From ed7384cbf65c79c96f4b55728f202e5299a5dbf6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?T=C3=B5nis=20Reimo?= Date: Mon, 24 Apr 2023 10:26:56 +0300 Subject: [PATCH 1/9] Initial commit --- LICENSE | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 LICENSE diff --git a/LICENSE b/LICENSE new file mode 100644 index 00000000..f2253383 --- /dev/null +++ b/LICENSE @@ -0,0 +1,21 @@ +MIT License + +Copyright (c) 2023 Open Electronic Identity + +Permission is hereby granted, free of charge, to any person obtaining a copy +of this software and associated documentation files (the "Software"), to deal +in the Software without restriction, including without limitation the rights +to use, copy, modify, merge, publish, distribute, sublicense, and/or sell +copies of the Software, and to permit persons to whom the Software is +furnished to do so, subject to the following conditions: + +The above copyright notice and this permission notice shall be included in all +copies or substantial portions of the Software. + +THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR +IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, +FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE +AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER +LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, +OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE +SOFTWARE. From 41ea98fe408f295650d04f4af7b746d59359640a Mon Sep 17 00:00:00 2001 From: Rainer Metsvahi Date: Tue, 9 May 2023 11:15:43 +0300 Subject: [PATCH 2/9] Add readme --- README.md | 201 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 201 insertions(+) create mode 100644 README.md diff --git a/README.md b/README.md new file mode 100644 index 00000000..6cbc6894 --- /dev/null +++ b/README.md @@ -0,0 +1,201 @@ +# cdoc20_java + +[CDOC 2.0](https://installer.id.ee/media/cdoc/cdoc_2_0_spetsifikatsioon_d-19-12_v1.9.pdf) reference implementation (Java) + +CDOC 2.0 is a new version of [CDOC](https://www.id.ee/wp-content/uploads/2020/06/sk-cdoc-1.0-20120625_en.pdf) (CDOC lib [cdoc4j](https://github.com/open-eid/cdoc4j)), featuring additional security measures with optional server backend. CDoc version are not compatible. Additional background info can be found in [CDOC 2.0](https://www.ria.ee/sites/default/files/content-editors/EID/arne.ansperi_cdoc2_eidinfopaev_20_09_22.pdf). + + +Current CDoc 2.0 supports five scenarios + +## CDoc 2.0 ECDH scenario + +**Warning**: This description is simplification to give general idea, details and **final truth is in +[CDOC 2.0 specification](https://installer.id.ee/media/cdoc/cdoc_2_0_spetsifikatsioon_d-19-12_v1.9.pdf)**. + +1. Sender downloads recipient's certificate from SK LDAP using recipient id (isikukood). Recipient certificate contains + EC public key. +2. Sender generates EC (elliptic curve) key pair using the same EC curve as in recipient EC public key [^1] +3. Sender derives key encryption key (KEK) using ECDH (from sender EC private key and recipient EC public key) +4. Sender generates file master key (FMK) using HKDF extract algorithm +5. Sender derives content encryption key (CEK) and hmac key (HHK) from FMK using HKDF expand algorithm +6. Sender encrypts FMK with KEK (xor) +7. Sender adds encrypted FMK with senders and recipients public keys to CDoc header[^2] +8. Sender calculates header hmac using hmac key (HHK) and adds calculated hmac to CDoc +9. Sender encrypts content[^3] with CEK (ChaCha20-Poly1305 with AAD) +10. Sender sends CDoc to Recipient +11. Recipient finds recipients public key from CDoc +12. Recipient derives key encryption key (KEK) using ECDH (from recipient private key on id-kaart and sender public key) + and decrypts FMK +13. Recipient derives CEK and HHK from FMK using HKDF algorithm +14. Recipient calculates hmac and checks it against hmac in CDoc +15. Recipient decrypts content using CEK + +[^1]: Current specification defines only SecP384R1 Elliptic Curve for key agreement, but in future other EC curves or algorithms can be added, see flatbuffers schemas in cdoc20-schema + +[^2]: Header structure is defined in flatbuffers schema, see cdoc20-schema + +[^3]: Content is zlib compressed tar archive + +## CDoc 2.0 ECDH server scenario + +1. *Follow steps from previous scenario 1-6* +2. Sender chooses key transaction server (preconfigured list) +3. Sender sends sender public key and recipient public key to the key transfer server [^4] +4. Server stores public keys in server and generates transaction id +5. Sender adds key server id, recipient public key, transaction id and encrypted FMK to CDoc header +6. *Follow steps from previous scenario 8-10* +7. Recipient finds transaction id and server using his id-kaart public key from CDoc +8. Recipient authenticates himself against key transfer server using certificate on id-kaart (mutual TLS) +9. Recipient queries the server with transaction id [^4] +10. If recipient certificate public key and recipient public key in transaction record match, then server answers with sender public key +11. *Follow steps from previous steps 12-15* + + +Key transfer server benefits: +* After the key has been deleted from the key transfer server, the document cannot be decrypted even when keys on recipient's id-kaart have been compromised. +* Other scenarios can be implemented like expiring CDoc2.0 documents by deleting expired keys from key transfer server. + +[^4]: key transfer server protocol is defined in cdoc20-openapi module + +## CDoc 2.0 RSA-OAEP + +RSA-OAEP is similar to ECDH scenario, with difference that KEK is generated from secure random (not ECDH) and +KEK is encrypted with recipient RSA public key and included into CDOC header (instead of +sender public key). + +1. Sender acquires recipient's certificate from SK LDAP using recipient id or by some other means. + Recipient certificate contains recipient RSA public key. +2. Sender generates file master key (FMK) using HKDF extract algorithm. +3. Sender generates encryption key (KEK) using secure random. +4. Sender derives content encryption key (CEK) and hmac key (HHK) from FMK using HKDF expand algorithm. +5. Sender encrypts FMK with KEK (xor). +6. Sender encrypts KEK with recipient's RSA public key. +7. Sender adds encrypted FMK and encrypted KEK with recipient's public key to CDoc header. +8. Sender calculates header hmac using hmac key (HHK) and adds calculated hmac to CDoc. +9. Sender encrypts content with CEK (ChaCha20-Poly1305 with AAD). +10. Sender sends CDoc to recipient. +11. Recipient searches CDoc header for recipient's record that contains his public key. +12. Recipient decrypts key encryption key (KEK) using recipient's RSA private key. +13. Recipient decrypts FMK using KEK. +14. Recipient derives CEK and HHK from FMK using HKDF algorithm. +15. Recipient calculates hmac and checks it against hmac in CDoc. +16. Recipient decrypts content using CEK. + +## CDoc 2.0 RSA-OAEP with server scenario + +1. *Follow steps from RSA-OAEP scenario 1-6* +2. Sender chooses key capsule server (by providing server configuration) +3. Sender sends recipient public key and encrypted KEK inside capsule to the key capsule server +4. Server stores capsule containing recipient public key and encrypted KEK and responds with generated transaction id +5. Sender adds key server id, recipient public key, transaction id and encrypted FMK to CDoc header +6. *Follow steps from RSA-OAEP scenario 8-10* +7. Recipient finds transaction id and server using his public RSA key from CDoc +8. Recipient authenticates against server using RSA certificate (mutual TLS) +9. Recipient queries the server with transaction id [^4] +10. If recipient certificate public key and recipient public key in capsule record match, then server answers with + capsule that contains encrypted KEK +11. *Follow steps from RSA-OAEP scenario steps 12-15* + +## CDoc 2.0 with symmetric key + +Similar to ECDH scenario, but KEK is derived from symmetric key (secret) identified by key_label using HKDF algorithm. + +1. Sender and recipient have a pre shared secret identified by key_label +2. Sender derives key encryption key (KEK) from secret, key_label and salt (generated using secure random) using HKDF algorithm +3. *Follow steps from ECDH scenario 4-6* +4. Sender adds encrypted FMK with key_label to CDoc header +5. *Follow steps from ECDH scenario 8-10* +6. Recipient searches CDoc header for key_label and finds salt and encrypted FMK +7. Recipient derives encryption key (KEK) from salt, key_label and pre-shared symmetric key (secret) +8. Recipient decrypts FMK using KEK. +9. *Follow steps from ECDH scenario 13-15* + +cdoc20_java does not provide solution for securely storing the secret, but most password managers + can do that. + + +## Structure + +- cdoc20-schema - flatbuffers schemas and code generation +- cdoc20-lib - CDOC 2.0 creation and processing library +- cdoc20-cli - Command line utility to create/process CDOC 2.0 files +- cdoc20-openapi - OpenAPI definitions for server and client generation +- cdoc20-server - Optional server backend for securely exchanging key capsules +- cdoc20-client - Optional client for server backend +- gatling-tests - Functional and load tests for cdoc20-server +- test - Sample CDOC 2.0 containers (with script to create and decrypt them) + +## Preconditions for building +* Java 17 +* Maven 3.8.x +* Docker available and running (required for running tests) + +## Building +CDOC 2.0 has been tested with JDK 17 and Maven 3.8.4 + +``` +mvn clean install +``` + +## Testing +By default tests that require smart-card are excluded from running. To execute all tests enable allTests maven profile +``` +mvn -PallTests test +``` + +For more control set `tests` maven property directly. For more info see +[Junit5 Tag Expression](https://junit.org/junit5/docs/current/user-guide/#running-tests-tag-expressions) +``` +mvn -Dtests='!(slow | pkcs11)' +``` + +### PKCS11 tests + +To run the tests using a physical PKCS11 device (smart card or usb token), execute: + +``` +mvn test -Dtests=pkcs11 +``` + +The pkcs11 device configuration (PKCS11 library, slot, pin, etc) can be specified using `cdoc2.pkcs11.conf-file` system property, for example: + +``` +mvn test -Dtests=pkcs11 -Dcdoc2.pkcs11.conf-file=pkcs11-test-safenet.properties +``` + +By default, the pkcs11 configuration is read from the file `pkcs11-test-idcard.properties`. + +### Entropy +In case the tests run slowly (probably due to waiting on entropy generation), +using an entropy source (e.g `haveged`) may help on Linux: + +``` +apt-get install haveged +update-rc.d haveged defaults +service haveged start +``` + +## Running + +See `cdoc20-cli/README.md` + +## Releasing + +First update CHANGELOG.md - follow semantic versioning + +Will update version numbers in pom.xml files and create tag with version v{x.y.z} in git +``` +mvn clean +mvn --batch-mode -Dtag=v{x.y.z} release:prepare -DreleaseVersion={x.y.z} -DdevelopmentVersion={x.y+1.z}-SNAPSHOT +mvn release:perform -Darguments="-Dmaven.deploy.skip=true" +``` +Verify that git repositories are synced (master points to same commit) and the tag is pushed (using `git push v{x.y.z}`). + +As maven repository doesn't exist yet, then maven deploy is not performed + +For more info, see +[Maven Non-interactive Release](https://maven.apache.org/maven-release/maven-release-plugin/examples/non-interactive-release.html) + + + + From a7eb1506b1d1c85835056934e2378f6b38552976 Mon Sep 17 00:00:00 2001 From: Rainer Metsvahi Date: Tue, 9 May 2023 13:20:45 +0300 Subject: [PATCH 3/9] Merge --- .gitattributes | 1 + .gitignore | 37 + CHANGELOG.md | 144 +++ README.md | 2 +- cdoc20-cli/README.md | 295 ++++++ .../config/localhost/localhost.properties | 30 + .../localhost/localhost_pkcs12.properties | 21 + .../localhost/localhost_pkcs12_rsa.properties | 22 + cdoc20-cli/keys/37101010021_cert.cer | Bin 0 -> 1602 bytes cdoc20-cli/keys/37101010021_cert.pem | 36 + cdoc20-cli/keys/README.md | 95 ++ cdoc20-cli/keys/alice.pem | 6 + cdoc20-cli/keys/alice_pub.pem | 5 + cdoc20-cli/keys/bob.pem | 6 + cdoc20-cli/keys/bob_pub.pem | 5 + cdoc20-cli/keys/cdoc20client-certificate.pem | 15 + cdoc20-cli/keys/cdoc20client.pem | 4 + cdoc20-cli/keys/cdoc20client_pub.pem | 5 + cdoc20-cli/keys/rsa_priv.pem | 27 + cdoc20-cli/keys/rsa_pub.pem | 9 + cdoc20-cli/pom.xml | 135 +++ .../java/ee/cyber/cdoc20/cli/CDocCli.java | 52 ++ .../ee/cyber/cdoc20/cli/SymmetricKeyUtil.java | 103 +++ .../cdoc20/cli/commands/CDocCreateCmd.java | 135 +++ .../cdoc20/cli/commands/CDocDecryptCmd.java | 126 +++ .../cdoc20/cli/commands/CDocInfoCmd.java | 55 ++ .../cdoc20/cli/commands/CDocListCmd.java | 126 +++ .../main/resources/simplelogger.properties | 3 + cdoc20-cli/src/test/java/CDocCliTest.java | 107 +++ .../test/resources/simplelogger.properties | 3 + cdoc20-client/pom.xml | 222 +++++ .../client/Cdoc20KeyCapsuleApiClient.java | 293 ++++++ cdoc20-lib/README.md | 6 + cdoc20-lib/ldap.README | 9 + cdoc20-lib/pkcs11.README | 169 ++++ cdoc20-lib/pom.xml | 88 ++ .../java/ee/cyber/cdoc20/CDocBuilder.java | 183 ++++ .../ee/cyber/cdoc20/CDocConfiguration.java | 46 + .../java/ee/cyber/cdoc20/CDocDecrypter.java | 113 +++ .../java/ee/cyber/cdoc20/CDocException.java | 16 + .../ee/cyber/cdoc20/CDocUserException.java | 31 + .../cyber/cdoc20/CDocValidationException.java | 12 + .../java/ee/cyber/cdoc20/UserErrorCode.java | 38 + .../cyber/cdoc20/client/EcCapsuleClient.java | 23 + .../cdoc20/client/EcCapsuleClientImpl.java | 81 ++ .../cyber/cdoc20/client/ExtApiException.java | 24 + .../cyber/cdoc20/client/KeyCapsuleClient.java | 14 + .../client/KeyCapsuleClientFactory.java | 14 + .../cdoc20/client/KeyCapsuleClientImpl.java | 330 +++++++ .../cyber/cdoc20/client/RsaCapsuleClient.java | 10 + .../cdoc20/client/RsaCapsuleClientImpl.java | 47 + .../ee/cyber/cdoc20/client/ServerClient.java | 10 + .../ee/cyber/cdoc20/client/package-info.java | 4 + .../cdoc20/container/CDocParseException.java | 14 + .../ee/cyber/cdoc20/container/Envelope.java | 495 +++++++++++ .../cdoc20/container/FileNameValidator.java | 65 ++ .../java/ee/cyber/cdoc20/container/Tar.java | 189 ++++ .../ee/cyber/cdoc20/container/TarDeflate.java | 305 +++++++ .../UnknownFlatBufferTypeException.java | 10 + .../recipients/EccPubKeyRecipient.java | 64 ++ .../container/recipients/EccRecipient.java | 62 ++ .../recipients/EccServerKeyRecipient.java | 66 ++ .../recipients/PublicKeyRecipient.java | 7 + .../recipients/RSAPubKeyRecipient.java | 58 ++ .../container/recipients/RSARecipient.java | 40 + .../recipients/RSAServerKeyRecipient.java | 63 ++ .../container/recipients/Recipient.java | 59 ++ .../recipients/RecipientDeserializer.java | 195 ++++ .../recipients/RecipientFactory.java | 252 ++++++ .../recipients/RecipientSerializer.java | 179 ++++ .../container/recipients/SerializableFBS.java | 12 + .../container/recipients/ServerRecipient.java | 9 + .../recipients/SymmetricKeyRecipient.java | 52 ++ .../ee/cyber/cdoc20/crypto/ChaChaCipher.java | 173 ++++ .../java/ee/cyber/cdoc20/crypto/Crypto.java | 289 ++++++ .../cdoc20/crypto/DecryptionKeyMaterial.java | 86 ++ .../java/ee/cyber/cdoc20/crypto/ECKeys.java | 312 +++++++ .../ee/cyber/cdoc20/crypto/EllipticCurve.java | 153 ++++ .../cdoc20/crypto/EncryptionKeyMaterial.java | 82 ++ .../ee/cyber/cdoc20/crypto/KekDerivable.java | 13 + .../java/ee/cyber/cdoc20/crypto/KekTools.java | 159 ++++ .../java/ee/cyber/cdoc20/crypto/PemTools.java | 300 +++++++ .../ee/cyber/cdoc20/crypto/Pkcs11Tools.java | 405 +++++++++ .../java/ee/cyber/cdoc20/crypto/RsaUtils.java | 142 +++ .../ee/cyber/cdoc20/util/OperatingSystem.java | 39 + .../java/ee/cyber/cdoc20/util/Resources.java | 49 + .../java/ee/cyber/cdoc20/util/SkLdapUtil.java | 210 +++++ .../main/resources/simplelogger.properties | 3 + .../test/java/ee/cyber/cdoc20/SkLdapTest.java | 40 + .../cyber/cdoc20/container/EnvelopeTest.java | 839 ++++++++++++++++++ .../cdoc20/container/EnvelopeTestUtils.java | 325 +++++++ .../cdoc20/container/TarDeflateTest.java | 348 ++++++++ .../cdoc20/crypto/ChaChaChipherTest.java | 233 +++++ .../ee/cyber/cdoc20/crypto/CryptoTest.java | 152 ++++ .../ee/cyber/cdoc20/crypto/ECKeysTest.java | 389 ++++++++ .../crypto/Pkcs11DeviceConfiguration.java | 67 ++ .../ee/cyber/cdoc20/crypto/Pkcs11Test.java | 97 ++ .../java/ee/cyber/cdoc20/crypto/RsaTest.java | 155 ++++ .../resources/pkcs11-test-idcard.properties | 10 + .../resources/pkcs11-test-safenet.properties | 8 + cdoc20-openapi/cdoc20-key-capsules.yaml | 113 +++ cdoc20-openapi/pom.xml | 203 +++++ cdoc20-schema/README.md | 13 + cdoc20-schema/pom.xml | 173 ++++ cdoc20-schema/src/main/fbs/header.fbs | 44 + cdoc20-schema/src/main/fbs/recipients.fbs | 54 ++ .../cdoc20/fbs/header/FbsHeaderTest.java | 157 ++++ cdoc20-server/.gitignore | 38 + cdoc20-server/README.md | 111 +++ cdoc20-server/admin-guide.md | 294 ++++++ .../config/application-local.properties | 70 ++ cdoc20-server/get-server/docker/Dockerfile | 12 + .../get-server/docker/application.properties | 67 ++ .../get-server/docker/docker-entrypoint.sh | 9 + cdoc20-server/get-server/pom.xml | 279 ++++++ .../server/Cdoc20GetServerApplication.java | 55 ++ .../ClientAuthCertRevocationCustomizer.java | 58 ++ .../cdoc20/server/api/GetKeyCapsuleApi.java | 131 +++ .../cdoc20/server/GetKeyCapsuleApiTests.java | 435 +++++++++ .../src/test/resources/application.properties | 28 + .../get-server/src/test/resources/logback.xml | 46 + cdoc20-server/keys/README.md | 27 + .../ca_certs/TEST_of_ESTEID-SK_2015.pem.crt | 37 + .../keys/ca_certs/client-certificate.pem | 15 + .../keys/ca_certs/esteid2018.pem.crt | 31 + cdoc20-server/keys/cdoc20client.p12 | Bin 0 -> 1330 bytes cdoc20-server/keys/cdoc20server.p12 | Bin 0 -> 1316 bytes cdoc20-server/keys/clienttruststore.jks | Bin 0 -> 982 bytes .../keys/rsa/client-rsa-16384-cert.pem | Bin 0 -> 4488 bytes cdoc20-server/keys/rsa/client-rsa-16384.p12 | Bin 0 -> 14424 bytes .../keys/rsa/client-rsa-2048-cert.pem | Bin 0 -> 888 bytes cdoc20-server/keys/rsa/client-rsa-2048.p12 | Bin 0 -> 2760 bytes .../keys/rsa/client-rsa-4096-cert.pem | Bin 0 -> 1408 bytes cdoc20-server/keys/rsa/client-rsa-4096.p12 | Bin 0 -> 4440 bytes .../keys/rsa/client-rsa-8192-cert.pem | Bin 0 -> 2432 bytes cdoc20-server/keys/rsa/client-rsa-8192.p12 | Bin 0 -> 7768 bytes cdoc20-server/keys/server-certificate.pem | 15 + cdoc20-server/keys/servertruststore.jks | Bin 0 -> 5974 bytes .../cdoc2-rsa-test-sk-cert.pem | 34 + .../cdoc2-rsa-test-sk.p12 | Bin 0 -> 3117 bytes .../cdoc2-rsa-test-sk.pem | 30 + .../cdoc2-test-pulk-cert.pem | 34 + cdoc20-server/pom.xml | 22 + cdoc20-server/postgres.README.md | 9 + .../config/application-local.properties | 54 ++ cdoc20-server/put-server/docker/Dockerfile | 12 + .../put-server/docker/application.properties | 53 ++ .../put-server/docker/docker-entrypoint.sh | 9 + cdoc20-server/put-server/pom.xml | 279 ++++++ .../server/Cdoc20PutServerApplication.java | 46 + .../cdoc20/server/api/CapsuleValidator.java | 70 ++ .../server/api/CreateKeyCapsuleApi.java | 105 +++ .../cdoc20/server/CreateKeyCapsuleTests.java | 386 ++++++++ .../src/test/resources/application.properties | 19 + .../put-server/src/test/resources/logback.xml | 46 + cdoc20-server/server-common/pom.xml | 114 +++ .../cdoc20/server/GlobalExceptionHandler.java | 31 + .../cyber/cdoc20/server/MonitoringUtil.java | 22 + .../server/RegisteredEndpointsLogger.java | 34 + .../server/SystemTimeInfoContributor.java | 23 + .../java/ee/cyber/cdoc20/server/Utils.java | 26 + .../cdoc20/server/BaseIntegrationTest.java | 144 +++ .../java/ee/cyber/cdoc20/server/TestData.java | 46 + .../cdoc20/server/TestingConfiguration.java | 69 ++ .../ee/cyber/cdoc20/server/UtilsTest.java | 22 + cdoc20-server/server-db/liquibase.properties | 4 + cdoc20-server/server-db/pom.xml | 71 ++ .../cdoc20/server/model/db/KeyCapsuleDb.java | 77 ++ .../server/model/db/KeyCapsuleRepository.java | 6 + .../changelog/changes/001-initial-state.sql | 11 + .../db/changelog/db.changelog-master.yaml | 3 + .../resources/db/liquibase.properties.docker | 2 + checkstyle-suppressions.xml | 16 + checkstyle.xml | 137 +++ docker/README.md | 65 ++ docker/docker-compose.yml | 56 ++ gatling-tests/.gitignore | 2 + gatling-tests/README.md | 149 ++++ gatling-tests/pom.xml | 130 +++ .../server/KeyCapsuleFunctionalTests.java | 72 ++ .../cdoc20/server/KeyCapsuleLoadTests.java | 99 +++ .../cdoc20/server/TestDataGenerator.java | 195 ++++ .../cdoc20/server/conf/LoadTestConfig.java | 19 + .../server/conf/LoadTestParameters.java | 11 + .../cdoc20/server/conf/LoadedKeyStore.java | 15 + .../cyber/cdoc20/server/conf/TestConfig.java | 133 +++ .../cyber/cdoc20/server/datagen/CertUtil.java | 131 +++ .../server/datagen/KeyStoreGenerator.java | 68 ++ .../cdoc20/server/datagen/KeyStoreUtil.java | 82 ++ .../cdoc20/server/dto/GeneratedCapsule.java | 15 + .../cdoc20/server/dto/KeyCapsuleRequest.java | 29 + .../cdoc20/server/dto/KeyCapsuleType.java | 9 + .../scenarios/EccKeyCapsuleScenarios.java | 93 ++ .../server/scenarios/KeyCapsuleScenarios.java | 179 ++++ .../scenarios/RsaKeyCapsuleScenarios.java | 112 +++ .../server/scenarios/ScenarioIdentifiers.java | 27 + .../test/resources/application.conf.sample | 43 + .../src/test/resources/cdoc20client.p12 | Bin 0 -> 1330 bytes .../src/test/resources/keys/gatling-ca.p12 | Bin 0 -> 1308 bytes .../src/test/resources/keys/gatling-ca.pem | 15 + .../resources/keys/test-clients/.gitignore | 1 + .../src/test/resources/logback-test.xml | 19 + pom.xml | 232 +++++ test/generate_documents.sh | 238 +++++ .../ec_server_ria_dev_id_card.cdoc | Bin 0 -> 4029 bytes .../testvectors/ec_server_ria_dev_pkcs12.cdoc | Bin 0 -> 3721 bytes test/testvectors/ec_simple.cdoc | Bin 0 -> 3749 bytes .../rsa_server_ria_dev_pkcs12.cdoc | Bin 0 -> 3893 bytes test/testvectors/rsa_simple.cdoc | Bin 0 -> 4057 bytes test/testvectors/symmetric.cdoc | Bin 0 -> 3573 bytes test/testvectors/symmetric_longfilename.cdoc | Bin 0 -> 444 bytes 211 files changed, 17486 insertions(+), 1 deletion(-) create mode 100644 .gitattributes create mode 100644 .gitignore create mode 100644 CHANGELOG.md create mode 100644 cdoc20-cli/README.md create mode 100644 cdoc20-cli/config/localhost/localhost.properties create mode 100644 cdoc20-cli/config/localhost/localhost_pkcs12.properties create mode 100644 cdoc20-cli/config/localhost/localhost_pkcs12_rsa.properties create mode 100644 cdoc20-cli/keys/37101010021_cert.cer create mode 100644 cdoc20-cli/keys/37101010021_cert.pem create mode 100644 cdoc20-cli/keys/README.md create mode 100644 cdoc20-cli/keys/alice.pem create mode 100644 cdoc20-cli/keys/alice_pub.pem create mode 100644 cdoc20-cli/keys/bob.pem create mode 100644 cdoc20-cli/keys/bob_pub.pem create mode 100644 cdoc20-cli/keys/cdoc20client-certificate.pem create mode 100644 cdoc20-cli/keys/cdoc20client.pem create mode 100644 cdoc20-cli/keys/cdoc20client_pub.pem create mode 100644 cdoc20-cli/keys/rsa_priv.pem create mode 100644 cdoc20-cli/keys/rsa_pub.pem create mode 100644 cdoc20-cli/pom.xml create mode 100644 cdoc20-cli/src/main/java/ee/cyber/cdoc20/cli/CDocCli.java create mode 100644 cdoc20-cli/src/main/java/ee/cyber/cdoc20/cli/SymmetricKeyUtil.java create mode 100644 cdoc20-cli/src/main/java/ee/cyber/cdoc20/cli/commands/CDocCreateCmd.java create mode 100644 cdoc20-cli/src/main/java/ee/cyber/cdoc20/cli/commands/CDocDecryptCmd.java create mode 100644 cdoc20-cli/src/main/java/ee/cyber/cdoc20/cli/commands/CDocInfoCmd.java create mode 100644 cdoc20-cli/src/main/java/ee/cyber/cdoc20/cli/commands/CDocListCmd.java create mode 100644 cdoc20-cli/src/main/resources/simplelogger.properties create mode 100644 cdoc20-cli/src/test/java/CDocCliTest.java create mode 100644 cdoc20-cli/src/test/resources/simplelogger.properties create mode 100644 cdoc20-client/pom.xml create mode 100644 cdoc20-client/src/main/java/ee/cyber/cdoc20/client/Cdoc20KeyCapsuleApiClient.java create mode 100644 cdoc20-lib/README.md create mode 100644 cdoc20-lib/ldap.README create mode 100644 cdoc20-lib/pkcs11.README create mode 100644 cdoc20-lib/pom.xml create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/CDocBuilder.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/CDocConfiguration.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/CDocDecrypter.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/CDocException.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/CDocUserException.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/CDocValidationException.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/UserErrorCode.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/client/EcCapsuleClient.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/client/EcCapsuleClientImpl.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/client/ExtApiException.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/client/KeyCapsuleClient.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/client/KeyCapsuleClientFactory.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/client/KeyCapsuleClientImpl.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/client/RsaCapsuleClient.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/client/RsaCapsuleClientImpl.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/client/ServerClient.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/client/package-info.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/container/CDocParseException.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/container/Envelope.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/container/FileNameValidator.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/container/Tar.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/container/TarDeflate.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/container/UnknownFlatBufferTypeException.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/container/recipients/EccPubKeyRecipient.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/container/recipients/EccRecipient.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/container/recipients/EccServerKeyRecipient.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/container/recipients/PublicKeyRecipient.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/container/recipients/RSAPubKeyRecipient.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/container/recipients/RSARecipient.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/container/recipients/RSAServerKeyRecipient.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/container/recipients/Recipient.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/container/recipients/RecipientDeserializer.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/container/recipients/RecipientFactory.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/container/recipients/RecipientSerializer.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/container/recipients/SerializableFBS.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/container/recipients/ServerRecipient.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/container/recipients/SymmetricKeyRecipient.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/crypto/ChaChaCipher.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/crypto/Crypto.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/crypto/DecryptionKeyMaterial.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/crypto/ECKeys.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/crypto/EllipticCurve.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/crypto/EncryptionKeyMaterial.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/crypto/KekDerivable.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/crypto/KekTools.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/crypto/PemTools.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/crypto/Pkcs11Tools.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/crypto/RsaUtils.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/util/OperatingSystem.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/util/Resources.java create mode 100644 cdoc20-lib/src/main/java/ee/cyber/cdoc20/util/SkLdapUtil.java create mode 100644 cdoc20-lib/src/main/resources/simplelogger.properties create mode 100644 cdoc20-lib/src/test/java/ee/cyber/cdoc20/SkLdapTest.java create mode 100644 cdoc20-lib/src/test/java/ee/cyber/cdoc20/container/EnvelopeTest.java create mode 100644 cdoc20-lib/src/test/java/ee/cyber/cdoc20/container/EnvelopeTestUtils.java create mode 100644 cdoc20-lib/src/test/java/ee/cyber/cdoc20/container/TarDeflateTest.java create mode 100644 cdoc20-lib/src/test/java/ee/cyber/cdoc20/crypto/ChaChaChipherTest.java create mode 100644 cdoc20-lib/src/test/java/ee/cyber/cdoc20/crypto/CryptoTest.java create mode 100644 cdoc20-lib/src/test/java/ee/cyber/cdoc20/crypto/ECKeysTest.java create mode 100644 cdoc20-lib/src/test/java/ee/cyber/cdoc20/crypto/Pkcs11DeviceConfiguration.java create mode 100644 cdoc20-lib/src/test/java/ee/cyber/cdoc20/crypto/Pkcs11Test.java create mode 100644 cdoc20-lib/src/test/java/ee/cyber/cdoc20/crypto/RsaTest.java create mode 100644 cdoc20-lib/src/test/resources/pkcs11-test-idcard.properties create mode 100644 cdoc20-lib/src/test/resources/pkcs11-test-safenet.properties create mode 100644 cdoc20-openapi/cdoc20-key-capsules.yaml create mode 100644 cdoc20-openapi/pom.xml create mode 100644 cdoc20-schema/README.md create mode 100644 cdoc20-schema/pom.xml create mode 100644 cdoc20-schema/src/main/fbs/header.fbs create mode 100644 cdoc20-schema/src/main/fbs/recipients.fbs create mode 100644 cdoc20-schema/src/test/java/ee/cyber/cdoc20/fbs/header/FbsHeaderTest.java create mode 100644 cdoc20-server/.gitignore create mode 100644 cdoc20-server/README.md create mode 100644 cdoc20-server/admin-guide.md create mode 100644 cdoc20-server/get-server/config/application-local.properties create mode 100644 cdoc20-server/get-server/docker/Dockerfile create mode 100644 cdoc20-server/get-server/docker/application.properties create mode 100755 cdoc20-server/get-server/docker/docker-entrypoint.sh create mode 100644 cdoc20-server/get-server/pom.xml create mode 100644 cdoc20-server/get-server/src/main/java/ee/cyber/cdoc20/server/Cdoc20GetServerApplication.java create mode 100644 cdoc20-server/get-server/src/main/java/ee/cyber/cdoc20/server/ClientAuthCertRevocationCustomizer.java create mode 100644 cdoc20-server/get-server/src/main/java/ee/cyber/cdoc20/server/api/GetKeyCapsuleApi.java create mode 100644 cdoc20-server/get-server/src/test/java/ee/cyber/cdoc20/server/GetKeyCapsuleApiTests.java create mode 100644 cdoc20-server/get-server/src/test/resources/application.properties create mode 100644 cdoc20-server/get-server/src/test/resources/logback.xml create mode 100644 cdoc20-server/keys/README.md create mode 100644 cdoc20-server/keys/ca_certs/TEST_of_ESTEID-SK_2015.pem.crt create mode 100644 cdoc20-server/keys/ca_certs/client-certificate.pem create mode 100644 cdoc20-server/keys/ca_certs/esteid2018.pem.crt create mode 100644 cdoc20-server/keys/cdoc20client.p12 create mode 100644 cdoc20-server/keys/cdoc20server.p12 create mode 100644 cdoc20-server/keys/clienttruststore.jks create mode 100644 cdoc20-server/keys/rsa/client-rsa-16384-cert.pem create mode 100644 cdoc20-server/keys/rsa/client-rsa-16384.p12 create mode 100644 cdoc20-server/keys/rsa/client-rsa-2048-cert.pem create mode 100644 cdoc20-server/keys/rsa/client-rsa-2048.p12 create mode 100644 cdoc20-server/keys/rsa/client-rsa-4096-cert.pem create mode 100644 cdoc20-server/keys/rsa/client-rsa-4096.p12 create mode 100644 cdoc20-server/keys/rsa/client-rsa-8192-cert.pem create mode 100644 cdoc20-server/keys/rsa/client-rsa-8192.p12 create mode 100644 cdoc20-server/keys/server-certificate.pem create mode 100644 cdoc20-server/keys/servertruststore.jks create mode 100644 cdoc20-server/keys/sk-signed-test-certs/cdoc2-rsa-test-sk-cert.pem create mode 100644 cdoc20-server/keys/sk-signed-test-certs/cdoc2-rsa-test-sk.p12 create mode 100644 cdoc20-server/keys/sk-signed-test-certs/cdoc2-rsa-test-sk.pem create mode 100644 cdoc20-server/keys/sk-signed-test-certs/cdoc2-test-pulk-cert.pem create mode 100644 cdoc20-server/pom.xml create mode 100644 cdoc20-server/postgres.README.md create mode 100644 cdoc20-server/put-server/config/application-local.properties create mode 100644 cdoc20-server/put-server/docker/Dockerfile create mode 100644 cdoc20-server/put-server/docker/application.properties create mode 100755 cdoc20-server/put-server/docker/docker-entrypoint.sh create mode 100644 cdoc20-server/put-server/pom.xml create mode 100644 cdoc20-server/put-server/src/main/java/ee/cyber/cdoc20/server/Cdoc20PutServerApplication.java create mode 100644 cdoc20-server/put-server/src/main/java/ee/cyber/cdoc20/server/api/CapsuleValidator.java create mode 100644 cdoc20-server/put-server/src/main/java/ee/cyber/cdoc20/server/api/CreateKeyCapsuleApi.java create mode 100644 cdoc20-server/put-server/src/test/java/ee/cyber/cdoc20/server/CreateKeyCapsuleTests.java create mode 100644 cdoc20-server/put-server/src/test/resources/application.properties create mode 100644 cdoc20-server/put-server/src/test/resources/logback.xml create mode 100644 cdoc20-server/server-common/pom.xml create mode 100644 cdoc20-server/server-common/src/main/java/ee/cyber/cdoc20/server/GlobalExceptionHandler.java create mode 100644 cdoc20-server/server-common/src/main/java/ee/cyber/cdoc20/server/MonitoringUtil.java create mode 100644 cdoc20-server/server-common/src/main/java/ee/cyber/cdoc20/server/RegisteredEndpointsLogger.java create mode 100644 cdoc20-server/server-common/src/main/java/ee/cyber/cdoc20/server/SystemTimeInfoContributor.java create mode 100644 cdoc20-server/server-common/src/main/java/ee/cyber/cdoc20/server/Utils.java create mode 100644 cdoc20-server/server-common/src/test/java/ee/cyber/cdoc20/server/BaseIntegrationTest.java create mode 100644 cdoc20-server/server-common/src/test/java/ee/cyber/cdoc20/server/TestData.java create mode 100644 cdoc20-server/server-common/src/test/java/ee/cyber/cdoc20/server/TestingConfiguration.java create mode 100644 cdoc20-server/server-common/src/test/java/ee/cyber/cdoc20/server/UtilsTest.java create mode 100644 cdoc20-server/server-db/liquibase.properties create mode 100644 cdoc20-server/server-db/pom.xml create mode 100644 cdoc20-server/server-db/src/main/java/ee/cyber/cdoc20/server/model/db/KeyCapsuleDb.java create mode 100644 cdoc20-server/server-db/src/main/java/ee/cyber/cdoc20/server/model/db/KeyCapsuleRepository.java create mode 100644 cdoc20-server/server-db/src/main/resources/db/changelog/changes/001-initial-state.sql create mode 100644 cdoc20-server/server-db/src/main/resources/db/changelog/db.changelog-master.yaml create mode 100644 cdoc20-server/server-db/src/main/resources/db/liquibase.properties.docker create mode 100644 checkstyle-suppressions.xml create mode 100644 checkstyle.xml create mode 100644 docker/README.md create mode 100644 docker/docker-compose.yml create mode 100644 gatling-tests/.gitignore create mode 100644 gatling-tests/README.md create mode 100644 gatling-tests/pom.xml create mode 100644 gatling-tests/src/main/java/ee/cyber/cdoc20/server/KeyCapsuleFunctionalTests.java create mode 100644 gatling-tests/src/main/java/ee/cyber/cdoc20/server/KeyCapsuleLoadTests.java create mode 100644 gatling-tests/src/main/java/ee/cyber/cdoc20/server/TestDataGenerator.java create mode 100644 gatling-tests/src/main/java/ee/cyber/cdoc20/server/conf/LoadTestConfig.java create mode 100644 gatling-tests/src/main/java/ee/cyber/cdoc20/server/conf/LoadTestParameters.java create mode 100644 gatling-tests/src/main/java/ee/cyber/cdoc20/server/conf/LoadedKeyStore.java create mode 100644 gatling-tests/src/main/java/ee/cyber/cdoc20/server/conf/TestConfig.java create mode 100644 gatling-tests/src/main/java/ee/cyber/cdoc20/server/datagen/CertUtil.java create mode 100644 gatling-tests/src/main/java/ee/cyber/cdoc20/server/datagen/KeyStoreGenerator.java create mode 100644 gatling-tests/src/main/java/ee/cyber/cdoc20/server/datagen/KeyStoreUtil.java create mode 100644 gatling-tests/src/main/java/ee/cyber/cdoc20/server/dto/GeneratedCapsule.java create mode 100644 gatling-tests/src/main/java/ee/cyber/cdoc20/server/dto/KeyCapsuleRequest.java create mode 100644 gatling-tests/src/main/java/ee/cyber/cdoc20/server/dto/KeyCapsuleType.java create mode 100644 gatling-tests/src/main/java/ee/cyber/cdoc20/server/scenarios/EccKeyCapsuleScenarios.java create mode 100644 gatling-tests/src/main/java/ee/cyber/cdoc20/server/scenarios/KeyCapsuleScenarios.java create mode 100644 gatling-tests/src/main/java/ee/cyber/cdoc20/server/scenarios/RsaKeyCapsuleScenarios.java create mode 100644 gatling-tests/src/main/java/ee/cyber/cdoc20/server/scenarios/ScenarioIdentifiers.java create mode 100644 gatling-tests/src/test/resources/application.conf.sample create mode 100644 gatling-tests/src/test/resources/cdoc20client.p12 create mode 100644 gatling-tests/src/test/resources/keys/gatling-ca.p12 create mode 100644 gatling-tests/src/test/resources/keys/gatling-ca.pem create mode 100644 gatling-tests/src/test/resources/keys/test-clients/.gitignore create mode 100644 gatling-tests/src/test/resources/logback-test.xml create mode 100644 pom.xml create mode 100755 test/generate_documents.sh create mode 100644 test/testvectors/ec_server_ria_dev_id_card.cdoc create mode 100644 test/testvectors/ec_server_ria_dev_pkcs12.cdoc create mode 100644 test/testvectors/ec_simple.cdoc create mode 100644 test/testvectors/rsa_server_ria_dev_pkcs12.cdoc create mode 100644 test/testvectors/rsa_simple.cdoc create mode 100644 test/testvectors/symmetric.cdoc create mode 100644 test/testvectors/symmetric_longfilename.cdoc diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 00000000..2227abb0 --- /dev/null +++ b/.gitattributes @@ -0,0 +1 @@ +*.bin binary \ No newline at end of file diff --git a/.gitignore b/.gitignore new file mode 100644 index 00000000..2f5eabec --- /dev/null +++ b/.gitignore @@ -0,0 +1,37 @@ +# ---> Maven +target/ +pom.xml.tag +pom.xml.releaseBackup +pom.xml.versionsBackup +pom.xml.next +release.properties +dependency-reduced-pom.xml +buildNumber.properties +.mvn/timing.properties + +# ---> Java +*.class + +# Mobile Tools for Java (J2ME) +.mtj.tmp/ + +# Package Files # +*.jar +*.war +*.ear + +# virtual machine crash logs, see http://www.java.com/en/download/help/error_hotspot.xml +hs_err_pid* + +# IDE project files +/.idea/ +*.iml + + +/doc/ +/cdoc20-server/src/main/resources/keystore/cdoc20server.p12 +/cdoc20-server/src/main/resources/keystore/servertruststore.jks +/cdoc20-client/src/test/resources/test.properties + +/cdoc20-server/src/test/resources/test.properties +/test/testvectors/zipbomb.cdoc diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 00000000..7b740a01 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,144 @@ +# Changelog + + +## [0.5.0] Jenkins pipeline updates (2023-01-31) + +### Features + +* Added Jenkins pipeline for uploading cdoc2.0 jar artifacts to RIA Nexus repository +* Update and run key server instances also on cdoc2-keyserver-02.dev.riaint.ee host + + +## [0.4.0] ChaCha Poly1305 MAC is checked before other errors are reported (2023-01-30) + +### Features + +* Rewrite tar processing/ChaCha decryption so that Poly1305 MAC is always checked (even when zlib/tar processing errors happen) +* Added sample CDOC 2.0 containers with keys and configuration files +* Added Unicode Right-To-Left Override (U+202E) to forbidden characters + +### Bug Fixes + +* Incomplete CDOC container file is removed, when creation of CDOC container fails +* Remove keyserver secrets logging from CLI debug log + + +## [0.3.0] (2023-01-23) + +### Features + +* client authenticate certificate revocation checks (OCSP) for get-server +* enable monitoring endpoints, see cdoc20-server/admin-guide.md +* only tls v1.3 is supported by servers +* remove deprecated ecc-details API +* gatling-tests updates + +### Bug Fixes +* constraint violation in OpenAPI spec are reported as http 400 (previously http 500) + + +## [0.2.0] User error codes (2022-12-16) + +### Features +* Add error codes for common user errors +* Gatling test updates + +## [0.1.0] Enable Posix extensions for tar (2022-12-12) +Switch to semantic versioning + +### Features +* Enable POSIX (PAX) extension for tar: + * support long filenames (over 100 bytes) + * support big file sizes (over 8GB) + * always use utf-8 in filenames (even, when platform default is not utf-8) +* Synchronize flatbuffers schema files with Specification v0.7 + +## [0.0.13] Symmetric Key support (long term crypto) (2022-12-07) + +### Features +* Symmetric Key scenario implementation +* Added `cdoc info` cli command that lists recipients in CDOC header + +## [0.0.12] RSA-OAEP server scenario (2022-11-25) + +### Features +* RSA-OAEP server scenario implementation +* Client uses cdoc2-key-capsules API to create/download key capsules +* Server configuration changes for client (single configuration file for create and decrypt `--server` configuration) +* E-Resident certificate support (find e-resident certificate from SK LDAP) +* Basic filename validation in container (illegal symbols and filenames) +* CLI supports certificate and private key loading from .p12 file (PKCS12) + +### Bug Fixes +* `cdoc list` command supports `--server` option + +## [0.0.11] RsaPublicKey (2022-11-21) + +### Bug Fixes +* Use RsaPublicKey encoding (RFC8017 RSA Public Key Syntax (A.1.1)) instead of X.509 (Java default encoding) + +## [0.0.10] Key server RSA support (2022-11-14) + +### Features +* Added support for RSA keys in key server +* Added support for 2 key server instances when using cdoc20-cli +* Added key server administration manual + +## [0.0.9] RSA-OAEP support (2022-11-02) + +### Features +* Support for creating and decrypting CDOC2 documents with RSA keys +* Improved Recipient.KeyLabel field support in cdoc20-lib (PublicKey used for encryption is paired with keyLabel) +* Removed cdoc20-cli -ZZ hidden feature (disable compression for payload) +* Added additional EC infinity point (X: null, Y: null) checks and tests + + +## [0.0.8] Two key capsule server instances (2022-10-31) + +### Features +* The key server is composed of 2 server instances, each with its own configuration. +* The API for creating key capsules does not require client authentication (mTLS). + +## [0.0.7] Minimal support for Recipient.KeyLabel field (2022-10-14) + +### Features +* Minimal support for Recipient.KeyLabel in FBS header (field is present in FB header, but lib is not filling its value + with info from recipient certificate) +* Upgrade flatbuffers-java to version 2.0.8 +* Move gatling-tests to main branch + +## [0.0.6] server scenario implementation (2022-10-11) + +### Features + +* Key exchange server implementation +* CLI and libary support for key scenario +* Server OpenAPI changes (more strict string format for recipient_pub_key and server_pub_key fields) + +## [0.0.5] PKCS11, LDAP and generated sender keys (2022-05-13) + +### Features + +* Refactor EllipticCurve code so that EC curve is created from certificate or public key. Interface support other EC curves + besides secp384r1. No actual support for other curves implemented yet. +* Generate sender key pair to for recipient public key. Remove option to use pre-generated sender key pair +* Support for decrypting with private decryption key from PKCS11 (support for id-kaart) +* Support for downloading recipient Esteid certificate from + [SK LDAP](https://www.skidsolutions.eu/repositoorium/ldap/esteid-ldap-kataloogi-kasutamine/) +* Documentation updates +* First version server OpenAPI specification + + +### Bug Fixes + +* Use zlib compression instead of gzip compression +* Delete all files, when decryption fails (last file was not deleted) +* EllipticCurve was incorrectly created from fmkEncryption method not Details.EccPublicKey curve + (no actual error as both had same byte value). + + +## [0.0.4] First release (2022-04-22) + +### Features + +* Create/decrypt Cdoc2.0 files with software generated EC keys diff --git a/README.md b/README.md index 6cbc6894..3f811c54 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ [CDOC 2.0](https://installer.id.ee/media/cdoc/cdoc_2_0_spetsifikatsioon_d-19-12_v1.9.pdf) reference implementation (Java) -CDOC 2.0 is a new version of [CDOC](https://www.id.ee/wp-content/uploads/2020/06/sk-cdoc-1.0-20120625_en.pdf) (CDOC lib [cdoc4j](https://github.com/open-eid/cdoc4j)), featuring additional security measures with optional server backend. CDoc version are not compatible. Additional background info can be found in [CDOC 2.0](https://www.ria.ee/sites/default/files/content-editors/EID/arne.ansperi_cdoc2_eidinfopaev_20_09_22.pdf). +CDOC 2.0 is a new version of [CDOC](https://www.id.ee/wp-content/uploads/2020/06/sk-cdoc-1.0-20120625_en.pdf) (CDOC lib [cdoc4j](https://github.com/open-eid/cdoc4j)), featuring additional security measures with optional server backend. CDoc version are not compatible. Additional background info can be found in [CDOC 2.0](https://www.ria.ee/media/2340/download). Current CDoc 2.0 supports five scenarios diff --git a/cdoc20-cli/README.md b/cdoc20-cli/README.md new file mode 100644 index 00000000..89b7c852 --- /dev/null +++ b/cdoc20-cli/README.md @@ -0,0 +1,295 @@ +# Building & Running + +## Building +Run from cdoc20_java parent directory +``` +mvn clean package +``` + +Will create `cdoc20-cli/target/cdoc20-cli-.jar` + +## Running +Run from cdoc20-cli directory + +Latest help can be seen by running: +``` +java -jar target/cdoc20-cli-.jar +``` + +where `` must be replaced with the latest version built. Example `0.0.12-SNAPSHOT` + +Sample generated CDOC2 documents are located at `cdoc20_java/test/testvectors` + +Commands for creating and decrypting sample files using cdoc-cli are in `cdoc20_java/test/generate_documents.sh` + + +### Encryption +To create: +- Output file `/tmp/mydoc.cdoc` +- with generated private key +- to recipient `keys/bob_pub.pem` +- to encrypt file 'README.md' + +``` +java -jar target/cdoc20-cli-*.jar create --file /tmp/mydoc.cdoc -p keys/bob_pub.pem README.md +``` + +### Encryption with server scenario +Server must be running, see cdoc20-server/README.md for starting the server + +To store keys in key server, specify addition `--server` option: + +When encrypting for est-eid card, `-r` can be used +``` +java -jar target/cdoc20-cli-*.jar create --server=config/localhost/localhost.properties -f /tmp/localhost_id-card.cdoc -r 37903130370 README.md +``` + +Optionally cdoc20-cli also supports encrypting with "soft" key or certificate + +Public key (`-p`) +``` +java -jar target/cdoc20-cli-*.jar create --server=config/localhost/localhost.properties -f /tmp/localhost.cdoc -p keys/cdoc20client_pub.pem README.md +``` + +Certificate (`-c` option): +``` +java -jar target/cdoc20-cli-*.jar create --server=config/localhost/localhost.properties -f /tmp/localhost.cdoc -c keys/cdoc20client-certificate.pem README.md +``` + +### Encryption with symmetric key + +Generate key with openssl (minimum length 32 bytes): +``` +openssl rand -base64 32 +`HHeUrHfo+bCZd//gGmEOU2nA5cgQolQ/m18UO/dN1tE=` +``` + +Base64 encoded keys must be prefixed with 'base64,', so that key becomes "base64,HHeUrHfo+bCZd//gGmEOU2nA5cgQolQ/m18UO/dN1tE=" + +Encrypt with generated key and label 'mylabel': +``` +java -jar target/cdoc20-cli-*.jar create --secret "mylabel:base64,HHeUrHfo+bCZd//gGmEOU2nA5cgQolQ/m18UO/dN1tE=" -f /tmp/symmetric.cdoc README.md +``` + +Or clear text: +``` +java -jar target/cdoc20-cli-*.jar create --secret "mylongpasswd:longstringthatIcanremember,butothersdon'tknow" -f /tmp/symmetric.cdoc README.md +``` + +Or secret read from file (so that secret is not exposed through process list) +``` +java -jar target/cdoc20-cli-0.0.13-SNAPSHOT.jar create @keys/b64secret.option -f /tmp/symmetric.cdoc README.md +``` + +``` +cat keys/b64secret.option +--secret "label_b64secret:base64,aejUgxxSQXqiiyrxSGACfMiIRBZq5KjlCwr/xVNY/B0=" +``` + +Decryption is done with the same label and key used for encryption +``` +java -jar target/cdoc20-cli-*.jar decrypt @keys/b64secret.option -f /tmp/symmetric.cdoc -o /tmp +``` + +Key and label can be safely stored in a password manager. + + + +### Decryption +To decrypt: +- CDOC 2.0 file `/tmp/mydoc.cdoc` +- with decryption private EC key `keys/bob.pem` +- to output directory `/tmp` + +``` +java -jar target/cdoc20-cli-*.jar decrypt --file /tmp/mydoc.cdoc -k keys/bob.pem --output /tmp +``` + +### Decrypting with server scenario +Server must be running, see cdoc20-server/README.md for starting the server + +To decrypt CDOC document that has its keys distributed through key server, cdoc-cli must have `--server` option: + +Configuration for id-card (certificate for mutual TLS and private key is read from smart-card) +``` +java -jar target/cdoc20-cli*.jar decrypt --server=config/localhost/localhost.properties -f /tmp/localhost_id-card.cdoc -o /tmp/ +``` + +It is also possible to decrypt documents created with "soft" keys, but configuration for mutual TLS (properties file) and +key (read separately from a file) must match. Also, server must be configured to trust client certificate used for +mutual TLS. +``` +java -jar target/cdoc20-cli-*.jar decrypt --server=config/localhost/localhost_pkcs12.properties -f /tmp/localhost.cdoc -k keys/cdoc20client.pem -o /tmp/ +``` + + +### List + +``` +java -jar target/cdoc20-cli-*.jar list --file /tmp/mydoc.cdoc -k keys/bob.pem +``` + +or + +``` +java -jar target/cdoc20-cli-*.jar list --server=config/localhost/localhost_pkcs12.properties -f /tmp/localhost.cdoc -k keys/cdoc20client.pem +``` + +### List recipients + +List recipients. Prints recipient types and key labels from CDOC header. + +``` +java -jar target/cdoc20-cli-*.jar info -f /tmp/id.cdoc +``` + + +## ID-kaart (Est-id secure card) + + +### Encrypting for ID-card owner + +cdoc20-cli can download authentication certificate (Isikutuvastus PIN1) from SK LDAP directory +https://www.skidsolutions.eu/repositoorium/ldap/esteid-ldap-kataloogi-kasutamine/ + +To create cdoc for recipient with id code 37101010021 use: +``` +java -jar target/cdoc20-cli-*.jar create --file /tmp/mydoc.cdoc -r 37101010021 README.md +``` + + +### Decrypting with ID-card + +To decrypt: +- CDOC file mydoc.cdoc +- use private key from ID-card slot 0 (Isikutuvastus PIN1) +- Decrypt files from cdoc file into current directory +``` +java -jar target/cdoc20-cli-*.jar decrypt -f mydoc.cdoc +``` + +### Certificate extraction + +* Run DigiDoc4 client +* Crypto -> Add file (choose random file) +* Recipients -> Certificate from card -> click on certificate -> Show Certificate -> Save + +Saved certificate will be .cer file (same as der) + +or + +* Run DigiDoc4 client +* Crypto -> Add file (choose random file) +* Recipients -> Enter personal code -> Search -> Show Certificate -> Save + + +### Encrypting documents with certificate + +To create: +- Output file `/tmp/mydoc.cdoc` +- with generated private key +- to recipient with certificate `keys/37101010021.cer` (DER or PEM formats are supported) +- to encrypt file 'README.md' + +``` +java -jar target/cdoc20-cli-*.jar create --file /tmp/mydoc.cdoc -c keys/37101010021.cer README.md +``` + + +### Troubleshooting ID-card + +Verify that DigiDoc4 client is running and can access ID-card + +cdoc20-cli will try to configure itself automatically. If OpenSC library is installed to non-standard location, then +specify its location by setting 'pkcs11-library' property: + +``` +java -jar target/cdoc20-cli-*.jar decrypt -Dpkcs11-library=/usr/lib/x86_64-linux-gnu/opensc-pkcs11.so -f mydoc.cdoc +``` + +More tips for debugging ID-card related issues are provided in cdoc20-lib/pkcs11.README file + + +## Other configuration options + +Set with -D option + +``` +java -jar target/cdoc20-cli-*.jar decrypt -Dee.cyber.cdoc20.overwrite=false -f mydoc.cdoc +``` + +#### pkcs11-library +PKCS11 library location. Default is platform specific + +Common OpenSC library locations: + +* For Windows, it could be C:\Windows\SysWOW64\opensc-pkcs11.dll +* For Linux, it could be /usr/lib/x86_64-linux-gnu/opensc-pkcs11.so +* For OSX, it could be /usr/local/lib/opensc-pkcs11.so + +## SafeNet eToken support + +Requirements: +* OpenSC is installed +* SafeNet Authentication Client (provides the pkcs11 library) is installed. + See https://knowledge.digicert.com/generalinformation/INFO1982.html for details. +* Create an OpenSC configuration file `opensc-safenet.cfg` for the USB device in the following format + +``` +name=SafeNet-eToken +library=/usr/lib/libeToken.so +slot=1 +``` + +To find the slot for the SafeNet eToken, execute: + +``` +pkcs11-tool --module /usr/lib/libeToken.so -L +``` + +List entries on the eToken device: + +``` +keytool -providerclass sun.security.pkcs11.SunPKCS11 -providerarg opensc-safenet.cfg -storetype PKCS11 -storepass YOUR-SAFENET-PIN -list +``` + +Export Certificate from the SafeNet eToken device: + +``` +keytool -providerclass sun.security.pkcs11.SunPKCS11 -providerarg opensc-safenet.cfg -storetype PKCS11 -storepass YOUR-SAFENET-PIN -alias YOUR_ENTRY_ALIAS -exportcert -rfc -file etoken-cert.pem +``` + +Encrypt certificate as described in the "Encrypting documents with certificate" section. + +List files encrypted for the eToken device by specifying pkcs11 library, slot and key alias: + +``` +java -jar target/cdoc20-cli-*.jar list -f file-for-etoken.cdoc -Dpkcs11-library=/usr/lib/libeToken.so -s 2 -a cdoc2-test +``` + +Decrypt files encrypted for the eToken device by specifying pkcs11 library, slot and key alias: + +``` +java -jar target/cdoc20-cli-*.jar decrypt -f file-for-etoken.cdoc -Dpkcs11-library=/usr/lib/libeToken.so -s 2 -a cdoc2-test +``` + +#### ee.cyber.cdoc20.overwrite +When decrypting, is overwriting files allowed. Default is false + +#### ee.cyber.cdoc20.maxDiskUsagePercentage +default 98.0 + +Decrypting will be stopped if disk usage is over maxDiskUsagePercentage + + +#### ee.cyber.cdoc20.tarEntriesThreshold +default 1000 + +Decrypting will be stopped if container contains over tarEntriesThreshold entries (files) + + +#### ee.cyber.cdoc20.compressionThreshold +default 10.0 + +Decrypting will be stopped if compressed file compression ratio is over compressionThreshold + diff --git a/cdoc20-cli/config/localhost/localhost.properties b/cdoc20-cli/config/localhost/localhost.properties new file mode 100644 index 00000000..fcab3524 --- /dev/null +++ b/cdoc20-cli/config/localhost/localhost.properties @@ -0,0 +1,30 @@ +# Client configuration where keys and certificates are read from smart-card (PKCS11 configuration) +# java -jar target/cdoc20-cli-0.0.12-SNAPSHOT.jar create --server=config/localhost/localhost.properties -f /tmp/localhost_id-card.cdoc -r 37903130370 README.md + +# java -jar target/cdoc20-cli-0.0.10-SNAPSHOT.jar decrypt --server=config/localhost/localhost.properties -f /tmp/localhost_id-card.cdoc -o /tmp/ + +cdoc20.client.server.id=localhost +# capsules created over TLS (no client auth required) +cdoc20.client.server.base-url.post=https://localhost:8443 +# Querying capsules requires mTLS +cdoc20.client.server.base-url.get=https://localhost:8444 +cdoc20.client.server.debug=true + +# trusted certificates by client +cdoc20.client.ssl.trust-store.type=JKS +#specify trust store jks as file in classpath +#cdoc20.client.ssl.trust-store=classpath:keystore/clienttruststore.jks +#or path (full or relative) +cdoc20.client.ssl.trust-store=../cdoc20-server/keys/clienttruststore.jks +cdoc20.client.ssl.trust-store-password=passwd + +# mutual TLS with cert from smart-card (EST-ID certificates are trusted by the server) +# Only required for get server +cdoc20.client.ssl.client-store.type=PKCS11 +# if ssl.client-store-password.prompt is set, then ask user interactively +cdoc20.client.ssl.client-store-password.prompt=PIN1 +# otherwise use password value +#cdoc20.client.ssl.client-store-password=3471 + +#PKCS11 library location, if not found in default location +#pkcs11-library=/usr/lib/x86_64-linux-gnu/opensc-pkcs11.so diff --git a/cdoc20-cli/config/localhost/localhost_pkcs12.properties b/cdoc20-cli/config/localhost/localhost_pkcs12.properties new file mode 100644 index 00000000..5a2b2c49 --- /dev/null +++ b/cdoc20-cli/config/localhost/localhost_pkcs12.properties @@ -0,0 +1,21 @@ +# key server listening on localhost, mutual TLS with private key/certificate (P12) read from file +# See cdoc20-server/README.md how to start the server + +# server.id is written to cdoc header. Must have configuration on recipient side +cdoc20.client.server.id=localhost +# capsules can be created over TLS (no client auth required) +cdoc20.client.server.base-url.post=https://localhost:8443 +# Quering capsules requires mTLS +cdoc20.client.server.base-url.get=https://localhost:8444 +cdoc20.client.server.debug=true + +# trusted certificates by client +cdoc20.client.ssl.trust-store.type=JKS +cdoc20.client.ssl.trust-store=../cdoc20-server/keys/clienttruststore.jks +cdoc20.client.ssl.trust-store-password=passwd + + +# client private key and certificate for mutual TLS (if required by server) +cdoc20.client.ssl.client-store.type=PKCS12 +cdoc20.client.ssl.client-store=../cdoc20-server/keys/cdoc20client.p12 +cdoc20.client.ssl.client-store-password=passwd diff --git a/cdoc20-cli/config/localhost/localhost_pkcs12_rsa.properties b/cdoc20-cli/config/localhost/localhost_pkcs12_rsa.properties new file mode 100644 index 00000000..b2612dc9 --- /dev/null +++ b/cdoc20-cli/config/localhost/localhost_pkcs12_rsa.properties @@ -0,0 +1,22 @@ +# localhost client configuration for RSA keys +# java -jar target/cdoc20-cli-0.0.12-SNAPSHOT.jar create --server=config/localhost/localhost_pkcs12_rsa.properties -f /tmp/localhost_rsa.cdoc -c ../cdoc20-server/keys/rsa/client-rsa-2048-cert.pem README.md +# java -jar target/cdoc20-cli-0.0.12-SNAPSHOT.jar decrypt --server=config/localhost/localhost_pkcs12_rsa.properties -f /tmp/localhost_rsa.cdoc -p12 ../cdoc20-server/keys/rsa/client-rsa-2048.p12:passwd -o /tmp/ + +# server.id is written to cdoc header. Must have configuration on recipient side +cdoc20.client.server.id=localhost +# capsules can be created over TLS (no client auth required) +cdoc20.client.server.base-url.post=https://localhost:8443 +# Quering capsules requires mTLS +cdoc20.client.server.base-url.get=https://localhost:8444 +cdoc20.client.server.debug=true + +# trusted certificates by client +cdoc20.client.ssl.trust-store.type=JKS +cdoc20.client.ssl.trust-store=../cdoc20-server/keys/clienttruststore.jks +cdoc20.client.ssl.trust-store-password=passwd + + +# client private key and certificate for mutual TLS +cdoc20.client.ssl.client-store.type=PKCS12 +cdoc20.client.ssl.client-store=../cdoc20-server/keys/rsa/client-rsa-2048.p12 +cdoc20.client.ssl.client-store-password=passwd diff --git a/cdoc20-cli/keys/37101010021_cert.cer b/cdoc20-cli/keys/37101010021_cert.cer new file mode 100644 index 0000000000000000000000000000000000000000..4754a1a7f4b8975a672de803452177b41feb6ab4 GIT binary patch literal 1602 zcmZ8hc~BE)6whv!00NOCO$3C*a8x13w+RSnBO*kuF=7H(PzEDxa81Z+HsP{XgPNAo zB93@aZMj;DfEB3>tu2D1pjM1WsT>`x&d4!S9O{8mZHHz-uy*#3-S_Q#@ArG}{oV(P z87n|B5?D=#AsBW|_w^rjmt7#z>Gn)XDQgtCFdTy{ah4Y@5aeV>16tGxI5Oxd2*U%G z%TYeyQN}!H&nOj7g&B;v1~-xzX25fCQj3vV6Nz%bJCu*wnW;!t%H={7goT6wRElze z5A}oY%ubf8l6i!NXM4%xV}zoa#CSn`>{_Kj z8ioSu0X8HL;6`~N&hy@Qp)SCQIt+3~D1Vd%+$qz}!|6YfAP=}Q>}`Fs%3z3L7i>mo zeEMb@GPHHwJW$7?$3 zis1}U45v+x$j1YL0Sz#1^nB(+&=i8uVfx3wTtXf25VINV0wlvRm;oV>l}m?!28bCB zHq*||9){R{Ta3nS;tf2_96X0Gh>Fy>mdGQu z_)3h*VFR7khz}ECBdk>JP`qW|=a_W3@TIzF*V*V&dz49NGUxUvlM1&b zHHfkdMi52O1oMq6F;u&NyHO9<0ENm%s|GN(8#V|zEPjLN8 zg}zUei(mKnN1 z;0H%a&Lz2TFBmVqh*mfERz&af*2N6c56Y|!KY6{{omaE!rNc?b9!V;`D!Odb`r}J? zX8eO6%F=|kH&=YE9KL^vwRLBr7r&#cZR3PBXKJA9@Y&J2$jKvXPCBO18tbjkTqo+k zN?{kCrX6gxkBjMgEc&ivLG^}PMA68@n}>J&F}jBpSrt@mIoB*Ms7>mYJxMk=l`9uj zW&VAn=221e68#6kB`vypohQueP51KJwikR+7}XJX`{KPzg2Yx%;+e3Zo*hF+U5~=~ zPp?J~ms;vthr>4~vAb(3=y9EY#U`{rEBdIv`}g3URejgeHpczN_biyWEF%vzRh2ES z^6_pg8QH7It=TXcpuG!w%472$T?)U1KBqYq@7P7I5}O+g@f6G!#DT8@EEz;lBSaB+I<37bk%&u-95gUdEpUM zM>J>LZ|r^gyyCits=vuW%aTsDxs-hS + + 4.0.0 + + cdoc20 + ee.cyber.cdoc20 + 0.6.0-SNAPSHOT + + + + cdoc20-cli + + + 17 + 17 + ${project.basedir}/../cdoc20-cli/target/site/jacoco-aggregate/jacoco.xml + + + + + + maven-public + https://repository.apache.org/content/repositories/public + + + + + + + info.picocli + picocli + 4.6.3 + + + org.slf4j + slf4j-simple + 1.7.32 + + + ee.cyber.cdoc20 + cdoc20-lib + 0.6.0-SNAPSHOT + compile + + + + + + + org.apache.maven.plugins + maven-shade-plugin + ${maven-shade-plugin.version} + + + package + + shade + + + + + + ee.cyber.cdoc20.cli.CDocCli + + + + + + *junit*:* + + + + + *:* + + META-INF/*.SF + META-INF/*.DSA + META-INF/*.RSA + + + + false + + + + + + + + + + + + + + + diff --git a/cdoc20-cli/src/main/java/ee/cyber/cdoc20/cli/CDocCli.java b/cdoc20-cli/src/main/java/ee/cyber/cdoc20/cli/CDocCli.java new file mode 100644 index 00000000..39c811d7 --- /dev/null +++ b/cdoc20-cli/src/main/java/ee/cyber/cdoc20/cli/CDocCli.java @@ -0,0 +1,52 @@ +package ee.cyber.cdoc20.cli; + +import ee.cyber.cdoc20.cli.commands.CDocCreateCmd; +import ee.cyber.cdoc20.cli.commands.CDocDecryptCmd; +import ee.cyber.cdoc20.cli.commands.CDocInfoCmd; +import ee.cyber.cdoc20.cli.commands.CDocListCmd; +import picocli.CommandLine; +import picocli.CommandLine.Command; +import picocli.CommandLine.Option; + +import java.util.concurrent.Callable; + +//S106 Standard outputs should not be used directly to log anything +//CLI needs to interact with standard outputs +@SuppressWarnings("java:S106") +@Command( + version = {"cdoc20-cli version: 0.0.1", "cdoc20-lib version: 0.0.1"}, + name = "cdoc20-cli", + header = "\r\ncdoc20-cli is a command line interface for cdoc20 library\r\n", + customSynopsis = { "cdoc [create] ", + "cdoc [decrypt] ", + "cdoc [list] ", + "cdoc [info] "}, + subcommands = {CDocCreateCmd.class, + CDocDecryptCmd.class, + CDocListCmd.class, + CDocInfoCmd.class} +) +public class CDocCli implements Callable { + @Option(names = {"--version"}, versionHelp = true, description = "display version info") + boolean versionInfoRequested; + + @Option(names = { "-h", "--help" }, usageHelp = true, description = "display a help message") + boolean helpRequested = false; + + public static void main(String... args) { + if (args.length == 0) { + CommandLine.usage(new CDocCli(), System.out); + CommandLine.usage(new CDocCreateCmd(), System.out); + CommandLine.usage(new CDocDecryptCmd(), System.out); + CommandLine.usage(new CDocListCmd(), System.out); + CommandLine.usage(new CDocInfoCmd(), System.out); + } + int exitCode = new CommandLine(new CDocCli()).execute(args); + System.exit(exitCode); + } + + @Override + public Void call() { + return null; + } +} diff --git a/cdoc20-cli/src/main/java/ee/cyber/cdoc20/cli/SymmetricKeyUtil.java b/cdoc20-cli/src/main/java/ee/cyber/cdoc20/cli/SymmetricKeyUtil.java new file mode 100644 index 00000000..73046d79 --- /dev/null +++ b/cdoc20-cli/src/main/java/ee/cyber/cdoc20/cli/SymmetricKeyUtil.java @@ -0,0 +1,103 @@ +package ee.cyber.cdoc20.cli; + +import java.nio.charset.StandardCharsets; +import java.util.AbstractMap; +import java.util.Base64; +import java.util.LinkedList; +import java.util.List; +import javax.crypto.SecretKey; +import javax.crypto.spec.SecretKeySpec; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; + +import ee.cyber.cdoc20.CDocValidationException; +import ee.cyber.cdoc20.crypto.DecryptionKeyMaterial; +import ee.cyber.cdoc20.crypto.EncryptionKeyMaterial; + +/** + * Symmetric key usage in CDOC is supported by CDOC format, but its use cases are not finalized. + * In the future, symmetric key may be derived using password-based key-derivation algorithm or from hardware token. + * For now, symmetric key can be provided directly from the command line (or from a file with @option) + */ +public final class SymmetricKeyUtil { + + public static final String BASE_64_PREFIX = "base64,"; + + // --secret format description, used in cdoc classes + public static final String SECRET_DESCRIPTION = "symmetric key with label. Must have format