AlgorithmParameterSpec, KeySpec predicate refinement

[AndreSonntag]

Currently, CrySL provides different predicates for AlgorithmParamterSpec interface implementers. We should have the same for KeySpec implementers. In the following example, we get an InvalidKeySpecException, due to the wrong KeySpec object.

public static PrivateKey createPrivateKey(){
 KeyFactory keyFactory = KeyFactory.getInstance("DSA");
 PBEKeySpec spec = new PBEKeySpec(new char[16]);
 PrivateKey privateKey = keyFactory.generatePrivate(spec);
 return privateKey;
}  

java.security.spec.AlgorithmParameterSpec

• [x] java.security.spec.DSAGenParameterSpec preparedDSA[]

• [x] java.security.spec.DSAParameterSpec preparedDSA[]

• [x] java.security.spec.ECGenParameterSpec preparedEC[]

• [x] java.security.spec.ECParameterSpec preparedEC[]

• [x] java.security.spec.MGF1ParameterSpec preparedMFG1[]

• [x] java.security.spec.RSAKeyGenParameterSpec preparedRSA[]

• [x] javax.crypto.spec.DHGenParameterSpec preparedDH[]

• [x] javax.crypto.spec.DHParameterSpec preparedDH[]

• [x] javax.crypto.spec.GCMParameterSpec preparedGCM[]

• [x] javax.crypto.spec.IvParameterSpec preparedIV[]

• [x] javax.crypto.spec.OAEPParameterSpec preparedOAEP[]

• [x] javax.crypto.spec.PBEParameterSpec preparedPBE[]

• [x] javax.xml.crypto.dsig.spec.HMACParameterSpec preparedHMAC[]

• [x] java.security.spec.PSSParameterSpec preparedPSS[]

java.security.spec.KeySpec

• [x] javax.crypto.spec.PBEKeySpec speccedKey[] → speccedPBEKeySpec[this, keylength]

• [x] javax.crypto.spec.SecretKeySpec speccedKey[] → speccedSymmetricKeySpec[this, keyAlgorithm], generatedSymmetricKey[this, keyAlgorithm]

• [x] java.security.spec.X509EncodedKeySpec speccedPubKeySpec[this]

• [x] java.security.spec.PKCS8EncodedKeySpec speccedPrivKeySpec[this]

• [x] java.security.spec.EncodedKeySpec speccedPubKeySpec[this], speccedPrivKeySpec[this]

• [x] java.security.spec.DSAPrivateKeySpec speccedDSAPrivKeySpec[this]

• [x] java.security.spec.DSAPublicKeySpec speccedDSAPubKeySpec[this]

• [x] java.security.spec.ECPrivateKeySpec speccedECPrivKeySpec[this]

• [x] java.security.spec.ECPublicKeySpec speccedECPubKeySpec[this]

• [x] java.security.spec.RSAPrivateKeySpec speccedRSAPrivKeySpec[this]

• [x] java.security.spec.RSAPublicKeySpec speccedRSAPubKeySpec[this]

• [x] java.security.spec.RSAPrivateCrtKeySpec speccedRSAPrivKeySpec[this]

• [x] javax.crypto.spec.DHPrivateKeySpec speccedDHPrivKeySpec[this]

• [x] javax.crypto.spec.DHPublicKeySpec speccedDHPubKeySpec[this]

• [ ] javax.crypto.spec.DESedeKeySpec not secure

• [ ] javax.crypto.spec.DESKeySpec not secure

Sources: https://docs.oracle.com/javase/8/docs/api/java/security/spec/package-tree.html https://docs.oracle.com/javase/8/docs/api/javax/crypto/spec/package-tree.html

[AndreSonntag]

Branch: https://github.com/CROSSINGTUD/Crypto-API-Rules/tree/AlgorithmParameterSpec_KeySpec_refinement