1 /*
2 * Licensed to the Apache Software Foundation (ASF) under one
3 * or more contributor license agreements. See the NOTICE file
4 * distributed with this work for additional information
5 * regarding copyright ownership. The ASF licenses this file
6 * to you under the Apache License, Version 2.0 (the
7 * "License"); you may not use this file except in compliance
8 * with the License. You may obtain a copy of the License at
9 *
10 * http://www.apache.org/licenses/LICENSE-2.0
11 *
12 * Unless required by applicable law or agreed to in writing,
13 * software distributed under the License is distributed on an
14 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15 * KIND, either express or implied. See the License for the
16 * specific language governing permissions and limitations
17 * under the License.
18 *
19 */
20
21 package org.apache.directory.server.kerberos.shared.crypto.encryption;
22
23
24 import java.util.Collections;
25 import java.util.HashMap;
26 import java.util.Iterator;
27 import java.util.Map;
28 import java.util.Set;
29
30 import javax.security.auth.kerberos.KerberosKey;
31 import javax.security.auth.kerberos.KerberosPrincipal;
32
33 import org.apache.directory.server.kerberos.shared.messages.value.EncryptionKey;
34
35
36 /**
37 * A factory class for producing {@link KerberosKey}'s. For a list of desired cipher
38 * types, Kerberos string-to-key functions are used to derive keys for DES-, DES3-, AES-,
39 * and RC4-based encryption types.
40 *
41 * @author <a href="mailto:dev@directory.apache.org">Apache Directory Project</a>
42 * @version $Rev$, $Date$
43 */
44 public class KerberosKeyFactory
45 {
46 /** A map of default encryption types mapped to cipher names. */
47 private static final Map<EncryptionType, String> DEFAULT_CIPHERS;
48
49 static
50 {
51 Map<EncryptionType, String> map = new HashMap<EncryptionType, String>();
52
53 map.put( EncryptionType.DES_CBC_MD5, "DES" );
54 map.put( EncryptionType.DES3_CBC_SHA1_KD, "DESede" );
55 map.put( EncryptionType.RC4_HMAC, "ArcFourHmac" );
56 map.put( EncryptionType.AES128_CTS_HMAC_SHA1_96, "AES128" );
57 map.put( EncryptionType.AES256_CTS_HMAC_SHA1_96, "AES256" );
58
59 DEFAULT_CIPHERS = Collections.unmodifiableMap( map );
60 }
61
62
63 /**
64 * Get a map of KerberosKey's for a given principal name and passphrase. The default set
65 * of encryption types is used.
66 *
67 * @param principalName The principal name to use for key derivation.
68 * @param passPhrase The passphrase to use for key derivation.
69 * @return The map of KerberosKey's.
70 */
71 public static Map<EncryptionType, EncryptionKey> getKerberosKeys( String principalName, String passPhrase )
72 {
73 return getKerberosKeys( principalName, passPhrase, DEFAULT_CIPHERS.keySet() );
74 }
75
76
77 /**
78 * Get a list of KerberosKey's for a given principal name and passphrase and list of cipher
79 * types to derive keys for.
80 *
81 * @param principalName The principal name to use for key derivation.
82 * @param passPhrase The passphrase to use for key derivation.
83 * @param ciphers The set of ciphers to derive keys for.
84 * @return The list of KerberosKey's.
85 */
86 public static Map<EncryptionType, EncryptionKey> getKerberosKeys( String principalName, String passPhrase,
87 Set<EncryptionType> ciphers )
88 {
89 KerberosPrincipal principal = new KerberosPrincipal( principalName );
90 Map<EncryptionType, EncryptionKey> kerberosKeys = new HashMap<EncryptionType, EncryptionKey>();
91
92 Iterator<EncryptionType> it = ciphers.iterator();
93 while ( it.hasNext() )
94 {
95 EncryptionType encryptionType = it.next();
96 String algorithm = DEFAULT_CIPHERS.get( encryptionType );
97
98 try
99 {
100 KerberosKey kerberosKey = new KerberosKey( principal, passPhrase.toCharArray(), algorithm );
101 EncryptionKey encryptionKey = new EncryptionKey( encryptionType, kerberosKey.getEncoded(), kerberosKey
102 .getVersionNumber() );
103
104 kerberosKeys.put( encryptionType, encryptionKey );
105 }
106 catch ( IllegalArgumentException iae )
107 {
108 // Algorithm AES256 not enabled by policy.
109 // Algorithm ArcFourHmac not supported by IBM JREs.
110 // Algorithm DESede not supported by IBM JREs.
111 }
112 }
113
114 return kerberosKeys;
115 }
116 }