Initial Commit
This commit is contained in:
453
iTechSharp/srcbc/openssl/PEMReader.cs
Normal file
453
iTechSharp/srcbc/openssl/PEMReader.cs
Normal file
@@ -0,0 +1,453 @@
|
||||
using System;
|
||||
using System.Collections;
|
||||
using System.IO;
|
||||
using System.Text;
|
||||
|
||||
using Org.BouncyCastle.Asn1;
|
||||
using Org.BouncyCastle.Asn1.Nist;
|
||||
using Org.BouncyCastle.Asn1.Pkcs;
|
||||
using Org.BouncyCastle.Asn1.Sec;
|
||||
using Org.BouncyCastle.Asn1.TeleTrust;
|
||||
using Org.BouncyCastle.Asn1.X509;
|
||||
using Org.BouncyCastle.Asn1.X9;
|
||||
using Org.BouncyCastle.Crypto;
|
||||
using Org.BouncyCastle.Crypto.Generators;
|
||||
using Org.BouncyCastle.Crypto.Parameters;
|
||||
using Org.BouncyCastle.Pkcs;
|
||||
using Org.BouncyCastle.Security;
|
||||
using Org.BouncyCastle.Utilities.Encoders;
|
||||
using Org.BouncyCastle.X509;
|
||||
|
||||
namespace Org.BouncyCastle.OpenSsl
|
||||
{
|
||||
/**
|
||||
* Class for reading OpenSSL PEM encoded streams containing
|
||||
* X509 certificates, PKCS8 encoded keys and PKCS7 objects.
|
||||
* <p>
|
||||
* In the case of PKCS7 objects the reader will return a CMS ContentInfo object. Keys and
|
||||
* Certificates will be returned using the appropriate java.security type.</p>
|
||||
*/
|
||||
public class PemReader
|
||||
{
|
||||
private readonly TextReader reader;
|
||||
private readonly IPasswordFinder pFinder;
|
||||
|
||||
public TextReader Reader
|
||||
{
|
||||
get { return reader; }
|
||||
}
|
||||
|
||||
/**
|
||||
* Create a new PemReader
|
||||
*
|
||||
* @param reader the Reader
|
||||
*/
|
||||
public PemReader(
|
||||
TextReader reader)
|
||||
: this(reader, null)
|
||||
{
|
||||
}
|
||||
|
||||
/**
|
||||
* Create a new PemReader with a password finder
|
||||
*
|
||||
* @param reader the Reader
|
||||
* @param pFinder the password finder
|
||||
*/
|
||||
public PemReader(
|
||||
TextReader reader,
|
||||
IPasswordFinder pFinder)
|
||||
{
|
||||
if (reader == null)
|
||||
throw new ArgumentNullException("reader");
|
||||
|
||||
this.reader = reader;
|
||||
this.pFinder = pFinder;
|
||||
}
|
||||
|
||||
private const string BeginString = "-----BEGIN ";
|
||||
|
||||
public object ReadObject()
|
||||
{
|
||||
string line;
|
||||
while ((line = reader.ReadLine()) != null)
|
||||
{
|
||||
int startPos = line.IndexOf(BeginString);
|
||||
if (startPos == -1)
|
||||
continue;
|
||||
|
||||
startPos += BeginString.Length;
|
||||
|
||||
int endPos = line.IndexOf('-', startPos);
|
||||
if (endPos == -1)
|
||||
endPos = line.Length;
|
||||
|
||||
string headerName = line.Substring(startPos, endPos - startPos).Trim();
|
||||
//Console.WriteLine("[" + headerName + "]");
|
||||
|
||||
string endMarker = "-----END " + headerName;
|
||||
|
||||
switch (headerName)
|
||||
{
|
||||
case "PUBLIC KEY":
|
||||
return ReadPublicKey(endMarker);
|
||||
case "RSA PUBLIC KEY":
|
||||
return ReadRsaPublicKey(endMarker);
|
||||
case "CERTIFICATE REQUEST":
|
||||
case "NEW CERTIFICATE REQUEST":
|
||||
return ReadCertificateRequest(endMarker);
|
||||
case "CERTIFICATE":
|
||||
case "X509 CERTIFICATE":
|
||||
return ReadCertificate(endMarker);
|
||||
case "PKCS7":
|
||||
return ReadPkcs7(endMarker);
|
||||
case "X509 CRL":
|
||||
return ReadCrl(endMarker);
|
||||
case "ATTRIBUTE CERTIFICATE":
|
||||
return ReadAttributeCertificate(endMarker);
|
||||
case "RSA PRIVATE KEY":
|
||||
return ReadKeyPair("RSA", endMarker);
|
||||
case "DSA PRIVATE KEY":
|
||||
return ReadKeyPair("DSA", endMarker);
|
||||
// TODO Add back in when tests done, and return type issue resolved
|
||||
//case "EC PARAMETERS":
|
||||
// return ReadECParameters(endMarker);
|
||||
case "EC PRIVATE KEY":
|
||||
return ReadECPrivateKey(endMarker);
|
||||
default:
|
||||
// TODO Throw an exception for an unknown header?
|
||||
|
||||
// Ignore contents
|
||||
ReadBytes(endMarker);
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
return null;
|
||||
}
|
||||
|
||||
private byte[] ReadBytes(
|
||||
string endMarker)
|
||||
{
|
||||
return ReadBytesAndFields(endMarker, null);
|
||||
}
|
||||
|
||||
private byte[] ReadBytesAndFields(
|
||||
string endMarker,
|
||||
IDictionary fields)
|
||||
{
|
||||
StringBuilder buf = new StringBuilder();
|
||||
|
||||
string line;
|
||||
while ((line = reader.ReadLine()) != null
|
||||
&& line.IndexOf(endMarker) == -1)
|
||||
{
|
||||
int colonPos = line.IndexOf(':');
|
||||
|
||||
if (colonPos == -1)
|
||||
{
|
||||
buf.Append(line.Trim());
|
||||
}
|
||||
else if (fields != null)
|
||||
{
|
||||
// Process field
|
||||
string fieldName = line.Substring(0, colonPos).Trim();
|
||||
|
||||
if (fieldName.StartsWith("X-"))
|
||||
fieldName = fieldName.Substring(2);
|
||||
|
||||
string fieldValue = line.Substring(colonPos + 1).Trim();
|
||||
|
||||
// TODO Complain if field already specified?
|
||||
fields[fieldName] = fieldValue;
|
||||
}
|
||||
}
|
||||
|
||||
if (line == null)
|
||||
{
|
||||
throw new IOException(endMarker + " not found");
|
||||
}
|
||||
|
||||
if (buf.Length % 4 != 0)
|
||||
{
|
||||
throw new IOException("base64 data appears to be truncated");
|
||||
}
|
||||
|
||||
return Base64.Decode(buf.ToString());
|
||||
}
|
||||
|
||||
private AsymmetricKeyParameter ReadRsaPublicKey(
|
||||
string endMarker)
|
||||
{
|
||||
RsaPublicKeyStructure rsaPubStructure = RsaPublicKeyStructure.GetInstance(
|
||||
Asn1Object.FromByteArray(
|
||||
ReadBytes(endMarker)));
|
||||
|
||||
return new RsaKeyParameters(
|
||||
false, // not private
|
||||
rsaPubStructure.Modulus,
|
||||
rsaPubStructure.PublicExponent);
|
||||
}
|
||||
|
||||
private AsymmetricKeyParameter ReadPublicKey(
|
||||
string endMarker)
|
||||
{
|
||||
return PublicKeyFactory.CreateKey(
|
||||
ReadBytes(endMarker));
|
||||
}
|
||||
|
||||
/**
|
||||
* Reads in a X509Certificate.
|
||||
*
|
||||
* @return the X509Certificate
|
||||
* @throws IOException if an I/O error occured
|
||||
*/
|
||||
private X509Certificate ReadCertificate(
|
||||
string endMarker)
|
||||
{
|
||||
byte[] bytes = ReadBytes(endMarker);
|
||||
|
||||
try
|
||||
{
|
||||
return new X509CertificateParser().ReadCertificate(bytes);
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
throw new IOException("problem parsing cert: " + e.ToString());
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Reads in a X509CRL.
|
||||
*
|
||||
* @return the X509Certificate
|
||||
* @throws IOException if an I/O error occured
|
||||
*/
|
||||
private X509Crl ReadCrl(
|
||||
string endMarker)
|
||||
{
|
||||
byte[] bytes = ReadBytes(endMarker);
|
||||
|
||||
try
|
||||
{
|
||||
return new X509CrlParser().ReadCrl(bytes);
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
throw new IOException("problem parsing cert: " + e.ToString());
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Reads in a PKCS10 certification request.
|
||||
*
|
||||
* @return the certificate request.
|
||||
* @throws IOException if an I/O error occured
|
||||
*/
|
||||
private Pkcs10CertificationRequest ReadCertificateRequest(
|
||||
string endMarker)
|
||||
{
|
||||
byte[] bytes = ReadBytes(endMarker);
|
||||
|
||||
try
|
||||
{
|
||||
return new Pkcs10CertificationRequest(bytes);
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
throw new IOException("problem parsing cert: " + e.ToString());
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Reads in a X509 Attribute Certificate.
|
||||
*
|
||||
* @return the X509 Attribute Certificate
|
||||
* @throws IOException if an I/O error occured
|
||||
*/
|
||||
private IX509AttributeCertificate ReadAttributeCertificate(
|
||||
string endMarker)
|
||||
{
|
||||
byte[] bytes = ReadBytes(endMarker);
|
||||
|
||||
return new X509V2AttributeCertificate(bytes);
|
||||
}
|
||||
|
||||
/**
|
||||
* Reads in a PKCS7 object. This returns a ContentInfo object suitable for use with the CMS
|
||||
* API.
|
||||
*
|
||||
* @return the X509Certificate
|
||||
* @throws IOException if an I/O error occured
|
||||
*/
|
||||
// TODO Consider returning Asn1.Pkcs.ContentInfo
|
||||
private Asn1.Cms.ContentInfo ReadPkcs7(
|
||||
string endMarker)
|
||||
{
|
||||
byte[] bytes = ReadBytes(endMarker);
|
||||
|
||||
try
|
||||
{
|
||||
return Asn1.Cms.ContentInfo.GetInstance(
|
||||
Asn1Object.FromByteArray(bytes));
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
throw new IOException("problem parsing PKCS7 object: " + e.ToString());
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Read a Key Pair
|
||||
*/
|
||||
private AsymmetricCipherKeyPair ReadKeyPair(
|
||||
string type,
|
||||
string endMarker)
|
||||
{
|
||||
//
|
||||
// extract the key
|
||||
//
|
||||
IDictionary fields = new Hashtable();
|
||||
byte[] keyBytes = ReadBytesAndFields(endMarker, fields);
|
||||
|
||||
string procType = (string) fields["Proc-Type"];
|
||||
|
||||
if (procType == "4,ENCRYPTED")
|
||||
{
|
||||
if (pFinder == null)
|
||||
throw new InvalidOperationException("No password finder specified, but a password is required");
|
||||
|
||||
char[] password = pFinder.GetPassword();
|
||||
|
||||
if (password == null)
|
||||
throw new IOException("Password is null, but a password is required");
|
||||
|
||||
string dekInfo = (string) fields["DEK-Info"];
|
||||
string[] tknz = dekInfo.Split(',');
|
||||
|
||||
string dekAlgName = tknz[0].Trim();
|
||||
byte[] iv = Hex.Decode(tknz[1].Trim());
|
||||
|
||||
keyBytes = PemUtilities.Crypt(false, keyBytes, password, dekAlgName, iv);
|
||||
}
|
||||
|
||||
try
|
||||
{
|
||||
AsymmetricKeyParameter pubSpec, privSpec;
|
||||
Asn1Sequence seq = (Asn1Sequence) Asn1Object.FromByteArray(keyBytes);
|
||||
|
||||
switch (type)
|
||||
{
|
||||
case "RSA":
|
||||
{
|
||||
RsaPrivateKeyStructure rsa = new RsaPrivateKeyStructure(seq);
|
||||
|
||||
pubSpec = new RsaKeyParameters(false, rsa.Modulus, rsa.PublicExponent);
|
||||
privSpec = new RsaPrivateCrtKeyParameters(
|
||||
rsa.Modulus, rsa.PublicExponent, rsa.PrivateExponent,
|
||||
rsa.Prime1, rsa.Prime2, rsa.Exponent1, rsa.Exponent2,
|
||||
rsa.Coefficient);
|
||||
|
||||
break;
|
||||
}
|
||||
|
||||
case "DSA":
|
||||
{
|
||||
// TODO Create an ASN1 object somewhere for this?
|
||||
//DerInteger v = (DerInteger)seq[0];
|
||||
DerInteger p = (DerInteger)seq[1];
|
||||
DerInteger q = (DerInteger)seq[2];
|
||||
DerInteger g = (DerInteger)seq[3];
|
||||
DerInteger y = (DerInteger)seq[4];
|
||||
DerInteger x = (DerInteger)seq[5];
|
||||
|
||||
DsaParameters parameters = new DsaParameters(p.Value, q.Value, g.Value);
|
||||
|
||||
privSpec = new DsaPrivateKeyParameters(x.Value, parameters);
|
||||
pubSpec = new DsaPublicKeyParameters(y.Value, parameters);
|
||||
|
||||
break;
|
||||
}
|
||||
|
||||
default:
|
||||
throw new ArgumentException("Unknown key type: " + type, "type");
|
||||
}
|
||||
|
||||
return new AsymmetricCipherKeyPair(pubSpec, privSpec);
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
throw new IOException(
|
||||
"problem creating " + type + " private key: " + e.ToString());
|
||||
}
|
||||
}
|
||||
|
||||
// TODO Add an equivalent class for ECNamedCurveParameterSpec?
|
||||
//private ECNamedCurveParameterSpec ReadECParameters(
|
||||
private X9ECParameters ReadECParameters(
|
||||
string endMarker)
|
||||
{
|
||||
byte[] bytes = ReadBytes(endMarker);
|
||||
DerObjectIdentifier oid = (DerObjectIdentifier) Asn1Object.FromByteArray(bytes);
|
||||
|
||||
//return ECNamedCurveTable.getParameterSpec(oid.Id);
|
||||
return GetCurveParameters(oid.Id);
|
||||
}
|
||||
|
||||
//private static ECDomainParameters GetCurveParameters(
|
||||
private static X9ECParameters GetCurveParameters(
|
||||
string name)
|
||||
{
|
||||
// TODO ECGost3410NamedCurves support (returns ECDomainParameters though)
|
||||
X9ECParameters ecP = X962NamedCurves.GetByName(name);
|
||||
|
||||
if (ecP == null)
|
||||
{
|
||||
ecP = SecNamedCurves.GetByName(name);
|
||||
if (ecP == null)
|
||||
{
|
||||
ecP = NistNamedCurves.GetByName(name);
|
||||
if (ecP == null)
|
||||
{
|
||||
ecP = TeleTrusTNamedCurves.GetByName(name);
|
||||
|
||||
if (ecP == null)
|
||||
throw new Exception("unknown curve name: " + name);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
//return new ECDomainParameters(ecP.Curve, ecP.G, ecP.N, ecP.H, ecP.GetSeed());
|
||||
return ecP;
|
||||
}
|
||||
|
||||
private AsymmetricCipherKeyPair ReadECPrivateKey(
|
||||
string endMarker)
|
||||
{
|
||||
try
|
||||
{
|
||||
byte[] bytes = ReadBytes(endMarker);
|
||||
ECPrivateKeyStructure pKey = new ECPrivateKeyStructure(
|
||||
(Asn1Sequence) Asn1Object.FromByteArray(bytes));
|
||||
AlgorithmIdentifier algId = new AlgorithmIdentifier(
|
||||
X9ObjectIdentifiers.IdECPublicKey, pKey.GetParameters());
|
||||
|
||||
PrivateKeyInfo privInfo = new PrivateKeyInfo(algId, pKey.ToAsn1Object());
|
||||
SubjectPublicKeyInfo pubInfo = new SubjectPublicKeyInfo(algId, pKey.GetPublicKey().GetBytes());
|
||||
|
||||
// TODO Are the keys returned here ECDSA, as Java version forces?
|
||||
return new AsymmetricCipherKeyPair(
|
||||
PublicKeyFactory.CreateKey(pubInfo),
|
||||
PrivateKeyFactory.CreateKey(privInfo));
|
||||
}
|
||||
catch (InvalidCastException e)
|
||||
{
|
||||
throw new IOException("wrong ASN.1 object found in stream.", e);
|
||||
}
|
||||
catch (Exception e)
|
||||
{
|
||||
throw new IOException("problem parsing EC private key.", e);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user