Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Encrypt generated key with AES #51019

Merged
merged 5 commits into from
Jan 15, 2020
Merged

Encrypt generated key with AES #51019

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
8214f91
Encrypt generated cert with AES
ywangd Jan 15, 2020
f522668
Add test to ensure AES is in use
ywangd Jan 15, 2020
e743710
Fix key content check failure due to randomness
ywangd Jan 15, 2020
340b623
Document the empty catch block
ywangd Jan 15, 2020
34a605a
Add else block to complete text content test
ywangd Jan 15, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ...ugin/security/cli/src/main/java/org/elasticsearch/xpack/security/cli/CertificateTool.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -922,7 +922,7 @@ static Collection<CertificateInformation> parseFile(Path file) throws Exception
}

static PEMEncryptor getEncrypter(char[] password) {
return new JcePEMEncryptorBuilder("DES-EDE3-CBC").setProvider(BC_PROV).build(password);
return new JcePEMEncryptorBuilder("AES-128-CBC").setProvider(BC_PROV).build(password);
}

private static <T, E extends Exception> T withPassword(String description, char[] password, Terminal terminal,
Expand Down
20 changes: 19 additions & 1 deletion ...security/cli/src/test/java/org/elasticsearch/xpack/security/cli/CertificateToolTests.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@
import org.bouncycastle.asn1.x509.GeneralName;
import org.bouncycastle.asn1.x509.GeneralNames;
import org.bouncycastle.cert.X509CertificateHolder;
import org.bouncycastle.openssl.PEMDecryptorProvider;
import org.bouncycastle.openssl.PEMEncryptedKeyPair;
import org.bouncycastle.openssl.PEMParser;
import org.bouncycastle.pkcs.PKCS10CertificationRequest;
Expand Down Expand Up @@ -50,6 +51,7 @@
import org.hamcrest.Matchers;
import org.junit.After;
import org.junit.BeforeClass;
import org.mockito.Mockito;

import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.TrustManagerFactory;
Expand Down Expand Up @@ -349,6 +351,16 @@ public void testGeneratingSignedPemCertificates() throws Exception {
PEMParser pemParser = new PEMParser(reader);
Object parsed = pemParser.readObject();
assertThat(parsed, instanceOf(PEMEncryptedKeyPair.class));
// Verify we are using AES encryption
final PEMDecryptorProvider pemDecryptorProvider = Mockito.mock(PEMDecryptorProvider.class);
try {
((PEMEncryptedKeyPair) parsed).decryptKeyPair(pemDecryptorProvider);
} catch (Exception e) {
// Catch error thrown by the empty mock, we are only interested in the argument passed in
}
finally {
Mockito.verify(pemDecryptorProvider).get("AES-128-CBC");
}
char[] zeroChars = new char[caInfo.password.length];
Arrays.fill(zeroChars, (char) 0);
assertArrayEquals(zeroChars, caInfo.password);
Expand All @@ -368,7 +380,13 @@ public void testGeneratingSignedPemCertificates() throws Exception {
assertTrue(Files.exists(zipRoot.resolve(filename)));
final Path cert = zipRoot.resolve(filename + "/" + filename + ".crt");
assertTrue(Files.exists(cert));
assertTrue(Files.exists(zipRoot.resolve(filename + "/" + filename + ".key")));
Path keyFile = zipRoot.resolve(filename + "/" + filename + ".key");
assertTrue(Files.exists(keyFile));
if (keyPassword != null) {
assertTrue(Files.readString(keyFile).contains("DEK-Info: AES-128-CBC"));
} else {
assertFalse(Files.readString(keyFile).contains("DEK-Info:"));
}
ywangd marked this conversation as resolved.
Show resolved Hide resolved
final Path p12 = zipRoot.resolve(filename + "/" + filename + ".p12");
try (InputStream input = Files.newInputStream(cert)) {
X509Certificate certificate = readX509Certificate(input);
Expand Down