com.hp.keystone

Class PkiUtils

java.lang.Object

com.hp.keystone.PkiUtils

public class PkiUtils
extends Object

PKI utilities for Keystone token validation.

Author:

John Borz

Field Summary

Fields

Modifier and Type	Field and Description
protected static org.slf4j.Logger	log

Constructor Summary

Constructors

Constructor and Description
PkiUtils()

Method Summary

Methods

Modifier and Type	Method and Description
static byte[]	decodeBase64Message(String message) Convert a JSON friendly PKI token to a standard base64 encoded string.
static byte[]	decodeToken(String token) Decode a CMS token retrieved from keystone by stripping headers, footers, and other extraneous characters to produce a PKCS7 compatible signed message which can be used to instantiate a sun PCKS7 object.
static byte[]	decompressPkizBytes(byte[] compressedBytes)
static String	getMD5Hash(String token)
static boolean	isTokenPKIType(String token) Checks the token type i.e.
static byte[]	validatePkiToken(Certificate certificate, String token) Verify signature by checking all signers and bailing as soon as a signerInfo verification fails
static byte[]	validatePkiToken(File certificateFile, String token) Verify signature by checking all signers and bailing as soon as a signerInfo verification fails

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

log

protected static final org.slf4j.Logger log

Constructor Detail

PkiUtils

public PkiUtils()

Method Detail

decompressPkizBytes

public static byte[] decompressPkizBytes(byte[] compressedBytes)
                                  throws IOException,
                                         DataFormatException

Throws:

IOException

DataFormatException

decodeBase64Message

public static byte[] decodeBase64Message(String message)
                                  throws IOException,
                                         DataFormatException

Convert a JSON friendly PKI token to a standard base64 encoded string.

Parameters:

message - - Base64 encoded message.

Returns:

- Byte array containing the base64 decoded message.

Throws:

IOException

DataFormatException

validatePkiToken

public static byte[] validatePkiToken(File certificateFile,
                      String token)
                               throws AuthenticationException

Verify signature by checking all signers and bailing as soon as a signerInfo verification fails

Parameters:

certificateFile - - Signing certificate public key

token - - PKCS7 message containing the signed text and the signature.

Returns:

byte array of plaintext of signed message

Throws:

AuthenticationException

decodeToken

public static byte[] decodeToken(String token)
                          throws IOException,
                                 DataFormatException

Decode a CMS token retrieved from keystone by stripping headers, footers, and other extraneous characters to produce a PKCS7 compatible signed message which can be used to instantiate a sun PCKS7 object.

Parameters:

token - - A string formatted PKI or PKIZ token

Returns:

DER formatted PKCS7 message.

Throws:

IOException

DataFormatException

validatePkiToken

public static byte[] validatePkiToken(Certificate certificate,
                      String token)
                               throws AuthenticationException

Verify signature by checking all signers and bailing as soon as a signerInfo verification fails

Parameters:

certificate - - Signing certificate public key

token - - PKCS7 message containing the signed text and the signature.

Returns:

Boolean indicating whether all signatures in the message are valid.

Throws:

AuthenticationException

getMD5Hash

public static String getMD5Hash(String token)
                         throws UnsupportedEncodingException,
                                NoSuchAlgorithmException

Throws:

UnsupportedEncodingException

NoSuchAlgorithmException

isTokenPKIType

public static boolean isTokenPKIType(String token)

Checks the token type i.e. PKI/PKIZ or UUID

Parameters:

token - the token need to checked

Returns:

true if the token is PKI type otherwise return false