APIdia Launch Partner
Top Description Inners Fields Constructors Methods
sun.security.jgss.krb5

pack-priv abstract Class MessageToken

extends Krb5Token
Class Inheritance
Known Direct Subclasses
sun.security.jgss.krb5.MicToken, sun.security.jgss.krb5.WrapToken
Imports
org.ietf.jgss.*, sun.security.jgss.*, java.io.InputStream, .OutputStream, .IOException, .ByteArrayInputStream, java.security.MessageDigest
This class is a base class for other token definitions that pertain to per-message GSS-API calls. Conceptually GSS-API has two types of per-message tokens: WrapToken and MicToken. They differ in the respect that a WrapToken carries additional plaintext or ciphertext application data besides just the sequence number and checksum. This class encapsulates the commonality in the structure of the WrapToken and the MicToken. This structure can be represented as: 

    0..1           TOK_ID          Identification field.
                                   01 01 - Mic token
                                   02 01 - Wrap token
    2..3           SGN_ALG         Checksum algorithm indicator.
                                   00 00 - DES MAC MD5
                                   01 00 - MD2.5
                                   02 00 - DES MAC
                                   04 00 - HMAC SHA1 DES3-KD
                                   11 00 - RC4-HMAC
    4..5           SEAL_ALG        ff ff - none
                                   00 00 - DES
                                   02 00 - DES3-KD
                                   10 00 - RC4-HMAC
    6..7           Filler          Contains ff ff
    8..15          SND_SEQ         Encrypted sequence number field.
    16..s+15       SGN_CKSUM       Checksum of plaintext padded data,
                                  calculated according to algorithm
                                 specified in SGN_ALG field.
    s+16..last     Data            encrypted or plaintext padded data
Where "s" indicates the size of the checksum.

As always, this is preceded by a GSSHeader.

Authors
Mayank Upadhyay, Ram Marti
See Also
sun.security.jgss.GSSHeader

Nested and Inner Type Summary

Modifier and TypeClass and Description
pack-priv class
MessageToken.MessageTokenHeader

This inner class represents the initial portion of the message token and contains information about the checksum and encryption algorithms that are in use.

Field Summary

Modifier and TypeField and Description
private byte[]
checksum

pack-priv CipherHelper
cipherHelper

private boolean
confState

private byte[]
encSeqNumber

private static final int
FILLER

Filler data as defined in the specification of the Kerberos v5 GSS-API Mechanism.

private GSSHeader
gssHeader

private boolean
initiator

pack-priv static final int
SEAL_ALG_ARCFOUR_HMAC

pack-priv static final int
SEAL_ALG_DES

pack-priv static final int
SEAL_ALG_DES3_KD

Use DES3-KD sealing algorithm.

pack-priv static final int
SEAL_ALG_NONE

A value for the SEAL_ALG field that indicates that no encryption was used.

private static final int
SEAL_ALG_POS

private int
seqNumber

private byte[]
seqNumberData

pack-priv static final int
SGN_ALG_DES_MAC

pack-priv static final int
SGN_ALG_DES_MAC_MD5

pack-priv static final int
SGN_ALG_HMAC_MD5_ARCFOUR

pack-priv static final int
SGN_ALG_HMAC_SHA1_DES3_KD

private static final int
SIGN_ALG_POS

private static final int
TOKEN_ID_POS

private static final int
TOKEN_NO_CKSUM_SIZE

private MessageToken.MessageTokenHeader
tokenHeader

private int
tokenId

Inherited from sun.security.jgss.krb5.Krb5Token:
AP_REP_IDAP_REQ_IDERR_IDMIC_IDMIC_ID_v2OIDWRAP_IDWRAP_ID_v2

Constructor Summary

AccessConstructor and Description
pack-priv
MessageToken(int
the token id that should be contained in this token as it is read.
tokenId, Krb5Context
the Kerberos context associated with this token
context, byte[]
the byte array containing the token
tokenBytes, int
the offset where the token begins
tokenOffset, int
the length of the token
tokenLen, MessageProp
the MessageProp structure in which the properties of the token should be stored.
prop)

Constructs a MessageToken from a byte array.

pack-priv
MessageToken(int
the token id that should be contained in this token as it is read.
tokenId, Krb5Context
the Kerberos context associated with this token
context, InputStream
the InputStream from which to read
is, MessageProp
the MessageProp structure in which the properties of the token should be stored.
prop)

Constructs a MessageToken from an InputStream.

pack-priv
MessageToken(int
the token id that should be contained in this token
tokenId, Krb5Context
the Kerberos context associated with this token
context)

Constructs an empty MessageToken for the local context to send to the peer.

Method Summary

Modifier and TypeMethod and Description
public void
encode(OutputStream
the OutputStream to which this should be written
os)

Encodes a GSSHeader and this token onto an OutputStream.

public void
genSignAndSeqNumber(MessageProp
the MessageProp structure that determines what sort of checksum and sealing algorithm should be used. The lower byte of qop determines the checksum algorithm while the upper byte determines the signing algorithm. Checksum values are: 0 - default (DES_MAC) 1 - MD5 2 - DES_MD5 3 - DES_MAC 4 - HMAC_SHA1 Sealing values are: 0 - default (DES) 1 - DES 2 - DES3-KD
prop, byte[]
an optional header that will be processed first during checksum calculation
optionalHeader, byte[]
the application data to checksum
data, int
the offset where the data starts
offset, int
the length of the data
len, byte[]
an optional trailer that will be processed last during checksum calculation. e.g., padding that should be appended to the application data
optionalTrailer)

Generates the checksum field and the encrypted sequence number field.

public final byte[]

Returns:

the checksum in the token
getChecksum()

Used to obtain the checksum that was contained in this token.

private byte[]
getChecksum(byte[]
an optional header that will be processed first during checksum calculation.
optionalHeader, byte[]
the application data
data, int
the offset where the data begins
offset, int
the length of the application data
len, byte[]
an optional trailer that will be processed last during checksum calculation. e.g., padding that should be appended to the application data
optionalTrailer)

Computes the checksum based on the algorithm stored in the tokenHeader.

public final boolean

Returns:

true if it contains any encrypted data, false if there is only plaintext data or if there is no data.
getConfState()

Used to determine if this token contains any encrypted data.

public final byte[]

Returns:

the encrypted sequence number in the token
getEncSeqNumber()

Used to obtain the encrypted sequence number in this token.

public final GSSHeader
getGSSHeader()

Used to obtain the GSSHeader that was at the start of this token.

protected int

Returns:

token size
getKrb5TokenSize()

Obtains the size of this token.

protected abstract int
getSealAlg(boolean
true if the application desired confidentiality on this token, false otherwise
confRequested, int
the qop requested by the application
qop)

Obtains the encryption algorithm that should be used in this token given the state of confidentiality the application requested.

public final int
getSequenceNumber()

protected int
getSgnAlg(int qop)

Determine signing algorithm based on QOP.

public final int

Returns:

the token id in the token
getTokenId()

Used to obtain the token id that was contained in this token.

protected final int
getTokenSize()

protected static final int
getTokenSize(CipherHelper ch)

private void
init(int tokenId, Krb5Context context)

public final boolean
verifySignAndSeqNumber(byte[]
an optional header that will be processed first during checksum calculation.
optionalHeader, byte[]
the application data
data, int
the offset where the data begins
offset, int
the length of the application data
len, byte[]
an optional trailer that will be processed last during checksum calculation. e.g., padding that should be appended to the application data
optionalTrailer)

Verifies that the checksum field and sequence number direction bytes are valid and consistent with the application data.

Inherited from sun.security.jgss.krb5.Krb5Token:
getTokenName

Field Detail

checksumback to summary
private byte[] checksum
cipherHelperback to summary
pack-priv CipherHelper cipherHelper
confStateback to summary
private boolean confState
encSeqNumberback to summary
private byte[] encSeqNumber
FILLERback to summary
private static final int FILLER

Filler data as defined in the specification of the Kerberos v5 GSS-API Mechanism.

gssHeaderback to summary
private GSSHeader gssHeader
initiatorback to summary
private boolean initiator
SEAL_ALG_ARCFOUR_HMACback to summary
pack-priv static final int SEAL_ALG_ARCFOUR_HMAC
SEAL_ALG_DESback to summary
pack-priv static final int SEAL_ALG_DES
SEAL_ALG_DES3_KDback to summary
pack-priv static final int SEAL_ALG_DES3_KD

Use DES3-KD sealing algorithm. (draft-raeburn-cat-gssapi-krb5-3des-00) This algorithm uses triple-DES with key derivation, with a usage value KG_USAGE_SEAL. Padding is still to 8-byte multiples, and the IV for encrypting application data is zero.

SEAL_ALG_NONEback to summary
pack-priv static final int SEAL_ALG_NONE

A value for the SEAL_ALG field that indicates that no encryption was used.

SEAL_ALG_POSback to summary
private static final int SEAL_ALG_POS
seqNumberback to summary
private int seqNumber
seqNumberDataback to summary
private byte[] seqNumberData
SGN_ALG_DES_MACback to summary
pack-priv static final int SGN_ALG_DES_MAC
SGN_ALG_DES_MAC_MD5back to summary
pack-priv static final int SGN_ALG_DES_MAC_MD5
SGN_ALG_HMAC_MD5_ARCFOURback to summary
pack-priv static final int SGN_ALG_HMAC_MD5_ARCFOUR
SGN_ALG_HMAC_SHA1_DES3_KDback to summary
pack-priv static final int SGN_ALG_HMAC_SHA1_DES3_KD
SIGN_ALG_POSback to summary
private static final int SIGN_ALG_POS
TOKEN_ID_POSback to summary
private static final int TOKEN_ID_POS
TOKEN_NO_CKSUM_SIZEback to summary
private static final int TOKEN_NO_CKSUM_SIZE
tokenHeaderback to summary
private MessageToken.MessageTokenHeader tokenHeader
tokenIdback to summary
private int tokenId

Constructor Detail

MessageTokenback to summary
pack-priv MessageToken(int tokenId, Krb5Context context, byte[] tokenBytes, int tokenOffset, int tokenLen, MessageProp prop) throws GSSException

Constructs a MessageToken from a byte array. If there are more bytes in the array than needed, the extra bytes are simply ignored.

Parameters
tokenId:int

the token id that should be contained in this token as it is read.

context:Krb5Context

the Kerberos context associated with this token

tokenBytes:byte[]

the byte array containing the token

tokenOffset:int

the offset where the token begins

tokenLen:int

the length of the token

prop:MessageProp

the MessageProp structure in which the properties of the token should be stored.

Exceptions
GSSException:
if there is a problem parsing the token
MessageTokenback to summary
pack-priv MessageToken(int tokenId, Krb5Context context, InputStream is, MessageProp prop) throws GSSException

Constructs a MessageToken from an InputStream. Bytes will be read on demand and the thread might block if there are not enough bytes to complete the token.

Parameters
tokenId:int

the token id that should be contained in this token as it is read.

context:Krb5Context

the Kerberos context associated with this token

is:InputStream

the InputStream from which to read

prop:MessageProp

the MessageProp structure in which the properties of the token should be stored.

Exceptions
GSSException:
if there is a problem reading from the InputStream or parsing the token
MessageTokenback to summary
pack-priv MessageToken(int tokenId, Krb5Context context) throws GSSException

Constructs an empty MessageToken for the local context to send to the peer. It also increments the local sequence number in the Krb5Context instance it uses after obtaining the object lock for it.

Parameters
tokenId:int

the token id that should be contained in this token

context:Krb5Context

the Kerberos context associated with this token

Method Detail

encodeback to summary
public void encode(OutputStream os) throws IOException, GSSException

Encodes a GSSHeader and this token onto an OutputStream.

Parameters
os:OutputStream

the OutputStream to which this should be written

Exceptions
GSSException:
if an error occurs while writing to the OutputStream
genSignAndSeqNumberback to summary
public void genSignAndSeqNumber(MessageProp prop, byte[] optionalHeader, byte[] data, int offset, int len, byte[] optionalTrailer) throws GSSException

Generates the checksum field and the encrypted sequence number field. The encrypted sequence number uses the 8 bytes of the checksum as an initial vector in a fixed DesCbc algorithm.

Parameters
prop:MessageProp

the MessageProp structure that determines what sort of checksum and sealing algorithm should be used. The lower byte of qop determines the checksum algorithm while the upper byte determines the signing algorithm. Checksum values are: 0 - default (DES_MAC) 1 - MD5 2 - DES_MD5 3 - DES_MAC 4 - HMAC_SHA1 Sealing values are: 0 - default (DES) 1 - DES 2 - DES3-KD

optionalHeader:byte[]

an optional header that will be processed first during checksum calculation

data:byte[]

the application data to checksum

offset:int

the offset where the data starts

len:int

the length of the data

optionalTrailer:byte[]

an optional trailer that will be processed last during checksum calculation. e.g., padding that should be appended to the application data

Exceptions
GSSException:
if an error occurs in the checksum calculation or encryption sequence number calculation.
getChecksumback to summary
public final byte[] getChecksum()

Used to obtain the checksum that was contained in this token.

Returns:byte[]

the checksum in the token

getChecksumback to summary
private byte[] getChecksum(byte[] optionalHeader, byte[] data, int offset, int len, byte[] optionalTrailer) throws GSSException

Computes the checksum based on the algorithm stored in the tokenHeader.

Parameters
optionalHeader:byte[]

an optional header that will be processed first during checksum calculation.

data:byte[]

the application data

offset:int

the offset where the data begins

len:int

the length of the application data

optionalTrailer:byte[]

an optional trailer that will be processed last during checksum calculation. e.g., padding that should be appended to the application data

Exceptions
GSSException:
if an error occurs in the checksum calculation.
getConfStateback to summary
public final boolean getConfState()

Used to determine if this token contains any encrypted data.

Returns:boolean

true if it contains any encrypted data, false if there is only plaintext data or if there is no data.

getEncSeqNumberback to summary
public final byte[] getEncSeqNumber()

Used to obtain the encrypted sequence number in this token.

Returns:byte[]

the encrypted sequence number in the token

getGSSHeaderback to summary
public final GSSHeader getGSSHeader()

Used to obtain the GSSHeader that was at the start of this token.

getKrb5TokenSizeback to summary
protected int getKrb5TokenSize() throws GSSException

Obtains the size of this token. Note that this excludes the size of the GSSHeader.

Returns:int

token size

getSealAlgback to summary
protected abstract int getSealAlg(boolean confRequested, int qop) throws GSSException

Obtains the encryption algorithm that should be used in this token given the state of confidentiality the application requested. Requested qop must be consistent with negotiated session key.

Parameters
confRequested:boolean

true if the application desired confidentiality on this token, false otherwise

qop:int

the qop requested by the application

Exceptions
GSSException:
if qop is incompatible with the negotiated session key
getSequenceNumberback to summary
public final int getSequenceNumber()
getSgnAlgback to summary
protected int getSgnAlg(int qop) throws GSSException

Determine signing algorithm based on QOP.

getTokenIdback to summary
public final int getTokenId()

Used to obtain the token id that was contained in this token.

Returns:int

the token id in the token

getTokenSizeback to summary
protected final int getTokenSize() throws GSSException
getTokenSizeback to summary
protected static final int getTokenSize(CipherHelper ch) throws GSSException
initback to summary
private void init(int tokenId, Krb5Context context) throws GSSException
verifySignAndSeqNumberback to summary
public final boolean verifySignAndSeqNumber(byte[] optionalHeader, byte[] data, int offset, int len, byte[] optionalTrailer) throws GSSException

Verifies that the checksum field and sequence number direction bytes are valid and consistent with the application data.

Parameters
optionalHeader:byte[]

an optional header that will be processed first during checksum calculation.

data:byte[]

the application data

offset:int

the offset where the data begins

len:int

the length of the application data

optionalTrailer:byte[]

an optional trailer that will be processed last during checksum calculation. e.g., padding that should be appended to the application data

Exceptions
GSSException:
if an error occurs in the checksum calculation or encryption sequence number calculation.
sun.security.jgss.krb5 back to summary

pack-priv Class MessageToken.MessageTokenHeader

extends Object
Class Inheritance
This inner class represents the initial portion of the message token and contains information about the checksum and encryption algorithms that are in use. It constitutes the first 8 bytes of the message token: 
    0..1           TOK_ID          Identification field.
                                   01 01 - Mic token
                                   02 01 - Wrap token
    2..3           SGN_ALG         Checksum algorithm indicator.
                                   00 00 - DES MAC MD5
                                   01 00 - MD2.5
                                   02 00 - DES MAC
                                   04 00 - HMAC SHA1 DES3-KD
                                   11 00 - RC4-HMAC
    4..5           SEAL_ALG        ff ff - none
                                   00 00 - DES
                                   02 00 - DES3-KD
                                   10 00 - RC4-HMAC
    6..7           Filler          Contains ff ff

Field Summary

Modifier and TypeField and Description
private final byte[]
bytes

private final int
sealAlg

private final int
signAlg

private final int
tokenId

Constructor Summary

AccessConstructor and Description
public
MessageTokenHeader(int
the token id for this message token
tokenId, boolean
true if confidentiality will be requested with this message token, false otherwise.
conf, int
the value of the quality of protection that will be desired.
qop)

Constructs a MessageTokenHeader for the specified token type with appropriate checksum and encryption algorithms fields.

public
MessageTokenHeader(InputStream
the InputStream to read from
is, MessageProp
the MessageProp to populate
prop)

Constructs a MessageTokenHeader by reading it from an InputStream and sets the appropriate confidentiality and quality of protection values in a MessageProp structure.

Method Summary

Modifier and TypeMethod and Description
public final void
encode(OutputStream
the OutputStream to write to
os)

Encodes this MessageTokenHeader onto an OutputStream

public final byte[]

Returns:

8 bytes that form this header
getBytes()

Returns the bytes of this header.

public final int

Returns:

the seal algorithm
getSealAlg()

Returns the seal algorithm for the message token.

public final int

Returns:

the sign algorithm
getSignAlg()

Returns the sign algorithm for the message token.

public final int

Returns:

the token id
getTokenId()

Returns the token id for the message token.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

bytesback to summary
private final byte[] bytes
sealAlgback to summary
private final int sealAlg
signAlgback to summary
private final int signAlg
tokenIdback to summary
private final int tokenId

Constructor Detail

MessageTokenHeaderback to summary
public MessageTokenHeader(int tokenId, boolean conf, int qop) throws GSSException

Constructs a MessageTokenHeader for the specified token type with appropriate checksum and encryption algorithms fields.

Parameters
tokenId:int

the token id for this message token

conf:boolean

true if confidentiality will be requested with this message token, false otherwise.

qop:int

the value of the quality of protection that will be desired.

MessageTokenHeaderback to summary
public MessageTokenHeader(InputStream is, MessageProp prop) throws IOException

Constructs a MessageTokenHeader by reading it from an InputStream and sets the appropriate confidentiality and quality of protection values in a MessageProp structure.

Parameters
is:InputStream

the InputStream to read from

prop:MessageProp

the MessageProp to populate

Exceptions
IOException:
is an error occurs while reading from the InputStream

Method Detail

encodeback to summary
public final void encode(OutputStream os) throws IOException

Encodes this MessageTokenHeader onto an OutputStream

Parameters
os:OutputStream

the OutputStream to write to

Exceptions
IOException:
is an error occurs while writing
getBytesback to summary
public final byte[] getBytes()

Returns the bytes of this header.

Returns:byte[]

8 bytes that form this header

getSealAlgback to summary
public final int getSealAlg()

Returns the seal algorithm for the message token.

Returns:int

the seal algorithm

See Also
sun.security.jgss.krb5.MessageToken#SEAL_ALG_DES, sun.security.jgss.krb5.MessageToken#SEAL_ALG_NONE
getSignAlgback to summary
public final int getSignAlg()

Returns the sign algorithm for the message token.

Returns:int

the sign algorithm

See Also
sun.security.jgss.krb5.MessageToken#SIGN_DES_MAC, sun.security.jgss.krb5.MessageToken#SIGN_DES_MAC_MD5
getTokenIdback to summary
public final int getTokenId()

Returns the token id for the message token.

Returns:int

the token id

See Also
sun.security.jgss.krb5.Krb5Token#MIC_ID, sun.security.jgss.krb5.Krb5Token#WRAP_ID