001/* 002 * Licensed to the Apache Software Foundation (ASF) under one 003 * or more contributor license agreements. See the NOTICE file 004 * distributed with this work for additional information 005 * regarding copyright ownership. The ASF licenses this file 006 * to you under the Apache License, Version 2.0 (the 007 * "License"); you may not use this file except in compliance 008 * with the License. You may obtain a copy of the License at 009 * 010 * http://www.apache.org/licenses/LICENSE-2.0 011 * 012 * Unless required by applicable law or agreed to in writing, 013 * software distributed under the License is distributed on an 014 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 015 * KIND, either express or implied. See the License for the 016 * specific language governing permissions and limitations 017 * under the License. 018 * 019 */ 020 021package org.apache.directory.server.kerberos.shared.crypto.encryption; 022 023 024import java.util.Collections; 025import java.util.EnumMap; 026import java.util.Map; 027import java.util.Set; 028 029import javax.security.auth.kerberos.KerberosKey; 030import javax.security.auth.kerberos.KerberosPrincipal; 031 032import org.apache.directory.shared.kerberos.KerberosUtils; 033import org.apache.directory.shared.kerberos.codec.types.EncryptionType; 034import org.apache.directory.shared.kerberos.components.EncryptionKey; 035 036 037/** 038 * A factory class for producing {@link KerberosKey}'s. For a list of desired cipher 039 * types, Kerberos string-to-key functions are used to derive keys for DES-, DES3-, AES-, 040 * and RC4-based encryption types. 041 * 042 * @author <a href="mailto:dev@directory.apache.org">Apache Directory Project</a> 043 */ 044public class KerberosKeyFactory 045{ 046 /** A map of default encryption types mapped to cipher names. */ 047 public static final Map<EncryptionType, String> DEFAULT_CIPHERS; 048 049 static 050 { 051 EnumMap<EncryptionType, String> map = new EnumMap<>( EncryptionType.class ); 052 053 map.put( EncryptionType.DES_CBC_MD5, "DES" ); 054 map.put( EncryptionType.DES3_CBC_SHA1_KD, "DESede" ); 055 map.put( EncryptionType.RC4_HMAC, "ArcFourHmac" ); 056 map.put( EncryptionType.AES128_CTS_HMAC_SHA1_96, "AES128" ); 057 map.put( EncryptionType.AES256_CTS_HMAC_SHA1_96, "AES256" ); 058 059 DEFAULT_CIPHERS = Collections.unmodifiableMap( map ); 060 } 061 062 063 /** 064 * Get a map of KerberosKey's for a given principal name and passphrase. The default set 065 * of encryption types is used. 066 * 067 * @param principalName The principal name to use for key derivation. 068 * @param passPhrase The passphrase to use for key derivation. 069 * @return The map of KerberosKey's. 070 */ 071 public static Map<EncryptionType, EncryptionKey> getKerberosKeys( String principalName, String passPhrase ) 072 { 073 return getKerberosKeys( principalName, passPhrase, DEFAULT_CIPHERS.keySet() ); 074 } 075 076 077 /** 078 * Get a list of KerberosKey's for a given principal name and passphrase and list of cipher 079 * types to derive keys for. 080 * 081 * @param principalName The principal name to use for key derivation. 082 * @param passPhrase The passphrase to use for key derivation. 083 * @param ciphers The set of ciphers to derive keys for. 084 * @return The list of KerberosKey's. 085 */ 086 // This will suppress PMD.EmptyCatchBlock warnings in this method 087 public static Map<EncryptionType, EncryptionKey> getKerberosKeys( String principalName, String passPhrase, 088 Set<EncryptionType> ciphers ) 089 { 090 EnumMap<EncryptionType, EncryptionKey> kerberosKeys = new EnumMap<>( EncryptionType.class ); 091 092 for ( EncryptionType encryptionType : ciphers ) 093 { 094 try 095 { 096 kerberosKeys.put( encryptionType, string2Key( principalName, passPhrase, encryptionType ) ); 097 } 098 catch ( IllegalArgumentException iae ) 099 { 100 // Algorithm AES256 not enabled by policy. 101 // Algorithm ArcFourHmac not supported by IBM JREs. 102 // Algorithm DESede not supported by IBM JREs. 103 } 104 } 105 106 return kerberosKeys; 107 } 108 109 110 public static EncryptionKey string2Key( String principalName, String passPhrase, EncryptionType encryptionType ) 111 { 112 KerberosPrincipal principal = new KerberosPrincipal( principalName ); 113 KerberosKey kerberosKey = new KerberosKey( principal, passPhrase.toCharArray(), 114 KerberosUtils.getAlgoNameFromEncType( encryptionType ) ); 115 116 return new EncryptionKey( encryptionType, kerberosKey.getEncoded(), kerberosKey.getVersionNumber() ); 117 } 118}