Securing keystores II

So in Securing Keystores I, I discussed wrapping keys using the key wrap techniques in the rfc3394 specification. However, I left something out of that article... the wrapping class.

Below is a partial listing for the class that handles this work the RSA Encrypter. One thing to notice is the embedded public and private key. This "ties" the keystore to the class. To do an offline attack, not only would you have to have the encrypted files, the keystore and the keystore password, you would also have to have this class to be able to unwrap the keys. This goes against the conventional notion of embedding keys in software.

snip...

import java.io.InputStream;
import java.io.ByteArrayInputStream;
import java.io.OutputStream;
import java.io.ByteArrayOutputStream;
import java.io.IOException;


import java.util.Arrays;

import javax.crypto.Cipher;
import javax.crypto.CipherInputStream;
import javax.crypto.CipherOutputStream;
import javax.crypto.SecretKey;

import com.Ostermiller.util.Base64;

import java.security.PublicKey;
import java.security.PrivateKey;
import java.security.Key;

import java.security.KeyFactory;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;

import net.app.exception.AppException;


public class RsaEncrypter {

private Cipher ecipher;
private Cipher dcipher;
private PublicKey publicKey;
private PrivateKey privateKey;


public  RsaEncrypter(PublicKey aPublicKey, PrivateKey aPrivateKey) throws AppException
{        
try {

if ((aPublicKey == null) && (aPrivateKey == null))
{

byte[] base64PublicKey = {'M','I','I','B','I','j','A','N','B','g','k','q','h','k','i','G','9','w','0','B','A','Q','E','F','A','A','O','C','A','Q','8','A','M','I','I','B','C','g','K','C','A','Q','E','A','q','m','j','X','K','m','l','s','U','G','y','5','Q','g','h','Q','u','R','0','I','Z','g','O','d','1','W','Q','Z','e','O','i','j',
'a','X','a','z','J','p','Z','U','b','+','k','2','E','g','l','y','O','q','V','D','i','d','k','Z','f','0','C','1','Z','J','D','+','W','l','K','F','f','Q','J','2','P','B','U','v','A','p','7','u','f','9','E','f','i','w','T','N','B','B','m','3','J','q','7','R','G','L','N','a','+','g','s','F','9','f','n','+',
'b','/','r','6','P','h','Z','l','7','W','i','Z','c','I','u','x','D','q','x','Y','Z','M','Y','t','6','r','0','6','l','3','Y','x','l','/','j','5','h','q','M','e','B','D','E','F','X','k','x','h','6','6','A','o','3','9','z','a','7','N','0','O','q','X','B','/','c','E','U','P','D','s','v','Z','d','d','E','N',
'S','E','1','o','/','5','c','g','v','+','y','V','O','W','C','6','C','4','E','h','6','5','l','R','N','N','W','l','k','8','r','4','g','p','+','3','u','R','d','+','i','e','U','K','f','h','v','i','E','k','b','q','o','q','c','5','B','2','y','J','K','i','v','u','J','C','B','Y','V','n','d','7','3','w','n','R',
'G','1','Y','/','a','9','a','w','Q','E','8','N','y','z','h','p','U','B','E','U','b','M','v','d','Z','G','I','Y','E','r','5','X','y','H','b','j','6','Z','R','X','V','V','E','T','/','l','S','g','/','E','Q','d','O','+','4','V','e','g','W','X','J','v','A','n','b','4','d','m','O','t','9','x','A','Q','4','z',
'Z','m','y','B','J','w','I','D','A','Q','A','B'}    

byte[] base64PrivateKey = {'M','I','I','E','v','A','I','B','A','D','A','N','B','g','k','q','h','k','i','G','9','w','0','B','A','Q','E','F','A','A','S','C','B','K','Y','w','g','g','S','i','A','g','E','A','A','o','I','B','A','Q','C','q','a','N','c','q','a','W','x','Q','b','L','l','C','C','F','C','5','H','Q','h','m','A','5','3','V',
'Z','B','l','4','6','K','N','p','d','r','M','m','l','l','R','v','6','T','Y','S','C','X','I','6','p','U','O','J','2','R','l','/','Q','L','V','k','k','P','5','a','U','o','V','9','A','n','Y','8','F','S','8','C','n','u','5','/','0','R','+','L','B','M','0','E','G','b','c','m','r','t','E','Y','s','1','r','6',
'C','w','X','1','+','f','5','v','+','v','o','+','F','m','X','t','a','J','l','w','i','7','E','O','r','F','h','k','x','i','3','q','v','T','q','X','d','j','G','X','+','P','m','G','o','x','4','E','M','Q','V','e','T','G','H','r','o','C','j','f','3','N','r','s','3','Q','6','p','c','H','9','w','R','Q','8','O',
'y','9','l','1','0','Q','1','I','T','W','j','/','l','y','C','/','7','J','U','5','Y','L','o','L','g','S','H','r','m','V','E','0','1','a','W','T','y','v','i','C','n','7','e','5','F','3','6','J','5','Q','p','+','G','+','I','S','R','u','q','i','p','z','k','H','b','I','k','q','K','+','4','k','I','F','h','W',
'd','3','v','f','C','d','E','b','V','j','9','r','1','r','B','A','T','w','3','L','O','G','l','Q','E','R','R','s','y','9','1','k','Y','h','g','S','v','l','f','I','d','u','P','p','l','F','d','V','U','R','P','+','V','K','D','8','R','B','0','7','7','h','V','6','B','Z','c','m','8','C','d','v','h','2','Y','6',
'3','3','E','B','D','j','N','m','b','I','E','n','A','g','M','B','A','A','E','C','g','g','E','A','d','t','Z','M','D','q','i','c','P','2','3','C','t','9','j','i','q','m','U','j','w','T','i','O','b','g','y','z','c','s','0','R','g','G','+','l','u','a','g','m','V','D','D','X','Y','z','a','x','M','V','K','k',
'y','d','H','b','Z','R','G','0','L','e','C','r','c','E','O','S','E','b','6','Q','w','4','+','m','S','/','a','X','r','g','0','h','K','S','p','8','6','n','o','g','b','l','q','F','O','O','u','C','6','1','K','a','o','p','H','n','L','S','J','i','N','s','A','Z','7','r','j','+','I','C','1','a','m','T','f','5',
'I','L','X','P','u','Z','6','i','6','J','M','l','P','K','0','F','H','i','5','M','t','X','G','W','I','8','+','y','j','c','Y','Q','G','y','W','C','i','q','I','S','I','n','h','J','/','s','R','K','l','r','T','L','p','o','4','W','Q','q','M','k','v','N','F','v','y','c','Q','X','2','9','2','h','a','t','n','Y',
'I','N','f','q','M','w','9','s','5','u','t','A','t','D','A','t','0','d','o','q','e','c','O','t','e','9','U','p','P','v','z','+','O','l','H','Y','h','v','j','f','Q','t','R','j','K','D','i','N','D','f','g','0','C','U','O','H','K','E','b','z','G','G','3','Y','F','7','n','b','k','Z','s','x','e','4','e','Q',
'3','D','p','f','K','R','M','C','7','Y','j','u','M','S','P','+','C','c','8','a','m','t','X','m','F','m','H','Z','F','r','n','d','M','W','Y','x','e','T','k','3','t','4','w','5','s','3','a','v','o','5','4','y','e','c','a','Z','4','t','1','G','i','Q','K','B','g','Q','D','x','8','9','a','V','G','b','I','z',
'L','H','E','L','K','7','P','G','r','x','w','z','A','M','I','P','a','b','U','R','t','C','n','F','G','a','A','p','m','F','+','O','L','T','q','L','r','d','s','M','l','B','w','F','o','g','5','3','f','n','u','P','L','x','4','O','l','j','p','7','6','D','J','U','o','z','f','B','5','Y','c','N','w','2','d','E',
'1','/','K','V','C','P','Q','y','/','U','1','L','y','0','p','P','5','v','7','Y','S','h','/','e','H','M','b','+','A','i','8','B','S','+','m','2','S','K','2','T','z','q','t','a','z','N','g','n','E','E','Z','q','D','I','d','1','W','H','9','K','D','J','r','x','U','P','+','u','B','K','S','2','q','m','N','y',
'C','M','s','X','2','R','F','P','c','w','K','B','g','Q','C','0','T','a','c','d','l','z','O','6','Q','8','l','M','a','P','Y','m','Z','S','u','0','d','0','M','G','d','s','j','5','Q','B','3','Q','a','A','/','j','+','B','G','D','Y','G','b','a','k','L','q','Y','4','j','9','d','Z','F','s','m','5','n','M','1',
't','X','q','f','K','l','S','D','f','Y','k','d','v','J','9','j','7','4','g','D','3','Y','P','2','P','r','4','x','V','c','X','L','w','C','B','0','A','7','m','o','v','9','E','0','5','h','k','d','P','e','+','8','h','K','F','b','l','5','s','q','9','O','p','1','/','Q','a','j','S','s','3','N','v','t','S','k',
'F','P','E','L','x','s','H','U','i','0','v','N','I','u','W','m','q','W','D','B','a','3','5','m','A','H','N','w','M','S','r','y','f','Q','K','B','g','F','D','R','d','T','T','a','n','3','a','O','e','r','g','T','g','f','p','0','1','Y','O','H','1','k','q','V','s','a','D','X','Q','D','i','R','J','b','m','f',
'J','x','P','z','s','a','G','k','k','g','2','y','j','2','W','m','S','x','T','J','D','/','a','0','8','2','J','F','9','g','U','b','e','2','x','g','F','K','j','U','x','X','b','o','d','V','8','+','j','s','4','P','b','p','p','1','l','9','M','g','d','Z','M','Z','A','r','k','2','k','U','x','8','6','k','9','A',
'Z','X','k','W','Z','V','u','5','D','R','n','Z','J','8','2','t','r','O','n','n','e','s','3','D','n','5','+','n','z','u','T','q','L','v','s','6','Z','h','0','3','e','d','l','2','M','r','+','N','h','m','F','R','5','Y','F','X','A','o','G','A','Q','3','3','d','1','I','H','I','5','y','y','A','q','Y','2','Q',
't','o','a','g','e','Y','k','7','G','a','x','V','R','p','f','t','k','R','m','i','+','R','7','e','z','2','L','C','n','Y','Y','X','k','y','r','9','t','S','P','f','y','w','v','w','j','G','Z','G','Z','F','Y','g','F','K','h','l','L','z','B','w','K','a','R','8','M','Z','Y','1','0','3','N','h','F','m','6','Y',
'/','9','A','H','V','e','Y','f','F','T','/','Y','P','A','j','1','1','b','B','d','k','R','/','E','l','t','i','F','S','O','s','s','6','M','W','y','O','m','X','B','7','A','Z','G','6','r','S','8','F','k','B','s','R','f','d','u','h','H','d','P','p','7','c','3','d','K','+','c','P','O','p','m','S','9','T','b',
'0','r','E','C','g','Y','B','I','p','z','w','l','r','P','n','S','7','R','p','7','Z','y','7','U','R','m','Y','J','9','c','h','t','f','/','q','1','q','D','d','P','q','J','v','w','/','/','q','5','q','E','1','m','A','K','3','u','T','G','t','e','x','Z','x','F','q','g','2','m','Z','R','n','c','g','w','T','Y',
'X','1','B','g','D','k','0','7','Y','4','H','s','Q','3','A','F','T','S','0','H','x','h','J','f','U','Y','f','M','4','u','O','p','5','J','Y','Q','B','+','Z','8','o','Z','b','X','3','2','d','U','9','6','q','Z','f','L','5','Q','J','P','Y','h','r','O','H','b','i','i','8','x','O','I','r','N','G','T','O','Z',
'x','R','z','D','G','O','y','y','B','Z','q','a','0','5','D','0','T','n','/','Y','f','B','r','8','e','Q','=','='}


byte[] pubKeyBytes = Base64.decode(base64PublicKey);
byte[] privKeyBytes = Base64.decode(base64PrivateKey);

X509EncodedKeySpec publicKeySpec = new X509EncodedKeySpec(pubKeyBytes);
PKCS8EncodedKeySpec privateKeySpec = new PKCS8EncodedKeySpec(privKeyBytes);

KeyFactory rsaKeyFactory = KeyFactory.getInstance("RSA");
this.setPrivateKey( (PrivateKey)rsaKeyFactory.generatePrivate(privateKeySpec) );        
this.setPublicKey( (PublicKey)rsaKeyFactory.generatePublic(publicKeySpec) );
}
else
{    
this.setPrivateKey( aPrivateKey  );        
this.setPublicKey( aPublicKey );                    
}

// Instantiate the Ciphers
ecipher = Cipher.getInstance("RSA");
dcipher = Cipher.getInstance("RSA");

ecipher.init(Cipher.ENCRYPT_MODE, publicKey);
dcipher.init(Cipher.DECRYPT_MODE, privateKey);

}
catch (Exception e)
{
System.out.println("Error: " + e.getMessage());
e.printStackTrace();
throw new AppException("Could not instantiate the RSA Encryption utility: " + e.getMessage());
}
}

public byte[] wrapKey(Key key) throws AppException
{ 
try
{
ecipher.init(Cipher.WRAP_MODE, publicKey);
return ecipher.wrap(key);

}
catch (Exception e)
{
System.out.println("Error: " + e.getMessage());
e.printStackTrace();
throw new AppException("Could not wrap the key: " + e.getMessage());
}
}

public  Key unwrapKey(byte[] key) throws AppException
{
try
{
dcipher.init(Cipher.UNWRAP_MODE, privateKey);            
return dcipher.unwrap(key, "RSA", Cipher.SECRET_KEY );

}
catch (Exception e)
{
System.out.println("Error: " + e.getMessage());
e.printStackTrace();
throw new AppException("Could not unwrap the key: " + e.getMessage());
}
}

public Cipher getEcipher()
{
return ecipher;
}

public Cipher getDcipher()
{
return dcipher;
}

public PublicKey getPublicKey()
{
return publicKey;
}

public void setPublicKey(PublicKey aPublicKey)
{
publicKey = aPublicKey;
}

public PrivateKey getPrivateKey()
{
return privateKey;
}

public void setPrivateKey(PrivateKey aPrivateKey)
{
privateKey = aPrivateKey;
}

Snip...