org.jboss.sasl.digest

Class DigestMD5Base.DigestIntegrity

java.lang.Object

org.jboss.sasl.digest.DigestMD5Base.DigestIntegrity

All Implemented Interfaces:

SecurityCtx

Direct Known Subclasses:

DigestMD5Base.DigestPrivacy

Enclosing class:

DigestMD5Base

class DigestMD5Base.DigestIntegrity
extends java.lang.Object
implements SecurityCtx

Implementation of the SecurityCtx interface allowing for messages between the client and server to be integrity checked. After a successful DIGEST-MD5 authentication, integtrity checking is invoked if the SASL QOP (quality-of-protection) is set to 'auth-int'.

Further details on the integrity-protection mechanism can be found at section 2.3 - Integrity protection in the RFC2831 definition.

Field Summary

Fields

Modifier and Type	Field and Description
private static java.lang.String	CLIENT_INT_MAGIC
protected byte[]	messageType
protected byte[]	myKi
protected int	mySeqNum
protected byte[]	peerKi
protected int	peerSeqNum
protected byte[]	sequenceNum
private static java.lang.String	SVR_INT_MAGIC

Constructor Summary

Constructors

Constructor and Description
DigestIntegrity(boolean clientMode) Initializes DigestIntegrity implementation of SecurityCtx to enable DIGEST-MD5 integrity checking.

Method Summary

Modifier and Type	Method and Description
private void	generateIntegrityKeyPair(boolean clientMode) Generate client-server, server-client key pairs for DIGEST-MD5 integrity checking.
protected byte[]	getHMAC(byte[] Ki, byte[] seqnum, byte[] msg, int start, int len) Generates MAC to be appended onto out-going messages.
protected void	incrementSeqNum() Increment own sequence number and set answer in NBO sequenceNum field.
byte[]	unwrap(byte[] incoming, int start, int len) Return verified message without MAC - only if the received MAC and re-generated MAC are the same.
byte[]	wrap(byte[] outgoing, int start, int len) Append MAC onto outgoing message.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

CLIENT_INT_MAGIC

private static final java.lang.String CLIENT_INT_MAGIC

See Also:

Constant Field Values

SVR_INT_MAGIC

private static final java.lang.String SVR_INT_MAGIC

See Also:

Constant Field Values

myKi

protected byte[] myKi

peerKi

protected byte[] peerKi

mySeqNum

protected int mySeqNum

peerSeqNum

protected int peerSeqNum

messageType

protected final byte[] messageType

sequenceNum

protected final byte[] sequenceNum

Constructor Detail

DigestIntegrity

DigestIntegrity(boolean clientMode)
         throws javax.security.sasl.SaslException

Initializes DigestIntegrity implementation of SecurityCtx to enable DIGEST-MD5 integrity checking.

Throws:

javax.security.sasl.SaslException - if an error is encountered generating the key-pairs for integrity checking.

Method Detail

generateIntegrityKeyPair

private void generateIntegrityKeyPair(boolean clientMode)
                               throws java.io.IOException,
                                      java.security.NoSuchAlgorithmException

Generate client-server, server-client key pairs for DIGEST-MD5 integrity checking.

Throws:

java.io.UnsupportedEncodingException - if the UTF-8 encoding is not supported on the platform.

java.io.IOException - if an error occurs when writing to or from the byte array output buffers.

java.security.NoSuchAlgorithmException - if the MD5 message digest algorithm cannot loaded.

wrap

public byte[] wrap(byte[] outgoing,
                   int start,
                   int len)
            throws javax.security.sasl.SaslException

Append MAC onto outgoing message.

Specified by:

wrap in interface SecurityCtx

Parameters:

outgoing - A non-null byte array containing the outgoing message.

start - The offset from which to read the byte array.

len - The non-zero number of bytes for be read from the offset.

Returns:

The message including the integrity MAC

Throws:

javax.security.sasl.SaslException - if an error is encountered converting a string into a UTF-8 byte encoding, or if the MD5 message digest algorithm cannot be found or if there is an error writing to the byte array output buffers.

unwrap

public byte[] unwrap(byte[] incoming,
                     int start,
                     int len)
              throws javax.security.sasl.SaslException

Return verified message without MAC - only if the received MAC and re-generated MAC are the same.

Specified by:

unwrap in interface SecurityCtx

Parameters:

incoming - A non-null byte array containing the incoming message.

start - The offset from which to read the byte array.

len - The non-zero number of bytes to read from the offset position.

Returns:

The verified message or null if integrity checking fails.

Throws:

javax.security.sasl.SaslException - if an error is encountered converting a string into a UTF-8 byte encoding, or if the MD5 message digest algorithm cannot be found or if there is an error writing to the byte array output buffers

getHMAC

protected byte[] getHMAC(byte[] Ki,
                         byte[] seqnum,
                         byte[] msg,
                         int start,
                         int len)
                  throws javax.security.sasl.SaslException

Generates MAC to be appended onto out-going messages.

Parameters:

Ki - A non-null byte array containing the key for the digest

seqnum - A non-null byte array contain the sequence number

msg - The message to be digested

start - The offset from which to read the msg byte array

len - The non-zero number of bytes to be read from the offset

Returns:

The MAC of a message.

Throws:

javax.security.sasl.SaslException - if an error occurs when generating MAC.

incrementSeqNum

protected void incrementSeqNum()

Increment own sequence number and set answer in NBO sequenceNum field.