public final class SecurityUtils
extends java.lang.Object
Modifier and Type | Field and Description |
---|---|
private static java.util.Set<java.lang.String> |
APRIORI_DISABLED_PROVIDERS |
static java.lang.String |
BOUNCY_CASTLE
Bouncycastle JCE provider name
|
static java.lang.String |
CURVE_ED25519_SHA512 |
static int |
DEFAULT_DHGEX_KEY_SIZE |
private static java.util.concurrent.atomic.AtomicReference<SecurityProviderChoice> |
DEFAULT_PROVIDER_HOLDER |
static java.util.List<java.lang.String> |
DEFAULT_SECURITY_PROVIDER_REGISTRARS |
static java.lang.String |
ECC_SUPPORTED_PROP
System property used to control whether Elliptic Curves are supported or not.
|
static java.lang.String |
EDDSA
EDDSA support - should match
EdDSAKey.KEY_ALGORITHM |
static java.lang.String |
EDDSA_SUPPORTED_PROP
Deprecated.
Please use "org.apache.sshd.security.provider.EdDSA.enabled&qupt;
|
private static java.lang.Boolean |
hasEcc |
private static java.util.concurrent.atomic.AtomicReference<KeyPairResourceParser> |
KEYPAIRS_PARSER_HODLER |
private static java.util.concurrent.atomic.AtomicInteger |
MAX_DHG_KEY_SIZE_HOLDER |
static int |
MAX_DHGEX_KEY_SIZE |
static java.lang.String |
MAX_DHGEX_KEY_SIZE_PROP
System property used to configure the value for the maximum supported Diffie-Hellman
Group Exchange key size.
|
static int |
MIN_DHGEX_KEY_SIZE
The min.
|
static int |
PREFERRED_DHGEX_KEY_SIZE |
static java.lang.String |
PROP_DEFAULT_SECURITY_PROVIDER |
static java.lang.String |
REGISTER_BOUNCY_CASTLE_PROP
Deprecated.
Please use "org.apache.sshd.security.provider.BC.enabled"
|
private static java.util.Map<java.lang.String,SecurityProviderRegistrar> |
REGISTERED_PROVIDERS |
private static java.util.concurrent.atomic.AtomicBoolean |
REGISTRATION_STATE_HOLDER |
private static java.util.Map<java.lang.Class<?>,java.util.Map<java.lang.String,SecurityEntityFactory<?>>> |
SECURITY_ENTITY_FACTORIES |
static java.lang.String |
SECURITY_PROVIDER_REGISTRARS
Comma separated list of fully qualified
SecurityProviderRegistrar s
to automatically register |
Modifier | Constructor and Description |
---|---|
private |
SecurityUtils() |
Modifier and Type | Method and Description |
---|---|
static boolean |
compareEDDSAPPublicKeys(java.security.PublicKey k1,
java.security.PublicKey k2) |
static boolean |
compareEDDSAPrivateKeys(java.security.PrivateKey k1,
java.security.PrivateKey k2) |
static AbstractGeneratorHostKeyProvider |
createGeneratorHostKeyProvider(java.nio.file.Path path) |
static <T> SecurityEntityFactory<T> |
createSecurityEntityFactory(java.lang.Class<T> entityType,
java.util.function.Predicate<? super SecurityProviderRegistrar> entitySelector) |
static java.security.KeyPair |
extractEDDSAKeyPair(Buffer buffer,
java.lang.String keyType) |
static java.security.PublicKey |
generateEDDSAPublicKey(java.lang.String keyType,
byte[] seed) |
static java.util.Set<java.lang.String> |
getAPrioriDisabledProviders() |
static KeyPairResourceParser |
getBouncycastleKeyPairResourceParser() |
static java.security.cert.CertificateFactory |
getCertificateFactory(java.lang.String type) |
static javax.crypto.Cipher |
getCipher(java.lang.String transformation) |
static SecurityProviderChoice |
getDefaultProviderChoice() |
static int |
getEDDSAKeySize(java.security.Key key) |
static java.lang.Class<? extends java.security.PrivateKey> |
getEDDSAPrivateKeyType() |
static PublicKeyEntryDecoder<? extends java.security.PublicKey,? extends java.security.PrivateKey> |
getEDDSAPublicKeyEntryDecoder() |
static java.lang.Class<? extends java.security.PublicKey> |
getEDDSAPublicKeyType() |
static Signature |
getEDDSASigner() |
static javax.crypto.KeyAgreement |
getKeyAgreement(java.lang.String algorithm) |
static java.security.KeyFactory |
getKeyFactory(java.lang.String algorithm) |
static java.security.KeyPairGenerator |
getKeyPairGenerator(java.lang.String algorithm) |
static KeyPairResourceParser |
getKeyPairResourceParser() |
static javax.crypto.Mac |
getMac(java.lang.String algorithm) |
static int |
getMaxDHGroupExchangeKeySize() |
static java.security.MessageDigest |
getMessageDigest(java.lang.String algorithm) |
static PrivateKeyEntryDecoder<? extends java.security.PublicKey,? extends java.security.PrivateKey> |
getOpenSSHEDDSAPrivateKeyEntryDecoder() |
static RandomFactory |
getRandomFactory() |
static SecurityProviderRegistrar |
getRegisteredProvider(java.lang.String provider) |
static java.util.Set<java.lang.String> |
getRegisteredProviders() |
static java.security.Signature |
getSignature(java.lang.String algorithm) |
static boolean |
isAPrioriDisabledProvider(java.lang.String name) |
static boolean |
isBouncyCastleRegistered() |
static boolean |
isDHGroupExchangeSupported() |
static boolean |
isDHGroupExchangeSupported(int maxKeySize) |
static boolean |
isDHOakelyGroupSupported(int keySize) |
static boolean |
isECCSupported() |
static boolean |
isEDDSACurveSupported() |
static boolean |
isProviderRegistered(java.lang.String provider) |
static boolean |
isRegistrationCompleted() |
static java.lang.Iterable<java.security.KeyPair> |
loadKeyPairIdentities(SessionContext session,
NamedResource resourceKey,
java.io.InputStream inputStream,
FilePasswordProvider provider) |
static <B extends Buffer> |
putEDDSAKeyPair(B buffer,
java.security.KeyPair kp) |
static <B extends Buffer> |
putEDDSAKeyPair(B buffer,
java.security.PublicKey pubKey,
java.security.PrivateKey prvKey) |
static <B extends Buffer> |
putRawEDDSAPublicKey(B buffer,
java.security.PublicKey key) |
static java.security.PublicKey |
recoverEDDSAPublicKey(java.security.PrivateKey key) |
private static void |
register() |
static SecurityProviderRegistrar |
registerSecurityProvider(SecurityProviderRegistrar registrar) |
static <T> SecurityEntityFactory<T> |
resolveSecurityEntityFactory(java.lang.Class<T> entityType,
java.lang.String algorithm,
java.util.function.Predicate<? super SecurityProviderRegistrar> entitySelector) |
static void |
setAPrioriDisabledProvider(java.lang.String name,
boolean disabled)
Marks a provider's registrar as "a-priori" programatically
so that when its
SecurityProviderRegistrar.isEnabled() is eventually
consulted it will return false regardless of the configured value for
the specific provider registrar instance. |
static void |
setDefaultProviderChoice(SecurityProviderChoice choice) |
static void |
setKeyPairResourceParser(KeyPairResourceParser parser) |
static void |
setMaxDHGroupExchangeKeySize(int keySize)
Set programmatically the reported value for
getMaxDHGroupExchangeKeySize() |
public static final java.lang.String BOUNCY_CASTLE
public static final java.lang.String EDDSA
EdDSAKey.KEY_ALGORITHM
public static final java.lang.String CURVE_ED25519_SHA512
public static final java.lang.String MAX_DHGEX_KEY_SIZE_PROP
public static final int MIN_DHGEX_KEY_SIZE
public static final int DEFAULT_DHGEX_KEY_SIZE
public static final int PREFERRED_DHGEX_KEY_SIZE
public static final int MAX_DHGEX_KEY_SIZE
public static final java.lang.String SECURITY_PROVIDER_REGISTRARS
SecurityProviderRegistrar
s
to automatically registerpublic static final java.util.List<java.lang.String> DEFAULT_SECURITY_PROVIDER_REGISTRARS
@Deprecated public static final java.lang.String REGISTER_BOUNCY_CASTLE_PROP
Bouncyastle
JCE providerpublic static final java.lang.String ECC_SUPPORTED_PROP
true
it is up to the user to make sure that indeed there is a provider for them@Deprecated public static final java.lang.String EDDSA_SUPPORTED_PROP
isEDDSACurveSupported()
). If not
set or set to true
, then the existence of the optional support classes
determines the support.public static final java.lang.String PROP_DEFAULT_SECURITY_PROVIDER
private static final java.util.concurrent.atomic.AtomicInteger MAX_DHG_KEY_SIZE_HOLDER
private static final java.util.Map<java.lang.String,SecurityProviderRegistrar> REGISTERED_PROVIDERS
private static final java.util.concurrent.atomic.AtomicReference<KeyPairResourceParser> KEYPAIRS_PARSER_HODLER
private static final java.util.Set<java.lang.String> APRIORI_DISABLED_PROVIDERS
private static final java.util.concurrent.atomic.AtomicBoolean REGISTRATION_STATE_HOLDER
private static final java.util.Map<java.lang.Class<?>,java.util.Map<java.lang.String,SecurityEntityFactory<?>>> SECURITY_ENTITY_FACTORIES
private static final java.util.concurrent.atomic.AtomicReference<SecurityProviderChoice> DEFAULT_PROVIDER_HOLDER
private static java.lang.Boolean hasEcc
public static boolean isAPrioriDisabledProvider(java.lang.String name)
name
- The provider's name - never null
/emptytrue
if the provider is marked as disabled a-priorisetAPrioriDisabledProvider(String, boolean)
public static void setAPrioriDisabledProvider(java.lang.String name, boolean disabled)
SecurityProviderRegistrar.isEnabled()
is eventually
consulted it will return false
regardless of the configured value for
the specific provider registrar instance. Note: has no effect if the
provider has already been registered.name
- The provider's name - never null
/emptydisabled
- true
whether to disable it a-prioriisAPrioriDisabledProvider(String)
public static java.util.Set<java.lang.String> getAPrioriDisabledProviders()
public static boolean isECCSupported()
true
if Elliptic Curve Cryptography is supportedECC_SUPPORTED_PROP
public static boolean isDHGroupExchangeSupported()
true
if Diffie-Hellman Group Exchange is supportedgetMaxDHGroupExchangeKeySize()
public static boolean isDHOakelyGroupSupported(int keySize)
keySize
- The expected key sizetrue
if Oakely Diffie-Hellman Group Exchange is supported
for the specified key sizegetMaxDHGroupExchangeKeySize()
public static int getMaxDHGroupExchangeKeySize()
public static void setMaxDHGroupExchangeKeySize(int keySize)
getMaxDHGroupExchangeKeySize()
keySize
- The reported key size - if zero, then it will be auto-detected, if
negative then DH group exchange will be disabledpublic static boolean isDHGroupExchangeSupported(int maxKeySize)
public static SecurityProviderChoice getDefaultProviderChoice()
public static void setDefaultProviderChoice(SecurityProviderChoice choice)
public static java.util.Set<java.lang.String> getRegisteredProviders()
public static boolean isBouncyCastleRegistered()
public static boolean isProviderRegistered(java.lang.String provider)
public static SecurityProviderRegistrar getRegisteredProvider(java.lang.String provider)
public static boolean isRegistrationCompleted()
private static void register()
public static SecurityProviderRegistrar registerSecurityProvider(SecurityProviderRegistrar registrar)
registrar
- The registrar instance to registernull
if not already registered
and not enabled or not supported registrar.public static java.lang.Iterable<java.security.KeyPair> loadKeyPairIdentities(SessionContext session, NamedResource resourceKey, java.io.InputStream inputStream, FilePasswordProvider provider) throws java.io.IOException, java.security.GeneralSecurityException
session
- The SessionContext
for invoking this load command - may
be null
if not invoked within a session context (e.g., offline tool).resourceKey
- An identifier of the key being loaded - used as
argument to the FilePasswordProvider#getPassword
invocationinputStream
- The InputStream
for the private keyprovider
- A FilePasswordProvider
- may be null
if the loaded key is guaranteed not to be encryptedKeyPair
-s - or null
if none loadedjava.io.IOException
- If failed to read/parse the input streamjava.security.GeneralSecurityException
- If failed to generate the keyspublic static AbstractGeneratorHostKeyProvider createGeneratorHostKeyProvider(java.nio.file.Path path)
public static KeyPairResourceParser getBouncycastleKeyPairResourceParser()
public static RandomFactory getRandomFactory()
isBouncyCastleRegistered()
then a BouncyCastleRandomFactory
instance, otherwise a JceRandomFactory
onepublic static boolean isEDDSACurveSupported()
true
if EDDSA curves (e.g., ed25519
) are supportedpublic static PublicKeyEntryDecoder<? extends java.security.PublicKey,? extends java.security.PrivateKey> getEDDSAPublicKeyEntryDecoder()
public static PrivateKeyEntryDecoder<? extends java.security.PublicKey,? extends java.security.PrivateKey> getOpenSSHEDDSAPrivateKeyEntryDecoder()
public static Signature getEDDSASigner()
public static int getEDDSAKeySize(java.security.Key key)
public static java.lang.Class<? extends java.security.PublicKey> getEDDSAPublicKeyType()
public static java.lang.Class<? extends java.security.PrivateKey> getEDDSAPrivateKeyType()
public static boolean compareEDDSAPPublicKeys(java.security.PublicKey k1, java.security.PublicKey k2)
public static boolean compareEDDSAPrivateKeys(java.security.PrivateKey k1, java.security.PrivateKey k2)
public static java.security.PublicKey recoverEDDSAPublicKey(java.security.PrivateKey key) throws java.security.GeneralSecurityException
java.security.GeneralSecurityException
public static java.security.PublicKey generateEDDSAPublicKey(java.lang.String keyType, byte[] seed) throws java.security.GeneralSecurityException
java.security.GeneralSecurityException
public static <B extends Buffer> B putRawEDDSAPublicKey(B buffer, java.security.PublicKey key)
public static <B extends Buffer> B putEDDSAKeyPair(B buffer, java.security.KeyPair kp)
public static <B extends Buffer> B putEDDSAKeyPair(B buffer, java.security.PublicKey pubKey, java.security.PrivateKey prvKey)
public static java.security.KeyPair extractEDDSAKeyPair(Buffer buffer, java.lang.String keyType) throws java.security.GeneralSecurityException
java.security.GeneralSecurityException
public static KeyPairResourceParser getKeyPairResourceParser()
public static void setKeyPairResourceParser(KeyPairResourceParser parser)
parser
- The system-wide KeyPairResourceParser
to use.
If set to null
, then the default parser will be re-constructed
on next call to getKeyPairResourceParser()
public static <T> SecurityEntityFactory<T> resolveSecurityEntityFactory(java.lang.Class<T> entityType, java.lang.String algorithm, java.util.function.Predicate<? super SecurityProviderRegistrar> entitySelector)
public static <T> SecurityEntityFactory<T> createSecurityEntityFactory(java.lang.Class<T> entityType, java.util.function.Predicate<? super SecurityProviderRegistrar> entitySelector)
public static java.security.KeyFactory getKeyFactory(java.lang.String algorithm) throws java.security.GeneralSecurityException
java.security.GeneralSecurityException
public static javax.crypto.Cipher getCipher(java.lang.String transformation) throws java.security.GeneralSecurityException
java.security.GeneralSecurityException
public static java.security.MessageDigest getMessageDigest(java.lang.String algorithm) throws java.security.GeneralSecurityException
java.security.GeneralSecurityException
public static java.security.KeyPairGenerator getKeyPairGenerator(java.lang.String algorithm) throws java.security.GeneralSecurityException
java.security.GeneralSecurityException
public static javax.crypto.KeyAgreement getKeyAgreement(java.lang.String algorithm) throws java.security.GeneralSecurityException
java.security.GeneralSecurityException
public static javax.crypto.Mac getMac(java.lang.String algorithm) throws java.security.GeneralSecurityException
java.security.GeneralSecurityException
public static java.security.Signature getSignature(java.lang.String algorithm) throws java.security.GeneralSecurityException
java.security.GeneralSecurityException
public static java.security.cert.CertificateFactory getCertificateFactory(java.lang.String type) throws java.security.GeneralSecurityException
java.security.GeneralSecurityException