Skip to content

Commit 7d8601e

Browse files
tvernumtvernum
authored
[Backport] Fix parsing of PBES2 encrypted PKCS#8 keys (#79352)
This commit adds support for decrypting PKCS#8 encoded private keys that have been encrypted using a PBES2 based scheme (AES only). Unfortunately `java.crypto.EncryptedPrivateKeyInfo` doesn't make this easy as the underlying encryption algorithm is hidden within the `AlgorithmParameters`, and can only be extracted by calling `toString()` on the parameters object. See: https://datatracker.ietf.org/doc/html/rfc8018#appendix-A.4 See: AlgorithmParameters#toString() See: com.sun.crypto.provider.PBES2Parameters#toString() This support is conditional on the underlying support in the JDK, which is absent from OpenJDK 8, but should work on all other supported JDKs. Backport of: #78904
1 parent ac55614 commit 7d8601e

File tree

13 files changed

+538
-74
lines changed

13 files changed

+538
-74
lines changed

‎libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/DerParser.java

Lines changed: 45 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -36,21 +36,22 @@ final class DerParser {
3636
private static final int CONSTRUCTED = 0x20;
3737

3838
// Tag and data types
39-
private static final int INTEGER = 0x02;
40-
private static final int OCTET_STRING = 0x04;
41-
private static final int OBJECT_OID = 0x06;
42-
private static final int NUMERIC_STRING = 0x12;
43-
private static final int PRINTABLE_STRING = 0x13;
44-
private static final int VIDEOTEX_STRING = 0x15;
45-
private static final int IA5_STRING = 0x16;
46-
private static final int GRAPHIC_STRING = 0x19;
47-
private static final int ISO646_STRING = 0x1A;
48-
private static final int GENERAL_STRING = 0x1B;
49-
50-
private static final int UTF8_STRING = 0x0C;
51-
private static final int UNIVERSAL_STRING = 0x1C;
52-
private static final int BMP_STRING = 0x1E;
53-
39+
static final class Type {
40+
static final int INTEGER = 0x02;
41+
static final int OCTET_STRING = 0x04;
42+
static final int OBJECT_OID = 0x06;
43+
static final int SEQUENCE = 0x10;
44+
static final int NUMERIC_STRING = 0x12;
45+
static final int PRINTABLE_STRING = 0x13;
46+
static final int VIDEOTEX_STRING = 0x15;
47+
static final int IA5_STRING = 0x16;
48+
static final int GRAPHIC_STRING = 0x19;
49+
static final int ISO646_STRING = 0x1A;
50+
static final int GENERAL_STRING = 0x1B;
51+
static final int UTF8_STRING = 0x0C;
52+
static final int UNIVERSAL_STRING = 0x1C;
53+
static final int BMP_STRING = 0x1E;
54+
}
5455

5556
private InputStream derInputStream;
5657
private int maxAsnObjectLength;
@@ -60,6 +61,22 @@ final class DerParser {
6061
this.maxAsnObjectLength = bytes.length;
6162
}
6263

64+
/**
65+
* Read an object and verify its type
66+
* @param requiredType The expected type code
67+
* @throws IOException if data can not be parsed
68+
* @throws IllegalStateException if the parsed object is of the wrong type
69+
*/
70+
Asn1Object readAsn1Object(int requiredType) throws IOException {
71+
final Asn1Object obj = readAsn1Object();
72+
if (obj.type != requiredType) {
73+
throw new IllegalStateException(
74+
"Expected ASN.1 object of type 0x" + Integer.toHexString(requiredType) + " but was 0x" + Integer.toHexString(obj.type)
75+
);
76+
}
77+
return obj;
78+
}
79+
6380
Asn1Object readAsn1Object() throws IOException {
6481
int tag = derInputStream.read();
6582
if (tag == -1) {
@@ -207,7 +224,7 @@ public DerParser getParser() throws IOException {
207224
* @return BigInteger
208225
*/
209226
public BigInteger getInteger() throws IOException {
210-
if (type != DerParser.INTEGER)
227+
if (type != Type.INTEGER)
211228
throw new IOException("Invalid DER: object is not integer"); //$NON-NLS-1$
212229

213230
return new BigInteger(value);
@@ -218,28 +235,28 @@ public String getString() throws IOException {
218235
String encoding;
219236

220237
switch (type) {
221-
case DerParser.OCTET_STRING:
238+
case Type.OCTET_STRING:
222239
// octet string is basically a byte array
223240
return toHexString(value);
224-
case DerParser.NUMERIC_STRING:
225-
case DerParser.PRINTABLE_STRING:
226-
case DerParser.VIDEOTEX_STRING:
227-
case DerParser.IA5_STRING:
228-
case DerParser.GRAPHIC_STRING:
229-
case DerParser.ISO646_STRING:
230-
case DerParser.GENERAL_STRING:
241+
case Type.NUMERIC_STRING:
242+
case Type.PRINTABLE_STRING:
243+
case Type.VIDEOTEX_STRING:
244+
case Type.IA5_STRING:
245+
case Type.GRAPHIC_STRING:
246+
case Type.ISO646_STRING:
247+
case Type.GENERAL_STRING:
231248
encoding = "ISO-8859-1"; //$NON-NLS-1$
232249
break;
233250

234-
case DerParser.BMP_STRING:
251+
case Type.BMP_STRING:
235252
encoding = "UTF-16BE"; //$NON-NLS-1$
236253
break;
237254

238-
case DerParser.UTF8_STRING:
255+
case Type.UTF8_STRING:
239256
encoding = "UTF-8"; //$NON-NLS-1$
240257
break;
241258

242-
case DerParser.UNIVERSAL_STRING:
259+
case Type.UNIVERSAL_STRING:
243260
throw new IOException("Invalid DER: can't handle UCS-4 string"); //$NON-NLS-1$
244261

245262
default:
@@ -251,7 +268,7 @@ public String getString() throws IOException {
251268

252269
public String getOid() throws IOException {
253270

254-
if (type != DerParser.OBJECT_OID) {
271+
if (type != Type.OBJECT_OID) {
255272
throw new IOException("Ivalid DER: object is not object OID");
256273
}
257274
StringBuilder sb = new StringBuilder(64);

‎libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/PemUtils.java

Lines changed: 123 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
package org.elasticsearch.common.ssl;
1010

1111
import org.elasticsearch.core.CharArrays;
12+
import org.elasticsearch.jdk.JavaVersion;
1213

1314
import javax.crypto.Cipher;
1415
import javax.crypto.EncryptedPrivateKeyInfo;
@@ -26,6 +27,7 @@
2627
import java.nio.file.Files;
2728
import java.nio.file.NoSuchFileException;
2829
import java.nio.file.Path;
30+
import java.security.AlgorithmParameters;
2931
import java.security.GeneralSecurityException;
3032
import java.security.KeyFactory;
3133
import java.security.KeyPairGenerator;
@@ -69,6 +71,9 @@ public final class PemUtils {
6971
private static final String OPENSSL_EC_PARAMS_FOOTER = "-----END EC PARAMETERS-----";
7072
private static final String HEADER = "-----BEGIN";
7173

74+
private static final String PBES2_OID = "1.2.840.113549.1.5.13";
75+
private static final String AES_OID = "2.16.840.1.101.3.4.1";
76+
7277
private PemUtils() {
7378
throw new IllegalStateException("Utility class should not be instantiated");
7479
}
@@ -336,17 +341,81 @@ private static PrivateKey parsePKCS8Encrypted(BufferedReader bReader, char[] key
336341
}
337342
byte[] keyBytes = Base64.getDecoder().decode(sb.toString());
338343

339-
EncryptedPrivateKeyInfo encryptedPrivateKeyInfo = new EncryptedPrivateKeyInfo(keyBytes);
340-
SecretKeyFactory secretKeyFactory = SecretKeyFactory.getInstance(encryptedPrivateKeyInfo.getAlgName());
344+
final EncryptedPrivateKeyInfo encryptedPrivateKeyInfo = getEncryptedPrivateKeyInfo(keyBytes);
345+
String algorithm = encryptedPrivateKeyInfo.getAlgName();
346+
if (algorithm.equals("PBES2") || algorithm.equals("1.2.840.113549.1.5.13")) {
347+
algorithm = getPBES2Algorithm(encryptedPrivateKeyInfo);
348+
}
349+
SecretKeyFactory secretKeyFactory = SecretKeyFactory.getInstance(algorithm);
341350
SecretKey secretKey = secretKeyFactory.generateSecret(new PBEKeySpec(keyPassword));
342-
Cipher cipher = Cipher.getInstance(encryptedPrivateKeyInfo.getAlgName());
351+
Cipher cipher = Cipher.getInstance(algorithm);
343352
cipher.init(Cipher.DECRYPT_MODE, secretKey, encryptedPrivateKeyInfo.getAlgParameters());
344353
PKCS8EncodedKeySpec keySpec = encryptedPrivateKeyInfo.getKeySpec(cipher);
345354
String keyAlgo = getKeyAlgorithmIdentifier(keySpec.getEncoded());
346355
KeyFactory keyFactory = KeyFactory.getInstance(keyAlgo);
347356
return keyFactory.generatePrivate(keySpec);
348357
}
349358

359+
private static EncryptedPrivateKeyInfo getEncryptedPrivateKeyInfo(byte[] keyBytes) throws IOException, GeneralSecurityException {
360+
try {
361+
return new EncryptedPrivateKeyInfo(keyBytes);
362+
} catch (IOException e) {
363+
// The Sun JCE provider can't handle non-AES PBES2 data (but it can handle PBES1 DES data - go figure)
364+
// It's not worth our effort to try and decrypt it ourselves, but we can detect it and give a good error message
365+
DerParser parser = new DerParser(keyBytes);
366+
final DerParser.Asn1Object rootSeq = parser.readAsn1Object(DerParser.Type.SEQUENCE);
367+
parser = rootSeq.getParser();
368+
final DerParser.Asn1Object algSeq = parser.readAsn1Object(DerParser.Type.SEQUENCE);
369+
parser = algSeq.getParser();
370+
final String algId = parser.readAsn1Object(DerParser.Type.OBJECT_OID).getOid();
371+
if (PBES2_OID.equals(algId)) {
372+
final DerParser.Asn1Object algData = parser.readAsn1Object(DerParser.Type.SEQUENCE);
373+
parser = algData.getParser();
374+
final DerParser.Asn1Object ignoreKdf = parser.readAsn1Object(DerParser.Type.SEQUENCE);
375+
final DerParser.Asn1Object cryptSeq = parser.readAsn1Object(DerParser.Type.SEQUENCE);
376+
parser = cryptSeq.getParser();
377+
final String encryptionId = parser.readAsn1Object(DerParser.Type.OBJECT_OID).getOid();
378+
if (encryptionId.startsWith(AES_OID) == false) {
379+
final String name = getAlgorithmNameFromOid(encryptionId);
380+
throw new GeneralSecurityException(
381+
"PKCS#8 Private Key is encrypted with unsupported PBES2 algorithm ["
382+
+ encryptionId
383+
+ "]"
384+
+ (name == null ? "" : " (" + name + ")"),
385+
e
386+
);
387+
}
388+
if (JavaVersion.current().compareTo(JavaVersion.parse("11.0.0")) < 0) {
389+
// PBES2 appears to be supported on Oracle 8, but not OpenJDK8
390+
// We don't bother clarifying the distinction here, because it's complicated and the best advice we can give is to
391+
// use the bundled JDK.
392+
throw new GeneralSecurityException(
393+
"PKCS#8 Private Key is encrypted with PBES2 which is not supported on this JDK ["
394+
+ JavaVersion.current()
395+
+ "], this problem can be resolved by using the Elasticsearch bundled JDK",
396+
e
397+
);
398+
}
399+
}
400+
throw e;
401+
}
402+
}
403+
404+
/**
405+
* This is horrible, but it's the only option other than to parse the encoded ASN.1 value ourselves
406+
* @see AlgorithmParameters#toString() and com.sun.crypto.provider.PBES2Parameters#toString()
407+
*/
408+
private static String getPBES2Algorithm(EncryptedPrivateKeyInfo encryptedPrivateKeyInfo) {
409+
final AlgorithmParameters algParameters = encryptedPrivateKeyInfo.getAlgParameters();
410+
if (algParameters != null) {
411+
return algParameters.toString();
412+
} else {
413+
// AlgorithmParameters can be null when running on BCFIPS.
414+
// However, since BCFIPS doesn't support any PBE specs, nothing we do here would work, so we just do enough to avoid an NPE
415+
return encryptedPrivateKeyInfo.getAlgName();
416+
}
417+
}
418+
350419
/**
351420
* Decrypts the password protected contents using the algorithm and IV that is specified in the PEM Headers of the file
352421
*
@@ -575,7 +644,7 @@ private static String getKeyAlgorithmIdentifier(byte[] keyBytes) throws IOExcept
575644
return "EC";
576645
}
577646
throw new GeneralSecurityException("Error parsing key algorithm identifier. Algorithm with OID [" + oidString +
578-
"] is not żsupported");
647+
"] is not supported");
579648
}
580649

581650
public static List<Certificate> readCertificates(Collection<Path> certPaths) throws CertificateException, IOException {
@@ -593,6 +662,56 @@ public static List<Certificate> readCertificates(Collection<Path> certPaths) thr
593662
return certificates;
594663
}
595664

665+
private static String getAlgorithmNameFromOid(String oidString) throws GeneralSecurityException {
666+
switch (oidString) {
667+
case "1.2.840.10040.4.1":
668+
return "DSA";
669+
case "1.2.840.113549.1.1.1":
670+
return "RSA";
671+
case "1.2.840.10045.2.1":
672+
return "EC";
673+
case "1.3.14.3.2.7":
674+
return "DES-CBC";
675+
case "2.16.840.1.101.3.4.1.1":
676+
return "AES-128_ECB";
677+
case "2.16.840.1.101.3.4.1.2":
678+
return "AES-128_CBC";
679+
case "2.16.840.1.101.3.4.1.3":
680+
return "AES-128_OFB";
681+
case "2.16.840.1.101.3.4.1.4":
682+
return "AES-128_CFB";
683+
case "2.16.840.1.101.3.4.1.6":
684+
return "AES-128_GCM";
685+
case "2.16.840.1.101.3.4.1.21":
686+
return "AES-192_ECB";
687+
case "2.16.840.1.101.3.4.1.22":
688+
return "AES-192_CBC";
689+
case "2.16.840.1.101.3.4.1.23":
690+
return "AES-192_OFB";
691+
case "2.16.840.1.101.3.4.1.24":
692+
return "AES-192_CFB";
693+
case "2.16.840.1.101.3.4.1.26":
694+
return "AES-192_GCM";
695+
case "2.16.840.1.101.3.4.1.41":
696+
return "AES-256_ECB";
697+
case "2.16.840.1.101.3.4.1.42":
698+
return "AES-256_CBC";
699+
case "2.16.840.1.101.3.4.1.43":
700+
return "AES-256_OFB";
701+
case "2.16.840.1.101.3.4.1.44":
702+
return "AES-256_CFB";
703+
case "2.16.840.1.101.3.4.1.46":
704+
return "AES-256_GCM";
705+
case "2.16.840.1.101.3.4.1.5":
706+
return "AESWrap-128";
707+
case "2.16.840.1.101.3.4.1.25":
708+
return "AESWrap-192";
709+
case "2.16.840.1.101.3.4.1.45":
710+
return "AESWrap-256";
711+
}
712+
return null;
713+
}
714+
596715
private static String getEcCurveNameFromOid(String oidString) throws GeneralSecurityException {
597716
switch (oidString) {
598717
// see https://tools.ietf.org/html/rfc5480#section-2.1.1.1

0 commit comments

Comments
 (0)