/*
* Copyright (c) 2010, 2016, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation. Oracle designates this
* particular file as subject to the "Classpath" exception as provided
* by Oracle in the LICENSE file that accompanied this code.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
package sun.security.ssl;
import java.security.AlgorithmConstraints;
import java.security.CryptoPrimitive;
import java.security.PrivateKey;
import java.security.Security;
import java.util.Set;
import java.util.HashSet;
import java.util.Map;
import java.util.EnumSet;
import java.util.TreeMap;
import java.util.Collection;
import java.util.Collections;
import java.util.ArrayList;
import sun.security.util.KeyUtil;
/**
* Signature and hash algorithm.
*
* [RFC5246] The client uses the "signature_algorithms" extension to
* indicate to the server which signature/hash algorithm pairs may be
* used in digital signatures. The "extension_data" field of this
* extension contains a "supported_signature_algorithms" value.
*
* enum {
* none(0), md5(1), sha1(2), sha224(3), sha256(4), sha384(5),
* sha512(6), (255)
* } HashAlgorithm;
*
* enum { anonymous(0), rsa(1), dsa(2), ecdsa(3), (255) }
* SignatureAlgorithm;
*
* struct {
* HashAlgorithm hash;
* SignatureAlgorithm signature;
* } SignatureAndHashAlgorithm;
*/
final class SignatureAndHashAlgorithm {
// minimum priority for default enabled algorithms
static final int SUPPORTED_ALG_PRIORITY_MAX_NUM = 0x00F0;
// performance optimization
private static final Set<CryptoPrimitive> SIGNATURE_PRIMITIVE_SET =
Collections.unmodifiableSet(EnumSet.of(CryptoPrimitive.SIGNATURE));
// supported pairs of signature and hash algorithm
private static final Map<Integer, SignatureAndHashAlgorithm> supportedMap;
private static final Map<Integer, SignatureAndHashAlgorithm> priorityMap;
// the hash algorithm
private HashAlgorithm hash;
// id in 16 bit MSB format, i.e. 0x0603 for SHA512withECDSA
private int id;
// the standard algorithm name, for example "SHA512withECDSA"
private String algorithm;
// Priority for the preference order. The lower the better.
//
// If the algorithm is unsupported, its priority should be bigger
// than SUPPORTED_ALG_PRIORITY_MAX_NUM.
private int priority;
// constructor for supported algorithm
private SignatureAndHashAlgorithm(HashAlgorithm hash,
SignatureAlgorithm signature, String algorithm, int priority) {
this.hash = hash;
this.algorithm = algorithm;
this.id = ((hash.value & 0xFF) << 8) | (signature.value & 0xFF);
this.priority = priority;
}
// constructor for unsupported algorithm
private SignatureAndHashAlgorithm(String algorithm, int id, int sequence) {
this.hash = HashAlgorithm.valueOf((id >> 8) & 0xFF);
this.algorithm = algorithm;
this.id = id;
// add one more to the sequence number, in case that the number is zero
this.priority = SUPPORTED_ALG_PRIORITY_MAX_NUM + sequence + 1;
}
// Note that we do not use the sequence argument for supported algorithms,
// so please don't sort by comparing the objects read from handshake
// messages.
static SignatureAndHashAlgorithm valueOf(int hash,
int signature, int sequence) {
hash &= 0xFF;
signature &= 0xFF;
int id = (hash << 8) | signature;
SignatureAndHashAlgorithm signAlg = supportedMap.get(id);
if (signAlg == null) {
// unsupported algorithm
signAlg = new SignatureAndHashAlgorithm(
"Unknown (hash:0x" + Integer.toString(hash, 16) +
", signature:0x" + Integer.toString(signature, 16) + ")",
id, sequence);
}
return signAlg;
}
int getHashValue() {
return (id >> 8) & 0xFF;
}
int getSignatureValue() {
return id & 0xFF;
}
String getAlgorithmName() {
return algorithm;
}
// return the size of a SignatureAndHashAlgorithm structure in TLS record
static int sizeInRecord() {
return 2;
}
// Get local supported algorithm collection complying to
// algorithm constraints
static Collection<SignatureAndHashAlgorithm>
getSupportedAlgorithms(AlgorithmConstraints constraints) {
Collection<SignatureAndHashAlgorithm> supported = new ArrayList<>();
for (SignatureAndHashAlgorithm sigAlg : priorityMap.values()) {
if (sigAlg.priority <= SUPPORTED_ALG_PRIORITY_MAX_NUM &&
constraints.permits(SIGNATURE_PRIMITIVE_SET,
sigAlg.algorithm, null)) {
supported.add(sigAlg);
}
}
return supported;
}
// Get supported algorithm collection from an untrusted collection
static Collection<SignatureAndHashAlgorithm> getSupportedAlgorithms(
AlgorithmConstraints constraints,
Collection<SignatureAndHashAlgorithm> algorithms ) {
Collection<SignatureAndHashAlgorithm> supported = new ArrayList<>();
for (SignatureAndHashAlgorithm sigAlg : algorithms) {
if (sigAlg.priority <= SUPPORTED_ALG_PRIORITY_MAX_NUM &&
constraints.permits(SIGNATURE_PRIMITIVE_SET,
sigAlg.algorithm, null)) {
supported.add(sigAlg);
}
}
return supported;
}
static String[] getAlgorithmNames(
Collection<SignatureAndHashAlgorithm> algorithms) {
ArrayList<String> algorithmNames = new ArrayList<>();
if (algorithms != null) {
for (SignatureAndHashAlgorithm sigAlg : algorithms) {
algorithmNames.add(sigAlg.algorithm);
}
}
String[] array = new String[algorithmNames.size()];
return algorithmNames.toArray(array);
}
static Set<String> getHashAlgorithmNames(
Collection<SignatureAndHashAlgorithm> algorithms) {
Set<String> algorithmNames = new HashSet<>();
if (algorithms != null) {
for (SignatureAndHashAlgorithm sigAlg : algorithms) {
if (sigAlg.hash.value > 0) {
algorithmNames.add(sigAlg.hash.standardName);
}
}
}
return algorithmNames;
}
static String getHashAlgorithmName(SignatureAndHashAlgorithm algorithm) {
return algorithm.hash.standardName;
}
private static void supports(HashAlgorithm hash,
SignatureAlgorithm signature, String algorithm, int priority) {
SignatureAndHashAlgorithm pair =
new SignatureAndHashAlgorithm(hash, signature, algorithm, priority);
if (supportedMap.put(pair.id, pair) != null) {
throw new RuntimeException(
"Duplicate SignatureAndHashAlgorithm definition, id: " +
pair.id);
}
if (priorityMap.put(pair.priority, pair) != null) {
throw new RuntimeException(
"Duplicate SignatureAndHashAlgorithm definition, priority: " +
pair.priority);
}
}
static SignatureAndHashAlgorithm getPreferableAlgorithm(
Collection<SignatureAndHashAlgorithm> algorithms, String expected) {
return SignatureAndHashAlgorithm.getPreferableAlgorithm(
algorithms, expected, null);
}
static SignatureAndHashAlgorithm getPreferableAlgorithm(
Collection<SignatureAndHashAlgorithm> algorithms,
String expected, PrivateKey signingKey) {
int maxDigestLength = getMaxDigestLength(signingKey);
for (SignatureAndHashAlgorithm algorithm : algorithms) {
int signValue = algorithm.id & 0xFF;
if ((expected == null) ||
(expected.equalsIgnoreCase("rsa") &&
signValue == SignatureAlgorithm.RSA.value) ||
(expected.equalsIgnoreCase("dsa") &&
signValue == SignatureAlgorithm.DSA.value) ||
(expected.equalsIgnoreCase("ecdsa") &&
signValue == SignatureAlgorithm.ECDSA.value) ||
(expected.equalsIgnoreCase("ec") &&
signValue == SignatureAlgorithm.ECDSA.value)) {
if (algorithm.priority <= SUPPORTED_ALG_PRIORITY_MAX_NUM &&
algorithm.hash.length <= maxDigestLength) {
return algorithm;
}
}
}
return null;
}
/*
* Need to check key length to match the length of hash value
*/
private static int getMaxDigestLength(PrivateKey signingKey) {
int maxDigestLength = Integer.MAX_VALUE;
// only need to check RSA algorithm at present.
if (signingKey != null &&
"rsa".equalsIgnoreCase(signingKey.getAlgorithm())) {
/*
* RSA keys of 512 bits have been shown to be practically
* breakable, it does not make much sense to use the strong
* hash algorithm for keys whose key size less than 512 bits.
* So it is not necessary to caculate the required max digest
* length exactly.
*
* If key size is greater than or equals to 768, there is no max
* digest length limitation in currect implementation.
*
* If key size is greater than or equals to 512, but less than
* 768, the digest length should be less than or equal to 32 bytes.
*
* If key size is less than 512, the digest length should be
* less than or equal to 20 bytes.
*/
int keySize = KeyUtil.getKeySize(signingKey);
if (keySize >= 768) {
maxDigestLength = HashAlgorithm.SHA512.length;
} else if ((keySize >= 512) && (keySize < 768)) {
maxDigestLength = HashAlgorithm.SHA256.length;
} else if ((keySize > 0) && (keySize < 512)) {
maxDigestLength = HashAlgorithm.SHA1.length;
} // Otherwise, cannot determine the key size, prefer the most
// preferable hash algorithm.
}
return maxDigestLength;
}
static enum HashAlgorithm {
UNDEFINED("undefined", "", -1, -1),
NONE( "none", "NONE", 0, -1),
MD5( "md5", "MD5", 1, 16),
SHA1( "sha1", "SHA-1", 2, 20),
SHA224( "sha224", "SHA-224", 3, 28),
SHA256( "sha256", "SHA-256", 4, 32),
SHA384( "sha384", "SHA-384", 5, 48),
SHA512( "sha512", "SHA-512", 6, 64);
final String name; // not the standard signature algorithm name
// except the UNDEFINED, other names are defined
// by TLS 1.2 protocol
final String standardName; // the standard MessageDigest algorithm name
final int value;
final int length; // digest length in bytes, -1 means not applicable
private HashAlgorithm(String name, String standardName,
int value, int length) {
this.name = name;
this.standardName = standardName;
this.value = value;
this.length = length;
}
static HashAlgorithm valueOf(int value) {
HashAlgorithm algorithm = UNDEFINED;
switch (value) {
case 0:
algorithm = NONE;
break;
case 1:
algorithm = MD5;
break;
case 2:
algorithm = SHA1;
break;
case 3:
algorithm = SHA224;
break;
case 4:
algorithm = SHA256;
break;
case 5:
algorithm = SHA384;
break;
case 6:
algorithm = SHA512;
break;
}
return algorithm;
}
}
static enum SignatureAlgorithm {
UNDEFINED("undefined", -1),
ANONYMOUS("anonymous", 0),
RSA( "rsa", 1),
DSA( "dsa", 2),
ECDSA( "ecdsa", 3);
final String name; // not the standard signature algorithm name
// except the UNDEFINED, other names are defined
// by TLS 1.2 protocol
final int value;
private SignatureAlgorithm(String name, int value) {
this.name = name;
this.value = value;
}
static SignatureAlgorithm valueOf(int value) {
SignatureAlgorithm algorithm = UNDEFINED;
switch (value) {
case 0:
algorithm = ANONYMOUS;
break;
case 1:
algorithm = RSA;
break;
case 2:
algorithm = DSA;
break;
case 3:
algorithm = ECDSA;
break;
}
return algorithm;
}
}
static {
supportedMap = Collections.synchronizedSortedMap(
new TreeMap<Integer, SignatureAndHashAlgorithm>());
priorityMap = Collections.synchronizedSortedMap(
new TreeMap<Integer, SignatureAndHashAlgorithm>());
synchronized (supportedMap) {
int p = SUPPORTED_ALG_PRIORITY_MAX_NUM;
supports(HashAlgorithm.MD5, SignatureAlgorithm.RSA,
"MD5withRSA", --p);
supports(HashAlgorithm.SHA1, SignatureAlgorithm.DSA,
"SHA1withDSA", --p);
supports(HashAlgorithm.SHA1, SignatureAlgorithm.RSA,
"SHA1withRSA", --p);
supports(HashAlgorithm.SHA1, SignatureAlgorithm.ECDSA,
"SHA1withECDSA", --p);
if (Security.getProvider("SunMSCAPI") == null) {
supports(HashAlgorithm.SHA224, SignatureAlgorithm.DSA,
"SHA224withDSA", --p);
supports(HashAlgorithm.SHA224, SignatureAlgorithm.RSA,
"SHA224withRSA", --p);
supports(HashAlgorithm.SHA224, SignatureAlgorithm.ECDSA,
"SHA224withECDSA", --p);
}
supports(HashAlgorithm.SHA256, SignatureAlgorithm.DSA,
"SHA256withDSA", --p);
supports(HashAlgorithm.SHA256, SignatureAlgorithm.RSA,
"SHA256withRSA", --p);
supports(HashAlgorithm.SHA256, SignatureAlgorithm.ECDSA,
"SHA256withECDSA", --p);
supports(HashAlgorithm.SHA384, SignatureAlgorithm.RSA,
"SHA384withRSA", --p);
supports(HashAlgorithm.SHA384, SignatureAlgorithm.ECDSA,
"SHA384withECDSA", --p);
supports(HashAlgorithm.SHA512, SignatureAlgorithm.RSA,
"SHA512withRSA", --p);
supports(HashAlgorithm.SHA512, SignatureAlgorithm.ECDSA,
"SHA512withECDSA", --p);
}
}
}