Java Examples for javax.crypto.AEADBadTagException

/**
   * Produces an authenticating token.
   *
   * @param user identity the token will authenticate.
   * @param expiration timestamp when token should expire.
   * @return token which can be used to authenticate as user until expiration.
   */
public String getSession(User user, ZonedDateTime expiration) {
    try {
        String cookieJson = mapper.writeValueAsString(new UserCookieData(user, expiration));
        byte[] cookieBody = encryptor.encrypt(cookieJson.getBytes(UTF_8));
        return Base64.getEncoder().encodeToString(cookieBody);
    } catch (AEADBadTagException e) {
        logger.error("Could not encrypt cookie", e);
        throw Throwables.propagate(e);
    } catch (JsonProcessingException e) {
        throw Throwables.propagate(e);
    }
}

/* Full read stream, check that getMoreData() is throwing an exception
     * This test
     *   1) Encrypt 100 bytes with AES/GCM/PKCS5Padding
     *   2) Changes the last byte to invalidate the authetication tag.
     *   3) Fully reads CipherInputStream to decrypt the message and closes
     */
static void gcm_AEADBadTag() throws Exception {
    Cipher c;
    byte[] read = new byte[200];
    System.out.println("Running gcm_AEADBadTag");
    // Encrypt 100 bytes with AES/GCM/PKCS5Padding
    byte[] ct = encryptedText("GCM", 100);
    // Corrupt the encrypted message
    ct = corruptGCM(ct);
    // Create stream for decryption
    CipherInputStream in = getStream("GCM", ct);
    try {
        int size = in.read(read);
        throw new RuntimeException("Fail: CipherInputStream.read() " + "returned " + size + " and didn't throw an exception.");
    } catch (IOException e) {
        Throwable ec = e.getCause();
        if (ec instanceof AEADBadTagException) {
            System.out.println("  Pass.");
        } else {
            System.out.println("  Fail: " + ec.getMessage());
            throw new RuntimeException(ec);
        }
    } finally {
        in.close();
    }
}

public static void main(String[] args) throws Exception {
    newGCMParameterSpecFail(-1, bytes);
    newGCMParameterSpecFail(128, null);
    newGCMParameterSpecPass(128, bytes);
    newGCMParameterSpecFail(-1, bytes, 2, 4);
    newGCMParameterSpecFail(128, null, 2, 4);
    newGCMParameterSpecFail(128, bytes, -2, 4);
    newGCMParameterSpecFail(128, bytes, 2, -4);
    // one too many
    newGCMParameterSpecFail(128, bytes, 2, 15);
    // ok.
    newGCMParameterSpecPass(128, bytes, 2, 14);
    newGCMParameterSpecPass(96, bytes, 4, 4);
    newGCMParameterSpecPass(96, bytes, 0, 0);
    // Might as well check the Exception constructors.
    try {
        new AEADBadTagException();
        new AEADBadTagException("Bad Tag Seen");
    } catch (Exception e) {
        e.printStackTrace();
        failed++;
    }
    if (failed != 0) {
        throw new Exception("Test(s) failed");
    }
}

private void testTampering(boolean aeadAvailable) throws InvalidKeyException, InvalidAlgorithmParameterException, NoSuchAlgorithmException, NoSuchProviderException, NoSuchPaddingException, IllegalBlockSizeException, BadPaddingException {
    Cipher eax = Cipher.getInstance("AES/EAX/NoPadding", "BC");
    final SecretKeySpec key = new SecretKeySpec(new byte[eax.getBlockSize()], eax.getAlgorithm());
    final IvParameterSpec iv = new IvParameterSpec(new byte[eax.getBlockSize()]);
    eax.init(Cipher.ENCRYPT_MODE, key, iv);
    byte[] ciphertext = eax.doFinal(new byte[100]);
    // Tamper
    ciphertext[0] = (byte) (ciphertext[0] + 1);
    try {
        eax.init(Cipher.DECRYPT_MODE, key, iv);
        eax.doFinal(ciphertext);
        fail("Tampered ciphertext should be invalid");
    } catch (BadPaddingException e) {
        if (aeadAvailable) {
            if (!e.getClass().getName().equals("javax.crypto.AEADBadTagException")) {
                fail("Tampered AEAD ciphertext should fail with AEADBadTagException when available.");
            }
        }
    }
}

@Override
protected byte[] _readChunk(long index) throws IOException, FileEncryptionException, FileIntegrityException {
    // first, get chunk iv for decryption
    long oldpos = backingRandomAccessFile.getFilePointer();
    backingRandomAccessFile.seek(chunkOffset(index));
    // read iv
    byte[] iv = new byte[CHUNK_IV_SIZE];
    int ret = backingRandomAccessFile.read(iv);
    if (ret != CHUNK_IV_SIZE) {
        throw new FileEncryptionException("Size mismatch reading chunk IV!");
    }
    GCMParameterSpec spec = new GCMParameterSpec(GCM_AUTHENTICATION_TAG_LEN, iv);
    byte[] res, buf;
    try {
        decCipher.init(Cipher.DECRYPT_MODE, getFileKey(), spec);
        // set chunk metadata for verifying metadata integrity
        // index of current chunk
        decCipher.updateAAD(LongByteConv.long2Bytes(index));
        // flag indicating if we're writing the last chunk
        decCipher.updateAAD(BooleanByteConv.bool2byte(false));
        buf = new byte[CHUNK_ENC_DATA_SIZE];
        ret = backingRandomAccessFile.read(buf);
        backingRandomAccessFile.seek(oldpos);
        if (ret != CHUNK_ENC_DATA_SIZE) {
            throw new FileEncryptionException("Size mismatch reading encrypted chunk data!");
        }
        // decrypt data
        res = decCipher.doFinal(buf);
    } catch (AEADBadTagException e) {
        throw new FileIntegrityException("Decryption error in chunk " + index + ". Possible file integrity violation.", e);
    } catch (InvalidKeyExceptionInvalidAlgorithmParameterException | IllegalBlockSizeException | BadPaddingException |  e) {
        throw new FileEncryptionException("Decryption error in chunk " + index + ": " + e.getMessage(), e);
    }
    if ((res == null) || (res.length != CHUNK_DATA_SIZE)) {
        throw new FileEncryptionException("Decryption error or chunk size mismatch during decryption!");
    } else {
        if (implementsAuthentication()) {
            // check authentication tag for integrity
            byte[] tag = Arrays.copyOfRange(buf, res.length, buf.length);
            if (!getAuthTagVerifier().verifyChunkAuthTag((int) index, tag)) {
                throw new FileIntegrityException("File authentication tag verification failed in chunk " + index);
            }
        }
        return res;
    }
}

@Override
protected final byte[] engineDoFinal(byte[] input, int inputOffset, int inputLen) throws IllegalBlockSizeException, BadPaddingException {
    if (mCachedException != null) {
        throw (IllegalBlockSizeException) new IllegalBlockSizeException().initCause(mCachedException);
    }
    try {
        ensureKeystoreOperationInitialized();
    } catch (InvalidKeyExceptionInvalidAlgorithmParameterException |  e) {
        throw (IllegalBlockSizeException) new IllegalBlockSizeException().initCause(e);
    }
    byte[] output;
    try {
        flushAAD();
        byte[] additionalEntropy = KeyStoreCryptoOperationUtils.getRandomBytesToMixIntoKeystoreRng(mRng, getAdditionalEntropyAmountForFinish());
        output = mMainDataStreamer.doFinal(input, inputOffset, inputLen, // no signature involved
        null, additionalEntropy);
    } catch (KeyStoreException e) {
        switch(e.getErrorCode()) {
            case KeymasterDefs.KM_ERROR_INVALID_INPUT_LENGTH:
                throw (IllegalBlockSizeException) new IllegalBlockSizeException().initCause(e);
            case KeymasterDefs.KM_ERROR_INVALID_ARGUMENT:
                throw (BadPaddingException) new BadPaddingException().initCause(e);
            case KeymasterDefs.KM_ERROR_VERIFICATION_FAILED:
                throw (AEADBadTagException) new AEADBadTagException().initCause(e);
            default:
                throw (IllegalBlockSizeException) new IllegalBlockSizeException().initCause(e);
        }
    }
    resetWhilePreservingInitState();
    return output;
}

public static void main(String[] args) throws Exception {
    newGCMParameterSpecFail(-1, bytes);
    newGCMParameterSpecFail(128, null);
    newGCMParameterSpecPass(128, bytes);
    newGCMParameterSpecFail(-1, bytes, 2, 4);
    newGCMParameterSpecFail(128, null, 2, 4);
    newGCMParameterSpecFail(128, bytes, -2, 4);
    newGCMParameterSpecFail(128, bytes, 2, -4);
    // one too many
    newGCMParameterSpecFail(128, bytes, 2, 15);
    // ok.
    newGCMParameterSpecPass(128, bytes, 2, 14);
    newGCMParameterSpecPass(96, bytes, 4, 4);
    newGCMParameterSpecPass(96, bytes, 0, 0);
    // Might as well check the Exception constructors.
    try {
        new AEADBadTagException();
        new AEADBadTagException("Bad Tag Seen");
    } catch (Exception e) {
        e.printStackTrace();
        failed++;
    }
    if (failed != 0) {
        throw new Exception("Test(s) failed");
    }
}

@Override
protected final byte[] engineDoFinal(byte[] input, int inputOffset, int inputLen) throws IllegalBlockSizeException, BadPaddingException {
    if (mCachedException != null) {
        throw (IllegalBlockSizeException) new IllegalBlockSizeException().initCause(mCachedException);
    }
    try {
        ensureKeystoreOperationInitialized();
    } catch (InvalidKeyExceptionInvalidAlgorithmParameterException |  e) {
        throw (IllegalBlockSizeException) new IllegalBlockSizeException().initCause(e);
    }
    byte[] output;
    try {
        flushAAD();
        byte[] additionalEntropy = KeyStoreCryptoOperationUtils.getRandomBytesToMixIntoKeystoreRng(mRng, getAdditionalEntropyAmountForFinish());
        output = mMainDataStreamer.doFinal(input, inputOffset, inputLen, // no signature involved
        null, additionalEntropy);
    } catch (KeyStoreException e) {
        switch(e.getErrorCode()) {
            case KeymasterDefs.KM_ERROR_INVALID_INPUT_LENGTH:
                throw (IllegalBlockSizeException) new IllegalBlockSizeException().initCause(e);
            case KeymasterDefs.KM_ERROR_INVALID_ARGUMENT:
                throw (BadPaddingException) new BadPaddingException().initCause(e);
            case KeymasterDefs.KM_ERROR_VERIFICATION_FAILED:
                throw (AEADBadTagException) new AEADBadTagException().initCause(e);
            default:
                throw (IllegalBlockSizeException) new IllegalBlockSizeException().initCause(e);
        }
    }
    resetWhilePreservingInitState();
    return output;
}

@Override
protected final byte[] engineDoFinal(byte[] input, int inputOffset, int inputLen) throws IllegalBlockSizeException, BadPaddingException {
    if (mCachedException != null) {
        throw (IllegalBlockSizeException) new IllegalBlockSizeException().initCause(mCachedException);
    }
    try {
        ensureKeystoreOperationInitialized();
    } catch (InvalidKeyExceptionInvalidAlgorithmParameterException |  e) {
        throw (IllegalBlockSizeException) new IllegalBlockSizeException().initCause(e);
    }
    byte[] output;
    try {
        flushAAD();
        byte[] additionalEntropy = KeyStoreCryptoOperationUtils.getRandomBytesToMixIntoKeystoreRng(mRng, getAdditionalEntropyAmountForFinish());
        output = mMainDataStreamer.doFinal(input, inputOffset, inputLen, // no signature involved
        null, additionalEntropy);
    } catch (KeyStoreException e) {
        switch(e.getErrorCode()) {
            case KeymasterDefs.KM_ERROR_INVALID_INPUT_LENGTH:
                throw (IllegalBlockSizeException) new IllegalBlockSizeException().initCause(e);
            case KeymasterDefs.KM_ERROR_INVALID_ARGUMENT:
                throw (BadPaddingException) new BadPaddingException().initCause(e);
            case KeymasterDefs.KM_ERROR_VERIFICATION_FAILED:
                throw (AEADBadTagException) new AEADBadTagException().initCause(e);
            default:
                throw (IllegalBlockSizeException) new IllegalBlockSizeException().initCause(e);
        }
    }
    resetWhilePreservingInitState();
    return output;
}