Add pem-api module: PEMDecoder/PEMEncoder (JEP 538 preview on JDK 27, JEP 542 final in JDK 28) for JWT keys, TLS, encrypted keys and BouncyCastle migration
Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01CifR2BE7PBvRy5hT8TS9oz
This commit is contained in:
Claude Sonnet 5.5
@@ -0,0 +1 @@
|
||||
target/
|
||||
@@ -0,0 +1,23 @@
|
||||
# pem-api
|
||||
|
||||
Companion code for the ankurm.com article **PEM Encodings in Java (JEP 538 / JEP 542): Read and Write Keys and Certificates Without BouncyCastle**.
|
||||
|
||||
`java.security.PEMDecoder` / `PEMEncoder` were previewed in JDK 25 (JEP 470) and 26 (JEP 524), and are a **third preview in JDK 27 (JEP 538)**,
|
||||
so JDK 27 needs `--enable-preview`. JEP 542 finalizes the API in JDK 28 (targeted; not GA until March 2027). The scripts run on JDK 27.0.1 (Temurin) and on the JDK 28 early-access build 21 (no flag).
|
||||
|
||||
| File | What it shows | Output |
|
||||
|---|---|---|
|
||||
| `src/RoundTrip.java` | decode / encode keys and certificates, CRLF line endings, what untyped `decode` returns | `output/01-round-trip.txt` |
|
||||
| `src/JwtSigning.java` | RS256 / ES256 / EdDSA signing with keys from PEM, the ES256 DER vs R||S trap | `output/02-jwt-signing.txt` |
|
||||
| `src/TlsFromPem.java` | key + certificate chain + CA from PEM into an `SSLContext`, a local HTTPS server and client | `output/03-tls.txt` |
|
||||
| `src/EncryptedKeys.java` | write / read encrypted PKCS#8, choose algorithm and cost, wrong password, OpenSSL files | `output/04-encrypted.txt` |
|
||||
| `src/Failures.java` | wrong target class, SEC1 `EC PRIVATE KEY`, malformed text, bundles | `output/05-failures.txt` |
|
||||
| `src/Migration.java` | the same jobs with BouncyCastle `bcpkix` 1.86, Spring Security 7.1.2 `RsaKeyConverters`, and the JDK | `output/06-migration.txt` |
|
||||
| (script) | compile without `--enable-preview`; run without it | `output/07-preview-flag.txt` |
|
||||
| (script) | the same demos on JDK 28 EA, no flag, diffed against the JDK 27 run | `output/08-jdk28-final.txt` |
|
||||
|
||||
```bash
|
||||
JDK27=/path/to/jdk-27 JDK28=/path/to/jdk-28-ea ./run.sh # JDK28 is optional; needs Maven Central once, for bcpkix and spring-security-core
|
||||
```
|
||||
|
||||
`fixtures/` holds throw-away OpenSSL-generated keys and certificates (see `fixtures/README.md`). Output is byte-stable; the ECDSA DER length (random, 70-72) is printed as a range check for that reason.
|
||||
@@ -0,0 +1,2 @@
|
||||
Throw-away keys generated with OpenSSL 3.0.13 for this demo only. They protect nothing. Do not reuse them.
|
||||
Password for the encrypted files: `changeit`.
|
||||
@@ -0,0 +1,19 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDFTCCAf2gAwIBAgIUCSAcRT4u1yYgnV75DA+j83tCQVEwDQYJKoZIhvcNAQEL
|
||||
BQAwGjEYMBYGA1UEAwwPcGVtLWFwaSBkZW1vIENBMB4XDTI2MTAyNjAxNDA1M1oX
|
||||
DTM2MTAyMzAxNDA1M1owGjEYMBYGA1UEAwwPcGVtLWFwaSBkZW1vIENBMIIBIjAN
|
||||
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu4m1GA1zj99imolAmktmnHBMz9LK
|
||||
wpT73gXpxAymH0nMe991uduv2l79KS2ItpwlwovXy6L4vk8oPauN3iN0aIm6MUUS
|
||||
j32fJmk+NY7CIkZwBt6ys69yhRCbf5a7ydHQdlNSO+QAqfD+DveTZI8UkOqxLBXP
|
||||
MWZlOSTN5tGsLBt2pVvMWXf2Dlt4PqHOHjU4NNiZeHwpOj9Z7JQAT0dOI57aYy1+
|
||||
b3vFUaG2TsKTsxwaxcwU4X6WV/yF3lVXVM1g9nRctdRq4BIOsTdViONfvSopMqhz
|
||||
vvowsX/w94dXvzCRfpJ5Z0lyi2+9xUID9pdF9G1v0K1aHeNOrSB20Z2QswIDAQAB
|
||||
o1MwUTAdBgNVHQ4EFgQUWNf+XHdl2Z/EhZm+oee/6tFj4tswHwYDVR0jBBgwFoAU
|
||||
WNf+XHdl2Z/EhZm+oee/6tFj4tswDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0B
|
||||
AQsFAAOCAQEAGGt+BC8ZiJLpX1Hxhrf5ycXYWOqGI9StMVxDR26f4qNQdAkm1k+s
|
||||
j8pFWdYTxd5TAomOLSKd0L/SSFK1WN5HWYALU8w5wxz5S1lh4COLYJ8arlM27dAr
|
||||
poZ7ODFj/kU9DiRSbRKj0S1gWX0QMxk6koz5IfSNqJUxCElcu1tcLTvvTd1UPL01
|
||||
A5F2z2Yzb6CZe4lLtmI23qhM4DdFPjBn9HA6RgyoRB2fiYd3KMv5eSxeN6wFwlCj
|
||||
1tXafCeqR3cWdS28dyA0uKEE6eCH0dS9eJE373g4XUe9tR5Q6t8Hj4sKW/y2x2e3
|
||||
0No5yG4y7XFYvupjujgy64RrmCXPgmheVA==
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,5 @@
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQg5DkYLeQPJV8WSlOv
|
||||
RorCeu8sce3UJ4faLsEP5N+e8YahRANCAAROEzEWo1RQXPHGPYXHHcCauMuJY5is
|
||||
kxndCQ0FD3unn4F4/kFy8PpFbipVPLV1XybI0Vmrq5QjJb+VG0Dyt/Pk
|
||||
-----END PRIVATE KEY-----
|
||||
@@ -0,0 +1,5 @@
|
||||
-----BEGIN EC PRIVATE KEY-----
|
||||
MHcCAQEEIOQ5GC3kDyVfFkpTr0aKwnrvLHHt1CeH2i7BD+TfnvGGoAoGCCqGSM49
|
||||
AwEHoUQDQgAEThMxFqNUUFzxxj2Fxx3AmrjLiWOYrJMZ3QkNBQ97p5+BeP5BcvD6
|
||||
RW4qVTy1dV8myNFZq6uUIyW/lRtA8rfz5A==
|
||||
-----END EC PRIVATE KEY-----
|
||||
@@ -0,0 +1,4 @@
|
||||
-----BEGIN PUBLIC KEY-----
|
||||
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEThMxFqNUUFzxxj2Fxx3AmrjLiWOY
|
||||
rJMZ3QkNBQ97p5+BeP5BcvD6RW4qVTy1dV8myNFZq6uUIyW/lRtA8rfz5A==
|
||||
-----END PUBLIC KEY-----
|
||||
@@ -0,0 +1,3 @@
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MC4CAQAwBQYDK2VwBCIEIG1a+f3CV8oDhLgpsiLuyV6eXvaULpBqfTiyil3lxq9l
|
||||
-----END PRIVATE KEY-----
|
||||
@@ -0,0 +1,30 @@
|
||||
-----BEGIN ENCRYPTED PRIVATE KEY-----
|
||||
MIIFLTBXBgkqhkiG9w0BBQ0wSjApBgkqhkiG9w0BBQwwHAQIPSkURdWa2RECAggA
|
||||
MAwGCCqGSIb3DQIJBQAwHQYJYIZIAWUDBAEqBBA3pcMudzEuNJ7AsZaSF7qPBIIE
|
||||
0EpPeCIYHNYqBmE0XBTn8gm60u7AHZpMrS/UayoB2EN64yxvpyK18ZN0WTFZoPQK
|
||||
NcfXpsHNtBb9qM6GcKbxcAvX3OWSk1VLmilw1pQw816R9Y6sZ1nqAfRmGC9Nppio
|
||||
k23pLtS+tQcJbDDd2p6Kl4V9lu2ABwqaiK7ERpabppymNJUYoD3TysHDirma7uFz
|
||||
UWjNYHURMGW/IYfyNis4Bp8Iqg9+YiVtYEh55onMXGYdrLM2Spro434q9hO4GEn/
|
||||
Qq/ujtwGCxwkbuD7D0wzS9ZQb4ubOL5sVJWBTSaLRa9TBpoVZNqIlNSaDrpJPehN
|
||||
GoHKAmSSLSnYqQGRlaWWOxZbIpy+msC9vJ/sFd66PRuR6zJ/F8DdV+Si79mDKjVn
|
||||
1IVOnn7dx3HkYtI8Jo1l4NFCXDellOevmK7G4HIa15a6yMd4exkGMV9Yjl+6T8MS
|
||||
owBMN43Zo0rO8Lys+o2Q8f1hqUoc9brroptgJkGxLB5HqVV74LiQVNNw27EtCSLx
|
||||
eo4Xsx08uVsItcPHd3lNpWVHU/hK2X5j88+36gNrGbbiZAw4cSuq2JhsHiz9bhMK
|
||||
WOj+fXTqEEnLMHa7hZE75JmigcHo7S3dymZD7V5k+IVGzzNsQ3O+lRpzjj3xJm7O
|
||||
A4wLG95iwlieZzt0NpNGbrU4DkOj0jpGObleWYWWjXkBRfDuUf79f9nr+uFiZH0M
|
||||
aTjhEU7sS3ljOcc2ch1WhrkP4PyHXpDJgPSjvdyLeVEOfZlCW1q+nxFTGwkkakFz
|
||||
GzzWPoxNeZdjWZ19eAXn/n4nw+xbwAOUM8TO5pHbv2dQNJkfY291E9qU3cE/dvYA
|
||||
DQ8PrEOZuXbbyYGsFvq6rfeZMOV3yDH/PvBzbaRuCx0g/6e/ju03IVWMPi1O+GOy
|
||||
Mr+D9OA4Xf7xQRW9TiXfr64OhBV02pEfD3SK2lypE4+ZFrIYKh6u7lT+0DSt8Va4
|
||||
T4WzUb/2qpjHPuBiNoxQJ/pE20m75s4Iij0vV7J6tsqVQZHLuYjpi1dwF3L70Z41
|
||||
Zm8wQbYK8uI6jh8qB7iolr9hUfw8i6uxEOeIwQcurEM0xR3eRz9d3mBo5hkwhW1c
|
||||
SOFwO89vAUDZp+njlYUgssy/gZnKOKbAvKBfOq1TGfvrMK1PqCl8dAnnJ2c1CEgM
|
||||
v2U/iSMMH5wHAl0DlMLNcCXpnR4q3jg1HWG6V1iaKv985N8pEbKK/Szk944FD06s
|
||||
NvNhHwmQADUZgJB224XP3LqlrmN/52x4+CCeAMJWwMU27e31WuoFs39uS+/kc3of
|
||||
BBkuPd1P4mdKkmbZuhMXinKvvrg+cla3PBPrklINYxfIspO0Cd4KsIfvLWIh32yC
|
||||
NGRK2x6SSDVt/eF+sfBOI8bkiNAVwWzJFPfsrhnJbOVPoFTyWpBfCCGzADHrdWZw
|
||||
sRYgh19Xm92OKtK+Lhgj+OqEvCNc4sdWypaSWhWeUStyB8bmNDY5YkEajWxnjbiM
|
||||
fKBLgHJHnpQYy0/eykVeQYk+LbKcpIIjBXxzhhZ8GL4RfcF33Ej4P9XnX65zLO0O
|
||||
vLaDToYSoiYpofludHBcq9a48WT2f1tasjd4sXiyK6oiiAUOPyQLCdhWPFLpODfW
|
||||
NqfHxMAdnXDJN09pHJFD9qVlloKuQSe2d3i/OwaCSS/J
|
||||
-----END ENCRYPTED PRIVATE KEY-----
|
||||
@@ -0,0 +1,30 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
Proc-Type: 4,ENCRYPTED
|
||||
DEK-Info: AES-256-CBC,74535134409159C4FE67EF01205160E7
|
||||
|
||||
A5ZS2v3peoqsMxlI0Egjp0bW77USJN9abGrqzqxIZFkq2rvXT4VAdMuJurZ7ENAK
|
||||
WJKGKxXlBj9X0tJmP3pnACQ9I5nbJVygflodzs/HRrJKProPdPHl5UZ7tYlRm2Vw
|
||||
nMfHJsr/j59f0Y9/8+TpHPsc8uWEbNrf32Sx9X89bvXQ1gBl8fuOqBwoOYJww70l
|
||||
0xVTjJso68wwLV9NMkzqM+LxRIh/WEX3Qd//M3WOGYyA24xB4aIimgtyIPxweZcj
|
||||
0qKVC3rLQ0P2FBBBlvIM4uh6C6R1KfZVgluSSwB83VDvO1N76chDCxyKvknKlPrA
|
||||
QLcl7oPfoh2gv31j0cTK0sQ+SLuuDmTKvAeWGq36clgCJWSjJ9MSvh4MVMoAcW1M
|
||||
q6hlOHsRuRb3G/ILcZnJ/n7G6+W/gSMMKGnIwBcstPvoQrNATBLtr8IXw5+vT/82
|
||||
oB6y4MjSzF7G0hg+0siuxZvgf5S7r2IrZWetABgSpWU1HTGGCgom7mHf8f6T1bc0
|
||||
Q7Ey8+uXzhltvjuOuNId83bHjAoIGxMCHAEadjDwfBll+nC5FjErxigurteKGTHc
|
||||
84Q8pGD8A8izEP49E8lNsBBBJx5OvcBnq4fW4aX78oLj/xOpU+y769yc7CCnooTc
|
||||
FWORC/7eUpVvMbEYcEfEj0bG+slyJ99kHEFQEe7m5OJTGbkFK91MCRE7bY2R9UCx
|
||||
w1mFrdhEWKUvwINB5czPfNHmz7ACYkVekWekh/7a77ygD6KD9tTaCat9HTzBpHR0
|
||||
0H0Wzp03o8kcs1DGpO2z9CPsFTd0lwYP3+xN8jSNUA3mpV3sov1MZrRGJkqt+TWp
|
||||
e6IPTlNxbJfuxRkbayyHBPjkBTjFwZOfWmkn0ySLT7Ujc7/zaz6+XcFoZsVF/tRr
|
||||
T5c2flSygpwzHCxJ4+WFJ4yoEUXd5CDRXaLgll3Y8pTVy8RfleyKfQcFWWIdFZLg
|
||||
3uzmKbEZIJ7L0IfAzCzRupQBJJRdZCX/Zd4WAcNq//JiyYSiKM06WKjsYtzld9AQ
|
||||
SFGR/zFA0ReoTX3+75HovlRmLPBgwUBJCLK2SCDVYaDNDJOXXS8YII3RZ+K9BNIJ
|
||||
vnEXOPNAfNOWIaLX/F3FILQCrBgBKgV7/wJSH0s8JN2sV6rsSo9/IaBEqMIly/Ui
|
||||
s99jyumLCobV9Pw4PhLaFpQpsAhB2nxjsRxRcomIgvOlIbn0v5FiBuLacTrs3JsI
|
||||
X+TS3gz939kn1w68e9c3F0ido95A2tAxiWuGpYiUbz4y7PToy9mE8rEqjlM8qYu3
|
||||
KlMluvRKH2mnd4KKZci4zoBEw5dyFUK+yj6NPwERWQ9b3KzcUNDsK9MhLMGhzXzw
|
||||
Hc0YqprUN5OWmo4X2GMdtXBzT6wqD+lkh0jZjoET6hPy6XTbZHOb/kDbGQFhtU5q
|
||||
3F1GUYSBG2BHSKbLLZDiGiQFERisLKbKNg8XaHCEi3iggFcWh96WWTLr5mWsHMmB
|
||||
TXwqziMPj0qzoBmvlMDaurtfCh73eRoqJ6iwmWuK1kSSPp2m2XrrTSSs/1wG9aOv
|
||||
PT1SXSrXXCtiN8Phm6emtpS7dDj7kJeJCiHuBBS49rWcGCKRyojUGHsf9cu7B6uC
|
||||
-----END RSA PRIVATE KEY-----
|
||||
@@ -0,0 +1,27 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIIEogIBAAKCAQEAybOBX3YVfWzrzRLOJmJX7gsquk3pMtUzwqgEku/qElWUyy/x
|
||||
CXfhmGTzHrYq0iSaOk6nx5xj6gzSas/VcPgDeRyRE74SQRWWGXT5q3v+FR2anBP6
|
||||
bvPRiEzM6eejn0C1aLXc7m0FgbKLItX9khdftGSb1xEdBCyhmhaCuNiuMXOxcHko
|
||||
2lS47W7YRbTlASup8LYCWgwil40YLQxgfQVqzZ6iSJjtP77rCrLOeLu/+kep67N5
|
||||
92BdI0N0WenhzEgyARoWZSBwg8wbdwhtSYetg2afXnmFDGv1f7bmztm5bdZa1e8D
|
||||
F+5St6mrgcoBGE5aDg5ROo+YfmMVQo5y7/H14QIDAQABAoH/D/RjB2oPyRwUiuQx
|
||||
6lddHTdE6fe/uoWi0oL32aegnFKosmnYZydUcPmLQaKnQHgkuvf9zYxRWvIosso9
|
||||
1/HGVI4t66HdT8ilVt4p4aatMn5k/HOYG66tpFpu2xG3n6E+uEmqcDGvfdLhrp++
|
||||
rw+qQlqy+RAhe3MMVWPycyywmrioGWeFa8enrE4y2jU+SKtVijBKd7tVskgzspJG
|
||||
9lfzMnSBR3NllyX8L6MBz2pOzcENi+a5wWCZhgymOrphdSl1BRhB9nQB+/6rjSBB
|
||||
mzGXbQY3+XQP3wZnHfmH15FIPQXSY+5ua0N2jSX7XRGNcWwQiLXJ1KPRiV2RqO3K
|
||||
JA9BAoGBAOocTmsHYBk4WNcu25wV3oi2/goBTWlPJ3d0FIhf02/q0u0DH2HHXIEs
|
||||
XB8zYqFIAgJjfVIX2hDqtxAB5ndrIfxU3jHhkzIvAOr6xxvLH00VAR/bZIEHWBFt
|
||||
LvtatSYQ2eEvz2jL3UorZABWwyBs18K1/vEfI+dRtoPeWyNjoS5RAoGBANyPceke
|
||||
KWRApdkq/gBUs+8syem6bwxdC0Iqc2w7Rg1Vxf4pluzswEYJC40tC8aYNID3aHG+
|
||||
nkDUsCGb7w+JsllMw3ICd35UwupfOkUTlUjLv1NIBMC09ySldj/xUmmSBTIOYREg
|
||||
hE1CK/beiYTeWgzWKud+TVzFNkuKJ06qqpqRAoGBAKuvwpqfOAyG1DBKvudC6oYc
|
||||
nUU9G0ZFtE3YJU6159vFvJXwmk0c5Wwd2hlPl99rbX3O9JMFxvhtCX+FxTyCptPk
|
||||
cWbnZQmCiwvIiciKOBRReRehz50Ig7+T8MaJCRw3c3G/nD3gdBL2q0nMVyEqcTjs
|
||||
O2EdUzlLJayjnvbfE89hAoGBANCHZsFq3OOGI8ehWCjj7IMzK2up8pgT2DMkg6BO
|
||||
ojq1X86fb6xtYpRUtPEzJ7EJ8ooEYGE6QdE1xZjhHzLnkxHO+/Js1qFAblC83BC3
|
||||
JSuAR1HsA2JXNlsVfSmTdcGOZw8efTN+NNf+uiZb3FUdDLKaQlJAHdCaPG1LH0LH
|
||||
JSmhAoGAKtv416KJHkpIQfPEyOqNxcKzOFtmVhx5azGD2Ddh4Q6vDDLvgfdDtQLQ
|
||||
NEwtVd3A9kIE6WEkkmcRyDOYQHWtTttRNaFE01fmUGEnG8OMtjC/A5fK70Kck1CY
|
||||
3hD2biU3hnKf5EvW5C7CflGeX1vg+8pm0d4x3Ddy4/Zq7U3met4=
|
||||
-----END RSA PRIVATE KEY-----
|
||||
@@ -0,0 +1,28 @@
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDJs4FfdhV9bOvN
|
||||
Es4mYlfuCyq6Teky1TPCqASS7+oSVZTLL/EJd+GYZPMetirSJJo6TqfHnGPqDNJq
|
||||
z9Vw+AN5HJETvhJBFZYZdPmre/4VHZqcE/pu89GITMzp56OfQLVotdzubQWBsosi
|
||||
1f2SF1+0ZJvXER0ELKGaFoK42K4xc7FweSjaVLjtbthFtOUBK6nwtgJaDCKXjRgt
|
||||
DGB9BWrNnqJImO0/vusKss54u7/6R6nrs3n3YF0jQ3RZ6eHMSDIBGhZlIHCDzBt3
|
||||
CG1Jh62DZp9eeYUMa/V/tubO2blt1lrV7wMX7lK3qauBygEYTloODlE6j5h+YxVC
|
||||
jnLv8fXhAgMBAAECgf8P9GMHag/JHBSK5DHqV10dN0Tp97+6haLSgvfZp6CcUqiy
|
||||
adhnJ1Rw+YtBoqdAeCS69/3NjFFa8iiyyj3X8cZUji3rod1PyKVW3inhpq0yfmT8
|
||||
c5gbrq2kWm7bEbefoT64SapwMa990uGun76vD6pCWrL5ECF7cwxVY/JzLLCauKgZ
|
||||
Z4Vrx6esTjLaNT5Iq1WKMEp3u1WySDOykkb2V/MydIFHc2WXJfwvowHPak7NwQ2L
|
||||
5rnBYJmGDKY6umF1KXUFGEH2dAH7/quNIEGbMZdtBjf5dA/fBmcd+YfXkUg9BdJj
|
||||
7m5rQ3aNJftdEY1xbBCItcnUo9GJXZGo7cokD0ECgYEA6hxOawdgGThY1y7bnBXe
|
||||
iLb+CgFNaU8nd3QUiF/Tb+rS7QMfYcdcgSxcHzNioUgCAmN9UhfaEOq3EAHmd2sh
|
||||
/FTeMeGTMi8A6vrHG8sfTRUBH9tkgQdYEW0u+1q1JhDZ4S/PaMvdSitkAFbDIGzX
|
||||
wrX+8R8j51G2g95bI2OhLlECgYEA3I9x6R4pZECl2Sr+AFSz7yzJ6bpvDF0LQipz
|
||||
bDtGDVXF/imW7OzARgkLjS0Lxpg0gPdocb6eQNSwIZvvD4myWUzDcgJ3flTC6l86
|
||||
RROVSMu/U0gEwLT3JKV2P/FSaZIFMg5hESCETUIr9t6JhN5aDNYq535NXMU2S4on
|
||||
TqqqmpECgYEAq6/Cmp84DIbUMEq+50LqhhydRT0bRkW0TdglTrXn28W8lfCaTRzl
|
||||
bB3aGU+X32ttfc70kwXG+G0Jf4XFPIKm0+RxZudlCYKLC8iJyIo4FFF5F6HPnQiD
|
||||
v5PwxokJHDdzcb+cPeB0EvarScxXISpxOOw7YR1TOUslrKOe9t8Tz2ECgYEA0Idm
|
||||
wWrc44Yjx6FYKOPsgzMra6nymBPYMySDoE6iOrVfzp9vrG1ilFS08TMnsQnyigRg
|
||||
YTpB0TXFmOEfMueTEc778mzWoUBuULzcELclK4BHUewDYlc2WxV9KZN1wY5nDx59
|
||||
M3401/66JlvcVR0MsppCUkAd0Jo8bUsfQsclKaECgYAq2/jXookeSkhB88TI6o3F
|
||||
wrM4W2ZWHHlrMYPYN2HhDq8MMu+B90O1AtA0TC1V3cD2QgTpYSSSZxHIM5hAda1O
|
||||
21E1oUTTV+ZQYScbw4y2ML8Dl8rvQpyTUJjeEPZuJTeGcp/kS9bkLsJ+UZ5fW+D7
|
||||
ymbR3jHcN3Lj9mrtTeZ63g==
|
||||
-----END PRIVATE KEY-----
|
||||
@@ -0,0 +1,9 @@
|
||||
-----BEGIN PUBLIC KEY-----
|
||||
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAybOBX3YVfWzrzRLOJmJX
|
||||
7gsquk3pMtUzwqgEku/qElWUyy/xCXfhmGTzHrYq0iSaOk6nx5xj6gzSas/VcPgD
|
||||
eRyRE74SQRWWGXT5q3v+FR2anBP6bvPRiEzM6eejn0C1aLXc7m0FgbKLItX9khdf
|
||||
tGSb1xEdBCyhmhaCuNiuMXOxcHko2lS47W7YRbTlASup8LYCWgwil40YLQxgfQVq
|
||||
zZ6iSJjtP77rCrLOeLu/+kep67N592BdI0N0WenhzEgyARoWZSBwg8wbdwhtSYet
|
||||
g2afXnmFDGv1f7bmztm5bdZa1e8DF+5St6mrgcoBGE5aDg5ROo+YfmMVQo5y7/H1
|
||||
4QIDAQAB
|
||||
-----END PUBLIC KEY-----
|
||||
@@ -0,0 +1,34 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICTzCCATegAwIBAgIUZmRuo+eancCdHWVyPKWCj5VH0cMwDQYJKoZIhvcNAQEL
|
||||
BQAwGjEYMBYGA1UEAwwPcGVtLWFwaSBkZW1vIENBMB4XDTI2MTAyNjAxNDA1M1oX
|
||||
DTM2MTAyMzAxNDA1M1owFDESMBAGA1UEAwwJbG9jYWxob3N0MFkwEwYHKoZIzj0C
|
||||
AQYIKoZIzj0DAQcDQgAEspmXXLwV6zHbch9SrHNAr5pZtpQWmPVG5H5PNCQoSAXo
|
||||
SGxW5mQUHCUKCs2fmVZ47KHASMBDGrhb3Q591R1kFKNeMFwwGgYDVR0RBBMwEYIJ
|
||||
bG9jYWxob3N0hwR/AAABMB0GA1UdDgQWBBT0AmAjlRBDLvRfihaFy6CfvjLj/zAf
|
||||
BgNVHSMEGDAWgBRY1/5cd2XZn8SFmb6h57/q0WPi2zANBgkqhkiG9w0BAQsFAAOC
|
||||
AQEAswC6WWfiDP7WgyWD8IkWah2mlxauTtqyUX3pH+dydZURkjoDEtLCgpaX399g
|
||||
dbNHa3HYpFJH/c5NMwEG/Zko7OhtLaE/v3yH77vzHnJbQp4MI3HRP3Moa1dpSe+g
|
||||
eKkSSMC7suwby+ykB4+V/5gDkeyMWYj25za1jnCoYCFDervPGZ/TQ7kycAWyxiU5
|
||||
+CmKCwpPkiMX56yC1CN5kdjIUmEXlEZ21baeJBOLL4zwmtYoc/QqMPjtxUlPFCh9
|
||||
K83Jn0pk5BnitIi2OLTG8NiUT5PV/Jk5PKDr/HpskDNiTskx9CZXNawmcey+CeeT
|
||||
YennaowCuIPG4GOo/16vB/UM/w==
|
||||
-----END CERTIFICATE-----
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIIDFTCCAf2gAwIBAgIUCSAcRT4u1yYgnV75DA+j83tCQVEwDQYJKoZIhvcNAQEL
|
||||
BQAwGjEYMBYGA1UEAwwPcGVtLWFwaSBkZW1vIENBMB4XDTI2MTAyNjAxNDA1M1oX
|
||||
DTM2MTAyMzAxNDA1M1owGjEYMBYGA1UEAwwPcGVtLWFwaSBkZW1vIENBMIIBIjAN
|
||||
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu4m1GA1zj99imolAmktmnHBMz9LK
|
||||
wpT73gXpxAymH0nMe991uduv2l79KS2ItpwlwovXy6L4vk8oPauN3iN0aIm6MUUS
|
||||
j32fJmk+NY7CIkZwBt6ys69yhRCbf5a7ydHQdlNSO+QAqfD+DveTZI8UkOqxLBXP
|
||||
MWZlOSTN5tGsLBt2pVvMWXf2Dlt4PqHOHjU4NNiZeHwpOj9Z7JQAT0dOI57aYy1+
|
||||
b3vFUaG2TsKTsxwaxcwU4X6WV/yF3lVXVM1g9nRctdRq4BIOsTdViONfvSopMqhz
|
||||
vvowsX/w94dXvzCRfpJ5Z0lyi2+9xUID9pdF9G1v0K1aHeNOrSB20Z2QswIDAQAB
|
||||
o1MwUTAdBgNVHQ4EFgQUWNf+XHdl2Z/EhZm+oee/6tFj4tswHwYDVR0jBBgwFoAU
|
||||
WNf+XHdl2Z/EhZm+oee/6tFj4tswDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0B
|
||||
AQsFAAOCAQEAGGt+BC8ZiJLpX1Hxhrf5ycXYWOqGI9StMVxDR26f4qNQdAkm1k+s
|
||||
j8pFWdYTxd5TAomOLSKd0L/SSFK1WN5HWYALU8w5wxz5S1lh4COLYJ8arlM27dAr
|
||||
poZ7ODFj/kU9DiRSbRKj0S1gWX0QMxk6koz5IfSNqJUxCElcu1tcLTvvTd1UPL01
|
||||
A5F2z2Yzb6CZe4lLtmI23qhM4DdFPjBn9HA6RgyoRB2fiYd3KMv5eSxeN6wFwlCj
|
||||
1tXafCeqR3cWdS28dyA0uKEE6eCH0dS9eJE373g4XUe9tR5Q6t8Hj4sKW/y2x2e3
|
||||
0No5yG4y7XFYvupjujgy64RrmCXPgmheVA==
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,5 @@
|
||||
-----BEGIN PRIVATE KEY-----
|
||||
MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgmOPW4XsEHwKxsZYV
|
||||
McWveS7DqdDiLNg8OKuX1HxadoihRANCAASymZdcvBXrMdtyH1Ksc0Cvmlm2lBaY
|
||||
9Ubkfk80JChIBehIbFbmZBQcJQoKzZ+ZVnjsocBIwEMauFvdDn3VHWQU
|
||||
-----END PRIVATE KEY-----
|
||||
@@ -0,0 +1,15 @@
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICTzCCATegAwIBAgIUZmRuo+eancCdHWVyPKWCj5VH0cMwDQYJKoZIhvcNAQEL
|
||||
BQAwGjEYMBYGA1UEAwwPcGVtLWFwaSBkZW1vIENBMB4XDTI2MTAyNjAxNDA1M1oX
|
||||
DTM2MTAyMzAxNDA1M1owFDESMBAGA1UEAwwJbG9jYWxob3N0MFkwEwYHKoZIzj0C
|
||||
AQYIKoZIzj0DAQcDQgAEspmXXLwV6zHbch9SrHNAr5pZtpQWmPVG5H5PNCQoSAXo
|
||||
SGxW5mQUHCUKCs2fmVZ47KHASMBDGrhb3Q591R1kFKNeMFwwGgYDVR0RBBMwEYIJ
|
||||
bG9jYWxob3N0hwR/AAABMB0GA1UdDgQWBBT0AmAjlRBDLvRfihaFy6CfvjLj/zAf
|
||||
BgNVHSMEGDAWgBRY1/5cd2XZn8SFmb6h57/q0WPi2zANBgkqhkiG9w0BAQsFAAOC
|
||||
AQEAswC6WWfiDP7WgyWD8IkWah2mlxauTtqyUX3pH+dydZURkjoDEtLCgpaX399g
|
||||
dbNHa3HYpFJH/c5NMwEG/Zko7OhtLaE/v3yH77vzHnJbQp4MI3HRP3Moa1dpSe+g
|
||||
eKkSSMC7suwby+ykB4+V/5gDkeyMWYj25za1jnCoYCFDervPGZ/TQ7kycAWyxiU5
|
||||
+CmKCwpPkiMX56yC1CN5kdjIUmEXlEZ21baeJBOLL4zwmtYoc/QqMPjtxUlPFCh9
|
||||
K83Jn0pk5BnitIi2OLTG8NiUT5PV/Jk5PKDr/HpskDNiTskx9CZXNawmcey+CeeT
|
||||
YennaowCuIPG4GOo/16vB/UM/w==
|
||||
-----END CERTIFICATE-----
|
||||
@@ -0,0 +1,24 @@
|
||||
$ java --enable-preview -cp ... RoundTrip (27.0.1.0.2+1)
|
||||
== decode a public key, a private key and a certificate
|
||||
RSA X.509 2048 bits
|
||||
RSA PKCS#8
|
||||
CN=localhost issued by CN=pem-api demo CA
|
||||
== encode them again: the same text openssl wrote, apart from the line terminator
|
||||
PEMEncoder line terminator is CRLF: true; the openssl file uses LF: true
|
||||
ok: raw text differs from the file (CRLF vs LF)
|
||||
ok: public key re-encodes to identical text once CRLF is normalised to LF
|
||||
ok: private key re-encodes to identical text (LF-normalised)
|
||||
ok: certificate re-encodes to identical text (LF-normalised)
|
||||
== encode a key pair that was generated just now
|
||||
[-----BEGIN PRIVATE KEY-----, -----END PRIVATE KEY-----]
|
||||
line width of the Base64 body: 64
|
||||
ok: private scalar survives the round trip
|
||||
ok: public key survives the round trip
|
||||
ok: ...but the private key's own encoding is not byte-for-byte the same (the PKCS#8 now carries the public key)
|
||||
== what does decode(String) with no target class hand back?
|
||||
rsa-public.pem -> PublicKey RSA
|
||||
rsa-private-pkcs8.pem -> PrivateKey RSA
|
||||
ed25519-private.pem -> PrivateKey EdDSA
|
||||
server.pem -> X509Certificate CN=localhost
|
||||
rsa-private-encrypted.pem -> EncryptedPrivateKeyInfo PBEWithHmacSHA256AndAES_256
|
||||
exit=0
|
||||
@@ -0,0 +1,13 @@
|
||||
$ java --enable-preview -cp ... JwtSigning (27.0.1.0.2+1)
|
||||
== RS256 with an RSA key from PEM
|
||||
header.payload = eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJhbmt1ciIsImlzcyI6Imh0dHBzOi8vYW5rdXJtLmNvbSJ9
|
||||
signature bytes = 256, jwt parts = 3
|
||||
ok: RS256 signature verifies with the public PEM
|
||||
== ES256 with an EC key from PEM (the trap is the signature format)
|
||||
SHA256withECDSA -> DER, starts 0x30, length varies run to run, 70-72: true (JWT readers reject this)
|
||||
SHA256withECDSAinP1363Format -> R||S, length 64 (what RFC 7518 requires for ES256)
|
||||
ok: ES256 signature is exactly 64 bytes
|
||||
ok: ES256 signature verifies with the public PEM
|
||||
== EdDSA with an Ed25519 key from PEM
|
||||
EdDSA signature bytes = 64 (the PKCS#8 file holds no public key, so there is nothing to decode for verifying here)
|
||||
exit=0
|
||||
@@ -0,0 +1,13 @@
|
||||
$ java --enable-preview -cp ... TlsFromPem (27.0.1.0.2+1)
|
||||
== read a two-certificate chain file
|
||||
CN=localhost
|
||||
CN=pem-api demo CA
|
||||
ok: the stream decoder returns the two certificates one by one
|
||||
== server side: key + chain -> KeyStore -> KeyManagerFactory -> SSLContext
|
||||
== client trusting only the CA certificate from ca.pem
|
||||
HTTP 200 hello over TLS (TLSv1.3)
|
||||
server presented: CN=localhost
|
||||
ok: request over TLS succeeds
|
||||
== same request with the JVM's default trust store (the CA is not in it)
|
||||
javax.net.ssl.SSLHandshakeException: (certificate_unknown) PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
|
||||
exit=0
|
||||
@@ -0,0 +1,20 @@
|
||||
$ java --enable-preview -cp ... EncryptedKeys (27.0.1.0.2+1)
|
||||
== write an encrypted key with the defaults
|
||||
[-----BEGIN ENCRYPTED PRIVATE KEY-----, -----END ENCRYPTED PRIVATE KEY-----]
|
||||
default algorithm: PBEWithHmacSHA256AndAES_128
|
||||
default iteration count: 4096, salt bytes: 20
|
||||
== read it back
|
||||
ok: withDecryption(password) returns the original key
|
||||
== choose the algorithm and cost yourself
|
||||
PBEWithHmacSHA512AndAES_256, iterations 600000
|
||||
ok: getKey(password) on the decoded EncryptedPrivateKeyInfo works too
|
||||
== a file written by openssl pkcs8 -topk8 -v2 aes-256-cbc
|
||||
PBEWithHmacSHA256AndAES_256
|
||||
ok: decrypts to the same key as the unencrypted file
|
||||
== failures
|
||||
no password, ask for PrivateKey !! java.lang.ClassCastException: Cannot cast javax.crypto.EncryptedPrivateKeyInfo to java.security.PrivateKey
|
||||
no password, no class -> EncryptedPrivateKeyInfo PBEWithHmacSHA256AndAES_256
|
||||
wrong password !! javax.crypto.CryptoException: java.security.InvalidKeyException: Cannot retrieve the PKCS8EncodedKeySpec
|
||||
password on a key that is not encrypted -> PrivateKey RSA
|
||||
openssl 'traditional' encrypted (Proc-Type: 4,ENCRYPTED) !! java.lang.IllegalArgumentException: java.security.InvalidKeyException: Invalid PKCS#1 encoding
|
||||
exit=0
|
||||
@@ -0,0 +1,25 @@
|
||||
$ java --enable-preview -cp ... Failures (27.0.1.0.2+1)
|
||||
== the file holds a different kind of object than the class you asked for
|
||||
certificate as PublicKey !! java.lang.ClassCastException: Cannot cast sun.security.x509.X509CertImpl to java.security.PublicKey
|
||||
private key as PublicKey !! java.lang.ClassCastException: Cannot cast sun.security.rsa.RSAPrivateCrtKeyImpl to java.security.PublicKey
|
||||
RSA private key as KeyPair !! java.lang.ClassCastException: Cannot cast sun.security.rsa.RSAPrivateCrtKeyImpl to java.security.KeyPair
|
||||
== untyped decode: the result type depends on what the file contains
|
||||
RSA PKCS#8 -> PrivateKey RSA
|
||||
EC PKCS#8 (openssl embeds the public key) -> KeyPair
|
||||
EC PKCS#8, asked for PrivateKey -> PrivateKey EC
|
||||
EC PKCS#8, asked for KeyPair -> KeyPair
|
||||
== the old OpenSSL formats
|
||||
RSA PRIVATE KEY (PKCS#1) -> PrivateKey RSA
|
||||
EC PRIVATE KEY (SEC1), untyped -> PEM(type=EC PRIVATE KEY) - NOT decoded
|
||||
EC PRIVATE KEY (SEC1), asked for PrivateKey !! java.lang.ClassCastException: Cannot cast java.security.PEM to java.security.PrivateKey
|
||||
as a PEM object: type=EC PRIVATE KEY, decoded bytes=121
|
||||
== malformed text
|
||||
empty string !! java.lang.IllegalArgumentException: java.io.EOFException: No data available
|
||||
no PEM in the text !! java.lang.IllegalArgumentException: java.io.EOFException: No PEM data found
|
||||
footer missing !! java.lang.IllegalArgumentException: java.io.EOFException: Incomplete header
|
||||
body is not Base64 of a key !! java.lang.IllegalArgumentException: java.io.IOException: No recognized algorithm detected in encoding
|
||||
Windows line endings (CRLF) -> PublicKey RSA
|
||||
comment lines before the header -> PublicKey RSA
|
||||
== several objects in one string: only the first is returned
|
||||
decode(String) on a 2-certificate bundle -> CN=localhost
|
||||
exit=0
|
||||
@@ -0,0 +1,25 @@
|
||||
$ java --enable-preview -cp ... Migration (27.0.1.0.2+1)
|
||||
== 1. load an RSA private key (PKCS#8)
|
||||
ok: BouncyCastle and the JDK produce equal keys
|
||||
BC parser returned: PrivateKeyInfo
|
||||
== 2. load a certificate
|
||||
ok: same certificate either way
|
||||
== 3. write keys
|
||||
ok: JcaPEMWriter and PEMEncoder write identical public-key text (line terminators aside)
|
||||
JcaPEMWriter on an RSA private key writes: -----BEGIN RSA PRIVATE KEY-----
|
||||
PEMEncoder on an RSA private key writes: -----BEGIN PRIVATE KEY-----
|
||||
== 4. encrypted PKCS#8 key (BC needs its own provider for AES/CBC/PKCS7Padding; the JDK does not)
|
||||
ok: same key either way
|
||||
== 5. what BouncyCastle reads and the JDK does not
|
||||
EC PRIVATE KEY (SEC1): BC -> PEMKeyPair, JDK -> PEM(type=EC PRIVATE KEY) - NOT decoded
|
||||
ok: after 'openssl pkcs8 -topk8 -nocrypt' the JDK reads the same secret scalar BC read from SEC1
|
||||
Proc-Type: 4,ENCRYPTED: BC -> PEMEncryptedKeyPair decrypted to RSA
|
||||
ok: ...and it is the same RSA key
|
||||
Proc-Type: 4,ENCRYPTED: JDK !! java.lang.IllegalArgumentException: java.security.InvalidKeyException: Invalid PKCS#1 encoding
|
||||
== 6. Spring Security RsaKeyConverters (RSA only; PKCS#8 and X.509 only)
|
||||
ok: pkcs8() reads the RSA private key
|
||||
ok: x509() reads the RSA public key
|
||||
pkcs8() on an EC key !! java.lang.IllegalArgumentException: java.security.spec.InvalidKeySpecException: java.security.InvalidKeyException: Invalid RSA private key
|
||||
pkcs8() on the PKCS#1 key !! java.lang.IllegalArgumentException: Key is not in PEM-encoded PKCS#8 format, please check that the header begins with -----BEGIN PRIVATE KEY-----
|
||||
JDK on the EC key -> PrivateKey EC
|
||||
exit=0
|
||||
@@ -0,0 +1,42 @@
|
||||
$ javac RoundTrip.java Fx.java (no flags) (27.0.1.0.2+1)
|
||||
src/Fx.java:27: error: PEM is a preview API and is disabled by default.
|
||||
if (o instanceof java.security.PEM p) return "PEM(type=" + p.type() + ") - NOT decoded";
|
||||
^
|
||||
(use --enable-preview to enable preview APIs)
|
||||
src/RoundTrip.java:10: error: PEMDecoder is a preview API and is disabled by default.
|
||||
PEMDecoder decoder = PEMDecoder.of();
|
||||
^
|
||||
(use --enable-preview to enable preview APIs)
|
||||
src/RoundTrip.java:10: error: PEMDecoder is a preview API and is disabled by default.
|
||||
PEMDecoder decoder = PEMDecoder.of();
|
||||
^
|
||||
(use --enable-preview to enable preview APIs)
|
||||
src/RoundTrip.java:11: error: PEMEncoder is a preview API and is disabled by default.
|
||||
PEMEncoder encoder = PEMEncoder.of();
|
||||
^
|
||||
(use --enable-preview to enable preview APIs)
|
||||
src/RoundTrip.java:11: error: PEMEncoder is a preview API and is disabled by default.
|
||||
PEMEncoder encoder = PEMEncoder.of();
|
||||
^
|
||||
(use --enable-preview to enable preview APIs)
|
||||
5 errors
|
||||
exit=1
|
||||
|
||||
$ java RoundTrip (compiled with --enable-preview, run without it) (27.0.1.0.2+1)
|
||||
Error: LinkageError occurred while loading main class RoundTrip
|
||||
java.lang.UnsupportedClassVersionError: Preview features are not enabled for RoundTrip (class file version 71.65535). Try running with '--enable-preview'
|
||||
|
||||
$ javac --enable-preview --release 27 RoundTrip.java Fx.java
|
||||
src/Fx.java:27: warning: [preview] PEM is a preview API and may be removed in a future release.
|
||||
if (o instanceof java.security.PEM p) return "PEM(type=" + p.type() + ") - NOT decoded";
|
||||
^
|
||||
src/RoundTrip.java:10: warning: [preview] PEMDecoder is a preview API and may be removed in a future release.
|
||||
PEMDecoder decoder = PEMDecoder.of();
|
||||
^
|
||||
src/RoundTrip.java:10: warning: [preview] PEMDecoder is a preview API and may be removed in a future release.
|
||||
PEMDecoder decoder = PEMDecoder.of();
|
||||
^
|
||||
src/RoundTrip.java:11: warning: [preview] PEMEncoder is a preview API and may be removed in a future release.
|
||||
PEMEncoder encoder = PEMEncoder.of();
|
||||
^
|
||||
exit=0
|
||||
@@ -0,0 +1,22 @@
|
||||
$ javac src/{Fx,RoundTrip,JwtSigning,TlsFromPem,EncryptedKeys,Failures}.java (no flags) (28-ea+21-1707)
|
||||
exit=0
|
||||
|
||||
$ java RoundTrip (no flags)
|
||||
exit=0
|
||||
output identical to the JDK 27 run
|
||||
|
||||
$ java JwtSigning (no flags)
|
||||
exit=0
|
||||
output identical to the JDK 27 run
|
||||
|
||||
$ java TlsFromPem (no flags)
|
||||
exit=0
|
||||
output identical to the JDK 27 run
|
||||
|
||||
$ java EncryptedKeys (no flags)
|
||||
exit=0
|
||||
output identical to the JDK 27 run
|
||||
|
||||
$ java Failures (no flags)
|
||||
exit=0
|
||||
output identical to the JDK 27 run
|
||||
@@ -0,0 +1,22 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!-- Used ONLY to fetch the two comparison libraries into target/lib (run.sh calls dependency:copy-dependencies).
|
||||
The JDK-only demos in src/ need none of this. -->
|
||||
<project xmlns="http://maven.apache.org/POM/4.0.0">
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
<groupId>com.ankurm</groupId>
|
||||
<artifactId>pem-api</artifactId>
|
||||
<version>1.0.0</version>
|
||||
<packaging>pom</packaging>
|
||||
<dependencies>
|
||||
<dependency>
|
||||
<groupId>org.bouncycastle</groupId>
|
||||
<artifactId>bcpkix-jdk18on</artifactId>
|
||||
<version>1.86</version>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.springframework.security</groupId>
|
||||
<artifactId>spring-security-core</artifactId>
|
||||
<version>7.1.2</version>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
</project>
|
||||
Executable
+53
@@ -0,0 +1,53 @@
|
||||
#!/usr/bin/env bash
|
||||
# PEM encodings in Java: JEP 538 (third preview, JDK 27) -> JEP 542 (final, JDK 28).
|
||||
# Regenerates every file in output/. JDK27=/path/to/jdk27 JDK28=/path/to/jdk28-ea ./run.sh
|
||||
set -uo pipefail
|
||||
unset JAVA_TOOL_OPTIONS
|
||||
HERE="$(cd "$(dirname "$0")" && pwd)"
|
||||
JDK27="${JDK27:?set JDK27}"; JDK28="${JDK28:-}"
|
||||
OUT="$HERE/output"; mkdir -p "$OUT"; B="$(mktemp -d)"; trap 'rm -rf "$B"' EXIT
|
||||
cd "$HERE"
|
||||
jv() { "$1/bin/java" -version 2>&1 | sed -n 2p | sed 's/.*(build \(.*\))/\1/'; }
|
||||
|
||||
# comparison libraries (BouncyCastle bcpkix, spring-security-core) -> target/lib
|
||||
[ -d target/lib ] || mvn -q -B dependency:copy-dependencies -DoutputDirectory=target/lib -DincludeScope=compile >/dev/null
|
||||
CP_LIBS="$(ls target/lib/*.jar | tr '\n' ':')"
|
||||
|
||||
P27="--enable-preview --release 27"
|
||||
mkdir -p "$B/c27"; "$JDK27/bin/javac" $P27 -cp "$CP_LIBS" -d "$B/c27" src/*.java 2>&1 | grep -v '^Note:'
|
||||
run27() { echo "\$ java --enable-preview -cp ... $1 ($(jv "$JDK27"))"; "$JDK27/bin/java" --enable-preview -Dfixtures=fixtures -cp "$B/c27:$CP_LIBS" "$1" 2>&1; echo "exit=$?"; }
|
||||
|
||||
{ run27 RoundTrip; } > "$OUT/01-round-trip.txt"
|
||||
{ run27 JwtSigning; } > "$OUT/02-jwt-signing.txt"
|
||||
{ run27 TlsFromPem; } > "$OUT/03-tls.txt"
|
||||
{ run27 EncryptedKeys; } > "$OUT/04-encrypted.txt"
|
||||
{ run27 Failures; } > "$OUT/05-failures.txt"
|
||||
{ run27 Migration; } > "$OUT/06-migration.txt"
|
||||
|
||||
# 07 - the preview flag: what you see without it
|
||||
{
|
||||
echo "\$ javac RoundTrip.java Fx.java (no flags) ($(jv "$JDK27"))"
|
||||
mkdir -p "$B/n"; "$JDK27/bin/javac" -d "$B/n" src/Fx.java src/RoundTrip.java 2>&1; echo "exit=${PIPESTATUS[0]}"
|
||||
echo
|
||||
echo "\$ java RoundTrip (compiled with --enable-preview, run without it) ($(jv "$JDK27"))"
|
||||
"$JDK27/bin/java" -cp "$B/c27" RoundTrip 2>&1 | head -3
|
||||
echo
|
||||
echo "\$ javac --enable-preview --release 27 RoundTrip.java Fx.java"
|
||||
mkdir -p "$B/p"; "$JDK27/bin/javac" --enable-preview --release 27 -Xlint:preview -d "$B/p" src/Fx.java src/RoundTrip.java 2>&1 | head -12; echo "exit=${PIPESTATUS[0]}"
|
||||
} > "$OUT/07-preview-flag.txt"
|
||||
|
||||
# 08 - the same demos on the JDK 28 early-access build, with NO preview flag (JEP 542 finalizes the API)
|
||||
if [ -n "$JDK28" ]; then
|
||||
mkdir -p "$B/c28"
|
||||
{
|
||||
echo "\$ javac src/{Fx,RoundTrip,JwtSigning,TlsFromPem,EncryptedKeys,Failures}.java (no flags) ($(jv "$JDK28"))"
|
||||
"$JDK28/bin/javac" -d "$B/c28" src/Fx.java src/RoundTrip.java src/JwtSigning.java src/TlsFromPem.java src/EncryptedKeys.java src/Failures.java 2>&1; echo "exit=${PIPESTATUS[0]}"
|
||||
for c in RoundTrip JwtSigning TlsFromPem EncryptedKeys Failures; do
|
||||
echo; echo "\$ java $c (no flags)"
|
||||
"$JDK28/bin/java" -Dfixtures=fixtures -cp "$B/c28" $c > "$B/28-$c.txt" 2>&1; echo "exit=$?"
|
||||
"$JDK27/bin/java" --enable-preview -Dfixtures=fixtures -cp "$B/c27" $c > "$B/27-$c.txt" 2>&1
|
||||
if diff -q "$B/27-$c.txt" "$B/28-$c.txt" >/dev/null; then echo "output identical to the JDK 27 run"; else echo "output DIFFERS from the JDK 27 run:"; diff "$B/27-$c.txt" "$B/28-$c.txt" | head -20; fi
|
||||
done
|
||||
} > "$OUT/08-jdk28-final.txt"
|
||||
fi
|
||||
echo done
|
||||
@@ -0,0 +1,46 @@
|
||||
import java.security.*;
|
||||
import javax.crypto.EncryptedPrivateKeyInfo;
|
||||
import javax.crypto.spec.PBEParameterSpec;
|
||||
|
||||
/** Encrypted private keys: write one, read one, read one openssl wrote, and every way it can go wrong. */
|
||||
public class EncryptedKeys {
|
||||
static final char[] PW = "changeit".toCharArray();
|
||||
|
||||
public static void main(String[] args) throws Exception {
|
||||
PEMDecoder d = PEMDecoder.of();
|
||||
PEMEncoder e = PEMEncoder.of();
|
||||
PrivateKey key = d.decode(Fx.read("rsa-private-pkcs8.pem"), PrivateKey.class);
|
||||
|
||||
Fx.h("write an encrypted key with the defaults");
|
||||
String enc = e.withEncryption(PW).encodeToString(key);
|
||||
System.out.println(enc.lines().filter(l -> l.startsWith("-----")).toList());
|
||||
EncryptedPrivateKeyInfo info = (EncryptedPrivateKeyInfo) d.decode(enc);
|
||||
System.out.println("default algorithm: " + info.getAlgName());
|
||||
PBEParameterSpec spec = info.getAlgParameters().getParameterSpec(PBEParameterSpec.class);
|
||||
System.out.println("default iteration count: " + spec.getIterationCount() + ", salt bytes: " + spec.getSalt().length);
|
||||
|
||||
Fx.h("read it back");
|
||||
Fx.check(d.withDecryption(PW).decode(enc, PrivateKey.class).equals(key), "withDecryption(password) returns the original key");
|
||||
|
||||
Fx.h("choose the algorithm and cost yourself");
|
||||
PBEParameterSpec custom = new PBEParameterSpec(new SecureRandom().generateSeed(16), 600_000);
|
||||
EncryptedPrivateKeyInfo strong = EncryptedPrivateKeyInfo.encrypt(key, PW, "PBEWithHmacSHA512AndAES_256", custom, null);
|
||||
String strongPem = e.encodeToString(strong);
|
||||
EncryptedPrivateKeyInfo again = (EncryptedPrivateKeyInfo) d.decode(strongPem);
|
||||
System.out.println(again.getAlgName() + ", iterations " + again.getAlgParameters().getParameterSpec(PBEParameterSpec.class).getIterationCount());
|
||||
Fx.check(again.getKey(PW).equals(key), "getKey(password) on the decoded EncryptedPrivateKeyInfo works too");
|
||||
|
||||
Fx.h("a file written by openssl pkcs8 -topk8 -v2 aes-256-cbc");
|
||||
EncryptedPrivateKeyInfo fromOpenssl = (EncryptedPrivateKeyInfo) d.decode(Fx.read("rsa-private-encrypted.pem"));
|
||||
System.out.println(fromOpenssl.getAlgName());
|
||||
Fx.check(d.withDecryption(PW).decode(Fx.read("rsa-private-encrypted.pem"), PrivateKey.class).equals(key), "decrypts to the same key as the unencrypted file");
|
||||
|
||||
Fx.h("failures");
|
||||
String f = Fx.read("rsa-private-encrypted.pem");
|
||||
Fx.tryIt("no password, ask for PrivateKey", () -> d.decode(f, PrivateKey.class));
|
||||
Fx.tryIt("no password, no class", () -> d.decode(f));
|
||||
Fx.tryIt("wrong password", () -> d.withDecryption("nope".toCharArray()).decode(f, PrivateKey.class));
|
||||
Fx.tryIt("password on a key that is not encrypted", () -> d.withDecryption(PW).decode(Fx.read("rsa-private-pkcs8.pem"), PrivateKey.class));
|
||||
Fx.tryIt("openssl 'traditional' encrypted (Proc-Type: 4,ENCRYPTED)", () -> d.withDecryption(PW).decode(Fx.read("rsa-private-legacy-encrypted.pem"), PrivateKey.class));
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,41 @@
|
||||
import java.security.*;
|
||||
import java.security.cert.X509Certificate;
|
||||
|
||||
/** Everything that goes wrong when you feed the decoder something it does not expect. */
|
||||
public class Failures {
|
||||
public static void main(String[] args) throws Exception {
|
||||
PEMDecoder d = PEMDecoder.of();
|
||||
|
||||
Fx.h("the file holds a different kind of object than the class you asked for");
|
||||
Fx.tryIt("certificate as PublicKey", () -> d.decode(Fx.read("server.pem"), PublicKey.class));
|
||||
Fx.tryIt("private key as PublicKey", () -> d.decode(Fx.read("rsa-private-pkcs8.pem"), PublicKey.class));
|
||||
Fx.tryIt("RSA private key as KeyPair", () -> d.decode(Fx.read("rsa-private-pkcs8.pem"), KeyPair.class));
|
||||
|
||||
Fx.h("untyped decode: the result type depends on what the file contains");
|
||||
Fx.tryIt("RSA PKCS#8", () -> d.decode(Fx.read("rsa-private-pkcs8.pem")));
|
||||
Fx.tryIt("EC PKCS#8 (openssl embeds the public key)", () -> d.decode(Fx.read("ec-private-pkcs8.pem")));
|
||||
Fx.tryIt("EC PKCS#8, asked for PrivateKey", () -> d.decode(Fx.read("ec-private-pkcs8.pem"), PrivateKey.class));
|
||||
Fx.tryIt("EC PKCS#8, asked for KeyPair", () -> d.decode(Fx.read("ec-private-pkcs8.pem"), KeyPair.class));
|
||||
|
||||
Fx.h("the old OpenSSL formats");
|
||||
Fx.tryIt("RSA PRIVATE KEY (PKCS#1)", () -> d.decode(Fx.read("rsa-private-pkcs1.pem"), PrivateKey.class));
|
||||
Fx.tryIt("EC PRIVATE KEY (SEC1), untyped", () -> d.decode(Fx.read("ec-private-sec1.pem")));
|
||||
Fx.tryIt("EC PRIVATE KEY (SEC1), asked for PrivateKey", () -> d.decode(Fx.read("ec-private-sec1.pem"), PrivateKey.class));
|
||||
PEM raw = d.decode(Fx.read("ec-private-sec1.pem"), PEM.class);
|
||||
System.out.println("as a PEM object: type=" + raw.type() + ", decoded bytes=" + raw.decode().length);
|
||||
|
||||
Fx.h("malformed text");
|
||||
String pub = Fx.read("rsa-public.pem");
|
||||
Fx.tryIt("empty string", () -> d.decode(""));
|
||||
Fx.tryIt("no PEM in the text", () -> d.decode("hello"));
|
||||
Fx.tryIt("footer missing", () -> d.decode(pub.replace("-----END PUBLIC KEY-----", "")));
|
||||
Fx.tryIt("body is not Base64 of a key", () -> d.decode("-----BEGIN PUBLIC KEY-----\n!!!!\n-----END PUBLIC KEY-----\n"));
|
||||
Fx.tryIt("Windows line endings (CRLF)", () -> d.decode(pub.replace("\n", "\r\n")));
|
||||
Fx.tryIt("comment lines before the header", () -> d.decode("# my key\n" + pub));
|
||||
|
||||
Fx.h("several objects in one string: only the first is returned");
|
||||
String chain = Fx.read("server-chain.pem");
|
||||
X509Certificate first = d.decode(chain, X509Certificate.class);
|
||||
System.out.println("decode(String) on a 2-certificate bundle -> " + first.getSubjectX500Principal());
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,35 @@
|
||||
import java.io.IOException;
|
||||
import java.nio.file.Files;
|
||||
import java.nio.file.Path;
|
||||
|
||||
/** Tiny helper shared by the demos: read a fixture, print a section header, assert. */
|
||||
final class Fx {
|
||||
static final Path DIR = Path.of(System.getProperty("fixtures", "fixtures"));
|
||||
static String read(String name) {
|
||||
try { return Files.readString(DIR.resolve(name)); }
|
||||
catch (IOException e) { throw new RuntimeException(e); }
|
||||
}
|
||||
static void h(String s) { System.out.println("== " + s); }
|
||||
static void check(boolean ok, String what) {
|
||||
if (!ok) throw new AssertionError(what);
|
||||
System.out.println("ok: " + what);
|
||||
}
|
||||
/** Run, and print the exception class and message instead of a stack trace. */
|
||||
static void tryIt(String label, java.util.concurrent.Callable<Object> c) {
|
||||
try {
|
||||
Object o = c.call();
|
||||
System.out.println(label + " -> " + describe(o));
|
||||
} catch (Throwable t) {
|
||||
System.out.println(label + " !! " + t);
|
||||
}
|
||||
}
|
||||
static String describe(Object o) {
|
||||
if (o instanceof java.security.PEM p) return "PEM(type=" + p.type() + ") - NOT decoded";
|
||||
if (o instanceof java.security.KeyPair) return "KeyPair";
|
||||
if (o instanceof java.security.PrivateKey k) return "PrivateKey " + k.getAlgorithm();
|
||||
if (o instanceof java.security.PublicKey k) return "PublicKey " + k.getAlgorithm();
|
||||
if (o instanceof java.security.cert.X509Certificate c) return "X509Certificate " + c.getSubjectX500Principal();
|
||||
if (o instanceof javax.crypto.EncryptedPrivateKeyInfo e) return "EncryptedPrivateKeyInfo " + e.getAlgName();
|
||||
return String.valueOf(o);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,59 @@
|
||||
import java.nio.charset.StandardCharsets;
|
||||
import java.security.*;
|
||||
import java.util.Base64;
|
||||
|
||||
/** Sign and verify a JWT with keys loaded from PEM files. No JWT library: the point is the key handling. */
|
||||
public class JwtSigning {
|
||||
static final Base64.Encoder B64 = Base64.getUrlEncoder().withoutPadding();
|
||||
|
||||
static String signingInput(String alg) {
|
||||
String header = "{\"alg\":\"" + alg + "\",\"typ\":\"JWT\"}";
|
||||
String payload = "{\"sub\":\"ankur\",\"iss\":\"https://ankurm.com\"}";
|
||||
return B64.encodeToString(header.getBytes(StandardCharsets.UTF_8)) + "." + B64.encodeToString(payload.getBytes(StandardCharsets.UTF_8));
|
||||
}
|
||||
|
||||
static byte[] sign(String jcaAlg, PrivateKey key, String input) throws Exception {
|
||||
Signature s = Signature.getInstance(jcaAlg);
|
||||
s.initSign(key);
|
||||
s.update(input.getBytes(StandardCharsets.US_ASCII));
|
||||
return s.sign();
|
||||
}
|
||||
|
||||
static boolean verify(String jcaAlg, PublicKey key, String input, byte[] sig) throws Exception {
|
||||
Signature s = Signature.getInstance(jcaAlg);
|
||||
s.initVerify(key);
|
||||
s.update(input.getBytes(StandardCharsets.US_ASCII));
|
||||
return s.verify(sig);
|
||||
}
|
||||
|
||||
public static void main(String[] args) throws Exception {
|
||||
PEMDecoder d = PEMDecoder.of();
|
||||
|
||||
Fx.h("RS256 with an RSA key from PEM");
|
||||
PrivateKey rsaPriv = d.decode(Fx.read("rsa-private-pkcs8.pem"), PrivateKey.class);
|
||||
PublicKey rsaPub = d.decode(Fx.read("rsa-public.pem"), PublicKey.class);
|
||||
String in = signingInput("RS256");
|
||||
byte[] sig = sign("SHA256withRSA", rsaPriv, in);
|
||||
String jwt = in + "." + B64.encodeToString(sig);
|
||||
System.out.println("header.payload = " + in);
|
||||
System.out.println("signature bytes = " + sig.length + ", jwt parts = " + jwt.split("\\.").length);
|
||||
Fx.check(verify("SHA256withRSA", rsaPub, in, sig), "RS256 signature verifies with the public PEM");
|
||||
|
||||
Fx.h("ES256 with an EC key from PEM (the trap is the signature format)");
|
||||
PrivateKey ecPriv = d.decode(Fx.read("ec-private-pkcs8.pem"), PrivateKey.class);
|
||||
PublicKey ecPub = d.decode(Fx.read("ec-public.pem"), PublicKey.class);
|
||||
String in2 = signingInput("ES256");
|
||||
byte[] der = sign("SHA256withECDSA", ecPriv, in2);
|
||||
byte[] raw = sign("SHA256withECDSAinP1363Format", ecPriv, in2);
|
||||
System.out.println("SHA256withECDSA -> DER, starts 0x" + Integer.toHexString(der[0] & 0xff) + ", length varies run to run, 70-72: " + (der.length >= 70 && der.length <= 72) + " (JWT readers reject this)");
|
||||
System.out.println("SHA256withECDSAinP1363Format -> R||S, length " + raw.length + " (what RFC 7518 requires for ES256)");
|
||||
Fx.check(raw.length == 64, "ES256 signature is exactly 64 bytes");
|
||||
Fx.check(verify("SHA256withECDSAinP1363Format", ecPub, in2, raw), "ES256 signature verifies with the public PEM");
|
||||
|
||||
Fx.h("EdDSA with an Ed25519 key from PEM");
|
||||
PrivateKey edPriv = d.decode(Fx.read("ed25519-private.pem"), PrivateKey.class);
|
||||
byte[] ed = sign("Ed25519", edPriv, signingInput("EdDSA"));
|
||||
System.out.println(edPriv.getAlgorithm() + " signature bytes = " + ed.length
|
||||
+ " (the PKCS#8 file holds no public key, so there is nothing to decode for verifying here)");
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,77 @@
|
||||
import java.io.ByteArrayInputStream;
|
||||
import java.io.StringReader;
|
||||
import java.io.StringWriter;
|
||||
import java.security.*;
|
||||
import java.security.cert.X509Certificate;
|
||||
import java.security.interfaces.ECPrivateKey;
|
||||
import org.bouncycastle.asn1.pkcs.PrivateKeyInfo;
|
||||
import org.bouncycastle.cert.X509CertificateHolder;
|
||||
import org.bouncycastle.cert.jcajce.JcaX509CertificateConverter;
|
||||
import org.bouncycastle.openssl.*;
|
||||
import org.bouncycastle.openssl.jcajce.*;
|
||||
import org.bouncycastle.operator.InputDecryptorProvider;
|
||||
import org.bouncycastle.pkcs.PKCS8EncryptedPrivateKeyInfo;
|
||||
import org.springframework.security.converter.RsaKeyConverters;
|
||||
|
||||
/** The same jobs done with BouncyCastle (bcpkix), with Spring Security's RsaKeyConverters, and with the JDK. */
|
||||
public class Migration {
|
||||
static final char[] PW = "changeit".toCharArray();
|
||||
|
||||
static Object bcParse(String pem) throws Exception {
|
||||
try (PEMParser p = new PEMParser(new StringReader(pem))) { return p.readObject(); }
|
||||
}
|
||||
|
||||
public static void main(String[] args) throws Exception {
|
||||
PEMDecoder jdk = PEMDecoder.of();
|
||||
JcaPEMKeyConverter conv = new JcaPEMKeyConverter();
|
||||
|
||||
Fx.h("1. load an RSA private key (PKCS#8)");
|
||||
PrivateKey viaBc = conv.getPrivateKey((PrivateKeyInfo) bcParse(Fx.read("rsa-private-pkcs8.pem")));
|
||||
PrivateKey viaJdk = jdk.decode(Fx.read("rsa-private-pkcs8.pem"), PrivateKey.class);
|
||||
Fx.check(viaBc.equals(viaJdk), "BouncyCastle and the JDK produce equal keys");
|
||||
System.out.println("BC parser returned: " + bcParse(Fx.read("rsa-private-pkcs8.pem")).getClass().getSimpleName());
|
||||
|
||||
Fx.h("2. load a certificate");
|
||||
X509CertificateHolder holder = (X509CertificateHolder) bcParse(Fx.read("server.pem"));
|
||||
X509Certificate c1 = new JcaX509CertificateConverter().getCertificate(holder);
|
||||
X509Certificate c2 = jdk.decode(Fx.read("server.pem"), X509Certificate.class);
|
||||
Fx.check(c1.equals(c2), "same certificate either way");
|
||||
|
||||
Fx.h("3. write keys");
|
||||
StringWriter sw = new StringWriter();
|
||||
try (JcaPEMWriter w = new JcaPEMWriter(sw)) { w.writeObject(c2.getPublicKey()); }
|
||||
Fx.check(sw.toString().replace("\r\n", "\n").equals(PEMEncoder.of().encodeToString(c2.getPublicKey()).replace("\r\n", "\n")), "JcaPEMWriter and PEMEncoder write identical public-key text (line terminators aside)");
|
||||
sw = new StringWriter();
|
||||
try (JcaPEMWriter w = new JcaPEMWriter(sw)) { w.writeObject(viaJdk); }
|
||||
System.out.println("JcaPEMWriter on an RSA private key writes: " + sw.toString().lines().findFirst().get());
|
||||
System.out.println("PEMEncoder on an RSA private key writes: " + PEMEncoder.of().encodeToString(viaJdk).lines().findFirst().get());
|
||||
|
||||
Fx.h("4. encrypted PKCS#8 key (BC needs its own provider for AES/CBC/PKCS7Padding; the JDK does not)");
|
||||
PKCS8EncryptedPrivateKeyInfo bcEnc = (PKCS8EncryptedPrivateKeyInfo) bcParse(Fx.read("rsa-private-encrypted.pem"));
|
||||
InputDecryptorProvider dec = new JceOpenSSLPKCS8DecryptorProviderBuilder().setProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider()).build(PW);
|
||||
PrivateKey k1 = conv.getPrivateKey(bcEnc.decryptPrivateKeyInfo(dec));
|
||||
PrivateKey k2 = jdk.withDecryption(PW).decode(Fx.read("rsa-private-encrypted.pem"), PrivateKey.class);
|
||||
Fx.check(k1.equals(k2), "same key either way");
|
||||
|
||||
Fx.h("5. what BouncyCastle reads and the JDK does not");
|
||||
Object sec1 = bcParse(Fx.read("ec-private-sec1.pem"));
|
||||
KeyPair bcPair = conv.getKeyPair((PEMKeyPair) sec1);
|
||||
System.out.println("EC PRIVATE KEY (SEC1): BC -> " + sec1.getClass().getSimpleName() + ", JDK -> " + Fx.describe(jdk.decode(Fx.read("ec-private-sec1.pem"))));
|
||||
PrivateKey ecViaJdk = jdk.decode(Fx.read("ec-private-pkcs8.pem"), PrivateKey.class);
|
||||
Fx.check(((ECPrivateKey) bcPair.getPrivate()).getS().equals(((ECPrivateKey) ecViaJdk).getS()), "after 'openssl pkcs8 -topk8 -nocrypt' the JDK reads the same secret scalar BC read from SEC1");
|
||||
|
||||
Object legacy = bcParse(Fx.read("rsa-private-legacy-encrypted.pem"));
|
||||
PEMDecryptorProvider legacyDec = new JcePEMDecryptorProviderBuilder().setProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider()).build(PW);
|
||||
KeyPair legacyKp = conv.getKeyPair(((PEMEncryptedKeyPair) legacy).decryptKeyPair(legacyDec));
|
||||
System.out.println("Proc-Type: 4,ENCRYPTED: BC -> " + legacy.getClass().getSimpleName() + " decrypted to " + legacyKp.getPrivate().getAlgorithm());
|
||||
Fx.check(legacyKp.getPrivate().equals(viaJdk), "...and it is the same RSA key");
|
||||
Fx.tryIt("Proc-Type: 4,ENCRYPTED: JDK", () -> jdk.withDecryption(PW).decode(Fx.read("rsa-private-legacy-encrypted.pem"), PrivateKey.class));
|
||||
|
||||
Fx.h("6. Spring Security RsaKeyConverters (RSA only; PKCS#8 and X.509 only)");
|
||||
Fx.check(RsaKeyConverters.pkcs8().convert(new ByteArrayInputStream(Fx.read("rsa-private-pkcs8.pem").getBytes())).equals(viaJdk), "pkcs8() reads the RSA private key");
|
||||
Fx.check(RsaKeyConverters.x509().convert(new ByteArrayInputStream(Fx.read("rsa-public.pem").getBytes())).equals(jdk.decode(Fx.read("rsa-public.pem"), PublicKey.class)), "x509() reads the RSA public key");
|
||||
Fx.tryIt("pkcs8() on an EC key", () -> RsaKeyConverters.pkcs8().convert(new ByteArrayInputStream(Fx.read("ec-private-pkcs8.pem").getBytes())));
|
||||
Fx.tryIt("pkcs8() on the PKCS#1 key", () -> RsaKeyConverters.pkcs8().convert(new ByteArrayInputStream(Fx.read("rsa-private-pkcs1.pem").getBytes())));
|
||||
Fx.tryIt("JDK on the EC key", () -> jdk.decode(Fx.read("ec-private-pkcs8.pem"), PrivateKey.class));
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,50 @@
|
||||
import java.security.*;
|
||||
import java.security.cert.X509Certificate;
|
||||
import java.security.interfaces.RSAPublicKey;
|
||||
|
||||
/** The smallest thing that works: PEM text to objects and back. */
|
||||
public class RoundTrip {
|
||||
static String lf(String s) { return s.replace("\r\n", "\n"); }
|
||||
|
||||
public static void main(String[] args) throws Exception {
|
||||
PEMDecoder decoder = PEMDecoder.of();
|
||||
PEMEncoder encoder = PEMEncoder.of();
|
||||
|
||||
Fx.h("decode a public key, a private key and a certificate");
|
||||
String pubText = Fx.read("rsa-public.pem");
|
||||
PublicKey pub = decoder.decode(pubText, PublicKey.class);
|
||||
System.out.println(pub.getAlgorithm() + " " + pub.getFormat() + " " + ((RSAPublicKey) pub).getModulus().bitLength() + " bits");
|
||||
|
||||
PrivateKey priv = decoder.decode(Fx.read("rsa-private-pkcs8.pem"), PrivateKey.class);
|
||||
System.out.println(priv.getAlgorithm() + " " + priv.getFormat());
|
||||
|
||||
X509Certificate cert = decoder.decode(Fx.read("server.pem"), X509Certificate.class);
|
||||
System.out.println(cert.getSubjectX500Principal() + " issued by " + cert.getIssuerX500Principal());
|
||||
|
||||
Fx.h("encode them again: the same text openssl wrote, apart from the line terminator");
|
||||
String encoded = encoder.encodeToString(pub);
|
||||
System.out.println("PEMEncoder line terminator is CRLF: " + encoded.contains("\r\n") + "; the openssl file uses LF: " + !pubText.contains("\r"));
|
||||
Fx.check(!encoded.equals(pubText), "raw text differs from the file (CRLF vs LF)");
|
||||
Fx.check(lf(encoded).equals(pubText), "public key re-encodes to identical text once CRLF is normalised to LF");
|
||||
Fx.check(lf(encoder.encodeToString(priv)).equals(Fx.read("rsa-private-pkcs8.pem")), "private key re-encodes to identical text (LF-normalised)");
|
||||
Fx.check(lf(encoder.encodeToString(cert)).equals(Fx.read("server.pem")), "certificate re-encodes to identical text (LF-normalised)");
|
||||
|
||||
Fx.h("encode a key pair that was generated just now");
|
||||
KeyPairGenerator g = KeyPairGenerator.getInstance("EC");
|
||||
g.initialize(256);
|
||||
KeyPair kp = g.generateKeyPair();
|
||||
String text = encoder.encodeToString(kp);
|
||||
System.out.println(text.lines().filter(l -> l.startsWith("-----")).toList());
|
||||
System.out.println("line width of the Base64 body: " + text.lines().skip(1).findFirst().get().length());
|
||||
KeyPair back = decoder.decode(text, KeyPair.class);
|
||||
Fx.check(((java.security.interfaces.ECPrivateKey) back.getPrivate()).getS().equals(((java.security.interfaces.ECPrivateKey) kp.getPrivate()).getS()), "private scalar survives the round trip");
|
||||
Fx.check(back.getPublic().equals(kp.getPublic()), "public key survives the round trip");
|
||||
// encoding a KeyPair writes the public key INTO the PKCS#8 structure, so the bytes differ from the bare private key
|
||||
Fx.check(!java.util.Arrays.equals(back.getPrivate().getEncoded(), kp.getPrivate().getEncoded()), "...but the private key's own encoding is not byte-for-byte the same (the PKCS#8 now carries the public key)");
|
||||
|
||||
Fx.h("what does decode(String) with no target class hand back?");
|
||||
for (String f : new String[]{"rsa-public.pem", "rsa-private-pkcs8.pem", "ed25519-private.pem", "server.pem", "rsa-private-encrypted.pem"}) {
|
||||
Fx.tryIt(f, () -> decoder.decode(Fx.read(f)));
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,87 @@
|
||||
import com.sun.net.httpserver.HttpsConfigurator;
|
||||
import com.sun.net.httpserver.HttpsServer;
|
||||
import java.io.EOFException;
|
||||
import java.io.InputStream;
|
||||
import java.net.InetAddress;
|
||||
import java.net.InetSocketAddress;
|
||||
import java.net.URI;
|
||||
import java.net.http.HttpClient;
|
||||
import java.net.http.HttpRequest;
|
||||
import java.net.http.HttpResponse;
|
||||
import java.security.*;
|
||||
import java.security.cert.Certificate;
|
||||
import java.security.cert.X509Certificate;
|
||||
import java.util.ArrayList;
|
||||
import java.util.List;
|
||||
import javax.net.ssl.*;
|
||||
|
||||
/** Build an SSLContext from three PEM files and talk to ourselves over TLS. */
|
||||
public class TlsFromPem {
|
||||
static List<Certificate> readAll(String pemText) throws Exception {
|
||||
List<Certificate> out = new ArrayList<>();
|
||||
try (InputStream in = new java.io.ByteArrayInputStream(pemText.getBytes())) {
|
||||
PEMDecoder d = PEMDecoder.of();
|
||||
while (true) {
|
||||
try { out.add(d.decode(in, X509Certificate.class)); }
|
||||
catch (EOFException end) { break; }
|
||||
}
|
||||
}
|
||||
return out;
|
||||
}
|
||||
|
||||
public static void main(String[] args) throws Exception {
|
||||
PEMDecoder d = PEMDecoder.of();
|
||||
|
||||
Fx.h("read a two-certificate chain file");
|
||||
List<Certificate> chain = readAll(Fx.read("server-chain.pem"));
|
||||
for (Certificate c : chain) System.out.println(" " + ((X509Certificate) c).getSubjectX500Principal());
|
||||
Fx.check(chain.size() == 2, "the stream decoder returns the two certificates one by one");
|
||||
|
||||
Fx.h("server side: key + chain -> KeyStore -> KeyManagerFactory -> SSLContext");
|
||||
PrivateKey key = d.decode(Fx.read("server-key.pem"), PrivateKey.class);
|
||||
char[] pw = new char[0];
|
||||
KeyStore ks = KeyStore.getInstance("PKCS12");
|
||||
ks.load(null, null);
|
||||
ks.setKeyEntry("server", key, pw, chain.toArray(new Certificate[0]));
|
||||
KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
|
||||
kmf.init(ks, pw);
|
||||
SSLContext serverCtx = SSLContext.getInstance("TLS");
|
||||
serverCtx.init(kmf.getKeyManagers(), null, null);
|
||||
|
||||
HttpsServer server = HttpsServer.create(new InetSocketAddress(InetAddress.getLoopbackAddress(), 0), 0);
|
||||
server.setHttpsConfigurator(new HttpsConfigurator(serverCtx));
|
||||
server.createContext("/", ex -> {
|
||||
byte[] body = "hello over TLS\n".getBytes();
|
||||
ex.sendResponseHeaders(200, body.length);
|
||||
ex.getResponseBody().write(body);
|
||||
ex.close();
|
||||
});
|
||||
server.start();
|
||||
URI uri = URI.create("https://localhost:" + server.getAddress().getPort() + "/");
|
||||
|
||||
try {
|
||||
Fx.h("client trusting only the CA certificate from ca.pem");
|
||||
KeyStore ts = KeyStore.getInstance("PKCS12");
|
||||
ts.load(null, null);
|
||||
ts.setCertificateEntry("ca", d.decode(Fx.read("ca.pem"), X509Certificate.class));
|
||||
TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
|
||||
tmf.init(ts);
|
||||
SSLContext clientCtx = SSLContext.getInstance("TLS");
|
||||
clientCtx.init(null, tmf.getTrustManagers(), null);
|
||||
HttpClient trusting = HttpClient.newBuilder().sslContext(clientCtx).build();
|
||||
HttpResponse<String> r = trusting.send(HttpRequest.newBuilder(uri).build(), HttpResponse.BodyHandlers.ofString());
|
||||
System.out.println("HTTP " + r.statusCode() + " " + r.body().strip() + " (" + r.sslSession().get().getProtocol() + ")");
|
||||
System.out.println("server presented: " + ((X509Certificate) r.sslSession().get().getPeerCertificates()[0]).getSubjectX500Principal());
|
||||
Fx.check(r.statusCode() == 200, "request over TLS succeeds");
|
||||
|
||||
Fx.h("same request with the JVM's default trust store (the CA is not in it)");
|
||||
try {
|
||||
HttpClient.newHttpClient().send(HttpRequest.newBuilder(uri).build(), HttpResponse.BodyHandlers.ofString());
|
||||
} catch (Exception e) {
|
||||
System.out.println(e);
|
||||
}
|
||||
} finally {
|
||||
server.stop(0);
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user