Package org.bouncycastle.jcajce.provider.keystore.pkcs12

Class PKCS12PBMAC1KeyStoreSpi

  • All Implemented Interfaces:
    PKCSObjectIdentifiers, X509ObjectIdentifiers, BCKeyStore
    public class PKCS12PBMAC1KeyStoreSpi
extends java.security.KeyStoreSpi
implements PKCSObjectIdentifiers, X509ObjectIdentifiers, BCKeyStore
    BC's JCA-visible KeyStoreSpi for the PBMAC1-protected PKCS#12 keystore variant (provider "BC", type PKCS12-PBMAC1). On-disk integrity uses RFC 9579 PBMAC1 instead of the legacy MacData construction; the rest of the layout — bag types, entry types and encryption algorithms — matches the standard PKCS#12 layout driven by PKCS12KeyStoreSpi.

    Supported entry types

    • Private-key entries — KeyStore.PrivateKeyEntry with a non-empty certificate chain. Stored as a SafeBag of type pkcs8ShroudedKeyBag per RFC 7292 sec. 4.2.2, with the associated chain emitted as certBag entries.
    • Trusted-certificate entries — KeyStore.TrustedCertificateEntry. Stored as a certBag per RFC 7292 sec. 4.2.3.
    • Secret-key entries — KeyStore.SecretKeyEntry, accepted since Bouncy Castle 1.85 (github #1807). Stored as a SafeBag of type secretBag per RFC 7292 sec. 4.2.5: the inner SecretBag carries the algorithm OID as secretTypeId and the SecretKey.getEncoded() bytes as a DER OCTET STRING secretValue, placed inside the keystore's encrypted SafeContents block. Only algorithms with a registered OID are supported — see PKCS12Util.resolveSecretKeyOid(SecretKey) for the current set (AES 128 / 192 / 256, DESede / TripleDES, HmacSHA1 / SHA-224 / SHA-256 / SHA-384 / SHA-512 / SHA3-{224,256,384,512}). Other algorithms are rejected at setKeyEntry-time with a pointer at BCFKS.

    SunJCE secret-key interop (read-only, opt-in)

    SunJCE writes secret keys using a non-standard encoding: the SafeBag is still secretBag, but the inner SecretBag.secretTypeId is pkcs8ShroudedKeyBag and the secretValue wraps an EncryptedPrivateKeyInfo whose decrypted PKCS#8 carries the raw key bytes. Setting the system or security property Properties.PKCS12_ALLOW_SUN_SECRET_KEYS ("org.bouncycastle.pkcs12.allow_sun_secret_keys") to true lets BC additionally decode this form on load. BC always writes the standards-compliant form regardless — i.e. files BC produces are not readable by SunJCE's PKCS#12 keystore.

    System / security properties consulted

    See Also:
    PKCS12KeyStoreSpi, Properties.PKCS12_ALLOW_SUN_SECRET_KEYS

    • Field Detail

      • random

        protected java.security.SecureRandom random

    • Method Detail

      • setRandom

        public void setRandom​(java.security.SecureRandom rand)
        Description copied from interface: BCKeyStore
        set the random source for the key store
        Specified by:
        setRandom in interface BCKeyStore

      • engineProbe

        public boolean engineProbe​(java.io.InputStream stream)
                    throws java.io.IOException
        Overrides:
        engineProbe in class java.security.KeyStoreSpi
        Throws:
        java.io.IOException

      • engineAliases

        public java.util.Enumeration engineAliases()
        Specified by:
        engineAliases in class java.security.KeyStoreSpi

      • engineContainsAlias

        public boolean engineContainsAlias​(java.lang.String alias)
        Specified by:
        engineContainsAlias in class java.security.KeyStoreSpi

      • engineDeleteEntry

        public void engineDeleteEntry​(java.lang.String alias)
                       throws java.security.KeyStoreException
        this is not quite complete - we should follow up on the chain, a bit tricky if a certificate appears in more than one chain... the store method now prunes out unused certificates from the chain map if they are present.
        Specified by:
        engineDeleteEntry in class java.security.KeyStoreSpi
        Throws:
        java.security.KeyStoreException

      • engineGetCertificate

        public java.security.cert.Certificate engineGetCertificate​(java.lang.String alias)
        simply return the cert for the private key
        Specified by:
        engineGetCertificate in class java.security.KeyStoreSpi

      • engineGetCertificateAlias

        public java.lang.String engineGetCertificateAlias​(java.security.cert.Certificate cert)
        Specified by:
        engineGetCertificateAlias in class java.security.KeyStoreSpi

      • engineGetCertificateChain

        public java.security.cert.Certificate[] engineGetCertificateChain​(java.lang.String alias)
        Specified by:
        engineGetCertificateChain in class java.security.KeyStoreSpi

      • engineGetCreationDate

        public java.util.Date engineGetCreationDate​(java.lang.String alias)
        Specified by:
        engineGetCreationDate in class java.security.KeyStoreSpi

      • engineGetKey

        public java.security.Key engineGetKey​(java.lang.String alias,
                                      char[] password)
                               throws java.security.NoSuchAlgorithmException,
                                      java.security.UnrecoverableKeyException
        Specified by:
        engineGetKey in class java.security.KeyStoreSpi
        Throws:
        java.security.NoSuchAlgorithmException
        java.security.UnrecoverableKeyException

      • engineIsCertificateEntry

        public boolean engineIsCertificateEntry​(java.lang.String alias)
        Specified by:
        engineIsCertificateEntry in class java.security.KeyStoreSpi

      • engineIsKeyEntry

        public boolean engineIsKeyEntry​(java.lang.String alias)
        Specified by:
        engineIsKeyEntry in class java.security.KeyStoreSpi

      • engineSetCertificateEntry

        public void engineSetCertificateEntry​(java.lang.String alias,
                                      java.security.cert.Certificate cert)
                               throws java.security.KeyStoreException
        Specified by:
        engineSetCertificateEntry in class java.security.KeyStoreSpi
        Throws:
        java.security.KeyStoreException

      • engineSetKeyEntry

        public void engineSetKeyEntry​(java.lang.String alias,
                              byte[] key,
                              java.security.cert.Certificate[] chain)
                       throws java.security.KeyStoreException
        Specified by:
        engineSetKeyEntry in class java.security.KeyStoreSpi
        Throws:
        java.security.KeyStoreException

      • engineSetKeyEntry

        public void engineSetKeyEntry​(java.lang.String alias,
                              java.security.Key key,
                              char[] password,
                              java.security.cert.Certificate[] chain)
                       throws java.security.KeyStoreException
        Specified by:
        engineSetKeyEntry in class java.security.KeyStoreSpi
        Throws:
        java.security.KeyStoreException

      • engineSize

        public int engineSize()
        Specified by:
        engineSize in class java.security.KeyStoreSpi

      • unwrapKey

        protected java.security.PrivateKey unwrapKey​(AlgorithmIdentifier algId,
                                             byte[] data,
                                             char[] password,
                                             boolean wrongPKCS12Zero)
                                      throws java.io.IOException
        Throws:
        java.io.IOException

      • wrapKey

        protected byte[] wrapKey​(java.lang.String algorithm,
                         java.security.Key key,
                         PKCS12PBEParams pbeParams,
                         char[] password)
                  throws java.io.IOException
        Throws:
        java.io.IOException

      • wrapKey

        protected byte[] wrapKey​(AlgorithmIdentifier encAlgId,
                         java.security.Key key,
                         char[] password)
                  throws java.io.IOException
        Throws:
        java.io.IOException

      • cryptData

        protected byte[] cryptData​(boolean forEncryption,
                           AlgorithmIdentifier algId,
                           char[] password,
                           boolean wrongPKCS12Zero,
                           byte[] data)
                    throws java.io.IOException
        Throws:
        java.io.IOException

      • engineLoad

        public void engineLoad​(java.security.KeyStore.LoadStoreParameter loadStoreParameter)
                throws java.io.IOException,
                       java.security.NoSuchAlgorithmException,
                       java.security.cert.CertificateException
        Overrides:
        engineLoad in class java.security.KeyStoreSpi
        Throws:
        java.io.IOException
        java.security.NoSuchAlgorithmException
        java.security.cert.CertificateException

      • engineLoad

        public void engineLoad​(java.io.InputStream stream,
                       char[] password)
                throws java.io.IOException
        Specified by:
        engineLoad in class java.security.KeyStoreSpi
        Throws:
        java.io.IOException

      • engineStore

        public void engineStore​(java.security.KeyStore.LoadStoreParameter param)
                 throws java.io.IOException,
                        java.security.NoSuchAlgorithmException,
                        java.security.cert.CertificateException
        Overrides:
        engineStore in class java.security.KeyStoreSpi
        Throws:
        java.io.IOException
        java.security.NoSuchAlgorithmException
        java.security.cert.CertificateException

      • engineStore

        public void engineStore​(java.io.OutputStream stream,
                        char[] password)
                 throws java.io.IOException
        Specified by:
        engineStore in class java.security.KeyStoreSpi
        Throws:
        java.io.IOException