public class JarAuthenticator
extends java.lang.Object
When used for MAC protection, a MAC is calculated over all non-meta data in the JAR file. The MAC value is then stored in the manifest under the 'MACValue' attribute. Once MAC protected, this MAC value can be later used to prove that the JAR file has not since been modified (authenticate).
When use for MAC authentication, a MAC is re-calculated over all non-meta data in the JAR and compared against the value found in the manifest under the 'MACValue' attribute. If the values match, the JAR file has been authenticated; otherwise it has been modified since originally MACed, and authentication fails.
This class is already used by the FIPS module to provide the required authentication of all security related classes. It is provided here as a utility for people who wish to add FIPS-approved Authentication for additional JAR files that they may create.
| Constructor and Description |
|---|
JarAuthenticator()
The default constructor.
|
JarAuthenticator(java.lang.String macAlgorithm)
This creates a
JarAuthenticator that uses the specified
MACing algorithm - any MAC algorithm that is provided by the Entrust
provider is supported. |
| Modifier and Type | Method and Description |
|---|---|
boolean |
authenticate(java.util.jar.JarFile jar,
byte[] key)
Authenticates a MAC protected JAR file.
|
static java.lang.String |
convertToJarProtocol(java.lang.String url,
TraceLog traceLog)
Converts to jar protocol any provided URL string that resembles
"some kind of" URL to a jar.
|
java.lang.String |
getMacAlgorithm()
Returns the MAC algorithm that this
JarAuthenticator uses
for both MAC creation and authentication. |
void |
mac(java.util.jar.JarFile jar,
byte[] key)
MAC protects a JAR file.
|
void |
setMacAlgorithm(java.lang.String macAlgorithm)
Sets the MAC algorithm that this
JarAuthenticator will use
for both MAC creation and authentication - any MAC algorithm that is
provided by the Entrust provider is supported. |
public JarAuthenticator()
JarAuthenticator that
uses the 'DESede' MAC algorithm.
The DESede MAC algorithm is based on the Data Authentication Algorithm specified in FIPS 113, using the DESede Symmetric Cipher instead of DES (DESede is recommended instead of DES). This algorithm is FIPS approved.
java.lang.SecurityException - [FIPS 140-2 status output] thrown if the Entrust provider
has not been installedpublic JarAuthenticator(java.lang.String macAlgorithm)
JarAuthenticator that uses the specified
MACing algorithm - any MAC algorithm that is provided by the Entrust
provider is supported.
For the MACs that this class creates/authenticates to be FIPS approved, the 'DES' or 'DESede' MAC algorithm must be used. Although this class allows the use of other MAC algorithms, this is not FIPS approved usage.
macAlgorithm - [FIPS 140-2 control input] the MAC algorithmjava.lang.IllegalArgumentException - [FIPS 140-2 status output] thrown if the MAC algorithm is
null, or not supportedjava.lang.SecurityException - [FIPS 140-2 status output] thrown if the Entrust provider
has not been installedpublic static java.lang.String convertToJarProtocol(java.lang.String url,
TraceLog traceLog)
Examples:
Note: The URL must reference a jar, not a particular class inside that jar.
url - a url stringtraceLog - the debug trace log that debug information will be written topublic void setMacAlgorithm(java.lang.String macAlgorithm)
JarAuthenticator will use
for both MAC creation and authentication - any MAC algorithm that is
provided by the Entrust provider is supported.
For the MACs this class creates/authenticates to be FIPS approved, the 'DES' or 'DESede' MAC algorithm must be used. Although this class allows the use of other MAC algorithms, this is not FIPS approved usage.
macAlgorithm - [FIPS 140-2 control input] the MAC algorithmjava.lang.IllegalArgumentException - [FIPS 140-2 status output] thrown if the MAC algorithm is
null, or not supportedjava.lang.SecurityException - [FIPS 140-2 status output] thrown if the Entrust provider
has not been installedpublic java.lang.String getMacAlgorithm()
JarAuthenticator uses
for both MAC creation and authentication.
public void mac(java.util.jar.JarFile jar,
byte[] key)
throws java.io.IOException,
java.security.InvalidKeyException
The group of files that the MAC is calculated over consists of all files in the JAR with the exception of the any meta-data.
The MAC value is then written into the manifest as an attribute with the name 'MACValue'. The process of writing the manifest actually consists of creating a new JAR file with the updated manifest, deleting the existing JAR file, and renaming to new JAR to the old one. As a result, following a call to this method, the JAR file parameter will no longer reference a valid jar file.
jar - [FIPS 140-2 control input] the JAR file to be MAC protectedkey - [FIPS 140-2 data input] [FIPS 140-2 CSP] the key that is used
to create the MACjava.lang.IllegalArgumentException - [FIPS 140-2 status output] thrown if any of the parameters
are nulljava.io.IOException - [FIPS 140-2 status output] thrown if errors occur while
reading/writing the JAR filejava.security.InvalidKeyException - [FIPS 140-2 status output] thrown if the key is not valid
for the MAC algorithmpublic boolean authenticate(java.util.jar.JarFile jar,
byte[] key)
throws java.io.IOException,
java.security.InvalidKeyException
The group of files being authenticated consists of all files in the JAR with the exception of any meta data.
The original MAC value is read from the manifest and compared with the recalculated value. If the values are identical, then the JAR has been authenticated and true is returned; otherwise false is returned.
jar - [FIPS 140-2 control input] the JAR file to be authenticatedkey - [FIPS 140-2 data input] [FIPS 140-2 CSP] the key that is used
to create the MACjava.lang.IllegalArgumentException - [FIPS 140-2 status output] thrown if any of the parameters
are nulljava.io.IOException - [FIPS 140-2 status output] thrown if errors occur while
reading the JAR filejava.security.InvalidKeyException - [FIPS 140-2 status output] thrown if the key is not valid
for the MAC algorithmFips140ErrorStateException - [FIPS 140-2 status output] thrown if the Toolkit is not
allowed to perform cryptographic operations