Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Load algorithm parameters from PEM encoded 'EC PRIVATE KEY' files

Browse Source 
Update `PrivateKeyParser` implementations so that algorithm parameters
for PEM encoded 'EC PRIVATE KEY' files are loaded from the incoming
data.

Prior to this commit, the algorithm parameter was hard-coded to
'secp384r1' which could result in a mismatch to the actual file
content.

Fixes gh-34232
This commit is contained in:
Phillip Webb
2023-08-31 19:24:43 -07:00
parent 80cb21e800
commit fd8cb74b46
8 changed files with 315 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
spring-boot-project/spring-boot-tools/spring-boot-buildpack-platform/src/test/java/org/springframework/boot/buildpack/platform/docker/ssl/PemFileWriter.java
View File

@@ -82,7 +82,13 @@ public class PemFileWriter {
+ "wSKcVTdEdO2DhBlYddN0zG0rjq4vDMtdmldEl4BdldQ=\n" + "-----END RSA PRIVATE KEY-----\n";
public static final String PRIVATE_EC_KEY = EXAMPLE_SECRET_QUALIFIER + "-----BEGIN EC PRIVATE KEY-----\n"
+ "MHcCAQEEIIwZkO8Zjbggzi8wwrk5rzSPzUX31gqTRhBYw4AL6w44oAoGCCqGSM49\n"
+ "MIGkAgEBBDB21WGGOb1DokKW0MUHO7RQ6jZSUYXfO2iyfCbjmSJhyK8fSuq1V0N2\n"
+ "Bj7X+XYhS6ygBwYFK4EEACKhZANiAATsRaYri/tDMvrrB2NJlxWFOZ4YBLYdSM+a\n"
+ "FlGh1FuLjOHW9cx8w0iRHd1Hxn4sxqsa62KzGoCj63lGoaJgi67YNCF0lBa/zCLy\n"
+ "ktaMsQePDOR8UR0Cfi2J9bh+IjxXd+o=\n" + "-----END EC PRIVATE KEY-----";
public static final String PRIVATE_EC_KEY_PRIME_256_V1 = EXAMPLE_SECRET_QUALIFIER
+ "-----BEGIN EC PRIVATE KEY-----\n" + "MHcCAQEEIIwZkO8Zjbggzi8wwrk5rzSPzUX31gqTRhBYw4AL6w44oAoGCCqGSM49\n"
+ "AwEHoUQDQgAE8y28khug747bA68M90IAMCPHAYyen+RsN6i84LORpNDUhv00QZWd\n"
+ "hOhjWFCQjnewR98Y8pEb1fnORll4LhHPlQ==\n" + "-----END EC PRIVATE KEY-----";

19
spring-boot-project/spring-boot-tools/spring-boot-buildpack-platform/src/test/java/org/springframework/boot/buildpack/platform/docker/ssl/PrivateKeyParserTests.java
View File

@@ -22,6 +22,7 @@ import java.net.URISyntaxException;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.security.PrivateKey;
import java.security.interfaces.ECPrivateKey;
import org.junit.jupiter.api.AfterEach;
import org.junit.jupiter.api.BeforeEach;
@@ -89,17 +90,27 @@ class PrivateKeyParserTests {
Path path = this.fileWriter.writeFile("key.pem", PemFileWriter.PRIVATE_RSA_KEY);
PrivateKey privateKey = PrivateKeyParser.parse(path);
assertThat(privateKey).isNotNull();
// keys in PKCS#1 format are converted to PKCS#8 for parsing
assertThat(privateKey.getFormat()).isEqualTo("PKCS#8");
}
@Test
void parsePkcs1EcKeyFile() throws IOException {
void parsePemEcKeyFile() throws IOException {
Path path = this.fileWriter.writeFile("key.pem", PemFileWriter.PRIVATE_EC_KEY);
PrivateKey privateKey = PrivateKeyParser.parse(path);
ECPrivateKey privateKey = (ECPrivateKey) PrivateKeyParser.parse(path);
assertThat(privateKey).isNotNull();
// keys in PKCS#1 format are converted to PKCS#8 for parsing
assertThat(privateKey.getFormat()).isEqualTo("PKCS#8");
assertThat(privateKey.getAlgorithm()).isEqualTo("EC");
assertThat(privateKey.getParams().toString()).contains("1.3.132.0.34").doesNotContain("prime256v1");
}
@Test
void parsePemEcKeyFilePrime256v1() throws IOException {
Path path = this.fileWriter.writeFile("key.pem", PemFileWriter.PRIVATE_EC_KEY_PRIME_256_V1);
ECPrivateKey privateKey = (ECPrivateKey) PrivateKeyParser.parse(path);
assertThat(privateKey).isNotNull();
assertThat(privateKey.getFormat()).isEqualTo("PKCS#8");
assertThat(privateKey.getAlgorithm()).isEqualTo("EC");
assertThat(privateKey.getParams().toString()).contains("prime256v1").doesNotContain("1.3.132.0.34");
}
@Test