summaryrefslogtreecommitdiffstats
path: root/security-utils
Commit message (Collapse)AuthorAgeFilesLines
* Add basic tooling for public key encryption and decryptionTor Brede Vekterli2022-10-271-0/+1
| | | | | | | Adds support for: * X25519 key pair generation * HPKE stream encryption with public key and token generation * HPKE stream decryption with private key
* Use JDK17's own hex utilities instead of BouncyCastle'sTor Brede Vekterli2022-10-254-73/+66
|
* Use HPKE instead of ECIES for shared single-use keysTor Brede Vekterli2022-10-203-88/+65
| | | | | Also use AES-128 instead of AES-256 for the one-time key since the underlying HPKE AEAD cipher protecting the key itself is AES-128.
* Add X25519 private to public key extraction and use for HPKE openingTor Brede Vekterli2022-10-196-25/+49
| | | | | | | Avoids the need to pass the full key pair when opening a sealed piece of ciphertext, since we can just extract the public key on-demand. Uses BouncyCastle X25519 utils under the hood.
* Minimal implementation of RFC 9180 Hybrid Public Key Encryption (HPKE)Tor Brede Vekterli2022-10-1815-1/+1237
| | | | | | | | | | | | | | | | | | | | | | | | | HPKE is a hybrid encryption scheme that builds around three primitives: * A key encapsulation mechanism (KEM) * A key derivation function (KDF) * An "authenticated encryption with associated data" (AEAD) algorithm The 3-tuple (KEM, KDF, AEAD) is known as the HPKE _ciphersuite_. This implementation has certain (intentional) limitations: * Only the `DHKEM(X25519, HKDF-SHA256), HKDF-SHA256, AES-128-GCM` ciphersuite is implemented. This is expected to be a good default choice for any internal use of this class. * Only the "base mode" (unauthenticated sender) is supported, i.e. no PSK support and no secret exporting. This implementation is only expected to be used for anonymous one-way encryption. * The API only offers single-shot encryption to keep anyone from being tempted to use it to build their own multi-message protocol on top. This entirely avoids the risk of nonce reuse caused by accidentally repeating sequence numbers. **Deprecation notice:** once BouncyCastle (or the Java crypto API) supports HPKE, this particular implementation can safely be deprecated and sent off to live on a farm.
* Add some utilities for comparing arrays without data-dependent branchesTor Brede Vekterli2022-10-172-0/+92
| | | | | Lets arrays be compared without leaking information about their contents caused by early exits etc.
* Test some specific HKDF vectors from Google's Wycheproof crypto test suiteTor Brede Vekterli2022-10-141-22/+106
|
* Implement RFC-5869 HMAC-based Extract-and-Expand Key Derivation Function (HKDF)Tor Brede Vekterli2022-10-132-0/+435
| | | | | | | | | | | | | | | | | | | The HKDF is initialized ("extracted") from a (non-secret) salt and a secret key. From this, any number of secret keys can be derived ("expanded") deterministically. When multiple keys are to be derived from the same initial keying/salting material, each separate key should use a distinct "context". This ensures that there exists a domain separation between the keys. Using the same context as another key on a HKDF initialized with the same salt+key results in the exact same derived key material as that key. This implementation only offers HMAC-SHA256-based key derivation. Tested with all HMAC-SHA256 test vectors in RFC-5869, with added edge case tests. Analogous to BouncyCastle's `HKDFBytesGenerator`, but with a simpler API that tries to be very explicit in its operation, as well as fully thread safe due to not storing intermediate calculations in member fields.
* Enforce SHA-256 and AES-CBC for ECIES key wrappingTor Brede Vekterli2022-10-133-23/+41
| | | | | | | For some reason requires passing in and keeping an explicit IV. Not sure why this is the case, since symmetric keys used in the context of a hybrid crypto scheme are generally derived via a KDF from the shared secret. This stuff is practically entirely undocumented... :I
* Merge pull request #24403 from vespa-engine/bjorncs/upgrade-bcBjørn Christian Seime2022-10-122-3/+3
|\ | | | | Upgrade BouncyCastle to 1.72 [run-systemtest]
| * Upgrade BouncyCastle to 1.72Bjørn Christian Seime2022-10-122-3/+3
| | | | | | | | Migrate to artifact names used by 1.71+
* | Address PR commentsTor Brede Vekterli2022-10-122-6/+8
| | | | | | | | | | * Make `SecureRandom` a shared static field * Just take in `PrivateKey` instead of `KeyPair` for key unsealing
* | Add utilities for secure one-way single-use key exchange tokens using ECIESTor Brede Vekterli2022-10-114-0/+342
|/ | | | | | | | | | | | | | | | | | | | | | Lets a sender generate a random, single-use symmetric key and securely share this with a receiver, with the sender only knowing the public key of the receiver. The shared key is exchanged via an opaque token that can only be decoded by having the private key corresponding to the public key used for encoding it. This is implemented using ECIES, a hybrid encryption scheme using Elliptic Curve Diffie-Hellman (ECDH) for ephemeral key exchange combined with a symmetric cipher using the ephemeral key for actual plaintext encryption/decryption. In addition to the key exchange itself, utilities for creating encryption and decryption ciphers for AES-GCM-256 from the shared keys are included. **Security note**: since the key is intended to be used for producing a single piece of ciphertext, a fixed Initialization Vector (IV) is used. The key MUST NOT be used to produce more than one ciphertext, lest the entire security model breaks down entirely.
* Ignore calls to SystemTlsContext.close()Bjørn Christian Seime2022-08-301-2/+1
|
* Convert security-utils to junit5Bjørn Christian Seime2022-07-2719-159/+153
|
* Force caller to handle failed capability verification checkBjørn Christian Seime2022-07-213-18/+35
|
* Improve error messageBjørn Christian Seime2022-07-212-2/+2
|
* Move logic for capability checking/logging to ConnectionAuthContextBjørn Christian Seime2022-07-214-9/+122
|
* Use getSubjectCommonName()Bjørn Christian Seime2022-07-211-7/+1
|
* Get ConnectionAuthContext from SSL session after handshake is completeBjørn Christian Seime2022-07-213-28/+67
| | | | | Bound key-value pairs from SSL handshake session are now copied to the final SSL session object. This simplifies the dataflow - not need to retrieve the instance right after our custom trust manager is invoked.
* Include client certificate chain even when authorization is disabledBjørn Christian Seime2022-07-203-4/+11
|
* Implement RequireCapabilitiesFilter in jrt + miscBjørn Christian Seime2022-07-203-8/+9
| | | | | Add peerSpec to Target/Connection. Always provide ConnectionAuthContext. Add helper for creating default, all-granting ConnectionAuthContext.
* Add to-string helper to ConnectionAuthContextBjørn Christian Seime2022-07-201-1/+38
|
* Simplify type definition for subject alternative namesBjørn Christian Seime2022-07-207-24/+24
|
* Add 'X509CertificateUtils.getSubjectCommonName()'Bjørn Christian Seime2022-07-201-1/+7
|
* Move generic crypto helpers from 'c.y.s.tls' to 'c.y.s'Bjørn Christian Seime2022-07-2012-30/+16
|
* Merge Java package 'c.y.s.tls.{auth,json,policy}' into 'c.y.s.tls'Bjørn Christian Seime2022-07-2027-95/+37
| | | | Facilitate improved encapsulation of Vespa mTLS related classes
* Remove empty packageBjørn Christian Seime2022-07-201-8/+0
|
* Add 'CapabilitySet.has()' methodsBjørn Christian Seime2022-07-201-0/+3
|
* Add environment variable for capabilities enforcement modeBjørn Christian Seime2022-07-202-0/+33
|
* Rename method/variable names to match new class nameBjørn Christian Seime2022-07-191-1/+1
|
* Include mode in log messageBjørn Christian Seime2022-07-151-3/+4
|
* Rename 'toCapabilityNames()' to 'toNames()'Bjørn Christian Seime2022-07-153-3/+3
|
* Always run PeerAutorizerBjørn Christian Seime2022-07-159-45/+44
| | | | | Interpret empty AuthorizedPeers as granting all capabilities unconditionally. Assume AuthorizedPeers as always present.
* Rename 'hasAllCapabilities()' => 'hasAll()'Bjørn Christian Seime2022-07-152-2/+2
|
* Change type from SortedSet to SetBjørn Christian Seime2022-07-152-7/+4
|
* Rename 'succeeded' => 'authorized'Bjørn Christian Seime2022-07-153-4/+4
|
* Include full certificate chain in auth contextBjørn Christian Seime2022-07-153-15/+26
|
* Return granted capabilities from PeerAuthorizerBjørn Christian Seime2022-07-156-59/+79
| | | | Introduce new ConnectionAuthContext as replacement for AuthorizationResult/SecurityContext.
* Add Capability and CapabilitySet including JSON serializationBjørn Christian Seime2022-07-138-6/+182
|
* Convert POJOs to recordBjørn Christian Seime2022-07-132-79/+9
|
* Modules are no longer dependency of JDK8 based clientsBjørn Christian Seime2022-07-121-5/+4
|
* Revert "Modules are no longer dependency of JDK8 based clients"Harald Musum2022-07-121-10/+29
|
* Modules are no longer dependency of JDK8 based clientsBjørn Christian Seime2022-07-121-29/+10
|
* Remove 'role' concept from 'authorized-peers'Bjørn Christian Seime2022-07-1111-122/+25
|
* Set project version to 8-SNAPSHOTgjoranv2022-06-081-2/+2
|
* install_jar CMake functionHåkon Hallingstad2022-05-201-1/+1
|
* Use parsedVersion. It was accidentally removed earlier on.Henning Baldersheim2022-04-281-1/+1
|
* Add mallinfo2 implementation.Henning Baldersheim2022-04-261-1/+1
|
* Add NTokenGeneratorHåkon Hallingstad2022-03-161-0/+8
|