SpringCloud/spring-cloud-commons
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Housekeeping with KeyProperties - change default settings

Browse Source 
N.B. this change will make existing encrypted properties undecryptable.
User would need to explicitly configure the old defaults for
encrypt.rsa.algorithm=DEFAULT and encrypt.rsa.strong=false.
This commit is contained in:
Dave Syer
2017-12-27 08:55:03 +00:00
parent 17adaf51d2
commit aef42a65f3
2 changed files with 17 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
spring-cloud-context/src/main/java/org/springframework/cloud/bootstrap/encrypt/EncryptionBootstrapConfiguration.java
View File

@@ -32,7 +32,6 @@ import org.springframework.core.env.Environment;
import org.springframework.core.type.AnnotatedTypeMetadata;
import org.springframework.security.crypto.encrypt.TextEncryptor;
import org.springframework.security.rsa.crypto.KeyStoreKeyFactory;
import org.springframework.security.rsa.crypto.RsaAlgorithm;
import org.springframework.security.rsa.crypto.RsaSecretEncryptor;
import org.springframework.util.StringUtils;
@@ -68,15 +67,15 @@ public class EncryptionBootstrapConfiguration {
return new RsaSecretEncryptor(
new KeyStoreKeyFactory(keyStore.getLocation(),
keyStore.getPassword().toCharArray()).getKeyPair(
keyStore.getAlias(),
keyStore.getSecret().toCharArray()),
RsaAlgorithm.valueOf(this.key.getRsa().getAlgorithm()), this.key.getRsa().getSalt(),
keyStore.getAlias(),
keyStore.getSecret().toCharArray()),
this.key.getRsa().getAlgorithm(), this.key.getRsa().getSalt(),
this.key.getRsa().isStrong());
}
}
throw new IllegalStateException("Invalid keystore location");
}
return new EncryptorFactory().create(this.key.getKey());
}

21
spring-cloud-context/src/main/java/org/springframework/cloud/bootstrap/encrypt/KeyProperties.java
View File

@@ -17,6 +17,7 @@ package org.springframework.cloud.bootstrap.encrypt;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.core.io.Resource;
import org.springframework.security.rsa.crypto.RsaAlgorithm;
import org.springframework.util.ClassUtils;
@ConfigurationProperties("encrypt")
@@ -45,7 +46,8 @@ public class KeyProperties {
private Rsa rsa;
{
if (ClassUtils.isPresent("org.springframework.security.rsa.crypto.RsaAlgorithm", null)) {
if (ClassUtils.isPresent("org.springframework.security.rsa.crypto.RsaAlgorithm",
null)) {
this.rsa = new Rsa();
}
}
@@ -137,19 +139,18 @@ public class KeyProperties {
public static class Rsa {
/**
* The RSA algorithm to use (DEFAULT or OEAP). Once it is set do not change it (or
* The RSA algorithm to use (DEFAULT or OAEP). Once it is set do not change it (or
* existing ciphers will not a decryptable).
*/
//TODO: move from String to RsaAlgorithm
private String algorithm = "DEFAULT";
private RsaAlgorithm algorithm = RsaAlgorithm.OAEP;
/**
* Flag to indicate that "strong" AES encryption should be used internally. If
* true then the GCM algorithm is applied to the AES encrypted bytes. Default is
* false (in which case "standard" CBC is used instead). Once it is set do not
* change it (or existing ciphers will not a decryptable).
* true then the GCM algorithm is applied to the AES encrypted bytes. If false
* then the "standard" CBC is used instead. Once it is set do not change it (or
* existing ciphers will not a decryptable).
*/
private boolean strong = false;
private boolean strong = true;
/**
* Salt for the random secret used to encrypt cipher text. Once it is set do not
@@ -157,11 +158,11 @@ public class KeyProperties {
*/
private String salt = "deadbeef";
public String getAlgorithm() {
public RsaAlgorithm getAlgorithm() {
return this.algorithm;
}
public void setAlgorithm(String algorithm) {
public void setAlgorithm(RsaAlgorithm algorithm) {
this.algorithm = algorithm;
}