# HG changeset patch # User weijun # Date 1342871813 -28800 # Node ID 5dc3f32c0d26a5ae4769c7f284255e95dc2b87e5 # Parent 84cd98a5641c90e2ba494825bdc168a9873b6b0f 7180907: Jarsigner -verify fails if rsa file used sha-256 with authenticated attributes Reviewed-by: xuelei diff -r 84cd98a5641c -r 5dc3f32c0d26 src/share/classes/com/sun/crypto/provider/OAEPParameters.java --- a/src/share/classes/com/sun/crypto/provider/OAEPParameters.java Thu Jul 19 21:23:53 2012 -0700 +++ b/src/share/classes/com/sun/crypto/provider/OAEPParameters.java Sat Jul 21 19:56:53 2012 +0800 @@ -105,22 +105,6 @@ } } - private static String convertToStandardName(String internalName) { - if (internalName.equals("SHA")) { - return "SHA-1"; - } else if (internalName.equals("SHA224")) { - return "SHA-224"; - } else if (internalName.equals("SHA256")) { - return "SHA-256"; - } else if (internalName.equals("SHA384")) { - return "SHA-384"; - } else if (internalName.equals("SHA512")) { - return "SHA-512"; - } else { - return internalName; - } - } - protected void engineInit(byte[] encoded) throws IOException { DerInputStream der = new DerInputStream(encoded); @@ -132,8 +116,8 @@ DerValue data = datum[i]; if (data.isContextSpecific((byte) 0x00)) { // hash algid - mdName = convertToStandardName(AlgorithmId.parse - (data.data.getDerValue()).getName()); + mdName = AlgorithmId.parse + (data.data.getDerValue()).getName(); } else if (data.isContextSpecific((byte) 0x01)) { // mgf algid AlgorithmId val = AlgorithmId.parse(data.data.getDerValue()); @@ -142,7 +126,7 @@ } AlgorithmId params = AlgorithmId.parse( new DerValue(val.getEncodedParams())); - String mgfDigestName = convertToStandardName(params.getName()); + String mgfDigestName = params.getName(); if (mgfDigestName.equals("SHA-1")) { mgfSpec = MGF1ParameterSpec.SHA1; } else if (mgfDigestName.equals("SHA-224")) { diff -r 84cd98a5641c -r 5dc3f32c0d26 src/share/classes/sun/security/pkcs/PKCS7.java --- a/src/share/classes/sun/security/pkcs/PKCS7.java Thu Jul 19 21:23:53 2012 -0700 +++ b/src/share/classes/sun/security/pkcs/PKCS7.java Sat Jul 21 19:56:53 2012 +0800 @@ -882,7 +882,7 @@ PKCS7 tsToken = tsReply.getToken(); TimestampToken tst = tsReply.getTimestampToken(); - if (!tst.getHashAlgorithm().getName().equals("SHA")) { + if (!tst.getHashAlgorithm().getName().equals("SHA-1")) { throw new IOException("Digest algorithm not SHA-1 in " + "timestamp token"); } diff -r 84cd98a5641c -r 5dc3f32c0d26 src/share/classes/sun/security/pkcs12/PKCS12KeyStore.java --- a/src/share/classes/sun/security/pkcs12/PKCS12KeyStore.java Thu Jul 19 21:23:53 2012 -0700 +++ b/src/share/classes/sun/security/pkcs12/PKCS12KeyStore.java Sat Jul 21 19:56:53 2012 +0800 @@ -1298,11 +1298,9 @@ try { String algName = macData.getDigestAlgName().toUpperCase(Locale.ENGLISH); - if (algName.equals("SHA") || - algName.equals("SHA1") || - algName.equals("SHA-1")) { - algName = "SHA1"; - } + + // Change SHA-1 to SHA1 + algName = algName.replace("-", ""); // generate MAC (MAC key is created within JCE) Mac m = Mac.getInstance("HmacPBE" + algName); diff -r 84cd98a5641c -r 5dc3f32c0d26 src/share/classes/sun/security/x509/AlgorithmId.java --- a/src/share/classes/sun/security/x509/AlgorithmId.java Thu Jul 19 21:23:53 2012 -0700 +++ b/src/share/classes/sun/security/x509/AlgorithmId.java Sat Jul 21 19:56:53 2012 +0800 @@ -242,10 +242,7 @@ AlgorithmId paramsId = AlgorithmId.parse(new DerValue(getEncodedParams())); String paramsName = paramsId.getName(); - if (paramsName.equals("SHA")) { - paramsName = "SHA1"; - } - algName = paramsName + "withECDSA"; + algName = makeSigAlg(paramsName, "EC"); } catch (IOException e) { // ignore } @@ -876,11 +873,11 @@ nameTable = new HashMap(); nameTable.put(MD5_oid, "MD5"); nameTable.put(MD2_oid, "MD2"); - nameTable.put(SHA_oid, "SHA"); - nameTable.put(SHA224_oid, "SHA224"); - nameTable.put(SHA256_oid, "SHA256"); - nameTable.put(SHA384_oid, "SHA384"); - nameTable.put(SHA512_oid, "SHA512"); + nameTable.put(SHA_oid, "SHA-1"); + nameTable.put(SHA224_oid, "SHA-224"); + nameTable.put(SHA256_oid, "SHA-256"); + nameTable.put(SHA384_oid, "SHA-384"); + nameTable.put(SHA512_oid, "SHA-512"); nameTable.put(RSAEncryption_oid, "RSA"); nameTable.put(RSA_oid, "RSA"); nameTable.put(DH_oid, "Diffie-Hellman"); @@ -917,11 +914,8 @@ * name and a encryption algorithm name. */ public static String makeSigAlg(String digAlg, String encAlg) { - digAlg = digAlg.replace("-", "").toUpperCase(Locale.ENGLISH); - if (digAlg.equalsIgnoreCase("SHA")) digAlg = "SHA1"; - - encAlg = encAlg.toUpperCase(Locale.ENGLISH); - if (encAlg.equals("EC")) encAlg = "ECDSA"; + digAlg = digAlg.replace("-", ""); + if (encAlg.equalsIgnoreCase("EC")) encAlg = "ECDSA"; return digAlg + "with" + encAlg; } diff -r 84cd98a5641c -r 5dc3f32c0d26 test/sun/security/x509/AlgorithmId/NonStandardNames.java --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/test/sun/security/x509/AlgorithmId/NonStandardNames.java Sat Jul 21 19:56:53 2012 +0800 @@ -0,0 +1,84 @@ +/* + * Copyright (c) 2012, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as + * published by the Free Software Foundation. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * version 2 for more details (a copy is included in the LICENSE file that + * accompanied this code). + * + * You should have received a copy of the GNU General Public License version + * 2 along with this work; if not, write to the Free Software Foundation, + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. + * + * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA + * or visit www.oracle.com if you need additional information or have any + * questions. + */ + +/* + * @test + * @bug 7180907 + * @summary Jarsigner -verify fails if rsa file used sha-256 with authenticated attributes + */ + +import java.security.MessageDigest; +import java.security.Signature; +import java.security.cert.X509Certificate; +import sun.security.pkcs.ContentInfo; +import sun.security.pkcs.PKCS7; +import sun.security.pkcs.PKCS9Attribute; +import sun.security.pkcs.PKCS9Attributes; +import sun.security.pkcs.SignerInfo; +import sun.security.tools.CertAndKeyGen; +import sun.security.x509.AlgorithmId; +import sun.security.x509.X500Name; + +public class NonStandardNames { + + public static void main(String[] args) throws Exception { + + byte[] data = "Hello".getBytes(); + X500Name n = new X500Name("cn=Me"); + + CertAndKeyGen cakg = new CertAndKeyGen("RSA", "SHA256withRSA"); + cakg.generate(1024); + X509Certificate cert = cakg.getSelfCertificate(n, 1000); + + MessageDigest md = MessageDigest.getInstance("SHA-256"); + PKCS9Attributes authed = new PKCS9Attributes(new PKCS9Attribute[]{ + new PKCS9Attribute(PKCS9Attribute.CONTENT_TYPE_OID, ContentInfo.DATA_OID), + new PKCS9Attribute(PKCS9Attribute.MESSAGE_DIGEST_OID, md.digest(data)), + }); + + Signature s = Signature.getInstance("SHA256withRSA"); + s.initSign(cakg.getPrivateKey()); + s.update(authed.getDerEncoding()); + byte[] sig = s.sign(); + + SignerInfo signerInfo = new SignerInfo( + n, + cert.getSerialNumber(), + AlgorithmId.get("SHA-256"), + authed, + AlgorithmId.get("SHA256withRSA"), + sig, + null + ); + + PKCS7 pkcs7 = new PKCS7( + new AlgorithmId[] {signerInfo.getDigestAlgorithmId()}, + new ContentInfo(data), + new X509Certificate[] {cert}, + new SignerInfo[] {signerInfo}); + + if (pkcs7.verify(signerInfo, data) == null) { + throw new Exception("Not verified"); + } + } +}