[ENTESB-20847] Add option to specify FIPS compliant SecureRandom algo…

modules/fuse-credential-store/fuse-credential-store-commands/src/main/java/org/jboss/fuse/jasypt/commands/Decrypt.java

@@ -33,6 +33,7 @@
 import org.jasypt.iv.ByteArrayFixedIvGenerator;
 import org.jasypt.iv.RandomIvGenerator;
 import org.jboss.fuse.jasypt.commands.completers.JasyptPbeAlgorithmsCompletionSupport;
+import org.jboss.fuse.jasypt.commands.support.FipsRandomSaltGenerator;
 
 import static org.jboss.fuse.jasypt.commands.Helpers.isIVNeeded;
 
@@ -71,6 +72,9 @@ public class Decrypt implements Action {
     @Option(name = "-E", aliases = { "--use-empty-iv-generator" }, description = "Use fixed IV generator for decryption of passwords encrypted with previous versions of Jasypt.")
     boolean useIVGeneratorForLegacyValues = false;
 
+    @Option(name = "--use-fips-secure-random-algorithm", description = "Use SecureRandom algorithm compliant with FIPS")
+    boolean useFIPSSecureRandomAlgorithm = false;
+
     @Argument(index = 0, description = "Input data to decrypt. If no data is specified, it'll be read from standard input.", required = false)
     String input;
 
@@ -105,13 +109,17 @@ public Object execute() throws Exception {
             if (!useIVGeneratorForLegacyValues) {
                 // normal behavior
                 JasyptStatelessService service = new JasyptStatelessService();
+                String randomSaltGeneratorClassName = null;
+                if (useFIPSSecureRandomAlgorithm) {
+                    randomSaltGeneratorClassName = FipsRandomSaltGenerator.class.getName();
+                }
 
                 clear = service.decrypt(
                         input,
                         password, null, null,
                         algorithm, null, null,
                         Integer.toString(iterations), null, null,
-                        null, null, null,
+                        randomSaltGeneratorClassName, null, null,
                         null, null, null,
                         null, null, null,
                         hex ? CommonUtils.STRING_OUTPUT_TYPE_HEXADECIMAL : CommonUtils.STRING_OUTPUT_TYPE_BASE64, null, null,

modules/fuse-credential-store/fuse-credential-store-commands/src/main/java/org/jboss/fuse/jasypt/commands/Encrypt.java

@@ -28,6 +28,7 @@
 import org.jasypt.intf.service.JasyptStatelessService;
 import org.jasypt.iv.RandomIvGenerator;
 import org.jboss.fuse.jasypt.commands.completers.JasyptPbeAlgorithmsCompletionSupport;
+import org.jboss.fuse.jasypt.commands.support.FipsRandomSaltGenerator;
 
 import static org.jboss.fuse.jasypt.commands.Helpers.isIVNeeded;
 
@@ -63,6 +64,9 @@ public class Encrypt implements Action {
            + "PBEWITHHMACSHA384ANDAES_256, PBEWITHHMACSHA1ANDAES_256, PBEWITHHMACSHA224ANDAES_128, PBEWITHHMACSHA512ANDAES_128 ")
     boolean useIVGenerator = false;
 
+    @Option(name = "--use-fips-secure-random-algorithm", description = "Use SecureRandom algorithm compliant with FIPS")
+    boolean useFIPSSecureRandomAlgorithm = false;
+
     @Argument(index = 0, description = "Input data to encrypt. If no data is specified, it'll be read from standard input.", required = false)
     String input;
 
@@ -93,12 +97,17 @@ public Object execute() throws Exception {
             Thread.currentThread().setContextClassLoader(this.getClass().getClassLoader());
 
             JasyptStatelessService service = new JasyptStatelessService();
+            String randomSaltGeneratorClassName = null;
+            if (useFIPSSecureRandomAlgorithm) {
+                randomSaltGeneratorClassName = FipsRandomSaltGenerator.class.getName();
+            }
+
             String secret = service.encrypt(
                     input,
                     password, null, null,
                     algorithm, null, null,
                     Integer.toString(iterations), null, null,
-                    null, null, null,
+                    randomSaltGeneratorClassName, null, null,
                     null, null, null,
                     null, null, null,
                     hex ? CommonUtils.STRING_OUTPUT_TYPE_HEXADECIMAL : CommonUtils.STRING_OUTPUT_TYPE_BASE64, null, null,

modules/fuse-credential-store/fuse-credential-store-commands/src/main/java/org/jboss/fuse/jasypt/commands/support/FipsRandomSaltGenerator.java

@@ -0,0 +1,30 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.jboss.fuse.jasypt.commands.support;
+
+import org.jasypt.salt.RandomSaltGenerator;
+
+/**
+ * When FIPS mode is enabled, the only available SecureRandom algorithm is "PKCS11"
+ */
+public class FipsRandomSaltGenerator extends RandomSaltGenerator {
+
+    public FipsRandomSaltGenerator() {
+        super("PKCS11");
+    }
+
+}