APIdia Launch Partner
Top Description Fields Constructors Methods
sun.security.krb5.internal.crypto.dk

public Class AesSha2DkCrypto

extends DkCrypto
Class Inheritance
Imports
javax.crypto.Cipher, .Mac, .SecretKeyFactory, .SecretKey, javax.crypto.spec.SecretKeySpec, .IvParameterSpec, .PBEKeySpec, java.security.GeneralSecurityException, sun.security.krb5.KrbCryptoException, .Confounder, sun.security.krb5.internal.crypto.KeyUsage, java.util.Arrays
This class provides the implementation of AES Encryption with HMAC-SHA2 for Kerberos 5 https://tools.ietf.org/html/rfc8009 Algorithm profile described in [KCRYPTO]: +--------------------------------------------------------------------+ | protocol key format 128- or 256-bit string | | | | string-to-key function PBKDF2+DK with variable | | iteration count (see | | above) | | | | default string-to-key parameters 00 00 80 00 | | | | key-generation seed length key size | | | | random-to-key function identity function | | | | hash function, H SHA-256 / SHA-384 | | | | HMAC output size, h 16/24 octets | | | | message block size, m 1 octet | | | | encryption/decryption functions, AES in CBC-CTS mode | | E and D (cipher block size 16 | | octets), with next to | | last block as CBC-style | | ivec | +--------------------------------------------------------------------+ Supports aes128-cts-hmac-sha256-128 and aes256-cts-hmac-sha384-192

Field Summary

Modifier and TypeField and Description
private static final int
BLOCK_SIZE

private static final boolean
debug

Hides sun.security.krb5.internal.crypto.dk.DkCrypto.debug.

private static final int
DEFAULT_ITERATION_COUNT

private static final byte[]
ETYPE_NAME_128

private static final byte[]
ETYPE_NAME_256

private final int
hashSize

private final int
keyLength

private static final byte[]
ZERO_IV

Inherited from sun.security.krb5.internal.crypto.dk.DkCrypto:
ALLOW_WEAK_PBKDF2_ITERATION_COUNTKERBEROS_CONSTANT

Constructor Summary

AccessConstructor and Description
public
AesSha2DkCrypto(int length)

Method Summary

Modifier and TypeMethod and Description
public byte[]
calculateChecksum(byte[] baseKey, int usage, byte[] input, int start, int len)

Overrides sun.security.krb5.internal.crypto.dk.DkCrypto.calculateChecksum.

Calculate the checksum

public byte[]
decrypt(byte[]
key from which keys are to be derived using usage
baseKey, int usage, byte[] ivec, byte[]
E(Ke, conf | plaintext | padding, ivec) | H1[1..h]
ciphertext, int start, int len)

Overrides sun.security.krb5.internal.crypto.dk.DkCrypto.decrypt.

private byte[]
decryptCTS(byte[] baseKey, int usage, byte[] ivec, byte[] ciphertext, int start, int len, boolean confounder_exists)

Decrypt AES in CBC-CTS mode using derived keys.

public byte[]
decryptRaw(byte[]
encryption key to use
baseKey, int
ignored
usage, byte[] ivec, byte[]
encrypted data to be decrypted
ciphertext, int start, int len)

Overrides sun.security.krb5.internal.crypto.dk.DkCrypto.decryptRaw.

Decrypts data using specified key and initial vector.

private byte[]
deriveKey(byte[] baseKey, int usage, byte type)

protected byte[]
dr(byte[] key, byte[] constant)

Overrides sun.security.krb5.internal.crypto.dk.DkCrypto.dr.

public byte[]
encrypt(byte[] baseKey, int usage, byte[] ivec, byte[] new_ivec, byte[] plaintext, int start, int len)

Overrides sun.security.krb5.internal.crypto.dk.DkCrypto.encrypt.

Performs encryption using derived key; adds confounder.

private byte[]
encryptCTS(byte[] baseKey, int usage, byte[] ivec, byte[] new_ivec, byte[] plaintext, int start, int len, boolean confounder_exists)

Encrypt AES in CBC-CTS mode using derived keys.

public byte[]
encryptRaw(byte[] baseKey, int usage, byte[] ivec, byte[] plaintext, int start, int len)

Overrides sun.security.krb5.internal.crypto.dk.DkCrypto.encryptRaw.

Performs encryption using derived key; does not add confounder.

public int
getChecksumLength()

Implements abstract sun.security.krb5.internal.crypto.dk.DkCrypto.getChecksumLength.

protected Cipher
getCipher(byte[] key, byte[] ivec, int mode)

Implements abstract sun.security.krb5.internal.crypto.dk.DkCrypto.getCipher.

protected byte[]
getHmac(byte[] key, byte[] msg)

Implements abstract sun.security.krb5.internal.crypto.dk.DkCrypto.getHmac.

Get the truncated HMAC

protected int
getKeySeedLength()

Implements abstract sun.security.krb5.internal.crypto.dk.DkCrypto.getKeySeedLength.

private static byte[]
PBKDF2(char[] secret, byte[] salt, int count, int keyLength)

protected byte[]
randomToKey(byte[] in)

Implements abstract sun.security.krb5.internal.crypto.dk.DkCrypto.randomToKey.

public byte[]
stringToKey(char[] password, String salt, byte[] s2kparams)

private byte[]
stringToKey(char[] secret, byte[] salt, byte[] params)

Inherited from sun.security.krb5.internal.crypto.dk.DkCrypto:
bytesToStringcharToUtf16charToUtf8dkiterationCountnfoldreadBigEndianrounduptraceOutput

Field Detail

BLOCK_SIZEback to summary
private static final int BLOCK_SIZE
debugback to summary
private static final boolean debug

Hides sun.security.krb5.internal.crypto.dk.DkCrypto.debug.

DEFAULT_ITERATION_COUNTback to summary
private static final int DEFAULT_ITERATION_COUNT
ETYPE_NAME_128back to summary
private static final byte[] ETYPE_NAME_128
ETYPE_NAME_256back to summary
private static final byte[] ETYPE_NAME_256
hashSizeback to summary
private final int hashSize
keyLengthback to summary
private final int keyLength
ZERO_IVback to summary
private static final byte[] ZERO_IV

Constructor Detail

AesSha2DkCryptoback to summary
public AesSha2DkCrypto(int length)

Method Detail

calculateChecksumback to summary
public byte[] calculateChecksum(byte[] baseKey, int usage, byte[] input, int start, int len) throws GeneralSecurityException

Overrides sun.security.krb5.internal.crypto.dk.DkCrypto.calculateChecksum.

Calculate the checksum

decryptback to summary
public byte[] decrypt(byte[] baseKey, int usage, byte[] ivec, byte[] ciphertext, int start, int len) throws GeneralSecurityException

Overrides sun.security.krb5.internal.crypto.dk.DkCrypto.decrypt.

Parameters
baseKey:byte[]

key from which keys are to be derived using usage

ciphertext:byte[]

E(Ke, conf | plaintext | padding, ivec) | H1[1..h]

decryptCTSback to summary
private byte[] decryptCTS(byte[] baseKey, int usage, byte[] ivec, byte[] ciphertext, int start, int len, boolean confounder_exists) throws GeneralSecurityException

Decrypt AES in CBC-CTS mode using derived keys.

decryptRawback to summary
public byte[] decryptRaw(byte[] baseKey, int usage, byte[] ivec, byte[] ciphertext, int start, int len) throws GeneralSecurityException

Overrides sun.security.krb5.internal.crypto.dk.DkCrypto.decryptRaw.

Decrypts data using specified key and initial vector.

Parameters
baseKey:byte[]

encryption key to use

usage:int

ignored

ciphertext:byte[]

encrypted data to be decrypted

deriveKeyback to summary
private byte[] deriveKey(byte[] baseKey, int usage, byte type) throws GeneralSecurityException
drback to summary
protected byte[] dr(byte[] key, byte[] constant) throws GeneralSecurityException

Overrides sun.security.krb5.internal.crypto.dk.DkCrypto.dr.

encryptback to summary
public byte[] encrypt(byte[] baseKey, int usage, byte[] ivec, byte[] new_ivec, byte[] plaintext, int start, int len) throws GeneralSecurityException, KrbCryptoException

Overrides sun.security.krb5.internal.crypto.dk.DkCrypto.encrypt.

Performs encryption using derived key; adds confounder.

encryptCTSback to summary
private byte[] encryptCTS(byte[] baseKey, int usage, byte[] ivec, byte[] new_ivec, byte[] plaintext, int start, int len, boolean confounder_exists) throws GeneralSecurityException, KrbCryptoException

Encrypt AES in CBC-CTS mode using derived keys.

encryptRawback to summary
public byte[] encryptRaw(byte[] baseKey, int usage, byte[] ivec, byte[] plaintext, int start, int len) throws GeneralSecurityException, KrbCryptoException

Overrides sun.security.krb5.internal.crypto.dk.DkCrypto.encryptRaw.

Performs encryption using derived key; does not add confounder.

getChecksumLengthback to summary
public int getChecksumLength()

Implements abstract sun.security.krb5.internal.crypto.dk.DkCrypto.getChecksumLength.

getCipherback to summary
protected Cipher getCipher(byte[] key, byte[] ivec, int mode) throws GeneralSecurityException

Implements abstract sun.security.krb5.internal.crypto.dk.DkCrypto.getCipher.

getHmacback to summary
protected byte[] getHmac(byte[] key, byte[] msg) throws GeneralSecurityException

Implements abstract sun.security.krb5.internal.crypto.dk.DkCrypto.getHmac.

Get the truncated HMAC

getKeySeedLengthback to summary
protected int getKeySeedLength()

Implements abstract sun.security.krb5.internal.crypto.dk.DkCrypto.getKeySeedLength.

PBKDF2back to summary
private static byte[] PBKDF2(char[] secret, byte[] salt, int count, int keyLength) throws GeneralSecurityException
randomToKeyback to summary
protected byte[] randomToKey(byte[] in)

Implements abstract sun.security.krb5.internal.crypto.dk.DkCrypto.randomToKey.

stringToKeyback to summary
public byte[] stringToKey(char[] password, String salt, byte[] s2kparams) throws GeneralSecurityException
stringToKeyback to summary
private byte[] stringToKey(char[] secret, byte[] salt, byte[] params) throws GeneralSecurityException