org.jboss.sasl.digest

Class DigestMD5Base

java.lang.Object

org.jboss.sasl.digest.AbstractSaslImpl

org.jboss.sasl.digest.DigestMD5Base

Direct Known Subclasses:

DigestMD5Client, DigestMD5Server

abstract class DigestMD5Base
extends AbstractSaslImpl

Utility class for DIGEST-MD5 mechanism. Provides utility methods and contains two inner classes which implement the SecurityCtx interface. The inner classes provide the funtionality to allow for quality-of-protection (QOP) with integrity checking and privacy.

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
(package private) class	DigestMD5Base.DigestIntegrity Implementation of the SecurityCtx interface allowing for messages between the client and server to be integrity checked.
(package private) class	DigestMD5Base.DigestPrivacy Implementation of the SecurityCtx interface allowing for messages between the client and server to be integrity checked and encrypted.

Field Summary

Fields

Modifier and Type	Field and Description
protected java.lang.String	authzid
protected javax.security.auth.callback.CallbackHandler	cbh
protected static byte[]	CIPHER_MASKS
protected static java.lang.String[]	CIPHER_TOKENS
protected static int	DEFAULT_MAXBUF
protected static int	DES
protected static byte	DES_3_STRENGTH
protected static byte	DES_STRENGTH
protected static int	DES3
private static java.lang.String	DI_CLASS_NAME
private static java.lang.String	DP_CLASS_NAME
protected static byte[]	EMPTY_BYTE_ARRAY
private static int	ENCODED_NONCE_SIZE
protected java.lang.String	encoding
protected byte[]	H_A1
private static java.lang.String[]	JCE_CIPHER_NAME
private static org.jboss.logging.Logger	log
private static java.math.BigInteger	MASK
protected static int	MAX_CHALLENGE_LENGTH
protected static int	MAX_RESPONSE_LENGTH
protected java.lang.String	negotiatedCipher
protected java.lang.String	negotiatedQop
protected java.lang.String	negotiatedRealm
protected java.lang.String	negotiatedStrength
protected byte[]	nonce
private static char[]	pem_array This array maps the characters to their 6 bit values
protected static java.lang.String	PRE_DIGESTED_PROPERTY
private static int	RAW_NONCE_SIZE
protected static int	RC4
protected static int	RC4_40
protected static byte	RC4_40_STRENGTH
protected static int	RC4_56
protected static byte	RC4_56_STRENGTH
protected static byte	RC4_STRENGTH
protected SecurityCtx	secCtx
private static java.lang.String	SECURITY_LAYER_MARKER
protected int	step
protected static byte	UNSET
protected boolean	useUTF8

Fields inherited from class org.jboss.sasl.digest.AbstractSaslImpl

allQop, completed, HIGH_STRENGTH, integrity, INTEGRITY_ONLY_PROTECTION, LOW_STRENGTH, MAX_SEND_BUF, MEDIUM_STRENGTH, myClassName, NO_PROTECTION, privacy, PRIVACY_PROTECTION, qop, rawSendSize, recvMaxBufSize, sendMaxBufSize, strength

Constructor Summary

Constructors

Modifier	Constructor and Description
protected	DigestMD5Base(java.util.Map<java.lang.String,?> props, java.lang.String className, int firstStep, javax.security.auth.callback.CallbackHandler cbh) Constucts an instance of DigestMD5Base.

Method Summary

Modifier and Type	Method and Description
private static byte[]	addDesParity(byte[] input, int offset, int len) Expands a 7-byte array into an 8-byte array that contains parity bits The binary format of a cryptographic key is: (B1,B2,...,B7,P1,B8,...B14,P2,B15,...,B49,P7,B50,...,B56,P8) where (B1,B2,...,B56) are the independent bits of a DES key and (PI,P2,...,P8) are reserved for parity bits computed on the preceding seven independent bits and set so that the parity of the octet is odd, i.e., there is an odd number of "1" bits in the octet.
protected byte[]	binaryToHex(byte[] digest) Convert a byte array to hexadecimal string.
void	dispose()
private static void	extractDirective(java.lang.String key, byte[] value, java.lang.String[] keyTable, byte[][] valueTable, java.util.List<byte[]> realmChoices, int realmIndex) Processes directive/value pairs from the digest-challenge and fill out the challengeVal array.
protected static byte[]	generateNonce()
protected byte[]	generateResponseValue(java.lang.String authMethod, java.lang.String digestUriValue, java.lang.String qopValue, byte[] urpHash, byte[] nonceValue, byte[] cNonceValue, int nonceCount, byte[] authzidValue) Assembles response-value for digest-response.
protected byte[]	generateResponseValue(java.lang.String authMethod, java.lang.String digestUriValue, java.lang.String qopValue, java.lang.String usernameValue, java.lang.String realmValue, char[] passwdValue, byte[] nonceValue, byte[] cNonceValue, int nonceCount, byte[] authzidValue) Assembles response-value for digest-response.
java.lang.String	getMechanismName() Retrieves the SASL mechanism IANA name.
java.lang.Object	getNegotiatedProperty(java.lang.String propName) Retrieves the negotiated property.
protected static byte[]	getPlatformCiphers()
private static boolean	isLws(byte b)
private static javax.crypto.SecretKey	makeDesKeys(byte[] input, java.lang.String desStrength) Create parity-adjusted keys suitable for DES / DESede encryption.
private static boolean	needEscape(char ch)
private static boolean	needEscape(java.lang.String str)
protected static java.lang.String	nonceCountToHex(int count) Takes 'nonceCount' value and returns HEX value of the value.
protected static byte[][]	parseDirectives(byte[] buf, java.lang.String[] keyTable, java.util.List<byte[]> realmChoices, int realmIndex) Parses digest-challenge string, extracting each token and value(s)
protected static java.lang.String	quotedStringValue(java.lang.String str)
private static void	setParityBit(byte[] key) Sets the parity bit (0th bit) in each byte so that each byte contains an odd number of 1's.
private static int	skipLws(byte[] buf, int start)
byte[]	unwrap(byte[] incoming, int start, int len) Unwrap the incoming message using the wrap method of the secCtx object instance.
byte[]	wrap(byte[] outgoing, int start, int len) Wrap outgoing bytes using the wrap method of the secCtx object instance.
protected static void	writeQuotedStringValue(java.io.ByteArrayOutputStream out, byte[] buf) Checks if a byte[] contains characters that must be quoted and write the resulting, possibly escaped, characters to out.

Methods inherited from class org.jboss.sasl.digest.AbstractSaslImpl

combineMasks, findPreferredMask, intToNetworkByteOrder, isComplete, networkByteOrderToInt, parseQop

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

log

private static final org.jboss.logging.Logger log

DI_CLASS_NAME

private static final java.lang.String DI_CLASS_NAME

DP_CLASS_NAME

private static final java.lang.String DP_CLASS_NAME

MAX_CHALLENGE_LENGTH

protected static final int MAX_CHALLENGE_LENGTH

See Also:

Constant Field Values

MAX_RESPONSE_LENGTH

protected static final int MAX_RESPONSE_LENGTH

See Also:

Constant Field Values

DEFAULT_MAXBUF

protected static final int DEFAULT_MAXBUF

See Also:

Constant Field Values

DES3

protected static final int DES3

See Also:

Constant Field Values

RC4

protected static final int RC4

See Also:

Constant Field Values

DES

protected static final int DES

See Also:

Constant Field Values

RC4_56

protected static final int RC4_56

See Also:

Constant Field Values

RC4_40

protected static final int RC4_40

See Also:

Constant Field Values

CIPHER_TOKENS

protected static final java.lang.String[] CIPHER_TOKENS

JCE_CIPHER_NAME

private static final java.lang.String[] JCE_CIPHER_NAME

DES_3_STRENGTH

protected static final byte DES_3_STRENGTH

See Also:

Constant Field Values

RC4_STRENGTH

protected static final byte RC4_STRENGTH

See Also:

Constant Field Values

DES_STRENGTH

protected static final byte DES_STRENGTH

See Also:

Constant Field Values

RC4_56_STRENGTH

protected static final byte RC4_56_STRENGTH

See Also:

Constant Field Values

RC4_40_STRENGTH

protected static final byte RC4_40_STRENGTH

See Also:

Constant Field Values

UNSET

protected static final byte UNSET

See Also:

Constant Field Values

CIPHER_MASKS

protected static final byte[] CIPHER_MASKS

SECURITY_LAYER_MARKER

private static final java.lang.String SECURITY_LAYER_MARKER

See Also:

Constant Field Values

EMPTY_BYTE_ARRAY

protected static final byte[] EMPTY_BYTE_ARRAY

PRE_DIGESTED_PROPERTY

protected static final java.lang.String PRE_DIGESTED_PROPERTY

See Also:

Constant Field Values

step

protected int step

cbh

protected javax.security.auth.callback.CallbackHandler cbh

secCtx

protected SecurityCtx secCtx

H_A1

protected byte[] H_A1

nonce

protected byte[] nonce

negotiatedStrength

protected java.lang.String negotiatedStrength

negotiatedCipher

protected java.lang.String negotiatedCipher

negotiatedQop

protected java.lang.String negotiatedQop

negotiatedRealm

protected java.lang.String negotiatedRealm

useUTF8

protected boolean useUTF8

encoding

protected java.lang.String encoding

authzid

protected java.lang.String authzid

pem_array

private static final char[] pem_array

This array maps the characters to their 6 bit values

RAW_NONCE_SIZE

private static final int RAW_NONCE_SIZE

See Also:

Constant Field Values

ENCODED_NONCE_SIZE

private static final int ENCODED_NONCE_SIZE

See Also:

Constant Field Values

MASK

private static final java.math.BigInteger MASK

Constructor Detail

DigestMD5Base

protected DigestMD5Base(java.util.Map<java.lang.String,?> props,
                        java.lang.String className,
                        int firstStep,
                        javax.security.auth.callback.CallbackHandler cbh)
                 throws javax.security.sasl.SaslException

Constucts an instance of DigestMD5Base. Calls super constructor to parse properties for mechanism.

Parameters:

props - A map of property/value pairs

className - name of class to use for logging

firstStep - number of first step in authentication state machine

digestUri - digestUri used in authentication

cbh - callback handler used to get info required for auth

Throws:

javax.security.sasl.SaslException - If invalid value found in props.

Method Detail

getMechanismName

public java.lang.String getMechanismName()

Retrieves the SASL mechanism IANA name.

Returns:

The String "DIGEST-MD5"

unwrap

public byte[] unwrap(byte[] incoming,
                     int start,
                     int len)
              throws javax.security.sasl.SaslException

Unwrap the incoming message using the wrap method of the secCtx object instance.

Parameters:

incoming - The byte array containing the incoming bytes.

start - The offset from which to read the byte array.

len - The number of bytes to read from the offset.

Returns:

The unwrapped message according to either the integrity or privacy quality-of-protection specifications.

Throws:

javax.security.sasl.SaslException - if an error occurs when unwrapping the incoming message

wrap

public byte[] wrap(byte[] outgoing,
                   int start,
                   int len)
            throws javax.security.sasl.SaslException

Wrap outgoing bytes using the wrap method of the secCtx object instance.

Parameters:

outgoing - The byte array containing the outgoing bytes.

start - The offset from which to read the byte array.

len - The number of bytes to read from the offset.

Returns:

The wrapped message according to either the integrity or privacy quality-of-protection specifications.

Throws:

javax.security.sasl.SaslException - if an error occurs when wrapping the outgoing message

dispose

public void dispose()
             throws javax.security.sasl.SaslException

Throws:

javax.security.sasl.SaslException

getNegotiatedProperty

public java.lang.Object getNegotiatedProperty(java.lang.String propName)

Description copied from class: AbstractSaslImpl

Retrieves the negotiated property.

Overrides:

getNegotiatedProperty in class AbstractSaslImpl

generateNonce

protected static byte[] generateNonce()

writeQuotedStringValue

protected static void writeQuotedStringValue(java.io.ByteArrayOutputStream out,
                                             byte[] buf)

Checks if a byte[] contains characters that must be quoted and write the resulting, possibly escaped, characters to out.

needEscape

private static boolean needEscape(java.lang.String str)

needEscape

private static boolean needEscape(char ch)

quotedStringValue

protected static java.lang.String quotedStringValue(java.lang.String str)

binaryToHex

protected byte[] binaryToHex(byte[] digest)
                      throws java.io.UnsupportedEncodingException

Convert a byte array to hexadecimal string.

Parameters:

digest - a non-null byte array

Returns:

a non-null String contain the HEX value

Throws:

java.io.UnsupportedEncodingException

getPlatformCiphers

protected static byte[] getPlatformCiphers()

generateResponseValue

protected byte[] generateResponseValue(java.lang.String authMethod,
                                       java.lang.String digestUriValue,
                                       java.lang.String qopValue,
                                       java.lang.String usernameValue,
                                       java.lang.String realmValue,
                                       char[] passwdValue,
                                       byte[] nonceValue,
                                       byte[] cNonceValue,
                                       int nonceCount,
                                       byte[] authzidValue)
                                throws java.security.NoSuchAlgorithmException,
                                       java.io.IOException

Assembles response-value for digest-response.

Parameters:

authMethod - "AUTHENTICATE" for client-generated response; "" for server-generated response

Returns:

A non-null byte array containing the repsonse-value.

Throws:

java.security.NoSuchAlgorithmException - if the platform does not have MD5 digest support.

java.io.UnsupportedEncodingException - if a an error occurs encoding a string into either Latin-1 or UTF-8.

java.io.IOException - if an error occurs writing to the output byte array buffer.

generateResponseValue

protected byte[] generateResponseValue(java.lang.String authMethod,
                                       java.lang.String digestUriValue,
                                       java.lang.String qopValue,
                                       byte[] urpHash,
                                       byte[] nonceValue,
                                       byte[] cNonceValue,
                                       int nonceCount,
                                       byte[] authzidValue)
                                throws java.security.NoSuchAlgorithmException,
                                       java.io.IOException

Assembles response-value for digest-response.

Parameters:

authMethod - "AUTHENTICATE" for client-generated response; "" for server-generated response

Returns:

A non-null byte array containing the repsonse-value.

Throws:

java.security.NoSuchAlgorithmException - if the platform does not have MD5 digest support.

java.io.UnsupportedEncodingException - if a an error occurs encoding a string into either Latin-1 or UTF-8.

java.io.IOException - if an error occurs writing to the output byte array buffer.

nonceCountToHex

protected static java.lang.String nonceCountToHex(int count)

Takes 'nonceCount' value and returns HEX value of the value.

Returns:

A non-null String representing the current NONCE-COUNT

parseDirectives

protected static byte[][] parseDirectives(byte[] buf,
                                          java.lang.String[] keyTable,
                                          java.util.List<byte[]> realmChoices,
                                          int realmIndex)
                                   throws javax.security.sasl.SaslException

Parses digest-challenge string, extracting each token and value(s)

Parameters:

buf - A non-null digest-challenge string.

Throws:

javax.security.sasl.SaslException - if the buf cannot be parsed according to RFC 2831

isLws

private static boolean isLws(byte b)

skipLws

private static int skipLws(byte[] buf,
                           int start)

extractDirective

private static void extractDirective(java.lang.String key,
                                     byte[] value,
                                     java.lang.String[] keyTable,
                                     byte[][] valueTable,
                                     java.util.List<byte[]> realmChoices,
                                     int realmIndex)
                              throws javax.security.sasl.SaslException

Processes directive/value pairs from the digest-challenge and fill out the challengeVal array.

Parameters:

key - A non-null String challenge token name.

value - A non-null String token value.

Throws:

javax.security.sasl.SaslException - if a either the key or the value is null

setParityBit

private static void setParityBit(byte[] key)

Sets the parity bit (0th bit) in each byte so that each byte contains an odd number of 1's.

addDesParity

private static byte[] addDesParity(byte[] input,
                                   int offset,
                                   int len)

Expands a 7-byte array into an 8-byte array that contains parity bits The binary format of a cryptographic key is: (B1,B2,...,B7,P1,B8,...B14,P2,B15,...,B49,P7,B50,...,B56,P8) where (B1,B2,...,B56) are the independent bits of a DES key and (PI,P2,...,P8) are reserved for parity bits computed on the preceding seven independent bits and set so that the parity of the octet is odd, i.e., there is an odd number of "1" bits in the octet.

makeDesKeys

private static javax.crypto.SecretKey makeDesKeys(byte[] input,
                                                  java.lang.String desStrength)
                                           throws java.security.NoSuchAlgorithmException,
                                                  java.security.InvalidKeyException,
                                                  java.security.spec.InvalidKeySpecException

Create parity-adjusted keys suitable for DES / DESede encryption.

Parameters:

input - A non-null byte array containing key material for DES / DESede.

desStrength - A string specifying eithe a DES or a DESede key.

Returns:

SecretKey An instance of either DESKeySpec or DESedeKeySpec.

Throws:

java.security.NoSuchAlgorithmException - if the either the DES or DESede algorithms cannote be lodaed by JCE.

java.security.InvalidKeyException - if an invalid array of bytes is used as a key for DES or DESede.

java.security.spec.InvalidKeySpecException - in an invalid parameter is passed to either te DESKeySpec of the DESedeKeySpec constructors.