午夜精品久久久久久99热软件,韩日一区二区三区,精品一区二区av

重新实现JCAPI的JCE Provider

david.turing — Tue, 18 Jul 2006 04:06:00 GMT

The Pheox JCAPI (http://pheox.com/download) 提供一个JCE Provider可以直接操作Microsoft 操作�pȝ��本地证书�?�U�钥的。JCAPI用一个jcapi.dll��装了这些复杂性，�q�个dll负责调用Windows内置的CSP来完成加密签名哈希等密码�q�算�?br />JCAPI.DLL属于轻量�U�的中间层类库，它让Java开发者免��d��待CSP的细节，比如获得一个CSP的Handle�?br />JCAPI.dll提供了下面的JNI调用�Q?br />

00000001    10002AA0    _Java_com_pheox_jcapi_CoreCipherJNI_decrypt@24
00000002    100021A0    _Java_com_pheox_jcapi_CoreCipherJNI_encrypt@20
00000003    100027A0    _Java_com_pheox_jcapi_CoreCipherJNI_encryptWithPrivateKey@20
00000004    10001E10    _Java_com_pheox_jcapi_CoreCipherJNI_getPrivateKeySize@12
00000005    10003610    _Java_com_pheox_jcapi_CoreKeyStoreJNI_aliases@16
00000006    100039D0    _Java_com_pheox_jcapi_CoreKeyStoreJNI_containsAlias@12
00000007    10005E50    _Java_com_pheox_jcapi_CoreKeyStoreJNI_createBase64Hash@12
00000008    10003B30    _Java_com_pheox_jcapi_CoreKeyStoreJNI_deleteEntry@12
00000009    10003DA0    _Java_com_pheox_jcapi_CoreKeyStoreJNI_getCertificate@12
0000000A    10003FE0    _Java_com_pheox_jcapi_CoreKeyStoreJNI_getCertificateChain@20
0000000B    10004530    _Java_com_pheox_jcapi_CoreKeyStoreJNI_getKey@12
0000000C    10004C00    _Java_com_pheox_jcapi_CoreKeyStoreJNI_isKeyEntry@12
0000000D    10004E00    _Java_com_pheox_jcapi_CoreKeyStoreJNI_setCertificateEntry@16
0000000E    10005020    _Java_com_pheox_jcapi_CoreKeyStoreJNI_setKeyEntry@44
0000000F    10005CA0    _Java_com_pheox_jcapi_CoreKeyStoreJNI_size@16
00000010    100062A0    _Java_com_pheox_jcapi_CoreSignatureJNI_hashFinal@12
00000011    10005F80    _Java_com_pheox_jcapi_CoreSignatureJNI_hashInit@12
00000012    10006140    _Java_com_pheox_jcapi_CoreSignatureJNI_hashUpdate@16
00000013    10006430    _Java_com_pheox_jcapi_CoreSignatureJNI_sign@28
00000014    10006F60    _Java_com_pheox_jcapi_CoreSignatureJNI_verify@28
00000015    10007CF0    _Java_com_pheox_jcapi_CoreUtilJNI_addPKCS11CSP@16
00000016    10007880    _Java_com_pheox_jcapi_CoreUtilJNI_createCertEntryStore@8
00000017    10007C20    _Java_com_pheox_jcapi_CoreUtilJNI_getAddedPKCS11CSPs@8
00000018    100078E0    _Java_com_pheox_jcapi_CoreUtilJNI_getCSP@12
00000019    10008F10    _Java_com_pheox_jcapi_CoreUtilJNI_getCertStoreFriendlyName@12
0000001A    100089C0    _Java_com_pheox_jcapi_CoreUtilJNI_getCertificateFriendlyName@12
0000001B    10007500    _Java_com_pheox_jcapi_CoreUtilJNI_getJCAPIDLLVersion@8
0000001C    10007520    _Java_com_pheox_jcapi_CoreUtilJNI_getMSCSPs@8
0000001D    10009010    _Java_com_pheox_jcapi_CoreUtilJNI_getMSCertStoreNames@8
0000001E    10007E20    _Java_com_pheox_jcapi_CoreUtilJNI_getPKCS11DLLName@12
0000001F    100083F0    _Java_com_pheox_jcapi_CoreUtilJNI_getPKCS11TokenInfo@12
00000020    10007B50    _Java_com_pheox_jcapi_CoreUtilJNI_getSupportedPKCS11CSPs@8
00000021    100077A0    _Java_com_pheox_jcapi_CoreUtilJNI_init@12
00000022    10007F40    _Java_com_pheox_jcapi_CoreUtilJNI_isPKCS11PrivateKey@12
00000023    10007D90    _Java_com_pheox_jcapi_CoreUtilJNI_removePKCS11CSP@12
00000024    10008F90    _Java_com_pheox_jcapi_CoreUtilJNI_reportMemStatus@8
00000025    10008360    _Java_com_pheox_jcapi_CoreUtilJNI_setCallbackPinCode@12
00000026    100083B0    _Java_com_pheox_jcapi_CoreUtilJNI_setCertOpenStoreFlags@12
00000027    10008C80    _Java_com_pheox_jcapi_CoreUtilJNI_setCertificateFriendlyName@16

它调用的�c�d��其实�q�是crypt32.dll和ADVAPI32.dll.

crypt32.dll:
0000002C    CertEnumSystemStore
00000041    CertGetCertificateContextProperty
0000008B    CryptFindLocalizedName
00000056    CertRegisterSystemStore
00000097    CryptHashCertificate
00000061    CertSetCertificateContextProperty
00000019    CertCreateCertificateContext
00000004    CertAddCertificateContextToStore
00000044    CertGetIssuerCertificateFromStore
0000001E    CertDeleteCertificateFromStore
00000029    CertEnumCertificatesInStore
0000007C    CryptDecodeObject
0000009C    CryptImportPublicKeyInfo
00000050    CertOpenStore
00000032    CertFindCertificateInStore
0000000F    CertCloseStore
0000003C    CertFreeCertificateContext

导入, ADVAPI32.dll
��序 (�C�意)    名字
000000A8    CryptSignHashA
00000099    CryptGetHashParam
0000008B    CryptDestroyHash
0000009D    CryptHashData
00000088    CryptCreateHash
00000094    CryptExportKey
00000089    CryptDecrypt
0000009F    CryptImportKey
0000008F    CryptEncrypt
0000009C    CryptGetUserKey
0000009A    CryptGetKeyParam
0000008C    CryptDestroyKey
00000085    CryptAcquireContextA
000000A0    CryptReleaseContext
000000AA    CryptVerifySignatureA
00000092    CryptEnumProvidersA
000001C9    RegCloseKey
000001EC    RegQueryValueExA
000001F9    RegSetValueExA
000001CD    RegCreateKeyExA
000001E2    RegOpenKeyExA
000000A1    CryptSetHashParam

在标准的CryptoAPI函数上的��装是有必要的，因�ؓ从Java�E�序员的角度�Q�我们不需要太兛_��CSP�Q�我们希望直接进行Cryptography�q�算�?br />
JCAPI�q�个provider提供3个SPI的实玎ͼ�

java.security.KeyStoreSpi

java.security.SignatureSpi

javax.crypto.CipherSpi

也就是，我们通过Java应用�E�序可以直接借助于JCE API来调用CryptoAPI�?

�q�个JCE API��法支持下面的基本操�?/p>

Add, remove, list and access X.509 certificates.
Add, remove, access and export RSA private keys.
Create signatures with RSA private keys using the following algorithms:
- SHA1withRSA
- MD5withRSA
- MD2withRSA
Verify signatures with RSA public keys.
Encrypt/decrypt data with RSA public/private keys using the following algorithm, mode and padding:
- RSA/ECB/PKCS1Padding
Wrap and unwrap symmetric- and asymmetric keys with RSA key pairs through MS CAPI and PKCS#11.
Built-in support for tested PKCS#11 CSP manufacturers that is compliant with the functions required by JCAPI.
Dynamically adding/removing of PKCS#11 CSPs into JCAPI.
Private key call-back interface for PKCS#11 providers. You can provide your own preferred Java call-back implementation to be called whenever a private key is accessed through PKCS#11.
List and configure MS CAPI system (certificate) stores.
Use a MS CAPI system (certificate) store as an un-trusted store.
Set and get MS CAPI friendly names for certificates.
Get MS CAPI friendly names for system (certificate) stores.
Get detailed information about your PKCS#11 hardware token through the JCAPI PKCS#11 information class.
Use JCAPI supported plug-ins. A JCAPI plug-in is a signed JAR file that extends or enhances the functionality of JCAPI without the need of recompiling JCAPI.
JCAPI SSL plugin. Use this plug-in to simplify the work of integrating the JCAPI key store for SSL enabled applications. The plug-in transparently supports both the old JSSE version for Java 1.3, and the newer versions included in Java 1.4 and higher. This plug-in transparently supports the PKCS#11 implementation as defined in Java 5. Your JCAPI supported hardware keys can be plugged in and used immediately for SSL. JCAPI will automatically configure the token for you by setting the correct slot identity to use etc.
JCAPI X.509 Factory plug-in. Use this plug-in to transparently replace any other X.509 certificate factories used by your Java system.
JCAPI is signed with a qualified code signing certificate that is trusted by all modern web browsers which makes it suitable in trusted applets.

JCE API支持一下的�pȝ��Q�我只是在Windows2000上测试通过�Q�其他��^台我不能保证破解能正�怋�用�?

Windows 98
Windows 98 SE
Windows ME
Windows 2000
Windows XP

JCE 支持JDK1.4以上�Q�JDK1.3�E�微为麻烦，要自己配制JCE和JSSE

Java 1.3.1 with JCE 1.2.2 and JSSE 1.0.3
Java 1.4
Java 1.5

我已�l�在吉大正元的eSafe钥匙上通过��试�Q�其他钥匙提供商可以发邮件给我，或者给Usb钥匙我去��试�?br />
JCAPI的时间限制比较容易去除，但由于JNI层以上的代码做了大量��h��Q�我不得不重写这个JCE Provider�Q�最��L��要实�?font face="Courier New">KeyStoreSpi�Q�SignatureSpi和CipherSpi�?/font>

JCAPI的JCE Provider我将会在下个月提�?/p>

david.turing 2006-07-18 12:06 发表评论

How to use Java produce Signature by USBKey under CryptoAPI/CSP

david.turing — Tue, 11 Jul 2006 05:24:00 GMT

摘要: How to use Java produce Signature by USBKey under CryptoAPI/CSP. 阅读全文

david.turing 2006-07-11 13:24 发表评论

Hacking getcsp of pheox

david.turing — Tue, 04 Jul 2006 14:52:00 GMT

package com.pheox.jcapi.test;

import com.pheox.jcapi.CoreSignatureJNI;
import com.pheox.jcapi.CoreUtilJNI;
import com.pheox.jcapi.JCAPIJNIException;

public class getcsp {

    public static void main(String[] args) {

//        String g = "MIIDrTCCA2ugAwIBAgICAeYwCwYHKoZIzjgEAwUAMIGQMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExEjAQBgNVBAcTCVBhbG8gQWx0bzEdMBsGA1UEChMUU3VuIE1pY3Jvc3lzdGVtcyBJbmMxIzAhBgNVBAsTGkphdmEgU29mdHdhcmUgQ29kZSBTaWduaW5nMRwwGgYDVQQDExNKQ0UgQ29kZSBTaWduaW5nIENBMB4XDTA1MDEyMTIyNDc1MloXDTEwMDEyNTIyNDc1MlowVDEdMBsGA1UEChMUU3VuIE1pY3Jvc3lzdGVtcyBJbmMxIzAhBgNVBAsTGkphdmEgU29mdHdhcmUgQ29kZSBTaWduaW5nMQ4wDAYDVQQDEwVQaGVveDCCAbgwggEsBgcqhkjOOAQBMIIBHwKBgQD9f1OBHXUSKVLfSpwu7OTn9hG3UjzvRADDHj+AtlEmaUVdQCJR+1k9jVj6v8X1ujD2y5tVbNeBO4AdNG/yZmC3a5lQpaSfn+gEexAiwk+7qdf+t8Yb+DtX58aophUPBPuD9tPFHsMCNVQTWhaRMvZ1864rYdcq7/IiAxmd0UgBxwIVAJdgUI8VIwvMspK5gqLrhAvwWBz1AoGBAPfhoIXWmz3ey7yrXDa4V7l5lK+7+jrqgvlXTAs9B4JnUVlXjrrUWU/mcQcQgYC0SRZxI+hMKBYTt88JMozIpuE8FnqLVHyNKOCjrh4rs6Z1kW6jfwv6ITVi8ftiegEkO8yk8b6oUZCJqIPf4VrlnwaSi2ZegHtVJWQBTDv+z0kqA4GFAAKBgQD2cHtWHnwO9pOZx9H0uUoLZGKE3iwvVAkUwzVqVEgT4fMG70icn2dII/RABPtXW6Zai87iIg7zC975qeeEznBee7ll/8HFFe8H4IL3tPCf+/TigELMORl3ySd8lzD1mEZMYUL6Rc16T3ZJ3iUxfrJJiN815SZ8qrDkHAtS1Hhot6OBjTCBijARBglghkgBhvhCAQEEBAMCBBAwDgYDVR0PAQH/BAQDAgXgMB0GA1UdDgQWBBRkqtvyzwWOJd+aZikkKKFLDTaqbDAfBgNVHSMEGDAWgBRl4vSGydNO8JFOWKJq9dh4WprBpjAlBgNVHREEHjAcgRp0b21teS5ncmFuZGVmb3JzQHBoZW94LmNvbTALBgcqhkjOOAQDBQADLwAwLAIUdTerIDsy5CLjjPffwoO4rYWZ4kECFAyrKdfe2Qj5T5MWse9EhMD951Wt";

  try {
   System.loadLibrary("JCAPI");
   System.out.println("Load Library Successfully!");
  } catch(UnsatisfiedLinkError e) {

   e.printStackTrace();
  }
  CoreUtilJNI core=new CoreUtilJNI();

  String[] mscsp=core.getMSCSP();

  for(int i=0;i   System.out.println(mscsp[i]);
  System.out.println("done");


  String content="1234567890abcdefghij+sssssssssssssssssssssssssssssssssssssssssssssssssssssssssssssss";

  byte[] data = {1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20};

  data=content.getBytes();

  try
        {
            int[] d= CoreSignatureJNI.hashInit("SHA1");
            CoreSignatureJNI.hashUpdate(d, data);
            byte abyte1[] = CoreSignatureJNI.hashFinal(d);

            System.out.println(""+new String(abyte1));
            return;
        }
        catch(JCAPIJNIException jcapijniexception)
        {
        jcapijniexception.printStackTrace();
        }





}

}

david.turing 2006-07-04 22:52 发表评论

david.turing — Sun, 21 May 2006 17:57:00 GMT

摘要: �ȝ��各种Java KeyStoreType 阅读全文

david.turing 2006-05-22 01:57 发表评论

计算HMAC

david.turing — Sun, 21 May 2006 09:05:00 GMT

Message Authentication Code (MAC) 是用于确信信息在传输�q�程中没有被修改�q�，体现了信息完整性， MAC 有很多种��法�Q�大部分��法用于��单的场景�Q�如文�g传输�Q�，他们都有效，但如果用于都未曾考虑会被恶意��d��的情况，在密码学领域中，更多被应用的�?/span> HMAC �Q?/span> HMAC 更安全，因�ؓ它是��Z�� Key 的�?/span> HMAC 是��用诸�?/span> MD5,SHA-1 �{�散列算法构�?/span> MAC �?/span>

HMAC 在这样一�U�场景中被应用：

巴赫��、穆�|�默��h��Z��拉克临时政府中不同的伊斯兰派�p�，�׃��国已经在伊拉克讄��了大量情报机构，他们担心政府部内部文件在�|�络传输可能被美国情报局修改�Q�考虑赯��Q�巴赫尔、穆�|�默德决定��?/span> MAC 技术：

1�Q?span style="FONT: 7pt 'Times New Roman'"> 他们商榷一个简单的密钥 Key1

2�Q?span style="FONT: 7pt 'Times New Roman'"> 他们商榷一�U�可靠的 HMAC ��法�Q�如 HMACSHA1

3�Q?span style="FONT: 7pt 'Times New Roman'"> 他们每次发送政府审�Ҏ��告前�Q�都�?/span> HMACSHA1 �q�行计算�Q��ƈ��该 hmac �?/span> x1 附带发送给�Ҏ��

4�Q?span style="FONT: 7pt 'Times New Roman'"> �Ҏ��接收到文�Ӟ��文件进行一��?/span> HMAC 的计��，得出新的 hmac �?/span> x2 �Q�对�?/span> x1 �?/span> x2 �Q�可以知道文件是否在中途被修改�q��?/span>

注意�Q�上�q�的步骤如果不考虑恶意��d��者，可以使用消息摘要�Q�恶意攻击者可以修改你的文�Ӟ��然后重新帮你计算摘要�Q�最后替换你的摘要：�Q?/span>

关于 HMAC 的更多标准，可以参�?/span> RFC2104 �?/span>

package org.dev2dev.security.test.mac;

import java.io.File;
import java.io.IOException;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;

import javax.crypto.KeyGenerator;
import javax.crypto.Mac;
import javax.crypto.SecretKey;

import org.dev2dev.common.FileUtils;

public class TestHmac {

/**
  * @param args
   */
public static void main(String[] args) {
      try {
          // 首先需要生成Hmac的key�Q�有比较多种�Ҏ��Q�HmacSHA1�Q�算法类型可以参�?a class="" title="KeyGenerator��法列表" href="/openssl/articles/SUNJCE_agorithm.html" target="_blank">KeyGenerator��法列表
              // 本例子用KeyGenerator生成key�Q�实际上,key可以保存��h��Q�也可以被分发给其他�?br />         KeyGenerator keyGen = KeyGenerator.getInstance("HmacMD5");
         SecretKey key = keyGen.generateKey();
         Mac mac = Mac.getInstance(key.getAlgorithm());
         mac.init(key);

         File infile=new File("c:\\1.txt");
         byte[] inputbyte=null;
   try {
    inputbyte = FileUtils.getBytesFromFile(infile);
   } catch (IOException e) {
    e.printStackTrace();
   }
         byte[] digest = mac.doFinal(inputbyte);

         // If desired, convert the digest into a string
         String HmacB64 = new sun.misc.BASE64Encoder().encode(digest);
         System.out.println("计算的HMAC ="+ HmacB64);
     } catch (InvalidKeyException e) {
      e.printStackTrace();
     } catch (NoSuchAlgorithmException e) {
      e.printStackTrace();
     }

}

}

david.turing 2006-05-21 17:05 发表评论