keys for DES-, DES3-, AES-,
40 * and RC4-based encryption types.
41 *
42 * @author <a href="mailto:dev@directory.apache.org">Apache Directory Project</a>
43 */
44 public class KerberosKeyFactory
45 {
46 /** A map of default encryption types mapped to cipher names. */
47 public static final Map<EncryptionType, String> DEFAULT_CIPHERS;
48
49 static
50 {
51 EnumMap<EncryptionType, String> map = new EnumMap<>( EncryptionType.class );
52
53 map.put( EncryptionType.DES_CBC_MD5, "DES" );
54 map.put( EncryptionType.DES3_CBC_SHA1_KD, "DESede" );
55 map.put( EncryptionType.RC4_HMAC, "ArcFourHmac" );
56 map.put( EncryptionType.AES128_CTS_HMAC_SHA1_96, "AES128" );
57 map.put( EncryptionType.AES256_CTS_HMAC_SHA1_96, "AES256" );
58
59 DEFAULT_CIPHERS = Collections.unmodifiableMap( map );
60 }
61
62
63 /**
64 * Get a map of KerberosKey's for a given principal name and passphrase. The default set
65 * of encryption types is used.
66 *
67 * @param principalName The principal name to use for key derivation.
68 * @param passPhrase The passphrase to use for key derivation.
69 * @return The map of KerberosKey's.
70 */
71 public static Map<EncryptionType, EncryptionKey> getKerberosKeys( String principalName, String passPhrase )
72 {
73 return getKerberosKeys( principalName, passPhrase, DEFAULT_CIPHERS.keySet() );
74 }
75
76
77 /**
78 * Get a list of KerberosKey's for a given principal name and passphrase and list of cipher
79 * types to derive keys for.
80 *
81 * @param principalName The principal name to use for key derivation.
82 * @param passPhrase The passphrase to use for key derivation.
83 * @param ciphers The set of ciphers to derive keys for.
84 * @return The list of KerberosKey's.
85 */
86 // This will suppress PMD.EmptyCatchBlock warnings in this method
87 public static Map<EncryptionType, EncryptionKey> getKerberosKeys( String principalName, String passPhrase,
88 Set<EncryptionType> ciphers )
89 {
90 EnumMap<EncryptionType, EncryptionKey> kerberosKeys = new EnumMap<>( EncryptionType.class );
91
92 for ( EncryptionType encryptionType : ciphers )
93 {
94 try
95 {
96 kerberosKeys.put( encryptionType, string2Key( principalName, passPhrase, encryptionType ) );
97 }
98 catch ( IllegalArgumentException iae )
99 {
100 // Algorithm AES256 not enabled by policy.
101 // Algorithm ArcFourHmac not supported by IBM JREs.
102 // Algorithm DESede not supported by IBM JREs.
103 }
104 }
105
106 return kerberosKeys;
107 }
108
109
110 public static EncryptionKey string2Key( String principalName, String passPhrase, EncryptionType encryptionType )
111 {
112 KerberosPrincipal principal = new KerberosPrincipal( principalName );
113 KerberosKey kerberosKey = new KerberosKey( principal, passPhrase.toCharArray(),
114 KerberosUtils.getAlgoNameFromEncType( encryptionType ) );
115
116 return new EncryptionKey( encryptionType, kerberosKey.getEncoded(), kerberosKey.getVersionNumber() );
117 }
118 }