Top Description Inners Fields Constructors Methods
org.eclipse.jgit.internal.transport.sshd.pkcs11

public Class Pkcs11Provider

extends Object
Class Inheritance
Imports
java.io.IOException, java.nio.file.Path, java.security.GeneralSecurityException, .KeyPair, .KeyStore, .PrivateKey, .Provider, .PublicKey, .Security, .Signature, java.security.cert.Certificate, .CertificateExpiredException, .CertificateNotYetValidException, .X509Certificate, java.util.AbstractMap.SimpleImmutableEntry, .ArrayList, .Enumeration, .List, .Map, .Map.Entry, java.util.concurrent.ConcurrentHashMap, java.util.concurrent.atomic.AtomicInteger, javax.security.auth.login.FailedLoginException, org.apache.sshd.agent.SshAgent, .SshAgentKeyConstraint, org.apache.sshd.client.auth.pubkey.KeyAgentIdentity, org.apache.sshd.common.session.SessionContext, org.apache.sshd.common.signature.BuiltinSignatures, org.eclipse.jgit.annotations.NonNull, org.eclipse.jgit.transport.URIish, org.slf4j.Logger, .LoggerFactory
Bridge for using a PKCS11 HSM (Hardware Security Module) for public-key authentication.

Nested and Inner Type Summary

Modifier and TypeClass and Description
private class
Pkcs11Provider.Pkcs11Identity

Field Summary

Modifier and TypeField and Description
private final KeyStore.Builder
builder

private static final AtomicInteger
COUNT

private KeyStore
keys

private static final Logger
LOG

private static final SshAgent
NULL_AGENT

A dummy agent; exists only because KeyAgentIdentity#KeyAgentIdentity(SshAgent, PublicKey, String) requires a non-null SshAgent.

private final SecurityCallback
prompter

private final Provider
provider

private static final Map<String, Pkcs11Provider>
PROVIDERS

Constructor Summary

AccessConstructor and Description
private
Pkcs11Provider(Provider pkcs11, SecurityCallback prompter)

Method Summary

Modifier and TypeMethod and Description
public Iterable<KeyAgentIdentity>

Returns:

all the available identities
getKeys(SessionContext
in which we to load the identities
session)

Obtains the identities provided by the PKCS11 library.

public String

Returns:

the name
getName()

Retrieves an identifying name of this Pkcs11Provider.

public static Pkcs11Provider

Returns:

a new Pkcs11Provider, or null if SunPKCS11 is not available
getProvider(Path
Path to the library the SunPKCS11 provider shall use
library, int
index identifying the token; if < 0, ignored and 0 is used
slotListIndex)

Creates a new Pkcs11Provider.

private boolean
isWrongPin(Throwable e)

private synchronized void
load(SessionContext session)

pack-priv synchronized byte[]
sign(SessionContext session, String algorithm, String alias, byte[] data)

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

builderback to summary
private final KeyStore.Builder builder
COUNTback to summary
private static final AtomicInteger COUNT
keysback to summary
private KeyStore keys
LOGback to summary
private static final Logger LOG
NULL_AGENTback to summary
private static final SshAgent NULL_AGENT

A dummy agent; exists only because KeyAgentIdentity#KeyAgentIdentity(SshAgent, PublicKey, String) requires a non-null SshAgent.

prompterback to summary
private final SecurityCallback prompter
providerback to summary
private final Provider provider
PROVIDERSback to summary
private static final Map<String, Pkcs11Provider> PROVIDERS

Constructor Detail

Pkcs11Providerback to summary
private Pkcs11Provider(Provider pkcs11, SecurityCallback prompter)

Method Detail

getKeysback to summary
public Iterable<KeyAgentIdentity> getKeys(SessionContext session) throws IOException, GeneralSecurityException

Obtains the identities provided by the PKCS11 library.

Parameters
session:SessionContext

in which we to load the identities

Returns:Iterable<KeyAgentIdentity>

all the available identities

Exceptions
IOException:
if keys cannot be accessed
GeneralSecurityException:
if keys cannot be accessed
getNameback to summary
public String getName()

Retrieves an identifying name of this Pkcs11Provider.

Returns:String

the name

getProviderback to summary
public static Pkcs11Provider getProvider(Path library, int slotListIndex) throws IOException

Creates a new Pkcs11Provider.

Parameters
library:Path

Path to the library the SunPKCS11 provider shall use

slotListIndex:int

index identifying the token; if < 0, ignored and 0 is used

Returns:Pkcs11Provider

a new Pkcs11Provider, or null if SunPKCS11 is not available

Exceptions
IOException:
if the configuration file cannot be created
ProviderException:
if the Java Provider encounters a problem
UnsupportedOperationException:
if PKCS#11 is unsupported
isWrongPinback to summary
private boolean isWrongPin(Throwable e)
loadback to summary
private synchronized void load(SessionContext session) throws GeneralSecurityException, IOException
signback to summary
pack-priv synchronized byte[] sign(SessionContext session, String algorithm, String alias, byte[] data) throws GeneralSecurityException, IOException
org.eclipse.jgit.internal.transport.sshd.pkcs11 back to summary

private Class Pkcs11Provider.Pkcs11Identity

extends KeyAgentIdentity
Class Inheritance

Constructor Summary

AccessConstructor and Description
pack-priv
Pkcs11Identity(PublicKey key, String alias)

Method Summary

Modifier and TypeMethod and Description
public Map.Entry<String, byte[]>
sign(SessionContext
The SessionContext for calling this method - may be null if not called within a session context
session, String
Recommended signature algorithm - if null/empty then one will be selected based on the key type and/or signature factories

Note

even if specific algorithm specified, the implementation may disregard and choose another

algo, byte[]
Data to sign
data)

Overrides org.apache.sshd.client.auth.pubkey.KeyAgentIdentity.sign.

Implements org.apache.sshd.client.auth.pubkey.PublicKeyIdentity.sign.

Proves the public key identity by signing the given data

Inherited from org.apache.sshd.client.auth.pubkey.KeyAgentIdentity:
getCommentgetKeyIdentitytoString

Constructor Detail

Pkcs11Identityback to summary
pack-priv Pkcs11Identity(PublicKey key, String alias)

Method Detail

signback to summary
public Map.Entry<String, byte[]> sign(SessionContext session, String algo, byte[] data) throws Exception

Overrides org.apache.sshd.client.auth.pubkey.KeyAgentIdentity.sign.

Implements org.apache.sshd.client.auth.pubkey.PublicKeyIdentity.sign.

Doc from org.apache.sshd.client.auth.pubkey.PublicKeyIdentity.sign.

Proves the public key identity by signing the given data

Parameters
session:SessionContext

The SessionContext for calling this method - may be null if not called within a session context

algo:String

Recommended signature algorithm - if null/empty then one will be selected based on the key type and/or signature factories

Note

even if specific algorithm specified, the implementation may disregard and choose another

data:byte[]

Data to sign

Returns:Map.Entry<String, byte[]>

used algorithm + signed data - using the identity

Annotations
@Override
Exceptions
Exception:
If failed to sign the data