Top Description Fields Constructors Methods
org.bouncycastle.tls.crypto.impl.jcajce

public Class JcaTlsCrypto

extends AbstractTlsCrypto
Class Inheritance
Imports
java.io.IOException, java.math.BigInteger, java.security.AlgorithmParameters, .GeneralSecurityException, .InvalidKeyException, .NoSuchAlgorithmException, .PrivateKey, .PublicKey, .SecureRandom, .Signature, java.security.spec.AlgorithmParameterSpec, java.util.Hashtable, .Vector, javax.crypto.Cipher, .KeyAgreement, org.bouncycastle.jcajce.util.JcaJceHelper, .ProviderJcaJceHelper, org.bouncycastle.tls.AlertDescription, .CertificateType, .DigitallySigned, .EncryptionAlgorithm, .HashAlgorithm, .MACAlgorithm, .NamedGroup, .ProtocolVersion, .SignatureAlgorithm, .SignatureAndHashAlgorithm, .SignatureScheme, .TlsDHUtils, .TlsFatalAlert, .TlsUtils, org.bouncycastle.tls.crypto.CryptoHashAlgorithm, .CryptoSignatureAlgorithm, .SRP6Group, .Tls13Verifier, .TlsCertificate, .TlsCipher, .TlsCryptoException, .TlsCryptoParameters, .TlsCryptoUtils, .TlsDHConfig, .TlsDHDomain, .TlsECConfig, .TlsECDomain, .TlsHMAC, .TlsHash, .TlsKemConfig, .TlsKemDomain, .TlsNonceGenerator, .TlsSRP6Client, .TlsSRP6Server, .TlsSRP6VerifierGenerator, .TlsSRPConfig, .TlsSecret, .TlsStreamSigner, .TlsStreamVerifier, org.bouncycastle.tls.crypto.impl.AbstractTlsCrypto, .TlsAEADCipher, .TlsAEADCipherImpl, .TlsBlockCipher, .TlsBlockCipherImpl, .TlsImplUtils, .TlsNullCipher, org.bouncycastle.tls.crypto.impl.jcajce.srp.SRP6Client, .SRP6Server, .SRP6VerifierGenerator, org.bouncycastle.util.Arrays, .Integers, .Strings
Class for providing cryptographic services for TLS based on implementations in the JCA/JCE.

This class provides default implementations for everything. If you need to customise it, extend the class and override the appropriate methods.

Field Summary

Modifier and TypeField and Description
private final SecureRandom
entropySource

private final JcaJceHelper
helper

private final SecureRandom
nonceEntropySource

private final Hashtable<K, V>
supportedEncryptionAlgorithms

private final Hashtable<K, V>
supportedNamedGroups

private final Hashtable<K, V>
supportedOther

Constructor Summary

AccessConstructor and Description
protected
JcaTlsCrypto(JcaJceHelper
a JCA/JCE helper configured for the class's default provider.
helper, SecureRandom
primary entropy source, used for key generation.
entropySource, SecureRandom
secondary entropy source, used for nonce and IV generation.
nonceEntropySource)

Base constructor.

Method Summary

Modifier and TypeMethod and Description
pack-priv JceTlsSecret
adoptLocalSecret(byte[] data)

public byte[]
calculateKeyAgreement(String agreementAlgorithm, PrivateKey privateKey, PublicKey publicKey, String secretAlgorithm)

protected TlsAEADCipherImpl

Returns:

an AEAD cipher.
createAEADCipher(String
the full name of the cipher (algorithm/mode/padding)
cipherName, String
the base algorithm name
algorithm, int
keySize (in bytes) for the cipher key.
keySize, boolean
true if the cipher is for encryption, false otherwise.
isEncrypting)

If you want to create your own versions of the AEAD ciphers required, override this method.

protected TlsBlockCipherImpl

Returns:

a block cipher.
createBlockCipher(String
the full name of the cipher (algorithm/mode/padding)
cipherName, String
the base algorithm name
algorithm, int
keySize (in bytes) for the cipher key.
keySize, boolean
true if the cipher is for encryption, false otherwise.
isEncrypting)

If you want to create your own versions of the block ciphers required, override this method.

protected TlsBlockCipherImpl

Returns:

a block cipher.
createBlockCipherWithCBCImplicitIV(String
the full name of the cipher (algorithm/mode/padding)
cipherName, String
the base algorithm name
algorithm, int
keySize (in bytes) for the cipher key.
keySize, boolean
true if the cipher is for encryption, false otherwise.
isEncrypting)

If you want to create your own versions of the block ciphers for < TLS 1.1, override this method.

protected TlsBlockCipherImpl
createCBCBlockCipherImpl(TlsCryptoParameters cryptoParams, String algorithm, int cipherKeySize, boolean forEncryption)

public TlsCertificate
createCertificate(byte[]
DER/BER encoding of the certificate of interest.
encoding)

Implements org.bouncycastle.tls.crypto.TlsCrypto.createCertificate.

Create a TlsCertificate from an ASN.1 binary encoding of an X.509 certificate.
public TlsCertificate
createCertificate(short
Certificate type as per IANA TLS Certificate Types registry
type, byte[]
DER/BER encoding of the certificate of interest.
encoding)

Implements org.bouncycastle.tls.crypto.TlsCrypto.createCertificate.

Create a TlsCertificate from a ASN.1 binary encoding of a certificate.
private TlsCipher
createChaCha20Poly1305(TlsCryptoParameters cryptoParams)

public TlsCipher
createCipher(TlsCryptoParameters
context specific parameters.
cryptoParams, int
the encryption algorithm to be employed by the cipher.
encryptionAlgorithm, int
the MAC algorithm to be employed by the cipher.
macAlgorithm)

Implements org.bouncycastle.tls.crypto.TlsCrypto.createCipher.

Create a cipher for the specified encryption and MAC algorithms.
private TlsAEADCipher
createCipher_AES_CCM(TlsCryptoParameters cryptoParams, int cipherKeySize, int macSize)

private TlsAEADCipher
createCipher_AES_GCM(TlsCryptoParameters cryptoParams, int cipherKeySize, int macSize)

private TlsAEADCipher
createCipher_ARIA_GCM(TlsCryptoParameters cryptoParams, int cipherKeySize, int macSize)

private TlsAEADCipher
createCipher_Camellia_GCM(TlsCryptoParameters cryptoParams, int cipherKeySize, int macSize)

protected TlsCipher
createCipher_CBC(TlsCryptoParameters cryptoParams, String algorithm, int cipherKeySize, int macAlgorithm)

private TlsAEADCipher
createCipher_SM4_CCM(TlsCryptoParameters cryptoParams)

private TlsAEADCipher
createCipher_SM4_GCM(TlsCryptoParameters cryptoParams)

public TlsDHDomain
createDHDomain(TlsDHConfig
the config describing the DH parameters to use.
dhConfig)

Implements org.bouncycastle.tls.crypto.TlsCrypto.createDHDomain.

Create a domain object supporting the domain parameters described in dhConfig.
public TlsECDomain
createECDomain(TlsECConfig
the config describing the EC parameters to use.
ecConfig)

Implements org.bouncycastle.tls.crypto.TlsCrypto.createECDomain.

Create a domain object supporting the domain parameters described in ecConfig.
public TlsHash
createHash(int
the hash algorithm the hash needs to implement.
cryptoHashAlgorithm)

Implements org.bouncycastle.tls.crypto.TlsCrypto.createHash.

Create a suitable hash for the hash algorithm identifier passed in.

See enumeration class CryptoHashAlgorithm for appropriate argument values.

protected TlsHash

Returns:

a hash calculator.
createHash(String
the name of the Hash function required.
digestName)

If you want to create your own versions of Hash functions, override this method.

public TlsHMAC
createHMAC(int
the MAC algorithm the HMAC needs to match.
macAlgorithm)

Implements org.bouncycastle.tls.crypto.TlsCrypto.createHMAC.

Create a suitable HMAC for the MAC algorithm identifier passed in.

See enumeration class MACAlgorithm for appropriate argument values.

protected TlsHMAC
createHMAC_SSL(int macAlgorithm)

public TlsHMAC
createHMACForHash(int
the hash algorithm the HMAC should use.
cryptoHashAlgorithm)

Implements org.bouncycastle.tls.crypto.TlsCrypto.createHMACForHash.

Create a suitable HMAC using the hash algorithm identifier passed in.

See enumeration class CryptoHashAlgorithm for appropriate argument values.

public TlsKemDomain
createKemDomain(TlsKemConfig
the config describing the KEM parameters to use.
kemConfig)

Implements org.bouncycastle.tls.crypto.TlsCrypto.createKemDomain.

Create a domain object supporting the domain parameters described in kemConfig.
protected TlsHMAC
createMAC(TlsCryptoParameters cryptoParams, int macAlgorithm)

public TlsNonceGenerator
createNonceGenerator(byte[]
context-specific seed material
additionalSeedMaterial)

Implements org.bouncycastle.tls.crypto.TlsCrypto.createNonceGenerator.

Create a nonce generator.
protected TlsNullCipher

Returns:

a null cipher suite implementation.
createNullCipher(TlsCryptoParameters cryptoParams, int
the name of the algorithm supporting the MAC.
macAlgorithm)

To disable the null cipher suite, override this method with one that throws an IOException.

pack-priv Cipher
createRSAEncryptionCipher()

public TlsSecret
createSecret(byte[]
the data to base the TlsSecret on.
data)

Implements org.bouncycastle.tls.crypto.TlsCrypto.createSecret.

Create a TlsSecret object based on provided data.
public TlsSRP6Client
createSRP6Client(TlsSRPConfig
client config.
srpConfig)

Implements org.bouncycastle.tls.crypto.TlsCrypto.createSRP6Client.

Create an SRP-6 client.
public TlsSRP6Server
createSRP6Server(TlsSRPConfig
server config.
srpConfig, BigInteger
the SRP6 verifier value.
srpVerifier)

Implements org.bouncycastle.tls.crypto.TlsCrypto.createSRP6Server.

Create an SRP-6 server.
public TlsSRP6VerifierGenerator
createSRP6VerifierGenerator(TlsSRPConfig
generator config.
srpConfig)

Implements org.bouncycastle.tls.crypto.TlsCrypto.createSRP6VerifierGenerator.

Create an SRP-6 verifier generator.
protected TlsStreamSigner
createStreamSigner(SignatureAndHashAlgorithm algorithm, PrivateKey privateKey, boolean needsRandom)

protected TlsStreamSigner
createStreamSigner(String algorithmName, AlgorithmParameterSpec parameter, PrivateKey privateKey, boolean needsRandom)

protected TlsStreamVerifier
createStreamVerifier(DigitallySigned digitallySigned, PublicKey publicKey)

protected TlsStreamVerifier
createStreamVerifier(String algorithmName, AlgorithmParameterSpec parameter, byte[] signature, PublicKey publicKey)

protected Tls13Verifier
createTls13Verifier(String algorithmName, AlgorithmParameterSpec parameter, PublicKey publicKey)

protected TlsStreamSigner
createVerifyingStreamSigner(SignatureAndHashAlgorithm algorithm, PrivateKey privateKey, boolean needsRandom, PublicKey publicKey)

protected TlsStreamSigner
createVerifyingStreamSigner(String algorithmName, AlgorithmParameterSpec parameter, PrivateKey privateKey, boolean needsRandom, PublicKey publicKey)

public TlsSecret
generateRSAPreMasterSecret(ProtocolVersion
the client version to place in the first 2 bytes
version)

Implements org.bouncycastle.tls.crypto.TlsCrypto.generateRSAPreMasterSecret.

Create a TlsSecret object containing a randomly-generated RSA PreMasterSecret
pack-priv String
getDigestName(int cryptoHashAlgorithm)

public JcaJceHelper
getHelper()

pack-priv String
getHMACAlgorithmName(int cryptoHashAlgorithm)

public AlgorithmParameters
getNamedGroupAlgorithmParameters(int namedGroup)

public SecureRandom
getSecureRandom()

Implements org.bouncycastle.tls.crypto.TlsCrypto.getSecureRandom.

Return the primary (safest) SecureRandom for this crypto.
public AlgorithmParameters
getSignatureSchemeAlgorithmParameters(int signatureScheme)

public boolean
hasAnyStreamVerifiers(Vector<E>
A Vector of SignatureAndHashAlgorithm values.
signatureAndHashAlgorithms)

Implements org.bouncycastle.tls.crypto.TlsCrypto.hasAnyStreamVerifiers.

Return true if this TlsCrypto would use a stream verifier for any of the passed in algorithms.
public boolean
hasAnyStreamVerifiersLegacy(short[]
An array of ClientCertificateType values.
clientCertificateTypes)

Implements org.bouncycastle.tls.crypto.TlsCrypto.hasAnyStreamVerifiersLegacy.

Return true if this TlsCrypto would use a stream verifier for any of the passed in algorithms.
public boolean
hasCryptoHashAlgorithm(int
the algorithm of interest.
cryptoHashAlgorithm)

Implements org.bouncycastle.tls.crypto.TlsCrypto.hasCryptoHashAlgorithm.

Return true if this TlsCrypto can support the passed in hash algorithm.
public boolean
hasCryptoSignatureAlgorithm(int
the algorithm of interest.
cryptoSignatureAlgorithm)

Implements org.bouncycastle.tls.crypto.TlsCrypto.hasCryptoSignatureAlgorithm.

Return true if this TlsCrypto can support the passed in signature algorithm (not necessarily in combination with EVERY hash algorithm).
public boolean
hasDHAgreement()

Implements org.bouncycastle.tls.crypto.TlsCrypto.hasDHAgreement.

Return true if this TlsCrypto can support DH key agreement.
public boolean
hasECDHAgreement()

Implements org.bouncycastle.tls.crypto.TlsCrypto.hasECDHAgreement.

Return true if this TlsCrypto can support ECDH key agreement.
public boolean
hasEncryptionAlgorithm(int
the algorithm of interest.
encryptionAlgorithm)

Implements org.bouncycastle.tls.crypto.TlsCrypto.hasEncryptionAlgorithm.

Return true if this TlsCrypto can support the passed in block/stream encryption algorithm.
public boolean
hasHKDFAlgorithm(int
the algorithm of interest.
cryptoHashAlgorithm)

Implements org.bouncycastle.tls.crypto.TlsCrypto.hasHKDFAlgorithm.

Return true if this TlsCrypto can support HKDF with the passed in hash algorithm.
public boolean
hasKemAgreement()

Implements org.bouncycastle.tls.crypto.TlsCrypto.hasKemAgreement.

Return true if this TlsCrypto can support KEM key agreement.
public boolean
hasMacAlgorithm(int
the algorithm of interest.
macAlgorithm)

Implements org.bouncycastle.tls.crypto.TlsCrypto.hasMacAlgorithm.

Return true if this TlsCrypto can support the passed in MAC algorithm.
public boolean
hasNamedGroup(int namedGroup)

Implements org.bouncycastle.tls.crypto.TlsCrypto.hasNamedGroup.

Return true if this TlsCrypto supports the passed in named group value.
public boolean
hasRSAEncryption()

Implements org.bouncycastle.tls.crypto.TlsCrypto.hasRSAEncryption.

Return true if this TlsCrypto can support RSA encryption/decryption.
public boolean
hasSignatureAlgorithm(short
the algorithm of interest.
signatureAlgorithm)

Implements org.bouncycastle.tls.crypto.TlsCrypto.hasSignatureAlgorithm.

Return true if this TlsCrypto can support the passed in signature algorithm (not necessarily in combination with EVERY hash algorithm).
public boolean
hasSignatureAndHashAlgorithm(SignatureAndHashAlgorithm
the algorithm of interest.
sigAndHashAlgorithm)

Implements org.bouncycastle.tls.crypto.TlsCrypto.hasSignatureAndHashAlgorithm.

Return true if this TlsCrypto can support the passed in signature algorithm.
public boolean
hasSignatureScheme(int
the scheme of interest.
signatureScheme)

Implements org.bouncycastle.tls.crypto.TlsCrypto.hasSignatureScheme.

Return true if this TlsCrypto can support the passed in signature scheme.
public boolean
hasSRPAuthentication()

Implements org.bouncycastle.tls.crypto.TlsCrypto.hasSRPAuthentication.

Return true if this TlsCrypto can support SRP authentication.
public TlsSecret
hkdfInit(int
the hash algorithm to instantiate HMAC with. See CryptoHashAlgorithm for values.
cryptoHashAlgorithm)

Implements org.bouncycastle.tls.crypto.TlsCrypto.hkdfInit.

Setup an initial "secret" for a chain of HKDF calls (RFC 5869), containing a string of HashLen zeroes.
protected Boolean
isSupportedEncryptionAlgorithm(int encryptionAlgorithm)

protected Boolean
isSupportedNamedGroup(int namedGroup)

protected boolean
isUsableCipher(String cipherAlgorithm, int keySize)

protected boolean
isUsableMAC(String macAlgorithm)

Inherited from org.bouncycastle.tls.crypto.impl.AbstractTlsCrypto:
adoptSecret