Skip to content

Commit

Permalink
Supporting FIPS work
Browse files Browse the repository at this point in the history
  • Loading branch information
@mshah0722
mshah0722 committed Sep 12, 2024
1 parent 6345656 commit 6d8eb2a
Show file tree
Hide file tree
Showing 10 changed files with 217 additions and 121 deletions.
25 changes: 24 additions & 1 deletion dev/com.ibm.ws.crypto.common/src/com/ibm/ws/crypto/common/FipsUtils.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,9 @@

public class FipsUtils {

public static boolean isFIPSEnabled = false;
public static boolean fipsChecked = false;

private static final TraceComponent tc = Tr.register(FipsUtils.class);

static String FIPSLevel = getFipsLevel();
Expand All @@ -29,7 +32,8 @@ static String getFipsLevel() {
String fipsLevel = AccessController.doPrivileged(new PrivilegedAction<String>() {
@Override
public String run() {
return System.getProperty("com.ibm.fips.mode");
String propertyValue = System.getProperty("com.ibm.fips.mode");
return (propertyValue == null) ? "disabled" : propertyValue.trim().toLowerCase();
}
});
return fipsLevel;
Expand All @@ -44,6 +48,25 @@ public static boolean isFips140_3Enabled() {
}
}

public static boolean isFips140_2Enabled() {
//TODO remove beta check
if (unitTest) {
return "140-2".equals(FIPSLevel);
} else {
return isRunningBetaMode() && "140-2".equals(FIPSLevel);
}
}

public static boolean isFIPSEnabled() {
if (fipsChecked) {
return isFIPSEnabled;
} else {
isFIPSEnabled = isFips140_2Enabled() || isFips140_3Enabled();
fipsChecked = true;
return isFIPSEnabled;
}
}

//TODO remove beta check
static boolean isRunningBetaMode() {
return ProductInfo.getBetaEdition();
Expand Down
6 changes: 4 additions & 2 deletions dev/com.ibm.ws.crypto.ltpakeyutil/bnd.bnd
View file
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,8 @@ Service-Component:\
com.ibm.ws.logging;version=latest, \
com.ibm.ws.kernel.service;version=latest, \
com.ibm.ws.kernel.boot.core;version=latest, \
com.ibm.ws.org.osgi.annotation.versioning;version=latest
com.ibm.ws.org.osgi.annotation.versioning;version=latest, \
com.ibm.ws.crypto.common;version=latest

-testpath: \
../build.sharedResources/lib/junit/old/junit.jar;version=file, \
Expand All @@ -48,5 +49,6 @@ Service-Component:\
com.ibm.ws.logging;version=latest, \
com.ibm.ws.kernel.boot.common;version=latest, \
com.ibm.ws.kernel.boot.logging;version=latest, \
com.ibm.ws.kernel.security.thread;version=latest
com.ibm.ws.kernel.security.thread;version=latest, \
com.ibm.ws.crypto.common;version=latest

37 changes: 24 additions & 13 deletions dev/com.ibm.ws.crypto.ltpakeyutil/src/com/ibm/ws/crypto/ltpakeyutil/KeyEncryptor.java
View file
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/*******************************************************************************
* Copyright (c) 1997, 2011 IBM Corporation and others.
* Copyright (c) 1997, 2024 IBM Corporation and others.
* All rights reserved. This program and the accompanying materials
* are made available under the terms of the Eclipse Public License 2.0
* which accompanies this distribution, and is available at
Expand All @@ -14,16 +14,19 @@

import java.security.MessageDigest;

import com.ibm.ws.crypto.common.FipsUtils;

/**
* A package local class for performing encryption and decryption of keys
* based on admin's password
*/
public class KeyEncryptor {

private static final String MESSAGE_DIGEST_ALGORITHM = "SHA";
private static final String DES_ECB_CIPHER = "DESede/ECB/PKCS5Padding";

private final byte[] desKey;
private static final boolean isFIPSEnabled = FipsUtils.isFIPSEnabled();
private static final int size = (isFIPSEnabled ? 32 : 24);
private static final String MESSAGE_DIGEST_ALGORITHM = (isFIPSEnabled ? "SHA-256" : "SHA");
private static final String CIPHER = (isFIPSEnabled ? "AES/GCM/NoPadding" : "DESede/ECB/PKCS5Padding");
private final byte[] key;

/**
* A KeyEncryptor constructor.
Expand All @@ -33,12 +36,14 @@ public class KeyEncryptor {
public KeyEncryptor(byte[] password) throws Exception {
MessageDigest md = MessageDigest.getInstance(MESSAGE_DIGEST_ALGORITHM);
byte[] digest = md.digest(password);
desKey = new byte[24];
System.arraycopy(digest, 0, desKey, 0, digest.length);
desKey[20] = (byte) 0x00;
desKey[21] = (byte) 0x00;
desKey[22] = (byte) 0x00;
desKey[23] = (byte) 0x00;
key = new byte[size];
System.arraycopy(digest, 0, key, 0, digest.length);
if (!isFIPSEnabled) {
key[20] = (byte) 0x00;
key[21] = (byte) 0x00;
key[22] = (byte) 0x00;
key[23] = (byte) 0x00;
}
}

/**
Expand All @@ -48,10 +53,16 @@ public KeyEncryptor(byte[] password) throws Exception {
* @return The decrypted key
*/
public byte[] decrypt(byte[] encryptedKey) throws Exception {
return LTPACrypto.decrypt(encryptedKey, desKey, DES_ECB_CIPHER);
return LTPACrypto.decrypt(encryptedKey, key, CIPHER);
}

/**
* Encrypt the key
*
* @param key The key
* @return The encrypted key
*/
public byte[] encrypt(byte[] key) throws Exception {
return LTPACrypto.encrypt(key, desKey, DES_ECB_CIPHER);
return LTPACrypto.encrypt(key, this.key, CIPHER);
}
}
68 changes: 43 additions & 25 deletions dev/com.ibm.ws.crypto.ltpakeyutil/src/com/ibm/ws/crypto/ltpakeyutil/LTPACrypto.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -38,19 +38,24 @@
import javax.crypto.SecretKey;
import javax.crypto.SecretKeyFactory;
import javax.crypto.spec.DESedeKeySpec;
import javax.crypto.spec.GCMParameterSpec;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;

import com.ibm.websphere.ras.Tr;
import com.ibm.websphere.ras.TraceComponent;
import com.ibm.websphere.ras.annotation.Trivial;
import com.ibm.ws.crypto.common.FipsUtils;

final class LTPACrypto {

private static final boolean isFIPSEnabled = FipsUtils.isFIPSEnabled();

private static final TraceComponent tc = Tr.register(LTPACrypto.class);
private static final String IBMJCE_NAME = "IBMJCE";
private static final String IBMJCE_PLUS_FIPS_NAME = "IBMJCEPlusFIPS";
private static final String OPENJCE_PLUS_NAME = "OpenJCEPlus";
private static final String OPENJCE_PLUS_FIPS_NAME = "OpenJCEPlusFIPS";
private static final String provider = getProvider();

private static final String SIGNATURE_ALGORITHM_SHA1WITHRSA = "SHA1withRSA";
Expand All @@ -63,6 +68,9 @@ final class LTPACrypto {
private static final String ENCRYPT_ALGORITHM_RSA = "RSA";
private static final String encryptAlgorithm = getEncryptionAlgorithm();

public static RSAPublicKey rsaPubKey;
public static RSAPrivateCrtKey rsaPrivKey;

private static int MAX_CACHE = 500;
private static IvParameterSpec ivs8 = null;
private static IvParameterSpec ivs16 = null;
Expand Down Expand Up @@ -637,21 +645,26 @@ private static Cipher createCipher(int cipherMode, byte[] key, String cipher, Se
ci = (provider == null) ? Cipher.getInstance(cipher) : Cipher.getInstance(cipher, provider);

if (cipher.indexOf("ECB") == -1) {
if (cipher.indexOf("AES") != -1) {
if (ivs16 == null) {
setIVS16(key);
}
ci.init(cipherMode, sKey, ivs16);
} else {
if (ivs8 == null) {
setIVS8(key);
}
ci.init(cipherMode, sKey, ivs8);
}
} else {
ci.init(cipherMode, sKey);
}
return ci;
if (cipher.indexOf("GCM") != -1) {
byte[] iv = new byte[12];
GCMParameterSpec params = new GCMParameterSpec(128, iv);
System.out.println("using GCM spec");
ci.init(cipherMode, sKey, params);
} else if (cipher.indexOf("AES") != -1) {
if (ivs16 == null) {
setIVS16(key);
}
ci.init(cipherMode, sKey, ivs16);
} else {
if (ivs8 == null) {
setIVS8(key);
}
ci.init(cipherMode, sKey, ivs8);
}
} else {
ci.init(cipherMode, sKey);
}
return ci;
}

/**
Expand Down Expand Up @@ -1159,14 +1172,19 @@ static final byte[][] rsaKey(int len, boolean crt, boolean f4) {
}

private static String getProvider() {
String provider = null;
if (LTPAKeyUtil.isFIPSEnabled() && LTPAKeyUtil.isIBMJCEPlusFIPSAvailable()) {
provider = IBMJCE_PLUS_FIPS_NAME;
} else if (LTPAKeyUtil.isIBMJCEAvailable()) {
provider = IBMJCE_NAME;
} else if (LTPAKeyUtil.isZOSandRunningJava11orHigher() && LTPAKeyUtil.isOpenJCEPlusAvailable()) {
provider = OPENJCE_PLUS_NAME;
}
String provider = null;
if (isFIPSEnabled && LTPAKeyUtil.isOpenJCEPlusFIPSAvailable()) {
provider = OPENJCE_PLUS_FIPS_NAME;
}
else if (isFIPSEnabled && LTPAKeyUtil.isIBMJCEPlusFIPSAvailable()) {
provider = IBMJCE_PLUS_FIPS_NAME;
}
else if (LTPAKeyUtil.isZOSandRunningJava11orHigher() && LTPAKeyUtil.isOpenJCEPlusAvailable()) {
provider = OPENJCE_PLUS_NAME;
}
else if (LTPAKeyUtil.isIBMJCEAvailable()) {
provider = IBMJCE_NAME;
}
if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
if (provider == null) {
Tr.debug(tc, "getProvider" + " Provider configured by JDK");
Expand All @@ -1178,14 +1196,14 @@ private static String getProvider() {
}

private static String getSignatureAlgorithm() {
if (LTPAKeyUtil.isFIPSEnabled() && LTPAKeyUtil.isIBMJCEPlusFIPSAvailable())
if (isFIPSEnabled && (LTPAKeyUtil.isOpenJCEPlusFIPSAvailable() || LTPAKeyUtil.isIBMJCEPlusFIPSAvailable()))
return SIGNATURE_ALGORITHM_SHA256WITHRSA;
else
return SIGNATURE_ALGORITHM_SHA1WITHRSA;
}

private static String getEncryptionAlgorithm() {
if (LTPAKeyUtil.isFIPSEnabled() && LTPAKeyUtil.isIBMJCEPlusFIPSAvailable())
if (isFIPSEnabled && (LTPAKeyUtil.isOpenJCEPlusFIPSAvailable() || LTPAKeyUtil.isIBMJCEPlusFIPSAvailable()))
return ENCRYPT_ALGORITHM_RSA;
else
return ENCRYPT_ALGORITHM_DESEDE;
Expand Down
28 changes: 19 additions & 9 deletions dev/com.ibm.ws.crypto.ltpakeyutil/src/com/ibm/ws/crypto/ltpakeyutil/LTPADigSignature.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,13 @@
import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;

import com.ibm.ws.crypto.common.FipsUtils;

final class LTPADigSignature {

static boolean isFipsEnabled = FipsUtils.isFIPSEnabled();
static int keySize = (isFipsEnabled ? 256 : 128);

static byte[][] testRawPubKey = null;
static byte[][] testRawPrivKey = null;
static MessageDigest md1 = null;
Expand All @@ -27,14 +32,19 @@ final class LTPADigSignature {

static {
try {
if (LTPAKeyUtil.isFIPSEnabled() && LTPAKeyUtil.isIBMJCEPlusFIPSAvailable()) {
md1 = MessageDigest.getInstance(LTPAKeyUtil.MESSAGE_DIGEST_ALGORITHM_SHA256,
LTPAKeyUtil.IBMJCE_PLUS_FIPS_NAME);
} else if (LTPAKeyUtil.isIBMJCEAvailable()) {
md1 = MessageDigest.getInstance(LTPAKeyUtil.MESSAGE_DIGEST_ALGORITHM_SHA, LTPAKeyUtil.IBMJCE_NAME);
} else {
md1 = MessageDigest.getInstance(LTPAKeyUtil.MESSAGE_DIGEST_ALGORITHM_SHA);
}
if (isFipsEnabled && LTPAKeyUtil.isOpenJCEPlusFIPSAvailable()) {
md1 = MessageDigest.getInstance(LTPAKeyUtil.MESSAGE_DIGEST_ALGORITHM_SHA256,
LTPAKeyUtil.OPENJCE_PLUS_FIPS_NAME);
} else if (isFipsEnabled && LTPAKeyUtil.isIBMJCEPlusFIPSAvailable()) {
md1 = MessageDigest.getInstance(LTPAKeyUtil.MESSAGE_DIGEST_ALGORITHM_SHA256,
LTPAKeyUtil.IBMJCE_PLUS_FIPS_NAME);
} else if (LTPAKeyUtil.isOpenJCEPlusAvailable()) {
md1 = MessageDigest.getInstance(LTPAKeyUtil.MESSAGE_DIGEST_ALGORITHM_SHA, LTPAKeyUtil.OPENJCE_PLUS_NAME);
} else if (LTPAKeyUtil.isIBMJCEAvailable()) {
md1 = MessageDigest.getInstance(LTPAKeyUtil.MESSAGE_DIGEST_ALGORITHM_SHA, LTPAKeyUtil.IBMJCE_NAME);
} else {
md1 = MessageDigest.getInstance(LTPAKeyUtil.MESSAGE_DIGEST_ALGORITHM_SHA);
}

} catch (NoSuchAlgorithmException e) {
// instrumented ffdc
Expand All @@ -48,7 +58,7 @@ public LTPADigSignature() {
}

static void generateRSAKeys(byte[][] rsaPubKey, byte[][] rsaPrivKey) {
byte[][] rsaKey = LTPACrypto.rsaKey(128, true, true); // 64 is 512, 128
byte[][] rsaKey = LTPACrypto.rsaKey(keySize, true, true); // 64 is 512, 128
// is 1024

rsaPrivKey[0] = rsaKey[0];
Expand Down
Loading

0 comments on commit 6d8eb2a

Please sign in to comment.