Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

RHCS-4630 (part 2) Add SHA-2 support to Server-side Keygen #4629

Merged
merged 1 commit into from
Nov 29, 2023
Merged

RHCS-4630 (part 2) Add SHA-2 support to Server-side Keygen #4629

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 38 additions & 2 deletions base/ca/src/main/java/com/netscape/cms/profile/common/CAEnrollProfile.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -329,13 +329,49 @@ public void execute(IRequest request)
// fake key replaced;
// need to compute/replace SKI as well if present

Extension ext = CertUtils.getExtension(PKIXExtensions.SubjectKey_Id.toString(), info);
SubjectKeyIdentifierExtension ext = (SubjectKeyIdentifierExtension) CertUtils.getExtension(PKIXExtensions.SubjectKey_Id.toString(), info);
if (ext != null) {
logger.debug(method + "found SubjectKey_Id extension");
/*
* determine message digest algorithm:
* the "old_ski" was generated based on the profile
* from the "fake key",
* so we could use it's length to determine the size
* of the new hash.
*
* Message digest can be controlled by the messageDigest
* parameter in the subjectKeyIdentifier extension in a
* profile. e.g.
* policyset.caCertSet.8.default.params.messageDigest=SHA-256
*/
String messageDigest = "SHA-1"; // default; len==20
KeyIdentifier old_ski = null;
try {
old_ski = (KeyIdentifier) ext.get(SubjectKeyIdentifierExtension.KEY_ID);
} catch (IOException e) {
old_ski = null;
}
if (old_ski != null) {
byte[] old_ski_val = old_ski.getIdentifier();
if (old_ski_val != null) {
int old_ski_len = old_ski_val.length;

if (old_ski_len == 32) {
messageDigest = "SHA-256";
} else if (old_ski_len == 48) {
messageDigest = "SHA-384";
} else if (old_ski_len == 64) {
messageDigest = "SHA-512";
}
}
}
logger.debug(method + "ServerSideKeygen message digest alg == " + messageDigest);
// compute keyId
X509Key realkey = (X509Key)
certKey.get(CertificateX509Key.KEY);
byte[] hash = CryptoUtil.generateKeyIdentifier(realkey.getKey());
byte[] hash = CryptoUtil.generateKeyIdentifier(realkey.getKey(), messageDigest);
int new_ski_len = hash.length;
logger.debug(method + "ServerSideKeygen hash len = " + new_ski_len);
KeyIdentifier id = new KeyIdentifier(hash);
SubjectKeyIdentifierExtension skiExt =
new SubjectKeyIdentifierExtension(id.getIdentifier());
Expand Down
Loading