001/*
002 *  Licensed to the Apache Software Foundation (ASF) under one
003 *  or more contributor license agreements.  See the NOTICE file
004 *  distributed with this work for additional information
005 *  regarding copyright ownership.  The ASF licenses this file
006 *  to you under the Apache License, Version 2.0 (the
007 *  "License"); you may not use this file except in compliance
008 *  with the License.  You may obtain a copy of the License at
009 *  
010 *    http://www.apache.org/licenses/LICENSE-2.0
011 *  
012 *  Unless required by applicable law or agreed to in writing,
013 *  software distributed under the License is distributed on an
014 *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
015 *  KIND, either express or implied.  See the License for the
016 *  specific language governing permissions and limitations
017 *  under the License. 
018 *  
019 */
020
021package org.apache.directory.server.kerberos.shared.crypto.encryption;
022
023
024import java.util.Collections;
025import java.util.EnumMap;
026import java.util.Map;
027import java.util.Set;
028
029import javax.security.auth.kerberos.KerberosKey;
030import javax.security.auth.kerberos.KerberosPrincipal;
031
032import org.apache.directory.shared.kerberos.KerberosUtils;
033import org.apache.directory.shared.kerberos.codec.types.EncryptionType;
034import org.apache.directory.shared.kerberos.components.EncryptionKey;
035
036
037/**
038 * A factory class for producing {@link KerberosKey}'s.  For a list of desired cipher
039 * types, Kerberos string-to-key functions are used to derive keys for DES-, DES3-, AES-,
040 * and RC4-based encryption types.
041 *
042 * @author <a href="mailto:dev@directory.apache.org">Apache Directory Project</a>
043 */
044public class KerberosKeyFactory
045{
046    /** A map of default encryption types mapped to cipher names. */
047    public static final Map<EncryptionType, String> DEFAULT_CIPHERS;
048
049    static
050    {
051        EnumMap<EncryptionType, String> map = new EnumMap<>( EncryptionType.class );
052
053        map.put( EncryptionType.DES_CBC_MD5, "DES" );
054        map.put( EncryptionType.DES3_CBC_SHA1_KD, "DESede" );
055        map.put( EncryptionType.RC4_HMAC, "ArcFourHmac" );
056        map.put( EncryptionType.AES128_CTS_HMAC_SHA1_96, "AES128" );
057        map.put( EncryptionType.AES256_CTS_HMAC_SHA1_96, "AES256" );
058
059        DEFAULT_CIPHERS = Collections.unmodifiableMap( map );
060    }
061
062
063    /**
064     * Get a map of KerberosKey's for a given principal name and passphrase.  The default set
065     * of encryption types is used.
066     * 
067     * @param principalName The principal name to use for key derivation.
068     * @param passPhrase The passphrase to use for key derivation.
069     * @return The map of KerberosKey's.
070     */
071    public static Map<EncryptionType, EncryptionKey> getKerberosKeys( String principalName, String passPhrase )
072    {
073        return getKerberosKeys( principalName, passPhrase, DEFAULT_CIPHERS.keySet() );
074    }
075
076
077    /**
078     * Get a list of KerberosKey's for a given principal name and passphrase and list of cipher
079     * types to derive keys for.
080     *
081     * @param principalName The principal name to use for key derivation.
082     * @param passPhrase The passphrase to use for key derivation.
083     * @param ciphers The set of ciphers to derive keys for.
084     * @return The list of KerberosKey's.
085     */
086    // This will suppress PMD.EmptyCatchBlock warnings in this method
087    public static Map<EncryptionType, EncryptionKey> getKerberosKeys( String principalName, String passPhrase,
088        Set<EncryptionType> ciphers )
089    {
090        EnumMap<EncryptionType, EncryptionKey> kerberosKeys = new EnumMap<>( EncryptionType.class );
091
092        for ( EncryptionType encryptionType : ciphers )
093        {
094            try
095            {
096                kerberosKeys.put( encryptionType, string2Key( principalName, passPhrase, encryptionType ) );
097            }
098            catch ( IllegalArgumentException iae )
099            {
100                // Algorithm AES256 not enabled by policy.
101                // Algorithm ArcFourHmac not supported by IBM JREs.
102                // Algorithm DESede not supported by IBM JREs.
103            }
104        }
105
106        return kerberosKeys;
107    }
108
109
110    public static EncryptionKey string2Key( String principalName, String passPhrase, EncryptionType encryptionType )
111    {
112        KerberosPrincipal principal = new KerberosPrincipal( principalName );
113        KerberosKey kerberosKey = new KerberosKey( principal, passPhrase.toCharArray(),
114            KerberosUtils.getAlgoNameFromEncType( encryptionType ) );
115
116        return new EncryptionKey( encryptionType, kerberosKey.getEncoded(), kerberosKey.getVersionNumber() );
117    }
118}