Skip to content

Commit 18e0b34

Browse files
wangweijwangweij
committedDec 12, 2024
8344137: Update XML Security for Java to 3.0.5
Reviewed-by: mullan
1 parent e9ad27f commit 18e0b34

File tree

24 files changed

+666
-42
lines changed

24 files changed

+666
-42
lines changed
 

‎src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/algorithms/JCEMapper.java

+16
Original file line numberDiff line numberDiff line change
@@ -207,6 +207,22 @@ public static void registerDefaultAlgorithms() {
207207
XMLSignature.ALGO_ID_SIGNATURE_ECDSA_SHA512,
208208
new Algorithm("EC", "SHA512withECDSA", "Signature")
209209
);
210+
algorithmsMap.put(
211+
XMLSignature.ALGO_ID_SIGNATURE_ECDSA_SHA3_224,
212+
new Algorithm("EC", "SHA3-224withECDSA", "Signature")
213+
);
214+
algorithmsMap.put(
215+
XMLSignature.ALGO_ID_SIGNATURE_ECDSA_SHA3_256,
216+
new Algorithm("EC", "SHA3-256withECDSA", "Signature")
217+
);
218+
algorithmsMap.put(
219+
XMLSignature.ALGO_ID_SIGNATURE_ECDSA_SHA3_384,
220+
new Algorithm("EC", "SHA3-384withECDSA", "Signature")
221+
);
222+
algorithmsMap.put(
223+
XMLSignature.ALGO_ID_SIGNATURE_ECDSA_SHA3_512,
224+
new Algorithm("EC", "SHA3-512withECDSA", "Signature")
225+
);
210226
algorithmsMap.put(
211227
XMLSignature.ALGO_ID_SIGNATURE_ECDSA_RIPEMD160,
212228
new Algorithm("EC", "RIPEMD160withECDSA", "Signature")

‎src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/algorithms/MessageDigestAlgorithm.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ public static MessageDigestAlgorithm getInstance(
103103
return new MessageDigestAlgorithm(doc, algorithmURI);
104104
}
105105

106-
private static MessageDigest getDigestInstance(String algorithmURI) throws XMLSignatureException {
106+
public static MessageDigest getDigestInstance(String algorithmURI) throws XMLSignatureException {
107107
String algorithmID = JCEMapper.translateURItoJCEID(algorithmURI);
108108

109109
if (algorithmID == null) {

‎src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/algorithms/SignatureAlgorithm.java

+12
Original file line numberDiff line numberDiff line change
@@ -494,6 +494,18 @@ public static void registerDefaultAlgorithms() {
494494
algorithmHash.put(
495495
XMLSignature.ALGO_ID_SIGNATURE_ECDSA_SHA512, SignatureECDSA.SignatureECDSASHA512.class
496496
);
497+
algorithmHash.put(
498+
XMLSignature.ALGO_ID_SIGNATURE_ECDSA_SHA3_224, SignatureECDSA.SignatureECDSASHA3_224.class
499+
);
500+
algorithmHash.put(
501+
XMLSignature.ALGO_ID_SIGNATURE_ECDSA_SHA3_256, SignatureECDSA.SignatureECDSASHA3_256.class
502+
);
503+
algorithmHash.put(
504+
XMLSignature.ALGO_ID_SIGNATURE_ECDSA_SHA3_384, SignatureECDSA.SignatureECDSASHA3_384.class
505+
);
506+
algorithmHash.put(
507+
XMLSignature.ALGO_ID_SIGNATURE_ECDSA_SHA3_512, SignatureECDSA.SignatureECDSASHA3_512.class
508+
);
497509
algorithmHash.put(
498510
XMLSignature.ALGO_ID_SIGNATURE_ECDSA_RIPEMD160, SignatureECDSA.SignatureECDSARIPEMD160.class
499511
);

‎src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/algorithms/implementations/ECDSAUtils.java

+40
Original file line numberDiff line numberDiff line change
@@ -770,6 +770,46 @@ public static byte[] convertXMLDSIGtoASN1(byte[] xmldsigBytes) throws IOExceptio
770770
"0340340340340340340340340340340340340340340340340340340323c313fab50589703b5ec68d3587fec60d161cc149c1ad4a91",
771771
0x2760)
772772
);
773+
774+
ecCurveDefinitions.add(
775+
new ECCurveDefinition(
776+
"brainpoolP256r1 [RFC 5639]",
777+
"1.3.36.3.3.2.8.1.1.7",
778+
"a9fb57dba1eea9bc3e660a909d838d726e3bf623d52620282013481d1f6e5377",
779+
"7d5a0975fc2c3057eef67530417affe7fb8055c126dc5c6ce94a4b44f330b5d9",
780+
"26dc5c6ce94a4b44f330b5d9bbd77cbf958416295cf7e1ce6bccdc18ff8c07b6",
781+
"8bd2aeb9cb7e57cb2c4b482ffc81b7afb9de27e1e3bd23c23a4453bd9ace3262",
782+
"547ef835c3dac4fd97f8461a14611dc9c27745132ded8e545c1d54c72f046997",
783+
"a9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e82974856a7",
784+
1)
785+
);
786+
787+
ecCurveDefinitions.add(
788+
new ECCurveDefinition(
789+
"brainpoolP384r1 [RFC 5639]",
790+
"1.3.36.3.3.2.8.1.1.11",
791+
"8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b412b1da197fb71123acd3a729901d1a71874700133107ec53",
792+
"7bc382c63d8c150c3c72080ace05afa0c2bea28e4fb22787139165efba91f90f8aa5814a503ad4eb04a8c7dd22ce2826",
793+
"04a8c7dd22ce28268b39b55416f0447c2fb77de107dcd2a62e880ea53eeb62d57cb4390295dbc9943ab78696fa504c11",
794+
"1d1c64f068cf45ffa2a63a81b7c13f6b8847a3e77ef14fe3db7fcafe0cbd10e8e826e03436d646aaef87b2e247d4af1e",
795+
"8abe1d7520f9c2a45cb1eb8e95cfd55262b70b29feec5864e19c054ff99129280e4646217791811142820341263c5315",
796+
"8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b31f166e6cac0425a7cf3ab6af6b7fc3103b883202e9046565",
797+
1)
798+
);
799+
800+
ecCurveDefinitions.add(
801+
new ECCurveDefinition(
802+
"brainpoolP512r1 [RFC 5639]",
803+
"1.3.36.3.3.2.8.1.1.13",
804+
"aadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca703308717d4d9b009bc66842aecda12ae6a380e62881ff2f2d82c68528aa6056583a48f3",
805+
"7830a3318b603b89e2327145ac234cc594cbdd8d3df91610a83441caea9863bc2ded5d5aa8253aa10a2ef1c98b9ac8b57f1117a72bf2c7b9e7c1ac4d77fc94ca",
806+
"3df91610a83441caea9863bc2ded5d5aa8253aa10a2ef1c98b9ac8b57f1117a72bf2c7b9e7c1ac4d77fc94cadc083e67984050b75ebae5dd2809bd638016f723",
807+
"81aee4bdd82ed9645a21322e9c4c6a9385ed9f70b5d916c1b43b62eef4d0098eff3b1f78e2d0d48d50d1687b93b97d5f7c6d5047406a5e688b352209bcb9f822",
808+
"7dde385d566332ecc0eabfa9cf7822fdf209f70024a57b1aa000c55b881f8111b2dcde494a5f485e5bca4bd88a2763aed1ca2b2fa8f0540678cd1e0f3ad80892",
809+
"aadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca90069",
810+
1)
811+
);
812+
773813
}
774814

775815
public static String getOIDFromPublicKey(ECPublicKey ecPublicKey) {

‎src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/algorithms/implementations/SignatureBaseRSA.java

+1-2
Original file line numberDiff line numberDiff line change
@@ -66,8 +66,7 @@ public SignatureBaseRSA() throws XMLSignatureException {
6666
public SignatureBaseRSA(Provider provider) throws XMLSignatureException {
6767
String algorithmID = JCEMapper.translateURItoJCEID(this.engineGetURI());
6868
this.signatureAlgorithm = getSignature(provider, algorithmID);
69-
LOG.debug("Created SignatureRSA using {0} and provider {1}",
70-
algorithmID, signatureAlgorithm.getProvider());
69+
LOG.debug("Created SignatureRSA using {0}", algorithmID);
7170
}
7271

7372
Signature getSignature(Provider provider, String algorithmID)

‎src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/algorithms/implementations/SignatureECDSA.java

+104
Original file line numberDiff line numberDiff line change
@@ -371,6 +371,110 @@ public String engineGetURI() {
371371
}
372372
}
373373

374+
/**
375+
* Class SignatureECDSASHA3-224
376+
*
377+
*/
378+
public static class SignatureECDSASHA3_224 extends SignatureECDSA {
379+
380+
/**
381+
* Constructor SignatureECDSASHA3-224
382+
*
383+
* @throws XMLSignatureException
384+
*/
385+
public SignatureECDSASHA3_224() throws XMLSignatureException {
386+
super();
387+
}
388+
389+
public SignatureECDSASHA3_224(Provider provider) throws XMLSignatureException {
390+
super(provider);
391+
}
392+
393+
/** {@inheritDoc} */
394+
@Override
395+
public String engineGetURI() {
396+
return XMLSignature.ALGO_ID_SIGNATURE_ECDSA_SHA3_224;
397+
}
398+
}
399+
400+
/**
401+
* Class SignatureECDSASHA3-256
402+
*
403+
*/
404+
public static class SignatureECDSASHA3_256 extends SignatureECDSA {
405+
406+
/**
407+
* Constructor SignatureECDSASHA3-256
408+
*
409+
* @throws XMLSignatureException
410+
*/
411+
public SignatureECDSASHA3_256() throws XMLSignatureException {
412+
super();
413+
}
414+
415+
public SignatureECDSASHA3_256(Provider provider) throws XMLSignatureException {
416+
super(provider);
417+
}
418+
419+
/** {@inheritDoc} */
420+
@Override
421+
public String engineGetURI() {
422+
return XMLSignature.ALGO_ID_SIGNATURE_ECDSA_SHA3_256;
423+
}
424+
}
425+
426+
/**
427+
* Class SignatureECDSASHA3-384
428+
*
429+
*/
430+
public static class SignatureECDSASHA3_384 extends SignatureECDSA {
431+
432+
/**
433+
* Constructor SignatureECDSASHA3-384
434+
*
435+
* @throws XMLSignatureException
436+
*/
437+
public SignatureECDSASHA3_384() throws XMLSignatureException {
438+
super();
439+
}
440+
441+
public SignatureECDSASHA3_384(Provider provider) throws XMLSignatureException {
442+
super(provider);
443+
}
444+
445+
/** {@inheritDoc} */
446+
@Override
447+
public String engineGetURI() {
448+
return XMLSignature.ALGO_ID_SIGNATURE_ECDSA_SHA3_384;
449+
}
450+
}
451+
452+
/**
453+
* Class SignatureECDSASHA3-512
454+
*
455+
*/
456+
public static class SignatureECDSASHA3_512 extends SignatureECDSA {
457+
458+
/**
459+
* Constructor SignatureECDSASHA3-512
460+
*
461+
* @throws XMLSignatureException
462+
*/
463+
public SignatureECDSASHA3_512() throws XMLSignatureException {
464+
super();
465+
}
466+
467+
public SignatureECDSASHA3_512(Provider provider) throws XMLSignatureException {
468+
super(provider);
469+
}
470+
471+
/** {@inheritDoc} */
472+
@Override
473+
public String engineGetURI() {
474+
return XMLSignature.ALGO_ID_SIGNATURE_ECDSA_SHA3_512;
475+
}
476+
}
477+
374478
/**
375479
* Class SignatureECDSARIPEMD160
376480
*/

‎src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/keys/KeyInfo.java

+25-15
Original file line numberDiff line numberDiff line change
@@ -32,15 +32,7 @@
3232
import javax.crypto.SecretKey;
3333

3434
import com.sun.org.apache.xml.internal.security.exceptions.XMLSecurityException;
35-
import com.sun.org.apache.xml.internal.security.keys.content.DEREncodedKeyValue;
36-
import com.sun.org.apache.xml.internal.security.keys.content.KeyInfoReference;
37-
import com.sun.org.apache.xml.internal.security.keys.content.KeyName;
38-
import com.sun.org.apache.xml.internal.security.keys.content.KeyValue;
39-
import com.sun.org.apache.xml.internal.security.keys.content.MgmtData;
40-
import com.sun.org.apache.xml.internal.security.keys.content.PGPData;
41-
import com.sun.org.apache.xml.internal.security.keys.content.RetrievalMethod;
42-
import com.sun.org.apache.xml.internal.security.keys.content.SPKIData;
43-
import com.sun.org.apache.xml.internal.security.keys.content.X509Data;
35+
import com.sun.org.apache.xml.internal.security.keys.content.*;
4436
import com.sun.org.apache.xml.internal.security.keys.content.keyvalues.DSAKeyValue;
4537
import com.sun.org.apache.xml.internal.security.keys.content.keyvalues.RSAKeyValue;
4638
import com.sun.org.apache.xml.internal.security.keys.keyresolver.KeyResolver;
@@ -50,7 +42,6 @@
5042
import com.sun.org.apache.xml.internal.security.transforms.Transforms;
5143
import com.sun.org.apache.xml.internal.security.utils.Constants;
5244
import com.sun.org.apache.xml.internal.security.utils.ElementProxy;
53-
import com.sun.org.apache.xml.internal.security.utils.SignatureElementProxy;
5445
import com.sun.org.apache.xml.internal.security.utils.XMLUtils;
5546
import org.w3c.dom.Attr;
5647
import org.w3c.dom.Document;
@@ -88,7 +79,7 @@
8879
* contains the corresponding type.
8980
*
9081
*/
91-
public class KeyInfo extends SignatureElementProxy {
82+
public class KeyInfo extends ElementProxy {
9283

9384
private static final com.sun.org.slf4j.internal.Logger LOG =
9485
com.sun.org.slf4j.internal.LoggerFactory.getLogger(KeyInfo.class);
@@ -231,12 +222,24 @@ public void add(RSAKeyValue rsakeyvalue) {
231222
}
232223

233224
/**
234-
* Method add
225+
* Method adds public key encoded as KeyValue. If public key type is not supported by KeyValue, then
226+
* DEREncodedKeyValue is used. If public key type is not supported by DEREncodedKeyValue, then
227+
* IllegalArgumentException is thrown.
235228
*
236-
* @param pk
229+
* @param pk public key to be added to KeyInfo
237230
*/
238-
public void add(PublicKey pk) {
239-
this.add(new KeyValue(getDocument(), pk));
231+
public void add(PublicKey pk) {
232+
233+
if (KeyValue.isSupportedKeyType(pk)) {
234+
this.add(new KeyValue(getDocument(), pk));
235+
return;
236+
}
237+
238+
try {
239+
this.add(new DEREncodedKeyValue(getDocument(), pk));
240+
} catch (XMLSecurityException ex) {
241+
throw new IllegalArgumentException(ex);
242+
}
240243
}
241244

242245
/**
@@ -772,6 +775,7 @@ public boolean containsKeyInfoReference() {
772775
return this.lengthKeyInfoReference() > 0;
773776
}
774777

778+
775779
/**
776780
* This method returns the public key.
777781
*
@@ -1188,4 +1192,10 @@ public void addStorageResolver(StorageResolver storageResolver) {
11881192
public String getBaseLocalName() {
11891193
return Constants._TAG_KEYINFO;
11901194
}
1195+
1196+
/** {@inheritDoc} */
1197+
@Override
1198+
public String getBaseNamespace() {
1199+
return Constants.SignatureSpecNS;
1200+
}
11911201
}

‎src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/keys/content/DEREncodedKeyValue.java

+4-2
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,10 @@
4141
public class DEREncodedKeyValue extends Signature11ElementProxy implements KeyInfoContent {
4242

4343
/** JCA algorithm key types supported by this implementation. */
44-
private static final String[] supportedKeyTypes = { "RSA", "DSA", "EC"};
44+
private static final String[] supportedKeyTypes = { "RSA", "DSA", "EC",
45+
"DiffieHellman", "DH", "XDH", "X25519", "X448",
46+
"EdDSA", "Ed25519", "Ed448",
47+
"RSASSA-PSS"};
4548

4649
/**
4750
* Constructor DEREncodedKeyValue
@@ -144,5 +147,4 @@ protected byte[] getEncodedDER(PublicKey publicKey) throws XMLSecurityException
144147
throw new XMLSecurityException(e, "DEREncodedKeyValue.UnsupportedPublicKey", exArgs);
145148
}
146149
}
147-
148150
}

‎src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/keys/content/KeyValue.java

+14-1
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,6 @@
4141
* (section 6.4). The KeyValue element may include externally defined public
4242
* keys values represented as PCDATA or element types from an external
4343
* namespace.
44-
*
4544
*/
4645
public class KeyValue extends SignatureElementProxy implements KeyInfoContent {
4746

@@ -120,6 +119,20 @@ public KeyValue(Document doc, PublicKey pk) {
120119
}
121120
}
122121

122+
/**
123+
* Verifies that the XML KeyValue encoding is supported for the given key type. If the
124+
* encoding is supported, it returns true else false.
125+
*
126+
* @return true if the public key has a KeyValue encoding, false otherwise.
127+
*/
128+
public static boolean isSupportedKeyType(PublicKey publicKey) {
129+
130+
return publicKey instanceof java.security.interfaces.DSAPublicKey
131+
|| publicKey instanceof java.security.interfaces.RSAPublicKey
132+
|| publicKey instanceof java.security.interfaces.ECPublicKey;
133+
134+
}
135+
123136
/**
124137
* Constructor KeyValue
125138
*

‎src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/keys/content/keyvalues/ECKeyValue.java

+52-1
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,45 @@ public class ECKeyValue extends Signature11ElementProxy implements KeyValueConte
9191
1
9292
);
9393

94+
/* Supported curve brainpoolP256r1 */
95+
private static final Curve BRAINPOOLP256R1 = initializeCurve(
96+
"brainpoolP256r1 [RFC 5639]",
97+
"1.3.36.3.3.2.8.1.1.7",
98+
"A9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377",
99+
"7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9",
100+
"26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6",
101+
"8BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262",
102+
"547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997",
103+
"A9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7",
104+
1
105+
);
106+
107+
/* Supported curve brainpoolP384r1 */
108+
private static final Curve BRAINPOOLP384R1 = initializeCurve(
109+
"brainpoolP384r1 [RFC 5639]",
110+
"1.3.36.3.3.2.8.1.1.11",
111+
"8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B412B1DA197FB71123ACD3A729901D1A71874700133107EC53",
112+
"7BC382C63D8C150C3C72080ACE05AFA0C2BEA28E4FB22787139165EFBA91F90F8AA5814A503AD4EB04A8C7DD22CE2826",
113+
"04A8C7DD22CE28268B39B55416F0447C2FB77DE107DCD2A62E880EA53EEB62D57CB4390295DBC9943AB78696FA504C11",
114+
"1D1C64F068CF45FFA2A63A81B7C13F6B8847A3E77EF14FE3DB7FCAFE0CBD10E8E826E03436D646AAEF87B2E247D4AF1E",
115+
"8ABE1D7520F9C2A45CB1EB8E95CFD55262B70B29FEEC5864E19C054FF99129280E4646217791811142820341263C5315",
116+
"8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B31F166E6CAC0425A7CF3AB6AF6B7FC3103B883202E9046565",
117+
1
118+
);
119+
120+
/* Supported curve brainpoolP512r1 */
121+
private static final Curve BRAINPOOLP512R1 = initializeCurve(
122+
"brainpoolP512r1 [RFC 5639]",
123+
"1.3.36.3.3.2.8.1.1.13",
124+
"AADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA703308717D4D9B009BC66842AECDA12AE6A380E62881FF2F2D82C68528AA6056583A48F3",
125+
"7830A3318B603B89E2327145AC234CC594CBDD8D3DF91610A83441CAEA9863BC2DED5D5AA8253AA10A2EF1C98B9AC8B57F1117A72BF2C7B9E7C1AC4D77FC94CA",
126+
"3DF91610A83441CAEA9863BC2DED5D5AA8253AA10A2EF1C98B9AC8B57F1117A72BF2C7B9E7C1AC4D77FC94CADC083E67984050B75EBAE5DD2809BD638016F723",
127+
"81AEE4BDD82ED9645A21322E9C4C6A9385ED9F70B5D916C1B43B62EEF4D0098EFF3B1F78E2D0D48D50D1687B93B97D5F7C6D5047406A5E688B352209BCB9F822",
128+
"7DDE385D566332ECC0EABFA9CF7822FDF209F70024A57B1AA000C55B881F8111B2DCDE494A5F485E5BCA4BD88A2763AED1CA2B2FA8F0540678CD1E0F3AD80892",
129+
"AADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA70330870553E5C414CA92619418661197FAC10471DB1D381085DDADDB58796829CA90069",
130+
1
131+
);
132+
94133
private static Curve initializeCurve(String name, String oid,
95134
String sfield, String a, String b,
96135
String x, String y, String n, int h) {
@@ -264,7 +303,13 @@ private static String getCurveOid(ECParameterSpec params) {
264303
match = SECP384R1;
265304
} else if (matchCurve(params, SECP521R1)) {
266305
match = SECP521R1;
267-
} else {
306+
} else if (matchCurve(params, BRAINPOOLP256R1)) {
307+
match = BRAINPOOLP256R1;
308+
} else if (matchCurve(params, BRAINPOOLP384R1)) {
309+
match = BRAINPOOLP384R1;
310+
} else if (matchCurve(params, BRAINPOOLP512R1)) {
311+
match = BRAINPOOLP512R1;
312+
}else {
268313
return null;
269314
}
270315
return match.getObjectId();
@@ -332,6 +377,12 @@ private static ECParameterSpec getECParameterSpec(String oid) {
332377
return SECP384R1;
333378
} else if (oid.equals(SECP521R1.getObjectId())) {
334379
return SECP521R1;
380+
} else if (oid.equals(BRAINPOOLP256R1.getObjectId())) {
381+
return BRAINPOOLP256R1;
382+
} else if (oid.equals(BRAINPOOLP384R1.getObjectId())) {
383+
return BRAINPOOLP384R1;
384+
} else if (oid.equals(BRAINPOOLP512R1.getObjectId())) {
385+
return BRAINPOOLP512R1;
335386
} else {
336387
return null;
337388
}

‎src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/resource/xmlsecurity_de.properties

+1-1
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ algorithms.HMACOutputLengthMax = HMACOutputLength darf nicht grosser als {0} sei
3030
algorithms.HMACOutputLengthMin = HMACOutputLength darf nicht kleiner als {0} sein
3131
algorithms.HMACOutputLengthOnlyForHMAC = Die HMACOutputLength kann nur bei HMAC integrit\u00e4ts Algorithmen angegeben werden
3232
algorithms.MissingRSAPSSParams = RSAPSSParams is a required Element for http://www.w3.org/2007/05/xmldsig-more#rsa-pss
33-
algorithms.NoSuchAlgorithm = Der Algorithmus {0} ist nicht verf\u00fcgbar.
33+
algorithms.NoSuchAlgorithmNoEx = Der Algorithmus {0} ist nicht verf\u00fcgbar.
3434
algorithms.NoSuchAlgorithm = Der Algorithmus {0} ist nicht verf\u00fcgbar. Original Nachricht war\: {1}
3535
algorithms.NoSuchMap = Algorithmus URI "{0}" konnte auf keinen JCE Algorithmus gemappt werden
3636
algorithms.NoSuchProvider = Der angegebene Provider {0} existiert nicht. Original Nachricht war\: {1}

‎src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/signature/XMLSignature.java

+17
Original file line numberDiff line numberDiff line change
@@ -209,6 +209,23 @@ public final class XMLSignature extends SignatureElementProxy {
209209
public static final String ALGO_ID_SIGNATURE_EDDSA_ED448 =
210210
"http://www.w3.org/2021/04/xmldsig-more#eddsa-ed448";
211211

212+
213+
/**Signature - SHA3-224withECDSA */
214+
public static final String ALGO_ID_SIGNATURE_ECDSA_SHA3_224 =
215+
"http://www.w3.org/2021/04/xmldsig-more#ecdsa-sha3-224";
216+
217+
/**Signature - SHA3-256withECDSA */
218+
public static final String ALGO_ID_SIGNATURE_ECDSA_SHA3_256 =
219+
"http://www.w3.org/2021/04/xmldsig-more#ecdsa-sha3-256";
220+
221+
/**Signature - SHA3-384withECDSA */
222+
public static final String ALGO_ID_SIGNATURE_ECDSA_SHA3_384 =
223+
"http://www.w3.org/2021/04/xmldsig-more#ecdsa-sha3-384";
224+
225+
/**Signature - SHA3-512withECDSA */
226+
public static final String ALGO_ID_SIGNATURE_ECDSA_SHA3_512 =
227+
"http://www.w3.org/2021/04/xmldsig-more#ecdsa-sha3-512";
228+
212229
/** Signature - Optional RSASSA-PSS */
213230
public static final String ALGO_ID_SIGNATURE_RSA_PSS =
214231
Constants.XML_DSIG_NS_MORE_07_05 + "rsa-pss";

‎src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/utils/Constants.java

+6
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,9 @@ public final class Constants {
7171
/** The (newer) URL for more algorithms **/
7272
public static final String XML_DSIG_NS_MORE_07_05 = "http://www.w3.org/2007/05/xmldsig-more#";
7373

74+
/** The 2021 xmldsig-more URL for Internet Engineering Task Force (IETF) algorithms **/
75+
public static final String XML_DSIG_NS_MORE_21_04 = "http://www.w3.org/2021/04/xmldsig-more#";
76+
7477
/** The URI for XML spec*/
7578
public static final String XML_LANG_SPACE_SpecNS = "http://www.w3.org/XML/1998/namespace";
7679

@@ -144,6 +147,9 @@ public final class Constants {
144147
/** Tag of Element MaskGenerationFunction **/
145148
public static final String _TAG_MGF = "MaskGenerationFunction";
146149

150+
/** Tag of Element Salt **/
151+
public static final String _TAG_SALT = "Salt";
152+
147153
/** Tag of Element SaltLength **/
148154
public static final String _TAG_SALTLENGTH = "SaltLength";
149155

‎src/java.xml.crypto/share/classes/com/sun/org/apache/xml/internal/security/utils/ElementProxy.java

+3
Original file line numberDiff line numberDiff line change
@@ -512,6 +512,9 @@ public static void registerDefaultPrefixes() throws XMLSecurityException {
512512
"http://www.nue.et-inf.uni-siegen.de/~geuer-pollmann/#xpathFilter", "xx"
513513
);
514514
setNamespacePrefix("http://www.w3.org/2009/xmldsig11#", "dsig11");
515+
setNamespacePrefix("http://www.w3.org/2001/04/xmldsig-more", "rfc4051");
516+
setNamespacePrefix("http://www.w3.org/2007/05/xmldsig-more#", "rfc6931");
517+
setNamespacePrefix("http://www.w3.org/2021/04/xmldsig-more#", "rfc9231");
515518
}
516519

517520
/**

‎src/java.xml.crypto/share/classes/javax/xml/crypto/dsig/SignatureMethod.java

+37-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2005, 2021, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2005, 2024, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -312,6 +312,42 @@ public interface SignatureMethod extends XMLStructure, AlgorithmMethod {
312312
"http://www.w3.org/2007/05/xmldsig-more#sha3-512-rsa-MGF1";
313313

314314

315+
/**
316+
* The <a href="http://www.w3.org/2021/04/xmldsig-more#ecdsa-sha3-224">
317+
* ECDSA-SHA3-224</a> signature method algorithm URI.
318+
*
319+
* @since 25
320+
*/
321+
String ECDSA_SHA3_224 =
322+
"http://www.w3.org/2021/04/xmldsig-more#ecdsa-sha3-224";
323+
324+
/**
325+
* The <a href="http://www.w3.org/2021/04/xmldsig-more#ecdsa-sha3-256">
326+
* ECDSA-SHA3-256</a> signature method algorithm URI.
327+
*
328+
* @since 25
329+
*/
330+
String ECDSA_SHA3_256 =
331+
"http://www.w3.org/2021/04/xmldsig-more#ecdsa-sha3-256";
332+
333+
/**
334+
* The <a href="http://www.w3.org/2021/04/xmldsig-more#ecdsa-sha3-384">
335+
* ECDSA-SHA3-384</a> signature method algorithm URI.
336+
*
337+
* @since 25
338+
*/
339+
String ECDSA_SHA3_384 =
340+
"http://www.w3.org/2021/04/xmldsig-more#ecdsa-sha3-384";
341+
342+
/**
343+
* The <a href="http://www.w3.org/2021/04/xmldsig-more#ecdsa-sha3-512">
344+
* ECDSA-SHA3-512</a> signature method algorithm URI.
345+
*
346+
* @since 25
347+
*/
348+
String ECDSA_SHA3_512 =
349+
"http://www.w3.org/2021/04/xmldsig-more#ecdsa-sha3-512";
350+
315351
/**
316352
* Returns the algorithm-specific input parameters of this
317353
* <code>SignatureMethod</code>.

‎src/java.xml.crypto/share/classes/org/jcp/xml/dsig/internal/dom/DOMKeyInfoFactory.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ public KeyValue newKeyValue(PublicKey key) throws KeyException {
8181
String algorithm = key.getAlgorithm();
8282
if ("DSA".equals(algorithm)) {
8383
return new DOMKeyValue.DSA((DSAPublicKey) key);
84-
} else if ("RSA".equals(algorithm)) {
84+
} else if ("RSA".equals(algorithm) || "RSASSA-PSS".equals(algorithm)) {
8585
return new DOMKeyValue.RSA((RSAPublicKey) key);
8686
} else if ("EC".equals(algorithm)) {
8787
return new DOMKeyValue.EC((ECPublicKey) key);

‎src/java.xml.crypto/share/classes/org/jcp/xml/dsig/internal/dom/DOMKeyValue.java

+76-1
Original file line numberDiff line numberDiff line change
@@ -241,6 +241,33 @@ RSAPublicKey unmarshalKeyValue(Element kvtElem)
241241
RSAPublicKeySpec spec = new RSAPublicKeySpec(modulus, exponent);
242242
return (RSAPublicKey) generatePublicKey(rsakf, spec);
243243
}
244+
245+
@Override
246+
public boolean equals(Object obj) {
247+
if (this == obj) {
248+
return true;
249+
}
250+
if (!(obj instanceof KeyValue)) {
251+
return false;
252+
}
253+
// This equality test allows RSA keys that have different
254+
// algorithms (ex: RSA and RSASSA-PSS) to be equal as long
255+
// as the key is the same.
256+
try {
257+
PublicKey otherKey = ((KeyValue)obj).getPublicKey();
258+
if (!(otherKey instanceof RSAPublicKey)) {
259+
return false;
260+
}
261+
RSAPublicKey otherRSAKey = (RSAPublicKey)otherKey;
262+
RSAPublicKey rsaKey = (RSAPublicKey)getPublicKey();
263+
return rsaKey.getPublicExponent().equals(
264+
otherRSAKey.getPublicExponent())
265+
&& rsaKey.getModulus().equals(otherRSAKey.getModulus());
266+
} catch (KeyException ke) {
267+
// no practical way to determine if the keys are equal
268+
return false;
269+
}
270+
}
244271
}
245272

246273
static final class DSA extends DOMKeyValue<DSAPublicKey> {
@@ -369,6 +396,42 @@ static final class EC extends DOMKeyValue<ECPublicKey> {
369396
1
370397
);
371398

399+
private static final Curve BRAINPOOLP256R1 = initializeCurve(
400+
"brainpoolP256r1 [RFC 5639]",
401+
"1.3.36.3.3.2.8.1.1.7",
402+
"A9FB57DBA1EEA9BC3E660A909D838D726E3BF623D52620282013481D1F6E5377",
403+
"7D5A0975FC2C3057EEF67530417AFFE7FB8055C126DC5C6CE94A4B44F330B5D9",
404+
"26DC5C6CE94A4B44F330B5D9BBD77CBF958416295CF7E1CE6BCCDC18FF8C07B6",
405+
"8BD2AEB9CB7E57CB2C4B482FFC81B7AFB9DE27E1E3BD23C23A4453BD9ACE3262",
406+
"547EF835C3DAC4FD97F8461A14611DC9C27745132DED8E545C1D54C72F046997",
407+
"A9FB57DBA1EEA9BC3E660A909D838D718C397AA3B561A6F7901E0E82974856A7",
408+
1
409+
);
410+
411+
private static final Curve BRAINPOOLP384R1 = initializeCurve(
412+
"brainpoolP384r1 [RFC 5639]",
413+
"1.3.36.3.3.2.8.1.1.11",
414+
"8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B412B1DA197FB71123ACD3A729901D1A71874700133107EC53",
415+
"7BC382C63D8C150C3C72080ACE05AFA0C2BEA28E4FB22787139165EFBA91F90F8AA5814A503AD4EB04A8C7DD22CE2826",
416+
"04A8C7DD22CE28268B39B55416F0447C2FB77DE107DCD2A62E880EA53EEB62D57CB4390295DBC9943AB78696FA504C11",
417+
"1D1C64F068CF45FFA2A63A81B7C13F6B8847A3E77EF14FE3DB7FCAFE0CBD10E8E826E03436D646AAEF87B2E247D4AF1E",
418+
"8ABE1D7520F9C2A45CB1EB8E95CFD55262B70B29FEEC5864E19C054FF99129280E4646217791811142820341263C5315",
419+
"8CB91E82A3386D280F5D6F7E50E641DF152F7109ED5456B31F166E6CAC0425A7CF3AB6AF6B7FC3103B883202E9046565",
420+
1
421+
);
422+
423+
private static final Curve BRAINPOOLP512R1 = initializeCurve(
424+
"brainpoolP512r1 [RFC 5639]",
425+
"1.3.36.3.3.2.8.1.1.13",
426+
"AADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA703308717D4D9B009BC66842AECDA12AE6A380E62881FF2F2D82C68528AA6056583A48F3",
427+
"7830A3318B603B89E2327145AC234CC594CBDD8D3DF91610A83441CAEA9863BC2DED5D5AA8253AA10A2EF1C98B9AC8B57F1117A72BF2C7B9E7C1AC4D77FC94CA",
428+
"3DF91610A83441CAEA9863BC2DED5D5AA8253AA10A2EF1C98B9AC8B57F1117A72BF2C7B9E7C1AC4D77FC94CADC083E67984050B75EBAE5DD2809BD638016F723",
429+
"81AEE4BDD82ED9645A21322E9C4C6A9385ED9F70B5D916C1B43B62EEF4D0098EFF3B1F78E2D0D48D50D1687B93B97D5F7C6D5047406A5E688B352209BCB9F822",
430+
"7DDE385D566332ECC0EABFA9CF7822FDF209F70024A57B1AA000C55B881F8111B2DCDE494A5F485E5BCA4BD88A2763AED1CA2B2FA8F0540678CD1E0F3AD80892",
431+
"AADD9DB8DBE9C48B3FD4E6AE33C9FC07CB308DB3B3C9D20ED6639CCA70330870553E5C414CA92619418661197FAC10471DB1D381085DDADDB58796829CA90069",
432+
1
433+
);
434+
372435
private static Curve initializeCurve(String name, String oid,
373436
String sfield, String a, String b,
374437
String x, String y, String n, int h) {
@@ -448,6 +511,12 @@ private static String getCurveOid(ECParameterSpec params) {
448511
match = SECP384R1;
449512
} else if (matchCurve(params, SECP521R1)) {
450513
match = SECP521R1;
514+
} else if (matchCurve(params, BRAINPOOLP256R1)) {
515+
match = BRAINPOOLP256R1;
516+
} else if (matchCurve(params, BRAINPOOLP384R1)) {
517+
match = BRAINPOOLP384R1;
518+
} else if (matchCurve(params, BRAINPOOLP512R1)) {
519+
match = BRAINPOOLP512R1;
451520
} else {
452521
return null;
453522
}
@@ -485,7 +554,7 @@ void marshalPublicKey(Node parent, Document doc, String dsPrefix,
485554
DOMUtils.setAttribute(namedCurveElem, "URI", "urn:oid:" + oid);
486555
String qname = (prefix == null || prefix.length() == 0)
487556
? "xmlns" : "xmlns:" + prefix;
488-
namedCurveElem.setAttributeNS("http://www.w3.org/2000/xmlns/",
557+
ecKeyValueElem.setAttributeNS("http://www.w3.org/2000/xmlns/",
489558
qname, XMLDSIG_11_XMLNS);
490559
ecKeyValueElem.appendChild(namedCurveElem);
491560
String encoded = XMLUtils.encodeToString(ecPublicKey);
@@ -555,6 +624,12 @@ private static ECParameterSpec getECParameterSpec(String oid) {
555624
return SECP384R1;
556625
} else if (oid.equals(SECP521R1.getObjectId())) {
557626
return SECP521R1;
627+
} else if (oid.equals(BRAINPOOLP256R1.getObjectId())) {
628+
return BRAINPOOLP256R1;
629+
} else if (oid.equals(BRAINPOOLP384R1.getObjectId())) {
630+
return BRAINPOOLP384R1;
631+
} else if (oid.equals(BRAINPOOLP512R1.getObjectId())) {
632+
return BRAINPOOLP512R1;
558633
} else {
559634
return null;
560635
}

‎src/java.xml.crypto/share/classes/org/jcp/xml/dsig/internal/dom/DOMSignatureMethod.java

+104
Original file line numberDiff line numberDiff line change
@@ -100,6 +100,14 @@ public abstract class DOMSignatureMethod extends AbstractDOMSignatureMethod {
100100
"http://www.w3.org/2021/04/xmldsig-more#eddsa-ed25519";
101101
static final String ED448 =
102102
"http://www.w3.org/2021/04/xmldsig-more#eddsa-ed448";
103+
static final String ECDSA_SHA3_224 =
104+
"http://www.w3.org/2021/04/xmldsig-more#ecdsa-sha3-224";
105+
static final String ECDSA_SHA3_256 =
106+
"http://www.w3.org/2021/04/xmldsig-more#ecdsa-sha3-256";
107+
static final String ECDSA_SHA3_384 =
108+
"http://www.w3.org/2021/04/xmldsig-more#ecdsa-sha3-384";
109+
static final String ECDSA_SHA3_512 =
110+
"http://www.w3.org/2021/04/xmldsig-more#ecdsa-sha3-512";
103111

104112
// see RFC 6931 for these algorithm definitions
105113
static final String ECDSA_RIPEMD160 =
@@ -241,6 +249,14 @@ static SignatureMethod unmarshal(Element smElem) throws MarshalException {
241249
return new SHA384withECDSA(smElem);
242250
} else if (alg.equals(ECDSA_SHA512)) {
243251
return new SHA512withECDSA(smElem);
252+
} else if (alg.equals(ECDSA_SHA3_224)) {
253+
return new SHA3_224withECDSA(smElem);
254+
} else if (alg.equals(ECDSA_SHA3_256)) {
255+
return new SHA3_256withECDSA(smElem);
256+
} else if (alg.equals(ECDSA_SHA3_384)) {
257+
return new SHA3_384withECDSA(smElem);
258+
} else if (alg.equals(ECDSA_SHA3_512)) {
259+
return new SHA3_512withECDSA(smElem);
244260
} else if (alg.equals(ECDSA_RIPEMD160)) {
245261
return new RIPEMD160withECDSA(smElem);
246262
} else if (alg.equals(SignatureMethod.HMAC_SHA1)) {
@@ -1160,6 +1176,94 @@ String getJCAFallbackAlgorithm() {
11601176
}
11611177
}
11621178

1179+
static final class SHA3_224withECDSA extends AbstractECDSASignatureMethod {
1180+
SHA3_224withECDSA(AlgorithmParameterSpec params)
1181+
throws InvalidAlgorithmParameterException {
1182+
super(params);
1183+
}
1184+
SHA3_224withECDSA(Element dmElem) throws MarshalException {
1185+
super(dmElem);
1186+
}
1187+
@Override
1188+
public String getAlgorithm() {
1189+
return ECDSA_SHA3_224;
1190+
}
1191+
@Override
1192+
String getJCAAlgorithm() {
1193+
return "SHA3-224withECDSAinP1363Format";
1194+
}
1195+
@Override
1196+
String getJCAFallbackAlgorithm() {
1197+
return "SHA3-224withECDSA";
1198+
}
1199+
}
1200+
1201+
static final class SHA3_256withECDSA extends AbstractECDSASignatureMethod {
1202+
SHA3_256withECDSA(AlgorithmParameterSpec params)
1203+
throws InvalidAlgorithmParameterException {
1204+
super(params);
1205+
}
1206+
SHA3_256withECDSA(Element dmElem) throws MarshalException {
1207+
super(dmElem);
1208+
}
1209+
@Override
1210+
public String getAlgorithm() {
1211+
return ECDSA_SHA3_256;
1212+
}
1213+
@Override
1214+
String getJCAAlgorithm() {
1215+
return "SHA3-256withECDSAinP1363Format";
1216+
}
1217+
@Override
1218+
String getJCAFallbackAlgorithm() {
1219+
return "SHA3-256withECDSA";
1220+
}
1221+
}
1222+
1223+
static final class SHA3_384withECDSA extends AbstractECDSASignatureMethod {
1224+
SHA3_384withECDSA(AlgorithmParameterSpec params)
1225+
throws InvalidAlgorithmParameterException {
1226+
super(params);
1227+
}
1228+
SHA3_384withECDSA(Element dmElem) throws MarshalException {
1229+
super(dmElem);
1230+
}
1231+
@Override
1232+
public String getAlgorithm() {
1233+
return ECDSA_SHA3_384;
1234+
}
1235+
@Override
1236+
String getJCAAlgorithm() {
1237+
return "SHA3-384withECDSAinP1363Format";
1238+
}
1239+
@Override
1240+
String getJCAFallbackAlgorithm() {
1241+
return "SHA3-384withECDSA";
1242+
}
1243+
}
1244+
1245+
static final class SHA3_512withECDSA extends AbstractECDSASignatureMethod {
1246+
SHA3_512withECDSA(AlgorithmParameterSpec params)
1247+
throws InvalidAlgorithmParameterException {
1248+
super(params);
1249+
}
1250+
SHA3_512withECDSA(Element dmElem) throws MarshalException {
1251+
super(dmElem);
1252+
}
1253+
@Override
1254+
public String getAlgorithm() {
1255+
return ECDSA_SHA3_512;
1256+
}
1257+
@Override
1258+
String getJCAAlgorithm() {
1259+
return "SHA3-512withECDSAinP1363Format";
1260+
}
1261+
@Override
1262+
String getJCAFallbackAlgorithm() {
1263+
return "SHA3-512withECDSA";
1264+
}
1265+
}
1266+
11631267
static final class RIPEMD160withECDSA extends AbstractECDSASignatureMethod {
11641268
RIPEMD160withECDSA(AlgorithmParameterSpec params)
11651269
throws InvalidAlgorithmParameterException {

‎src/java.xml.crypto/share/classes/org/jcp/xml/dsig/internal/dom/DOMXMLSignatureFactory.java

+8
Original file line numberDiff line numberDiff line change
@@ -345,6 +345,14 @@ public SignatureMethod newSignatureMethod(String algorithm,
345345
return new DOMSignatureMethod.SHA384withECDSA(params);
346346
} else if (algorithm.equals(DOMSignatureMethod.ECDSA_SHA512)) {
347347
return new DOMSignatureMethod.SHA512withECDSA(params);
348+
} else if (algorithm.equals(DOMSignatureMethod.ECDSA_SHA3_224)) {
349+
return new DOMSignatureMethod.SHA3_224withECDSA(params);
350+
} else if (algorithm.equals(DOMSignatureMethod.ECDSA_SHA3_256)) {
351+
return new DOMSignatureMethod.SHA3_256withECDSA(params);
352+
} else if (algorithm.equals(DOMSignatureMethod.ECDSA_SHA3_384)) {
353+
return new DOMSignatureMethod.SHA3_384withECDSA(params);
354+
} else if (algorithm.equals(DOMSignatureMethod.ECDSA_SHA3_512)) {
355+
return new DOMSignatureMethod.SHA3_512withECDSA(params);
348356
} else if (algorithm.equals(DOMSignatureMethod.ECDSA_RIPEMD160)) {
349357
return new DOMSignatureMethod.RIPEMD160withECDSA(params);
350358
} else if (algorithm.equals(DOMSignatureMethod.ED25519)) {

‎src/java.xml.crypto/share/classes/org/jcp/xml/dsig/internal/dom/XMLDSigRI.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -142,7 +142,7 @@ public Object newInstance(Object ctrParamObj)
142142
@SuppressWarnings("removal")
143143
public XMLDSigRI() {
144144
// This is the JDK XMLDSig provider, synced from
145-
// Apache Santuario XML Security for Java, version 3.0.3
145+
// Apache Santuario XML Security for Java, version 3.0.5
146146
super("XMLDSig", VER, INFO);
147147

148148
final Provider p = this;

‎src/java.xml.crypto/share/legal/santuario.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
## Apache Santuario v3.0.3
1+
## Apache Santuario v3.0.5
22

33
### Apache 2.0 License
44
```
@@ -211,7 +211,7 @@ limitations under the License.
211211
```
212212
213213
Apache Santuario - XML Security for Java
214-
Copyright 1999-2023 The Apache Software Foundation
214+
Copyright 1999-2024 The Apache Software Foundation
215215
216216
This product includes software developed at
217217
The Apache Software Foundation (http://www.apache.org/).
@@ -223,5 +223,5 @@ The development of this software was partly funded by the European
223223
Commission in the <WebSig> project in the ISIS Programme.
224224
225225
This product contains software that is
226-
copyright (c) 2021, Oracle and/or its affiliates.
226+
copyright (c) 2021, 2023, Oracle and/or its affiliates.
227227
```

‎test/jdk/javax/xml/crypto/dsig/GenerationTests.java

+41-4
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2005, 2023, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2005, 2024, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -24,7 +24,7 @@
2424
/**
2525
* @test
2626
* @bug 4635230 6283345 6303830 6824440 6867348 7094155 8038184 8038349 8046949
27-
* 8046724 8079693 8177334 8205507 8210736 8217878 8241306 8305972
27+
* 8046724 8079693 8177334 8205507 8210736 8217878 8241306 8305972 8344137
2828
* @summary Basic unit tests for generating XML Signatures with JSR 105
2929
* @modules java.base/sun.security.util
3030
* java.base/sun.security.x509
@@ -99,6 +99,7 @@ public class GenerationTests {
9999
private static SignatureMethod dsaSha1, dsaSha256,
100100
rsaSha1, rsaSha224, rsaSha256, rsaSha384, rsaSha512,
101101
ecdsaSha1, ecdsaSha224, ecdsaSha256, ecdsaSha384, ecdsaSha512,
102+
ecdsaSha3_224, ecdsaSha3_256, ecdsaSha3_384, ecdsaSha3_512,
102103
hmacSha1, hmacSha224, hmacSha256, hmacSha384, hmacSha512,
103104
rsaSha1mgf1, rsaSha224mgf1, rsaSha256mgf1, rsaSha384mgf1, rsaSha512mgf1,
104105
rsaSha3_224mgf1, rsaSha3_256mgf1, rsaSha3_384mgf1, rsaSha3_512mgf1,
@@ -244,9 +245,9 @@ public class GenerationTests {
244245
})
245246
.toArray(String[]::new);
246247

247-
// As of JDK 22, the number of defined algorithms are...
248+
// As of JDK 25, the number of defined algorithms are...
248249
static {
249-
if (allSignatureMethods.length != 29
250+
if (allSignatureMethods.length != 33
250251
|| allDigestMethods.length != 9) {
251252
System.out.println(Arrays.toString(allSignatureMethods));
252253
System.out.println(Arrays.toString(allDigestMethods));
@@ -305,6 +306,10 @@ public static void main(String args[]) throws Exception {
305306
test_create_signature_enveloping_p256_sha256();
306307
test_create_signature_enveloping_p256_sha384();
307308
test_create_signature_enveloping_p256_sha512();
309+
test_create_signature_enveloping_p256_sha3_224();
310+
test_create_signature_enveloping_p256_sha3_256();
311+
test_create_signature_enveloping_p256_sha3_384();
312+
test_create_signature_enveloping_p256_sha3_512();
308313
test_create_signature_enveloping_p384_sha1();
309314
test_create_signature_enveloping_p521_sha1();
310315
test_create_signature_enveloping_ed25519();
@@ -559,6 +564,10 @@ private static void setup() throws Exception {
559564
ecdsaSha256 = fac.newSignatureMethod(SignatureMethod.ECDSA_SHA256, null);
560565
ecdsaSha384 = fac.newSignatureMethod(SignatureMethod.ECDSA_SHA384, null);
561566
ecdsaSha512 = fac.newSignatureMethod(SignatureMethod.ECDSA_SHA512, null);
567+
ecdsaSha3_224 = fac.newSignatureMethod(SignatureMethod.ECDSA_SHA3_224, null);
568+
ecdsaSha3_256 = fac.newSignatureMethod(SignatureMethod.ECDSA_SHA3_256, null);
569+
ecdsaSha3_384 = fac.newSignatureMethod(SignatureMethod.ECDSA_SHA3_384, null);
570+
ecdsaSha3_512 = fac.newSignatureMethod(SignatureMethod.ECDSA_SHA3_512, null);
562571

563572
ed25519 = fac.newSignatureMethod(SignatureMethod.ED25519, null);
564573
ed448 = fac.newSignatureMethod(SignatureMethod.ED448, null);
@@ -892,6 +901,34 @@ static void test_create_signature_enveloping_p256_sha512() throws Exception {
892901
System.out.println();
893902
}
894903

904+
static void test_create_signature_enveloping_p256_sha3_224() throws Exception {
905+
System.out.println("* Generating signature-enveloping-p256-sha3_224.xml");
906+
test_create_signature_enveloping(sha1, ecdsaSha3_224, p256ki,
907+
getECPrivateKey("P256"), kvks, false, true);
908+
System.out.println();
909+
}
910+
911+
static void test_create_signature_enveloping_p256_sha3_256() throws Exception {
912+
System.out.println("* Generating signature-enveloping-p256-sha3_256.xml");
913+
test_create_signature_enveloping(sha1, ecdsaSha3_256, p256ki,
914+
getECPrivateKey("P256"), kvks, false, true);
915+
System.out.println();
916+
}
917+
918+
static void test_create_signature_enveloping_p256_sha3_384() throws Exception {
919+
System.out.println("* Generating signature-enveloping-p256-sha3_384.xml");
920+
test_create_signature_enveloping(sha1, ecdsaSha3_384, p256ki,
921+
getECPrivateKey("P256"), kvks, false, true);
922+
System.out.println();
923+
}
924+
925+
static void test_create_signature_enveloping_p256_sha3_512() throws Exception {
926+
System.out.println("* Generating signature-enveloping-p256-sha3_512.xml");
927+
test_create_signature_enveloping(sha1, ecdsaSha3_512, p256ki,
928+
getECPrivateKey("P256"), kvks, false, true);
929+
System.out.println();
930+
}
931+
895932
static void test_create_signature_enveloping_p384_sha1() throws Exception {
896933
System.out.println("* Generating signature-enveloping-p384-sha1.xml");
897934
test_create_signature_enveloping(sha1, ecdsaSha1, p384ki,

‎test/jdk/javax/xml/crypto/dsig/PSS.java

+61
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
/*
2+
* Copyright (c) 2024, Oracle and/or its affiliates. All rights reserved.
3+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+
*
5+
* This code is free software; you can redistribute it and/or modify it
6+
* under the terms of the GNU General Public License version 2 only, as
7+
* published by the Free Software Foundation.
8+
*
9+
* This code is distributed in the hope that it will be useful, but WITHOUT
10+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11+
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
12+
* version 2 for more details (a copy is included in the LICENSE file that
13+
* accompanied this code).
14+
*
15+
* You should have received a copy of the GNU General Public License version
16+
* 2 along with this work; if not, write to the Free Software Foundation,
17+
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
18+
*
19+
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
20+
* or visit www.oracle.com if you need additional information or have any
21+
* questions.
22+
*/
23+
24+
import jdk.test.lib.Asserts;
25+
import jdk.test.lib.security.XMLUtils;
26+
27+
import javax.xml.crypto.dsig.DigestMethod;
28+
import javax.xml.crypto.dsig.SignatureMethod;
29+
import javax.xml.crypto.dsig.spec.RSAPSSParameterSpec;
30+
import java.security.KeyPairGenerator;
31+
import java.security.spec.MGF1ParameterSpec;
32+
import java.security.spec.PSSParameterSpec;
33+
34+
/**
35+
* @test
36+
* @bug 8344137
37+
* @summary check RSASSA-PSS key
38+
* @library /test/lib
39+
* @modules java.xml.crypto
40+
*/
41+
public class PSS {
42+
43+
public static void main(String[] args) throws Exception {
44+
45+
var doc = XMLUtils.string2doc("<a><b>Text</b>Raw</a>");
46+
var kpg = KeyPairGenerator.getInstance("RSASSA-PSS");
47+
kpg.initialize(2048);
48+
var keyPair = kpg.generateKeyPair();
49+
50+
var pspec = new PSSParameterSpec("SHA-384", "MGF1",
51+
MGF1ParameterSpec.SHA512, 48,
52+
PSSParameterSpec.TRAILER_FIELD_BC);
53+
54+
var signed = XMLUtils.signer(keyPair.getPrivate(), keyPair.getPublic())
55+
.dm(DigestMethod.SHA384)
56+
.sm(SignatureMethod.RSA_PSS, new RSAPSSParameterSpec(pspec))
57+
.sign(doc);
58+
59+
Asserts.assertTrue(XMLUtils.validator().validate(signed));
60+
}
61+
}

‎test/lib/jdk/test/lib/security/XMLUtils.java

+38-8
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2021, 2023, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2021, 2024, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -198,6 +198,7 @@ public static class Signer {
198198
String dm = DigestMethod.SHA256;
199199
String cm = CanonicalizationMethod.EXCLUSIVE;
200200
String tr = Transform.ENVELOPED;
201+
Map<String, Object> props = new HashMap<>();
201202

202203
public Signer(PrivateKey privateKey) {
203204
this.privateKey = Objects.requireNonNull(privateKey);
@@ -247,14 +248,19 @@ public Signer sm(String method) throws Exception {
247248
return sm(method, null);
248249
}
249250

251+
public Signer prop(String name, Object o) {
252+
props.put(name, o);
253+
return this;
254+
}
255+
250256
// Signs different sources
251257

252258
// Signs an XML file in detached mode
253259
public Document sign(URI uri) throws Exception {
254260
Document newDocument = DocumentBuilderFactory.newInstance()
255261
.newDocumentBuilder().newDocument();
256262
FAC.newXMLSignature(buildSignedInfo(uri.toString()), buildKeyInfo()).sign(
257-
new DOMSignContext(privateKey, newDocument));
263+
withProps(new DOMSignContext(privateKey, newDocument)));
258264
return newDocument;
259265
}
260266

@@ -264,7 +270,8 @@ public Document sign(URI base, URI ref) throws Exception {
264270
.newDocumentBuilder().newDocument();
265271
DOMSignContext ctxt = new DOMSignContext(privateKey, newDocument);
266272
ctxt.setBaseURI(base.toString());
267-
FAC.newXMLSignature(buildSignedInfo(ref.toString()), buildKeyInfo()).sign(ctxt);
273+
FAC.newXMLSignature(buildSignedInfo(ref.toString()), buildKeyInfo())
274+
.sign(withProps(ctxt));
268275
return newDocument;
269276
}
270277

@@ -275,7 +282,7 @@ public Document sign(Document document) throws Exception {
275282
.transform(new DOMSource(document), result);
276283
Document newDocument = (Document) result.getNode();
277284
FAC.newXMLSignature(buildSignedInfo(""), buildKeyInfo()).sign(
278-
new DOMSignContext(privateKey, newDocument.getDocumentElement()));
285+
withProps(new DOMSignContext(privateKey, newDocument.getDocumentElement())));
279286
return newDocument;
280287
}
281288

@@ -290,7 +297,7 @@ public Document signEnveloping(Document document, String id, String ref) throws
290297
id, null, null)),
291298
null,
292299
null)
293-
.sign(new DOMSignContext(privateKey, newDocument));
300+
.sign(withProps(new DOMSignContext(privateKey, newDocument)));
294301
return newDocument;
295302
}
296303

@@ -308,7 +315,7 @@ public Document sign(byte[] data) throws Exception {
308315
"object", null, null)),
309316
null,
310317
null)
311-
.sign(new DOMSignContext(privateKey, newDocument));
318+
.sign(withProps(new DOMSignContext(privateKey, newDocument)));
312319
return newDocument;
313320
}
314321

@@ -325,10 +332,18 @@ public Document sign(String str) throws Exception {
325332
"object", null, null)),
326333
null,
327334
null)
328-
.sign(new DOMSignContext(privateKey, newDocument));
335+
.sign(withProps(new DOMSignContext(privateKey, newDocument)));
329336
return newDocument;
330337
}
331338

339+
// Add props to a context
340+
private DOMSignContext withProps(DOMSignContext ctxt) {
341+
for (var e : props.entrySet()) {
342+
ctxt.setProperty(e.getKey(), e.getValue());
343+
}
344+
return ctxt;
345+
}
346+
332347
// Builds a SignedInfo for a string reference
333348
private SignedInfo buildSignedInfo(String ref) throws Exception {
334349
return buildSignedInfo(FAC.newReference(
@@ -426,6 +441,7 @@ public static class Validator {
426441
private Boolean secureValidation = null;
427442
private String baseURI = null;
428443
private final KeyStore ks;
444+
Map<String, Object> props = new HashMap<>();
429445

430446
public Validator(KeyStore ks) {
431447
this.ks = ks;
@@ -441,6 +457,11 @@ public Validator baseURI(String base) {
441457
return this;
442458
}
443459

460+
public Validator prop(String name, Object o) {
461+
props.put(name, o);
462+
return this;
463+
}
464+
444465
public boolean validate(Document document) throws Exception {
445466
return validate(document, null);
446467
}
@@ -471,12 +492,21 @@ public KeySelectorResult select(KeyInfo ki, Purpose p,
471492
secureValidation);
472493
}
473494
return XMLSignatureFactory.getInstance("DOM")
474-
.unmarshalXMLSignature(valContext).validate(valContext);
495+
.unmarshalXMLSignature(valContext)
496+
.validate(withProps(valContext));
475497
}
476498
}
477499
return false;
478500
}
479501

502+
// Add props to a context
503+
private DOMValidateContext withProps(DOMValidateContext ctxt) {
504+
for (var e : props.entrySet()) {
505+
ctxt.setProperty(e.getKey(), e.getValue());
506+
}
507+
return ctxt;
508+
}
509+
480510
// Find public key from KeyInfo, ks will be used if it's KeyName
481511
private static class MyKeySelector extends KeySelector {
482512
private final KeyStore ks;

0 commit comments

Comments
 (0)
Please sign in to comment.