Skip to content

PGSC: Add JCE implementation for OpenPGP Smart Card message decryption #2374

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
vanitasvitae wants to merge 1 commit into
base: main
Choose a base branch
from
Open

PGSC: Add JCE implementation for OpenPGP Smart Card message decryption #2374

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion build.gradle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -297,7 +297,7 @@ configure(subprojects.findAll {it.name != 'bom'}) {
}

tasks.withType(JavaCompile).configureEach {
options.debug = releaseDebug;
options.debug = true;
}

tasks.withType(Test).configureEach {
Expand Down
2 changes: 1 addition & 1 deletion pg/src/main/java/org/bouncycastle/openpgp/operator/bc/RFC6637KDFCalculator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@
/**
* Calculator for the EC based KDF algorithm described in RFC 6637
*/
class RFC6637KDFCalculator
public class RFC6637KDFCalculator
{
// "Anonymous Sender ", which is the octet sequence
private static final byte[] ANONYMOUS_SENDER = Hex.decode("416E6F6E796D6F75732053656E64657220202020");
Expand Down
2 changes: 1 addition & 1 deletion pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JcaPGPKeyConverter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -669,7 +669,7 @@ public BCPGKey getBCPGKey(byte[] key)
}
}

private BCPGKey getPublicBCPGKey(int algorithm, PGPAlgorithmParameters algorithmParameters, PublicKey pubKey)
public BCPGKey getPublicBCPGKey(int algorithm, PGPAlgorithmParameters algorithmParameters, PublicKey pubKey)
throws PGPException
{
switch (algorithm)
Expand Down
397 changes: 397 additions & 0 deletions ...bouncycastle/openpgp/operator/jcajce/JceExternalPublicKeyDataDecryptorFactoryBuilder.java
View file
Open in desktop

Large diffs are not rendered by default.

4 changes: 4 additions & 0 deletions .../main/java/org/bouncycastle/openpgp/operator/jcajce/JcePublicKeyDataDecryptorFactory.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
package org.bouncycastle.openpgp.operator.jcajce;

public class JcePublicKeyDataDecryptorFactory {
}
1 change: 0 additions & 1 deletion pg/src/test/java/org/bouncycastle/bcpg/test/ExternalSecretKeyPacketTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
package org.bouncycastle.bcpg.test;

import org.bouncycastle.bcpg.ArmoredInputStream;
import org.bouncycastle.bcpg.ArmoredOutputStream;
import org.bouncycastle.bcpg.BCPGInputStream;
import org.bouncycastle.bcpg.BCPGOutputStream;
import org.bouncycastle.bcpg.ContainedPacket;
Expand Down
1 change: 0 additions & 1 deletion pgsc/src/main/java/org/bouncycastle/openpgp/smartcard/OpenPGPSmartCardBackend.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
package org.bouncycastle.openpgp.smartcard;

import org.bouncycastle.bcpg.KeyIdentifier;
import org.bouncycastle.bcpg.PublicKeyPacket;
import org.bouncycastle.openpgp.PGPException;
import org.bouncycastle.openpgp.PGPPublicKey;
Expand Down
2 changes: 1 addition & 1 deletion pgsc/src/main/java/org/bouncycastle/openpgp/smartcard/yubikey/YubikeyOpenPGPSmartCard.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@ public YubikeyOpenPGPSmartCard(YubikeySmartCardBackend backend,
}
catch (ApduException | IOException | BadResponseException e)
{
throw new CardException("Cannot perform initial read from Yubikey", e);
throw new CardException("Cannot perform initial read from Yubikey " + getSerialNumber(), e);
}
}

Expand Down
91 changes: 80 additions & 11 deletions pgsc/src/main/java/org/bouncycastle/openpgp/smartcard/yubikey/YubikeySmartCardBackend.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,6 @@
import org.bouncycastle.jce.provider.BouncyCastleProvider;
import org.bouncycastle.openpgp.PGPException;
import org.bouncycastle.openpgp.PGPKeyPair;
import org.bouncycastle.openpgp.PGPPrivateKey;
import org.bouncycastle.openpgp.PGPPublicKey;
import org.bouncycastle.openpgp.api.KeyPassphraseProvider;
import org.bouncycastle.openpgp.api.OpenPGPKey;
Expand All @@ -20,7 +19,8 @@
import org.bouncycastle.openpgp.operator.jcajce.JcaPGPKeyConverter;
import org.bouncycastle.openpgp.smartcard.OpenPGPSmartCardBackend;
import org.bouncycastle.openpgp.smartcard.card.CardException;
import org.bouncycastle.openpgp.smartcard.yubikey.operator.YubikeyPublicKeyDataDecryptorFactory;
import org.bouncycastle.openpgp.smartcard.yubikey.operator.bc.BcYubikeyPublicKeyDataDecryptorFactory;
import org.bouncycastle.openpgp.smartcard.yubikey.operator.jcajce.JceYubikeyPublicKeyDataDecryptorFactoryBuilder;
import org.bouncycastle.util.Arrays;

import java.security.NoSuchAlgorithmException;
Expand All @@ -40,42 +40,57 @@ public class YubikeySmartCardBackend
{
private static final int X25519_SCALAR_SIZE = 32;

private final YubikeyDecryptorFactoryProvider decryptorFactoryProvider;
private final JcaPGPKeyConverter converter;
private final JcaKeyFingerprintCalculator fingerprintCalculator;
private final Set<Integer> allowedCardSerials = new HashSet<>();
private final YubiKitManager manager;

public static YubikeySmartCardBackend createInstance()
{
return createInstance(new YubiKitManager());
return createInstance(bcImpl());
}

public static YubikeySmartCardBackend createInstance(YubiKitManager yubiKitManager)
public static YubikeySmartCardBackend createInstance(YubikeyDecryptorFactoryProvider decryptorFactoryProvider)
{
return createInstance(yubiKitManager, new BouncyCastleProvider());
return createInstance(new YubiKitManager(),
decryptorFactoryProvider);
}

public static YubikeySmartCardBackend createInstance(YubiKitManager yubiKitManager,
BouncyCastleProvider provider)
YubikeyDecryptorFactoryProvider decryptorFactoryProvider)
{
return new YubikeySmartCardBackend(yubiKitManager,
return createInstance(yubiKitManager,
new BouncyCastleProvider(),
decryptorFactoryProvider);
}

public static YubikeySmartCardBackend createInstance(YubiKitManager yubiKitManager,
BouncyCastleProvider provider,
YubikeyDecryptorFactoryProvider decryptorFactoryProvider)
{
return new YubikeySmartCardBackend(
yubiKitManager,
new JcaPGPKeyConverter().setProvider(provider),
new JcaKeyFingerprintCalculator().setProvider(provider));
new JcaKeyFingerprintCalculator().setProvider(provider),
decryptorFactoryProvider);
}

public YubikeySmartCardBackend(YubiKitManager yubiKitManager,
JcaPGPKeyConverter keyConverter,
JcaKeyFingerprintCalculator fingerprintCalculator)
JcaKeyFingerprintCalculator fingerprintCalculator,
YubikeyDecryptorFactoryProvider decryptorFactoryProvider)
{
this.manager = yubiKitManager;
this.converter = keyConverter;
this.fingerprintCalculator = fingerprintCalculator;
this.decryptorFactoryProvider = decryptorFactoryProvider;
}

@Override
public String getName()
{
return "Yubikit";
return "Yubikit " + decryptorFactoryProvider.getName();
}

/**
Expand Down Expand Up @@ -130,7 +145,7 @@ public PublicKeyDataDecryptorFactory providePublicKeyDataDecryptorFactory(
KeyPassphraseProvider userPinProvider)
throws PGPException
{
return new YubikeyPublicKeyDataDecryptorFactory(secretKey, card, userPinProvider);
return decryptorFactoryProvider.provide(secretKey, card, userPinProvider);
}

/**
Expand Down Expand Up @@ -276,4 +291,58 @@ private PGPPublicKey bruteForcePublicKey(PublicKey pk, Date creationTime,
}
return null;
}

public interface YubikeyDecryptorFactoryProvider
{
PublicKeyDataDecryptorFactory provide(OpenPGPKey.OpenPGPSecretKey secretKey,
YubikeyOpenPGPSmartCard card,
KeyPassphraseProvider userPinProvider)
throws PGPException;

String getName();
}

public static YubikeyDecryptorFactoryProvider bcImpl()
{
return new YubikeyDecryptorFactoryProvider()
{
@Override
public PublicKeyDataDecryptorFactory provide(OpenPGPKey.OpenPGPSecretKey secretKey,
YubikeyOpenPGPSmartCard card,
KeyPassphraseProvider userPinProvider)
throws PGPException
{
return new BcYubikeyPublicKeyDataDecryptorFactory(secretKey, card, userPinProvider);
}

@Override
public String getName()
{
return "BCYK";
}
};
}

public static YubikeyDecryptorFactoryProvider jceImpl()
{
return new YubikeyDecryptorFactoryProvider()
{
@Override
public PublicKeyDataDecryptorFactory provide(OpenPGPKey.OpenPGPSecretKey secretKey,
YubikeyOpenPGPSmartCard card,
KeyPassphraseProvider userPinProvider)
throws PGPException
{
return new JceYubikeyPublicKeyDataDecryptorFactoryBuilder(card, userPinProvider)
.setProvider(new BouncyCastleProvider())
.build(secretKey);
}

@Override
public String getName()
{
return "JCYK";
}
};
}
}
6 changes: 3 additions & 3 deletions ...YubikeyPublicKeyDataDecryptorFactory.java → ...YubikeyPublicKeyDataDecryptorFactory.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
package org.bouncycastle.openpgp.smartcard.yubikey.operator;
package org.bouncycastle.openpgp.smartcard.yubikey.operator.bc;

import com.yubico.yubikit.core.application.InvalidPinException;
import com.yubico.yubikit.core.keys.PublicKeyValues;
Expand Down Expand Up @@ -39,13 +39,13 @@
* unwrap work stays in {@link org.bouncycastle.openpgp.operator.bc.BcPublicKeyDataDecryptorFactory}.
* ElGamal and X448 are not supported by the applet and are rejected.
*/
public class YubikeyPublicKeyDataDecryptorFactory
public class BcYubikeyPublicKeyDataDecryptorFactory
extends BcExternalPublicKeyDataDecryptorFactory
{
private final KeyPassphraseProvider userPinProvider;
private final YubikeyOpenPGPSmartCard yubikey;

public YubikeyPublicKeyDataDecryptorFactory(OpenPGPKey.OpenPGPSecretKey secretKey,
public BcYubikeyPublicKeyDataDecryptorFactory(OpenPGPKey.OpenPGPSecretKey secretKey,
YubikeyOpenPGPSmartCard yubikey,
KeyPassphraseProvider userPinProvider)
throws PGPException
Expand Down
Loading
Loading