libjava/java/security/SignedObject.java

   1 /* SignedObject.java --- Signed Object Class
   2    Copyright (C) 1999 Free Software Foundation, Inc.
   3
   4 This file is part of GNU Classpath.
   5
   6 GNU Classpath is free software; you can redistribute it and/or modify
   7 it under the terms of the GNU General Public License as published by
   8 the Free Software Foundation; either version 2, or (at your option)
   9 any later version.
  10
  11 GNU Classpath is distributed in the hope that it will be useful, but
  12 WITHOUT ANY WARRANTY; without even the implied warranty of
  13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14 General Public License for more details.
  15
  16 You should have received a copy of the GNU General Public License
  17 along with GNU Classpath; see the file COPYING.  If not, write to the
  18 Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
  19 02111-1307 USA.
  20
  21 As a special exception, if you link this library with other files to
  22 produce an executable, this library does not by itself cause the
  23 resulting executable to be covered by the GNU General Public License.
  24 This exception does not however invalidate any other reasons why the
  25 executable file might be covered by the GNU General Public License. */
  26
  27 package java.security;
  28 import java.io.ByteArrayInputStream;
  29 import java.io.ByteArrayOutputStream;
  30 import java.io.IOException;
  31 import java.io.ObjectInputStream;
  32 import java.io.ObjectOutputStream;
  33 import java.io.Serializable;
  34
  35 /**
  36    SignedObject is used for storing rutime objects whose integrity
  37    cannot be compromised without being detected.
  38
  39    SignedObject contains a Serializable object which is yet to be
  40    signed and its signature.
  41
  42    The signed copy is a "deep copy" (in serialized form) of the
  43    original object. Any changes to the original will not affect
  44    the original.
  45
  46    Several things to note are that, first there is no need to
  47    initialize the signature engine as this class will handle that
  48    automatically. Second, verification will only succeed if the
  49    public key corresponds to the private key used to generate
  50    the SignedObject.
  51
  52    For fexibility, the signature engine can be specified in the
  53    constructor or the verify method. The programmer who writes
  54    code that verifies the SignedObject has not changed should be
  55    aware of the Signature engine they use. A malicious Signature
  56    may choose to always return true on verification and
  57    bypass the secrity check.
  58
  59    The GNU provider provides the NIST standard DSA which uses DSA
  60    and SHA-1. It can be specified by SHA/DSA, SHA-1/DSA or its
  61    OID. If the RSA signature algorithm is provided then
  62    it could be MD2/RSA. MD5/RSA, or SHA-1/RSA. The algorithm must
  63    be specified because there is no default.
  64
  65    @author Mark Benvenuto <ivymccough@worldnet.att.net>
  66
  67    @since JDK 1.2
  68  */
  69 public final class SignedObject implements Serializable
  70 {
  71   private byte[] content;
  72   private byte[] signature;
  73   private String thealgorithm;
  74
  75   /**
  76      Constructs a new SignedObject from a Serializeable object. The
  77      object is signed with private key and signature engine
  78
  79      @param object the object to sign
  80      @param signingKey the key to sign with
  81      @param signingEngine the signature engine to use
  82
  83      @throws IOException serialization error occurred
  84      @throws InvalidKeyException invalid key
  85      @throws SignatureException signing error
  86    */
  87   public SignedObject(Serializable object, PrivateKey signingKey,
  88                       Signature signingEngine) throws IOException,
  89     InvalidKeyException, SignatureException
  90   {
  91     thealgorithm = signingEngine.getAlgorithm();
  92
  93     ByteArrayOutputStream ostream = new ByteArrayOutputStream();
  94     ObjectOutputStream p = new ObjectOutputStream(ostream);
  95     p.writeObject(object);
  96     p.flush();
  97
  98     content = ostream.toByteArray();
  99
 100     signingEngine.initSign(signingKey);
 101     signingEngine.update(content);
 102     signature = signingEngine.sign();
 103   }
 104
 105   /**
 106      Returns the encapsulated object. The object is
 107      de-serialized before being returned.
 108
 109      @return the encapsulated object
 110
 111      @throws IOException de-serialization error occurred
 112      @throws ClassNotFoundException de-serialization error occurred
 113    */
 114   public Object getObject() throws IOException, ClassNotFoundException
 115   {
 116     ByteArrayInputStream istream = new ByteArrayInputStream(content);
 117
 118     return new ObjectInputStream(istream).readObject();
 119   }
 120
 121   /**
 122      Returns the signature of the encapsulated object.
 123
 124      @return a byte array containing the signature
 125    */
 126   public byte[] getSignature()
 127   {
 128     return signature;
 129   }
 130
 131   /**
 132      Returns the name of the signature algorithm.
 133
 134      @return the name of the signature algorithm.
 135    */
 136   public String getAlgorithm()
 137   {
 138     return thealgorithm;
 139   }
 140
 141   /**
 142      Verifies the SignedObject by checking that the signature that
 143      this class contains for the encapsulated object.
 144
 145      @param verificationKey the public key to use
 146      @param verificationEngine the signature engine to use
 147
 148      @return true if signature is correct, false otherwise
 149
 150      @throws InvalidKeyException invalid key
 151      @throws SignatureException signature verification failed
 152    */
 153   public boolean verify(PublicKey verificationKey,
 154                         Signature verificationEngine) throws
 155     InvalidKeyException, SignatureException
 156   {
 157     verificationEngine.initVerify(verificationKey);
 158     verificationEngine.update(content);
 159     return verificationEngine.verify(signature);
 160   }
 161
 162   //     readObject is called to restore the state of the SignedObject from a
 163   //     stream.
 164   //private void readObject(ObjectInputStream s)
 165   //                 throws IOException, ClassNotFoundException
 166 }