1 files changed, 169 insertions, 166 deletions
diff --git a/certService/src/main/java/org/onap/aaf/certservice/cmpv2client/impl/CmpResponseValidationHelper.java b/certService/src/main/java/org/onap/aaf/certservice/cmpv2client/impl/CmpResponseValidationHelper.java
index 8191c69d..4b9f2cd1 100644
--- a/certService/src/main/java/org/onap/aaf/certservice/cmpv2client/impl/CmpResponseValidationHelper.java
+++ b/certService/src/main/java/org/onap/aaf/certservice/cmpv2client/impl/CmpResponseValidationHelper.java
@@ -34,6 +34,7 @@ import java.util.Objects;
 import javax.crypto.Mac;
 import javax.crypto.SecretKey;
 import javax.crypto.spec.SecretKeySpec;
+
 import org.bouncycastle.asn1.ASN1Encodable;
 import org.bouncycastle.asn1.ASN1EncodableVector;
 import org.bouncycastle.asn1.ASN1ObjectIdentifier;
@@ -55,184 +56,186 @@ import org.slf4j.LoggerFactory;
 
 public final class CmpResponseValidationHelper {
 
-  private static final Logger LOG = LoggerFactory.getLogger(CmpResponseValidationHelper.class);
+    private static final Logger LOG = LoggerFactory.getLogger(CmpResponseValidationHelper.class);
+
+    private CmpResponseValidationHelper() {
+    }
 
-  private CmpResponseValidationHelper() {}
+    /**
+     * Create a base key to use for verifying the PasswordBasedMac on a PKIMessage
+     *
+     * @param pbmParamSeq      parameters recieved in PKIMessage used with password
+     * @param initAuthPassword password used to decrypt the basekey
+     * @return bytes representing the basekey
+     * @throws CmpClientException thrown if algorithem exceptions occur for the message digest
+     */
+    public static byte[] getBaseKeyFromPbmParameters(
+            PBMParameter pbmParamSeq, String initAuthPassword) throws CmpClientException {
+        final int iterationCount = pbmParamSeq.getIterationCount().getPositiveValue().intValue();
+        LOG.info("Iteration count is: {}", iterationCount);
+        final AlgorithmIdentifier owfAlg = pbmParamSeq.getOwf();
+        LOG.info("One Way Function type is: {}", owfAlg.getAlgorithm().getId());
+        final byte[] salt = pbmParamSeq.getSalt().getOctets();
+        final byte[] raSecret = initAuthPassword != null ? initAuthPassword.getBytes() : new byte[0];
+        byte[] basekey = new byte[raSecret.length + salt.length];
+        System.arraycopy(raSecret, 0, basekey, 0, raSecret.length);
+        System.arraycopy(salt, 0, basekey, raSecret.length, salt.length);
+        try {
+            final MessageDigest messageDigest =
+                    MessageDigest.getInstance(
+                            owfAlg.getAlgorithm().getId(), BouncyCastleProvider.PROVIDER_NAME);
+            for (int i = 0; i < iterationCount; i++) {
+                basekey = messageDigest.digest(basekey);
+                messageDigest.reset();
+            }
+        } catch (NoSuchAlgorithmException | NoSuchProviderException ex) {
+            LOG.error("ProtectionBytes don't match passwordBasedProtection, authentication failed");
+            throw new CmpClientException(
+                    "ProtectionBytes don't match passwordBasedProtection, authentication failed", ex);
+        }
+        return basekey;
+    }
 
-  /**
-   * Create a base key to use for verifying the PasswordBasedMac on a PKIMessage
-   *
-   * @param pbmParamSeq parameters recieved in PKIMessage used with password
-   * @param initAuthPassword password used to decrypt the basekey
-   * @return bytes representing the basekey
-   * @throws CmpClientException thrown if algorithem exceptions occur for the message digest
-   */
-  public static byte[] getBaseKeyFromPbmParameters(
-      PBMParameter pbmParamSeq, String initAuthPassword) throws CmpClientException {
-    final int iterationCount = pbmParamSeq.getIterationCount().getPositiveValue().intValue();
-    LOG.info("Iteration count is: {}", iterationCount);
-    final AlgorithmIdentifier owfAlg = pbmParamSeq.getOwf();
-    LOG.info("One Way Function type is: {}", owfAlg.getAlgorithm().getId());
-    final byte[] salt = pbmParamSeq.getSalt().getOctets();
-    final byte[] raSecret = initAuthPassword != null ? initAuthPassword.getBytes() : new byte[0];
-    byte[] basekey = new byte[raSecret.length + salt.length];
-    System.arraycopy(raSecret, 0, basekey, 0, raSecret.length);
-    System.arraycopy(salt, 0, basekey, raSecret.length, salt.length);
-    try {
-      final MessageDigest messageDigest =
-          MessageDigest.getInstance(
-              owfAlg.getAlgorithm().getId(), BouncyCastleProvider.PROVIDER_NAME);
-      for (int i = 0; i < iterationCount; i++) {
-        basekey = messageDigest.digest(basekey);
-        messageDigest.reset();
-      }
-    } catch (NoSuchAlgorithmException | NoSuchProviderException ex) {
-      LOG.error("ProtectionBytes don't match passwordBasedProtection, authentication failed");
-      throw new CmpClientException(
-          "ProtectionBytes don't match passwordBasedProtection, authentication failed", ex);
+    /**
+     * Verifies the signature of the response message using our public key
+     *
+     * @param respPkiMessage PKIMessage we wish to verify signature for
+     * @param pk             public key used to verify signature.
+     * @throws CmpClientException
+     */
+    public static void verifySignature(PKIMessage respPkiMessage, PublicKey pk)
+            throws CmpClientException {
+        final byte[] protBytes = getProtectedBytes(respPkiMessage);
+        final DERBitString derBitString = respPkiMessage.getProtection();
+        try {
+            final Signature signature =
+                    Signature.getInstance(
+                            PKCSObjectIdentifiers.sha256WithRSAEncryption.getId(),
+                            BouncyCastleProvider.PROVIDER_NAME);
+            signature.initVerify(pk);
+            signature.update(protBytes);
+            signature.verify(derBitString.getBytes());
+        } catch (NoSuchAlgorithmException
+                | NoSuchProviderException
+                | InvalidKeyException
+                | SignatureException e) {
+            CmpClientException clientException =
+                    new CmpClientException("Signature Verification failed", e);
+            LOG.error("Signature Verification failed", e);
+            throw clientException;
+        }
     }
-    return basekey;
-  }
 
-  /**
-   * Verifies the signature of the response message using our public key
-   *
-   * @param respPkiMessage PKIMessage we wish to verify signature for
-   * @param pk public key used to verify signature.
-   * @throws CmpClientException
-   */
-  public static void verifySignature(PKIMessage respPkiMessage, PublicKey pk)
-      throws CmpClientException {
-    final byte[] protBytes = getProtectedBytes(respPkiMessage);
-    final DERBitString derBitString = respPkiMessage.getProtection();
-    try {
-      final Signature signature =
-          Signature.getInstance(
-              PKCSObjectIdentifiers.sha256WithRSAEncryption.getId(),
-              BouncyCastleProvider.PROVIDER_NAME);
-      signature.initVerify(pk);
-      signature.update(protBytes);
-      signature.verify(derBitString.getBytes());
-    } catch (NoSuchAlgorithmException
-        | NoSuchProviderException
-        | InvalidKeyException
-        | SignatureException e) {
-      CmpClientException clientException =
-          new CmpClientException("Signature Verification failed", e);
-      LOG.error("Signature Verification failed", e);
-      throw clientException;
+    /**
+     * Converts the header and the body of a PKIMessage to an ASN1Encodable and returns the as a byte
+     * array
+     *
+     * @param msg PKIMessage to get protected bytes from
+     * @return the PKIMessage's header and body in byte array
+     */
+    public static byte[] getProtectedBytes(PKIMessage msg) throws CmpClientException {
+        return getProtectedBytes(msg.getHeader(), msg.getBody());
     }
-  }
-  /**
-   * Converts the header and the body of a PKIMessage to an ASN1Encodable and returns the as a byte
-   * array
-   *
-   * @param msg PKIMessage to get protected bytes from
-   * @return the PKIMessage's header and body in byte array
-   */
-  public static byte[] getProtectedBytes(PKIMessage msg) throws CmpClientException {
-    return getProtectedBytes(msg.getHeader(), msg.getBody());
-  }
 
-  /**
-   * Converts the header and the body of a PKIMessage to an ASN1Encodable and returns the as a byte
-   * array
-   *
-   * @param header PKIHeader to be converted
-   * @param body PKIMessage to be converted
-   * @return the PKIMessage's header and body in byte array
-   */
-  public static byte[] getProtectedBytes(PKIHeader header, PKIBody body) throws CmpClientException {
-    byte[] res;
-    ASN1EncodableVector v = new ASN1EncodableVector();
-    v.add(header);
-    v.add(body);
-    ASN1Encodable protectedPart = new DERSequence(v);
-    try {
-      ByteArrayOutputStream bao = new ByteArrayOutputStream();
-      DEROutputStream out = new DEROutputStream(bao);
-      out.writeObject(protectedPart);
-      res = bao.toByteArray();
-    } catch (IOException ioe) {
-      CmpClientException cmpClientException =
-          new CmpClientException("Error occured while getting protected bytes", ioe);
-      LOG.error("Error occured while getting protected bytes", ioe);
-      throw cmpClientException;
+    /**
+     * Converts the header and the body of a PKIMessage to an ASN1Encodable and returns the as a byte
+     * array
+     *
+     * @param header PKIHeader to be converted
+     * @param body   PKIMessage to be converted
+     * @return the PKIMessage's header and body in byte array
+     */
+    public static byte[] getProtectedBytes(PKIHeader header, PKIBody body) throws CmpClientException {
+        byte[] res;
+        ASN1EncodableVector encodableVector = new ASN1EncodableVector();
+        encodableVector.add(header);
+        encodableVector.add(body);
+        ASN1Encodable protectedPart = new DERSequence(encodableVector);
+        try {
+            ByteArrayOutputStream bao = new ByteArrayOutputStream();
+            DEROutputStream out = new DEROutputStream(bao);
+            out.writeObject(protectedPart);
+            res = bao.toByteArray();
+        } catch (IOException ioe) {
+            CmpClientException cmpClientException =
+                    new CmpClientException("Error occured while getting protected bytes", ioe);
+            LOG.error("Error occured while getting protected bytes", ioe);
+            throw cmpClientException;
+        }
+        return res;
     }
-    return res;
-  }
 
-  /**
-   * verify the password based protection within the response message
-   *
-   * @param respPkiMessage PKIMessage we want to verify password based protection for
-   * @param initAuthPassword password used to decrypt protection
-   * @param protectionAlgo protection algorithm we can use to decrypt protection
-   * @throws CmpClientException
-   */
-  public static void verifyPasswordBasedProtection(
-      PKIMessage respPkiMessage, String initAuthPassword, AlgorithmIdentifier protectionAlgo)
-      throws CmpClientException {
-    final byte[] protectedBytes = getProtectedBytes(respPkiMessage);
-    final PBMParameter pbmParamSeq = PBMParameter.getInstance(protectionAlgo.getParameters());
-    if (Objects.nonNull(pbmParamSeq)) {
-      try {
-        byte[] basekey = getBaseKeyFromPbmParameters(pbmParamSeq, initAuthPassword);
-        final Mac mac = getMac(protectedBytes, pbmParamSeq, basekey);
-        final byte[] outBytes = mac.doFinal();
-        final byte[] protectionBytes = respPkiMessage.getProtection().getBytes();
-        if (!Arrays.equals(outBytes, protectionBytes)) {
-          LOG.error("protectionBytes don't match passwordBasedProtection, authentication failed");
-          throw new CmpClientException(
-              "protectionBytes don't match passwordBasedProtection, authentication failed");
+    /**
+     * verify the password based protection within the response message
+     *
+     * @param respPkiMessage   PKIMessage we want to verify password based protection for
+     * @param initAuthPassword password used to decrypt protection
+     * @param protectionAlgo   protection algorithm we can use to decrypt protection
+     * @throws CmpClientException
+     */
+    public static void verifyPasswordBasedProtection(
+            PKIMessage respPkiMessage, String initAuthPassword, AlgorithmIdentifier protectionAlgo)
+            throws CmpClientException {
+        final byte[] protectedBytes = getProtectedBytes(respPkiMessage);
+        final PBMParameter pbmParamSeq = PBMParameter.getInstance(protectionAlgo.getParameters());
+        if (Objects.nonNull(pbmParamSeq)) {
+            try {
+                byte[] basekey = getBaseKeyFromPbmParameters(pbmParamSeq, initAuthPassword);
+                final Mac mac = getMac(protectedBytes, pbmParamSeq, basekey);
+                final byte[] outBytes = mac.doFinal();
+                final byte[] protectionBytes = respPkiMessage.getProtection().getBytes();
+                if (!Arrays.equals(outBytes, protectionBytes)) {
+                    LOG.error("protectionBytes don't match passwordBasedProtection, authentication failed");
+                    throw new CmpClientException(
+                            "protectionBytes don't match passwordBasedProtection, authentication failed");
+                }
+            } catch (NoSuchProviderException | NoSuchAlgorithmException | InvalidKeyException ex) {
+                CmpClientException cmpClientException =
+                        new CmpClientException("Error while validating CMP response ", ex);
+                LOG.error("Error while validating CMP response ", ex);
+                throw cmpClientException;
+            }
         }
-      } catch (NoSuchProviderException | NoSuchAlgorithmException | InvalidKeyException ex) {
-        CmpClientException cmpClientException =
-            new CmpClientException("Error while validating CMP response ", ex);
-        LOG.error("Error while validating CMP response ", ex);
-        throw cmpClientException;
-      }
     }
-  }
 
-  public static void checkImplicitConfirm(PKIHeader header) {
-    InfoTypeAndValue[] infos = header.getGeneralInfo();
-    if (Objects.nonNull(infos)) {
-      if (CMPObjectIdentifiers.it_implicitConfirm.equals(getImplicitConfirm(infos))) {
-        LOG.info("Implicit Confirm on certificate from server.");
-      } else {
-        LOG.debug("No Implicit confirm in Response");
-      }
-    } else {
-      LOG.debug("No general Info in header of response, cannot verify implicit confirm");
+    public static void checkImplicitConfirm(PKIHeader header) {
+        InfoTypeAndValue[] infos = header.getGeneralInfo();
+        if (Objects.nonNull(infos)) {
+            if (CMPObjectIdentifiers.it_implicitConfirm.equals(getImplicitConfirm(infos))) {
+                LOG.info("Implicit Confirm on certificate from server.");
+            } else {
+                LOG.debug("No Implicit confirm in Response");
+            }
+        } else {
+            LOG.debug("No general Info in header of response, cannot verify implicit confirm");
+        }
     }
-  }
 
-  public static ASN1ObjectIdentifier getImplicitConfirm(InfoTypeAndValue[] info) {
-    return info[0].getInfoType();
-  }
+    public static ASN1ObjectIdentifier getImplicitConfirm(InfoTypeAndValue[] info) {
+        return info[0].getInfoType();
+    }
 
-  /**
-   * Get cryptographical Mac we can use to decrypt our PKIMessage
-   *
-   * @param protectedBytes Protected bytes representing the PKIMessage
-   * @param pbmParamSeq Parameters used to decrypt PKIMessage, including mac algorithm used
-   * @param basekey Key used alongside mac Oid to create secret key for decrypting PKIMessage
-   * @return Mac that's ready to return decrypted bytes
-   * @throws NoSuchAlgorithmException Possibly thrown trying to get mac instance
-   * @throws NoSuchProviderException Possibly thrown trying to get mac instance
-   * @throws InvalidKeyException Possibly thrown trying to initialize mac using secretkey
-   */
-  public static Mac getMac(byte[] protectedBytes, PBMParameter pbmParamSeq, byte[] basekey)
-      throws NoSuchAlgorithmException, NoSuchProviderException, InvalidKeyException {
-    final AlgorithmIdentifier macAlg = pbmParamSeq.getMac();
-    LOG.info("Mac type is: {}", macAlg.getAlgorithm().getId());
-    final String macOid = macAlg.getAlgorithm().getId();
-    final Mac mac = Mac.getInstance(macOid, BouncyCastleProvider.PROVIDER_NAME);
-    final SecretKey key = new SecretKeySpec(basekey, macOid);
-    mac.init(key);
-    mac.reset();
-    mac.update(protectedBytes, 0, protectedBytes.length);
-    return mac;
-  }
+    /**
+     * Get cryptographical Mac we can use to decrypt our PKIMessage
+     *
+     * @param protectedBytes Protected bytes representing the PKIMessage
+     * @param pbmParamSeq    Parameters used to decrypt PKIMessage, including mac algorithm used
+     * @param basekey        Key used alongside mac Oid to create secret key for decrypting PKIMessage
+     * @return Mac that's ready to return decrypted bytes
+     * @throws NoSuchAlgorithmException Possibly thrown trying to get mac instance
+     * @throws NoSuchProviderException  Possibly thrown trying to get mac instance
+     * @throws InvalidKeyException      Possibly thrown trying to initialize mac using secretkey
+     */
+    public static Mac getMac(byte[] protectedBytes, PBMParameter pbmParamSeq, byte[] basekey)
+            throws NoSuchAlgorithmException, NoSuchProviderException, InvalidKeyException {
+        final AlgorithmIdentifier macAlg = pbmParamSeq.getMac();
+        LOG.info("Mac type is: {}", macAlg.getAlgorithm().getId());
+        final String macOid = macAlg.getAlgorithm().getId();
+        final Mac mac = Mac.getInstance(macOid, BouncyCastleProvider.PROVIDER_NAME);
+        final SecretKey key = new SecretKeySpec(basekey, macOid);
+        mac.init(key);
+        mac.reset();
+        mac.update(protectedBytes, 0, protectedBytes.length);
+        return mac;
+    }
 }