russell@unturf.com
0a580b313d
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
98 lines
4.4 KiB
Java
98 lines
4.4 KiB
Java
/*
|
|
* Copyright (c) 2025, Oracle and/or its affiliates. All rights reserved.
|
|
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
|
|
*
|
|
* This code is free software; you can redistribute it and/or modify it
|
|
* under the terms of the GNU General Public License version 2 only, as
|
|
* published by the Free Software Foundation.
|
|
*
|
|
* This code is distributed in the hope that it will be useful, but WITHOUT
|
|
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
|
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
|
|
* version 2 for more details (a copy is included in the LICENSE file that
|
|
* accompanied this code).
|
|
*
|
|
* You should have received a copy of the GNU General Public License version
|
|
* 2 along with this work; if not, write to the Free Software Foundation,
|
|
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
*
|
|
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
|
|
* or visit www.oracle.com if you need additional information or have any
|
|
* questions.
|
|
*/
|
|
|
|
/*
|
|
* @test
|
|
* @bug 8349732
|
|
* @library /test/lib
|
|
* @summary Add support for JARs signed with ML-DSA
|
|
* @modules java.base/sun.security.pkcs
|
|
*/
|
|
import jdk.test.lib.Asserts;
|
|
import jdk.test.lib.security.RepositoryFileReader;
|
|
import sun.security.pkcs.PKCS7;
|
|
|
|
import java.io.BufferedReader;
|
|
import java.io.ByteArrayInputStream;
|
|
import java.io.IOException;
|
|
import java.io.InputStreamReader;
|
|
import java.security.cert.CertificateFactory;
|
|
import java.security.cert.X509Certificate;
|
|
import java.util.Base64;
|
|
import java.util.stream.Collectors;
|
|
|
|
import static jdk.test.lib.security.RepositoryFileReader.*;
|
|
|
|
public class ML_DSA_CMS {
|
|
public static void main(String[] args) throws Exception {
|
|
// Example signed-data encodings from RFC 9882, Appendix B
|
|
// (https://datatracker.ietf.org/doc/html/rfc9882#name-examples), which
|
|
// can be verified by example certificates from RFC 9881, Appendix C.3
|
|
// (https://datatracker.ietf.org/doc/html/rfc9881#name-example-certificates)
|
|
//
|
|
// These data can be retrieved from the following GitHub releases:
|
|
// https://github.com/lamps-wg/cms-ml-dsa/releases/tag/draft-ietf-lamps-cms-ml-dsa-07
|
|
// https://github.com/lamps-wg/dilithium-certificates/releases/tag/draft-ietf-lamps-dilithium-certificates-13
|
|
//
|
|
// Although the release tags include "draft", these values are the
|
|
// same as those in the final RFCs 9881 and 9882.
|
|
try (var cmsReader = RepositoryFileReader.of(CMS_ML_DSA.class,
|
|
"cms-ml-dsa-draft-ietf-lamps-cms-ml-dsa-07/");
|
|
var dsaReader = RepositoryFileReader.of(DILITHIUM_CERTIFICATES.class,
|
|
"dilithium-certificates-draft-ietf-lamps-dilithium-certificates-13/")) {
|
|
test(readCMS(cmsReader, "mldsa44-signed-attrs.pem"),
|
|
readCert(dsaReader, "ML-DSA-44.crt"));
|
|
test(readCMS(cmsReader, "mldsa65-signed-attrs.pem"),
|
|
readCert(dsaReader, "ML-DSA-65.crt"));
|
|
test(readCMS(cmsReader, "mldsa87-signed-attrs.pem"),
|
|
readCert(dsaReader, "ML-DSA-87.crt"));
|
|
}
|
|
}
|
|
|
|
/// Verifies a signed file.
|
|
/// @param data the signed data in PKCS #7 format
|
|
/// @param cert the certificate used to verify
|
|
static void test(byte[] data, X509Certificate cert) throws Exception {
|
|
var p7 = new PKCS7(data);
|
|
for (var si : p7.getSignerInfos()) {
|
|
Asserts.assertTrue(p7.verify(si, null, cert).getIssuerName() != null);
|
|
}
|
|
}
|
|
|
|
// Read data in https://datatracker.ietf.org/doc/html/rfc9882#name-examples
|
|
static byte[] readCMS(RepositoryFileReader f, String entry) throws IOException {
|
|
var data = f.read("examples/" + entry);
|
|
var pem = new BufferedReader(new InputStreamReader(new ByteArrayInputStream(data)))
|
|
.lines()
|
|
.filter(s -> !s.contains("-----"))
|
|
.collect(Collectors.joining());
|
|
return Base64.getMimeDecoder().decode(pem);
|
|
}
|
|
|
|
// Read data in https://datatracker.ietf.org/doc/html/rfc9881#name-example-certificates
|
|
static X509Certificate readCert(RepositoryFileReader f, String entry) throws Exception {
|
|
var data = f.read("examples/" + entry);
|
|
var cf = CertificateFactory.getInstance("X.509");
|
|
return (X509Certificate) cf.generateCertificate(new ByteArrayInputStream(data));
|
|
}
|
|
}
|