Example usage for org.bouncycastle.asn1.x509 KeyUsage dataEncipherment

List of usage examples for org.bouncycastle.asn1.x509 KeyUsage dataEncipherment

  1. HOME
  2. Java
  3. org.bouncycastle
  4. org.bouncycastle.asn1.x509.*
  5. KeyUsage
  6. dataEncipherment

Introduction

In this page you can find the example usage for org.bouncycastle.asn1.x509 KeyUsage dataEncipherment.

Prototype

int dataEncipherment

To view the source code for org.bouncycastle.asn1.x509 KeyUsage dataEncipherment.

Click Source Link

Usage

From source file:com.peterphi.std.crypto.keygen.CaHelper.java

License:Open Source License

static private X509V3CertificateGenerator addCaExtensions(X509V3CertificateGenerator gen, PublicKey pubKey)
        throws Exception {
    gen.addExtension(X509Extensions.BasicConstraints, true, new BasicConstraints(true));
    gen.addExtension(X509Extensions.KeyUsage, true, new KeyUsage(KeyUsage.digitalSignature
            | KeyUsage.keyEncipherment | KeyUsage.dataEncipherment | KeyUsage.keyCertSign | KeyUsage.cRLSign));

    gen.addExtension(X509Extensions.ExtendedKeyUsage, getExtendedKeyUsageCriticality(),
            new ExtendedKeyUsage(KeyPurposeId.id_kp_serverAuth));
    // gen.addExtension(X509Extensions.SubjectAlternativeName, false,
    // new GeneralNames(new GeneralName(GeneralName.rfc822Name,
    // "test@test.test")));

    // netscape-cert-type "2.16.840.1.113730.1.1"
    // * bit-0 SSL client - 128
    // * bit-1 SSL server - 64
    // * bit-2 S/MIME - 32
    // * bit-3 Object Signing - 16
    // * bit-4 Reserved - 8
    // * bit-5 SSL CA - 4
    // * bit-6 S/MIME CA - 2
    // * bit-7 Object Signing CA - 1
    gen.addExtension(netscapeCertType, false, new DERBitString(new byte[] { Byte.MAX_VALUE })); // was 4

    addSubjectKeyIdentifier(gen, pubKey);
    addAuthorityKeyIdentifier(gen, pubKey);
    return gen;/*from  w  ww.j  a  va2  s . c om*/
}

From source file:com.peterphi.std.crypto.keygen.CaHelper.java

License:Open Source License

@SuppressWarnings("unused")
static private X509V3CertificateGenerator addServerExtensions(X509V3CertificateGenerator gen, PublicKey pubKey)
        throws Exception {
    gen.addExtension(X509Extensions.BasicConstraints, true, new BasicConstraints(true));
    gen.addExtension(X509Extensions.KeyUsage, true,
            new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment | KeyUsage.dataEncipherment));

    gen.addExtension(X509Extensions.ExtendedKeyUsage, getExtendedKeyUsageCriticality(),
            new ExtendedKeyUsage(KeyPurposeId.id_kp_serverAuth));
    // gen.addExtension(X509Extensions.SubjectAlternativeName, false,
    // new GeneralNames(new GeneralName(GeneralName.rfc822Name,
    // "test@test.test")));

    // netscape-cert-type "2.16.840.1.113730.1.1"
    // * bit-0 SSL client - 128
    // * bit-1 SSL server - 64
    // * bit-2 S/MIME - 32
    // * bit-3 Object Signing - 16
    // * bit-4 Reserved - 8
    // * bit-5 SSL CA - 4
    // * bit-6 S/MIME CA - 2
    // * bit-7 Object Signing CA - 1

    gen.addExtension(netscapeCertType, false, new DERBitString(new byte[] { -16 })); // was 4

    addSubjectKeyIdentifier(gen, pubKey);
    addAuthorityKeyIdentifier(gen, pubKey);
    return gen;//www. java2  s. c o m
}

From source file:com.peterphi.std.crypto.keygen.CaHelper.java

License:Open Source License

static private X509V3CertificateGenerator addClientExtensions(X509V3CertificateGenerator gen) throws Exception {
    gen.addExtension(X509Extensions.BasicConstraints, true, new BasicConstraints(false));
    gen.addExtension(X509Extensions.KeyUsage, true, new KeyUsage(KeyUsage.digitalSignature
            | KeyUsage.keyEncipherment | KeyUsage.dataEncipherment | KeyUsage.keyCertSign));
    gen.addExtension(X509Extensions.ExtendedKeyUsage, getExtendedKeyUsageCriticality(),
            new ExtendedKeyUsage(KeyPurposeId.id_kp_clientAuth));

    return gen;/*from  w w  w.  ja v  a 2  s .  c om*/
}

From source file:com.vmware.admiral.common.util.CertificateUtil.java

License:Open Source License

private static List<ExtensionHolder> getServerExtensions(X509Certificate issuerCertificate)
        throws CertificateEncodingException, NoSuchAlgorithmException, IOException {
    List<ExtensionHolder> extensions = new ArrayList<>();

    // SSO forces us to allow data encipherment
    extensions.add(new ExtensionHolder(Extension.keyUsage, true,
            new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment | KeyUsage.dataEncipherment)));

    extensions.add(new ExtensionHolder(Extension.extendedKeyUsage, true,
            new ExtendedKeyUsage(KeyPurposeId.id_kp_serverAuth)));

    Extension authorityKeyExtension = new Extension(Extension.authorityKeyIdentifier, false,
            new DEROctetString(new JcaX509ExtensionUtils().createAuthorityKeyIdentifier(issuerCertificate)));
    extensions.add(new ExtensionHolder(authorityKeyExtension.getExtnId(), authorityKeyExtension.isCritical(),
            authorityKeyExtension.getParsedValue()));

    return extensions;
}

From source file:com.vvote.thirdparty.ximix.util.BLSKeyStore.java

License:Apache License

private X509CertificateHolder createCertificate(String keyID, int sequenceNo, PrivateKey privKey)
        throws GeneralSecurityException, OperatorCreationException, IOException {
    String name = "C=AU, O=Ximix Network Node, OU=" + "Util";

    ////from www . j  av  a  2s.com
    // create the certificate - version 3
    //
    X509v3CertificateBuilder v3CertBuilder = new X509v3CertificateBuilder(new X500Name(name),
            BigInteger.valueOf(1), new Date(System.currentTimeMillis() - 1000L * 60 * 60 * 24 * 30),
            new Date(System.currentTimeMillis() + (1000L * 60 * 60 * 24 * 365)), new X500Name(name),
            this.fetchPublicKey(keyID));

    // we use keyUsage extension to distinguish between signing and encryption keys

    if (signingKeys.contains(keyID)) {
        v3CertBuilder.addExtension(Extension.keyUsage, true, new KeyUsage(KeyUsage.digitalSignature));
    } else {
        v3CertBuilder.addExtension(Extension.keyUsage, true, new KeyUsage(KeyUsage.dataEncipherment));
    }

    v3CertBuilder.addExtension(XimixObjectIdentifiers.ximixShareIdExtension, true, new ASN1Integer(sequenceNo));

    return v3CertBuilder.build(new JcaContentSignerBuilder("SHA1withECDSA").setProvider("BC").build(privKey));
}

From source file:com.wandrell.util.ksgen.BouncyCastleKeyStoreFactory.java

License:Open Source License

/**
 * Returns a certificate builder./*w  ww .  ja  va  2s .co m*/
 *
 * @param publicKey
 *            public key for the certificate builder
 * @param issuer
 *            issuer for the certificate builder
 * @return a certificate builder
 * @throws IOException
 *             if any format error occurrs while creating the certificate
 */
private final X509v3CertificateBuilder getCertificateBuilder(final PublicKey publicKey, final String issuer)
        throws IOException {
    final X500Name issuerName; // Issuer name
    final X500Name subjectName; // Subject name
    final BigInteger serial; // Serial number
    final X509v3CertificateBuilder builder; // Certificate builder
    final Date start; // Certificate start date
    final Date end; // Certificate end date
    final KeyUsage usage; // Key usage
    final ASN1EncodableVector purposes; // Certificate purposes

    issuerName = new X500Name(issuer);
    subjectName = issuerName;
    serial = BigInteger.valueOf(getRandom().nextInt());

    // Dates for the certificate
    start = getOneYearBackDate();
    end = getOneHundredYearsFutureDate();

    builder = new JcaX509v3CertificateBuilder(issuerName, serial, start, end, subjectName, publicKey);

    builder.addExtension(Extension.subjectKeyIdentifier, false, createSubjectKeyIdentifier(publicKey));
    builder.addExtension(Extension.basicConstraints, true, new BasicConstraints(true));

    usage = new KeyUsage(KeyUsage.keyCertSign | KeyUsage.digitalSignature | KeyUsage.keyEncipherment
            | KeyUsage.dataEncipherment | KeyUsage.cRLSign);
    builder.addExtension(Extension.keyUsage, false, usage);

    purposes = new ASN1EncodableVector();
    purposes.add(KeyPurposeId.id_kp_serverAuth);
    purposes.add(KeyPurposeId.id_kp_clientAuth);
    purposes.add(KeyPurposeId.anyExtendedKeyUsage);
    builder.addExtension(Extension.extendedKeyUsage, false, new DERSequence(purposes));

    return builder;

}

From source file:de.mendelson.util.security.cert.KeystoreCertificate.java

/**
 * Returns the key usages of this cert, OID 2.5.29.15
 *//*from ww w . ja  va  2 s. c  om*/
public List<String> getKeyUsages() {
    List<String> keyUsages = new ArrayList<String>();
    byte[] extensionValue = this.certificate.getExtensionValue("2.5.29.15");
    if (extensionValue == null) {
        return (keyUsages);
    }
    try {
        byte[] octedBytes = ((ASN1OctetString) ASN1Primitive.fromByteArray(extensionValue)).getOctets();
        //bit encoded values for the key usage
        int val = KeyUsage.getInstance(ASN1Primitive.fromByteArray(octedBytes)).getPadBits();
        //bit 0
        if ((val & KeyUsage.digitalSignature) == KeyUsage.digitalSignature) {
            keyUsages.add("Digital signature");
        }
        //bit 1
        if ((val & KeyUsage.nonRepudiation) == KeyUsage.nonRepudiation) {
            keyUsages.add("Non repudiation");
        }
        //bit 2
        if ((val & KeyUsage.keyEncipherment) == KeyUsage.keyEncipherment) {
            keyUsages.add("Key encipherment");
        }
        //bit 3
        if ((val & KeyUsage.dataEncipherment) == KeyUsage.dataEncipherment) {
            keyUsages.add("Data encipherment");
        }
        //bit 4
        if ((val & KeyUsage.keyAgreement) == KeyUsage.keyAgreement) {
            keyUsages.add("Key agreement");
        }
        //bit 5
        if ((val & KeyUsage.keyCertSign) == KeyUsage.keyCertSign) {
            keyUsages.add("Key certificate signing");
        }
        //bit6
        if ((val & KeyUsage.cRLSign) == KeyUsage.cRLSign) {
            keyUsages.add("CRL signing");
        }
        if ((val & KeyUsage.decipherOnly) == KeyUsage.decipherOnly) {
            keyUsages.add("Decipher");
        }

        if ((val & KeyUsage.encipherOnly) == KeyUsage.encipherOnly) {
            keyUsages.add("Encipher");
        }

    } catch (Exception e) {
        e.printStackTrace();
    }
    return (keyUsages);
}

From source file:de.petendi.commons.crypto.connector.BCConnector.java

License:Apache License

@Override
public X509Certificate createCertificate(String dn, String issuer, String crlUri, PublicKey publicKey,
        PrivateKey privateKey) throws CryptoException {
    Calendar date = Calendar.getInstance();
    // Serial Number
    BigInteger serialNumber = BigInteger.valueOf(date.getTimeInMillis());
    // Subject and Issuer DN
    X500Name subjectDN = new X500Name(dn);
    X500Name issuerDN = new X500Name(issuer);
    // Validity/*from  w w  w . j av  a2s .  com*/
    Date notBefore = date.getTime();
    date.add(Calendar.YEAR, 20);
    Date notAfter = date.getTime();
    // SubjectPublicKeyInfo
    SubjectPublicKeyInfo subjPubKeyInfo = new SubjectPublicKeyInfo(
            ASN1Sequence.getInstance(publicKey.getEncoded()));

    X509v3CertificateBuilder certGen = new X509v3CertificateBuilder(issuerDN, serialNumber, notBefore, notAfter,
            subjectDN, subjPubKeyInfo);
    DigestCalculator digCalc = null;
    try {
        digCalc = new BcDigestCalculatorProvider().get(new AlgorithmIdentifier(OIWObjectIdentifiers.idSHA1));
        X509ExtensionUtils x509ExtensionUtils = new X509ExtensionUtils(digCalc);
        // Subject Key Identifier
        certGen.addExtension(Extension.subjectKeyIdentifier, false,
                x509ExtensionUtils.createSubjectKeyIdentifier(subjPubKeyInfo));
        // Authority Key Identifier
        certGen.addExtension(Extension.authorityKeyIdentifier, false,
                x509ExtensionUtils.createAuthorityKeyIdentifier(subjPubKeyInfo));
        // Key Usage
        certGen.addExtension(Extension.keyUsage, false, new KeyUsage(KeyUsage.dataEncipherment));
        if (crlUri != null) {
            // CRL Distribution Points
            DistributionPointName distPointOne = new DistributionPointName(
                    new GeneralNames(new GeneralName(GeneralName.uniformResourceIdentifier, crlUri)));

            DistributionPoint[] distPoints = new DistributionPoint[1];
            distPoints[0] = new DistributionPoint(distPointOne, null, null);
            certGen.addExtension(Extension.cRLDistributionPoints, false, new CRLDistPoint(distPoints));
        }

        // Content Signer
        ContentSigner sigGen = new JcaContentSignerBuilder(getSignAlgorithm()).setProvider(getProviderName())
                .build(privateKey);
        // Certificate
        return new JcaX509CertificateConverter().setProvider(getProviderName())
                .getCertificate(certGen.build(sigGen));
    } catch (Exception e) {
        throw new CryptoException(e);
    }

}

From source file:de.rub.nds.tlsattacker.tlsserver.KeyStoreGenerator.java

License:Apache License

public static KeyStore createKeyStore(KeyPair keyPair)
        throws CertificateException, IOException, InvalidKeyException, KeyStoreException,
        NoSuchAlgorithmException, NoSuchProviderException, SignatureException, OperatorCreationException {
    PublicKey publicKey = keyPair.getPublic();
    PrivateKey privateKey = keyPair.getPrivate();

    X500Name issuerName = new X500Name("CN=127.0.0.1, O=TLS-Attacker, L=RUB, ST=NRW, C=DE");
    X500Name subjectName = issuerName;

    BigInteger serial = BigInteger.valueOf(new SecureRandom().nextInt());

    X509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(issuerName, serial, BEFORE, AFTER,
            subjectName, publicKey);//from   ww w . jav a 2s.c o m
    builder.addExtension(Extension.basicConstraints, true, new BasicConstraints(true));

    KeyUsage usage = new KeyUsage(KeyUsage.keyCertSign | KeyUsage.digitalSignature | KeyUsage.keyEncipherment
            | KeyUsage.dataEncipherment);
    builder.addExtension(Extension.keyUsage, false, usage);

    ASN1EncodableVector purposes = new ASN1EncodableVector();
    purposes.add(KeyPurposeId.id_kp_serverAuth);
    purposes.add(KeyPurposeId.id_kp_clientAuth);
    purposes.add(KeyPurposeId.anyExtendedKeyUsage);
    builder.addExtension(Extension.extendedKeyUsage, false, new DERSequence(purposes));

    String algorithm = createSigningAlgorithm(keyPair);
    X509Certificate cert = signCertificate(algorithm, builder, privateKey);
    cert.checkValidity(new Date());
    cert.verify(publicKey);

    KeyStore keyStore = KeyStore.getInstance("JKS");
    keyStore.load(null, null);
    keyStore.setKeyEntry(ALIAS, privateKey, PASSWORD.toCharArray(),
            new java.security.cert.Certificate[] { cert });

    return keyStore;
}

From source file:fi.aalto.cs.drumbeat.CACertificateCreator.java

License:Open Source License

public X509Certificate createCACert(PublicKey publicKey, PrivateKey privateKey) {

    X509Certificate ca_cert = null;
    try {/*w  w  w . ja  v a 2s . c om*/
        X500Name issuerName = new X500Name("CN=" + data_store.getCa_certificate().getCommon_name() + ", O="
                + data_store.getCa_certificate().getOrganization() + ", L="
                + data_store.getCa_certificate().getCity() + ", ST="
                + data_store.getCa_certificate().getCountry().getCountry_Name() + ", C="
                + data_store.getCa_certificate().getCountry().getCountry_Code());
        X500Name subjectName = issuerName;
        BigInteger serial = BigInteger.valueOf(new Random().nextInt());
        X509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(issuerName, serial,
                CertificateCommons.NOT_BEFORE, CertificateCommons.NOT_AFTER, subjectName, publicKey);
        builder.addExtension(Extension.subjectKeyIdentifier, false, createSubjectKeyIdentifier(publicKey));
        builder.addExtension(Extension.basicConstraints, true, new BasicConstraints(true));

        KeyUsage usage = new KeyUsage(KeyUsage.keyCertSign | KeyUsage.digitalSignature
                | KeyUsage.keyEncipherment | KeyUsage.dataEncipherment | KeyUsage.cRLSign);
        builder.addExtension(Extension.keyUsage, false, usage);

        ASN1EncodableVector purposes = new ASN1EncodableVector();
        purposes.add(KeyPurposeId.id_kp_serverAuth);
        purposes.add(KeyPurposeId.id_kp_clientAuth);
        purposes.add(KeyPurposeId.anyExtendedKeyUsage);
        builder.addExtension(Extension.extendedKeyUsage, false, new DERSequence(purposes));

        ca_cert = signCertificate(builder, privateKey);
        ca_cert.checkValidity(new Date());
        ca_cert.verify(publicKey);
    } catch (Exception e) {
        e.printStackTrace();
    }

    return ca_cert;
}