Skip to content

Commit d8a14d5

Browse files
mkleenemkleene
committed
try this way
1 parent 6905740 commit d8a14d5

12 files changed

Lines changed: 254 additions & 144 deletions

File tree

‎pom.xml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@
1717
<grpc.version>1.75.0</grpc.version>
1818
<protobuf.version>4.29.2</protobuf.version>
1919
<bouncycastle.version>1.82</bouncycastle.version>
20+
<bc-fips.version>2.1.2</bc-fips.version>
21+
<bcpkix-fips.version>2.1.11</bcpkix-fips.version>
22+
<bctls-fips.version>2.1.23</bctls-fips.version>
2023
<bytebuddy.version>1.18.3</bytebuddy.version>
2124
<!-- JaCoCo Properties -->
2225
<jacoco.version>0.8.13</jacoco.version>
@@ -123,6 +126,26 @@
123126
<artifactId>bcprov-jdk18on</artifactId>
124127
<version>${bouncycastle.version}</version>
125128
</dependency>
129+
<dependency>
130+
<groupId>org.bouncycastle</groupId>
131+
<artifactId>bctls-jdk18on</artifactId>
132+
<version>${bouncycastle.version}</version>
133+
</dependency>
134+
<dependency>
135+
<groupId>org.bouncycastle</groupId>
136+
<artifactId>bc-fips</artifactId>
137+
<version>${bc-fips.version}</version>
138+
</dependency>
139+
<dependency>
140+
<groupId>org.bouncycastle</groupId>
141+
<artifactId>bcpkix-fips</artifactId>
142+
<version>${bcpkix-fips.version}</version>
143+
</dependency>
144+
<dependency>
145+
<groupId>org.bouncycastle</groupId>
146+
<artifactId>bctls-fips</artifactId>
147+
<version>${bctls-fips.version}</version>
148+
</dependency>
126149
<!--
127150
Pin Byte Buddy for test-time Mockito instrumentation on newer JVMs (e.g. Java 21).
128151
This does NOT add a runtime dependency; it only manages the version used by modules.

‎sdk/pom.xml‎

Lines changed: 62 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
<connect.version>0.7.2</connect.version>
1818
<okhttp.version>4.12.0</okhttp.version>
1919
<platform.branch>protocol/go/v0.16.0</platform.branch>
20+
<!-- test.java.security.file is set by the `non-fips` (default) or `fips` profile -->
2021
</properties>
2122
<dependencies>
2223
<!-- Logging Dependencies -->
@@ -148,17 +149,7 @@
148149
<version>6.0.53</version>
149150
<scope>provided</scope>
150151
</dependency>
151-
<!-- Crypto Dependencies -->
152-
<dependency>
153-
<groupId>org.bouncycastle</groupId>
154-
<artifactId>bcpkix-jdk18on</artifactId>
155-
<scope>test</scope>
156-
</dependency>
157-
<dependency>
158-
<groupId>org.bouncycastle</groupId>
159-
<artifactId>bcprov-jdk18on</artifactId>
160-
<scope>test</scope>
161-
</dependency>
152+
<!-- Crypto Dependencies are pulled in via the `non-fips` (default) or `fips` profile -->
162153
<!-- Testing Dependencies -->
163154
<dependency>
164155
<groupId>org.junit.jupiter</groupId>
@@ -473,11 +464,69 @@
473464
</execution>
474465
</executions>
475466
</plugin>
467+
<plugin>
468+
<groupId>org.apache.maven.plugins</groupId>
469+
<artifactId>maven-surefire-plugin</artifactId>
470+
<configuration>
471+
<argLine>-Djava.security.properties=${test.java.security.file}</argLine>
472+
</configuration>
473+
</plugin>
476474
</plugins>
477475
</build>
478-
<!--profile
479-
to execute fuzz test -->
480476
<profiles>
477+
<profile>
478+
<id>non-fips</id>
479+
<activation>
480+
<activeByDefault>true</activeByDefault>
481+
</activation>
482+
<properties>
483+
<test.java.security.file>${project.basedir}/src/test/java.security.test</test.java.security.file>
484+
</properties>
485+
<dependencies>
486+
<dependency>
487+
<groupId>org.bouncycastle</groupId>
488+
<artifactId>bcprov-jdk18on</artifactId>
489+
<scope>runtime</scope>
490+
</dependency>
491+
<dependency>
492+
<groupId>org.bouncycastle</groupId>
493+
<artifactId>bcpkix-jdk18on</artifactId>
494+
<scope>runtime</scope>
495+
</dependency>
496+
<dependency>
497+
<groupId>org.bouncycastle</groupId>
498+
<artifactId>bctls-jdk18on</artifactId>
499+
<scope>runtime</scope>
500+
</dependency>
501+
</dependencies>
502+
</profile>
503+
<profile>
504+
<id>fips</id>
505+
<activation>
506+
<activeByDefault>false</activeByDefault>
507+
</activation>
508+
<properties>
509+
<test.java.security.file>${project.basedir}/src/test/java.security.fips.test</test.java.security.file>
510+
</properties>
511+
<dependencies>
512+
<dependency>
513+
<groupId>org.bouncycastle</groupId>
514+
<artifactId>bc-fips</artifactId>
515+
<scope>runtime</scope>
516+
</dependency>
517+
<dependency>
518+
<groupId>org.bouncycastle</groupId>
519+
<artifactId>bcpkix-fips</artifactId>
520+
<scope>runtime</scope>
521+
</dependency>
522+
<dependency>
523+
<groupId>org.bouncycastle</groupId>
524+
<artifactId>bctls-fips</artifactId>
525+
<scope>runtime</scope>
526+
</dependency>
527+
</dependencies>
528+
</profile>
529+
<!-- profile to execute fuzz test -->
481530
<profile>
482531
<id>fuzz</id>
483532
<activation>

‎sdk/src/main/java/io/opentdf/platform/sdk/AesGcm.java‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
import javax.crypto.BadPaddingException;
44
import javax.crypto.Cipher;
55
import javax.crypto.IllegalBlockSizeException;
6+
import javax.crypto.KeyGenerator;
67
import javax.crypto.NoSuchPaddingException;
78
import javax.crypto.SecretKey;
89
import javax.crypto.spec.GCMParameterSpec;
@@ -20,10 +21,27 @@
2021
public class AesGcm {
2122
public static final int GCM_NONCE_LENGTH = 12; // in bytes
2223
public static final int GCM_TAG_LENGTH = 16; // in bytes
24+
public static final int GCM_KEY_SIZE_BITS = 256;
25+
private static final String KEY_ALGORITHM = "AES";
2326
private static final String CIPHER_TRANSFORM = "AES/GCM/NoPadding";
2427

2528
private final SecretKey key;
2629

30+
/**
31+
* <p>Generate a fresh 256-bit AES key using the JCA {@link KeyGenerator}.</p>
32+
*
33+
* @return the encoded key bytes
34+
*/
35+
public static byte[] generateKey() {
36+
try {
37+
KeyGenerator keyGenerator = KeyGenerator.getInstance(KEY_ALGORITHM);
38+
keyGenerator.init(GCM_KEY_SIZE_BITS);
39+
return keyGenerator.generateKey().getEncoded();
40+
} catch (NoSuchAlgorithmException e) {
41+
throw new SDKException("error generating AES key", e);
42+
}
43+
}
44+
2745

2846
/**
2947
* <p>Return symmetric key</p>

‎sdk/src/main/java/io/opentdf/platform/sdk/TDF.java‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -98,8 +98,6 @@ private static byte[] tdfECKeySaltCompute() {
9898
private static final String kTDFAsZip = "zip";
9999
private static final String kTDFZipReference = "reference";
100100

101-
private static final SecureRandom sRandom = new SecureRandom();
102-
103101
private static final Gson gson = new GsonBuilder().create();
104102

105103
static class EncryptedMetadata {
@@ -162,8 +160,7 @@ private void prepareManifest(Config.TDFConfig tdfConfig, Map<String, List<KASInf
162160
String splitID = split.getKey();
163161

164162
// Symmetric key
165-
byte[] symKey = new byte[GCM_KEY_SIZE];
166-
sRandom.nextBytes(symKey);
163+
byte[] symKey = AesGcm.generateKey();
167164
symKeys.add(symKey);
168165

169166
// Add policyBinding

‎sdk/src/test/java.security.fips.test‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
ssl.KeyManagerFactory.algorithm=PKIX
2+
ssl.TrustManagerFactory.algorithm=PKIX
3+
4+
securerandom.strongAlgorithms=DRBG:SUN
5+
6+
security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
7+
security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider fips:BCFIPS
8+
security.provider.3=SUN
9+
security.provider.4=
10+
security.provider.5=
11+
security.provider.6=
12+
security.provider.7=
13+
security.provider.8=
14+
security.provider.9=
15+
security.provider.10=
16+
security.provider.11=
17+
security.provider.12=
18+
security.provider.13=
19+
security.provider.14=

‎sdk/src/test/java.security.test‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
keystore.type.compat=false
2+
ssl.KeyManagerFactory.algorithm=PKIX
3+
ssl.TrustManagerFactory.algorithm=PKIX
4+
5+
# TODO: get rid of the BC providers, we should not need them
6+
security.provider.1=org.bouncycastle.jce.provider.BouncyCastleProvider
7+
security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider
8+
security.provider.3=SUN

‎sdk/src/test/java/io/opentdf/platform/sdk/CryptoProviderSetupExtension.java‎

Lines changed: 0 additions & 26 deletions
This file was deleted.

0 commit comments

Comments
 (0)