diff --git a/crypto/src/tls/TlsRsaUtilities.cs b/crypto/src/tls/TlsRsaUtilities.cs
index d520d3ea2..065279528 100644
--- a/crypto/src/tls/TlsRsaUtilities.cs
+++ b/crypto/src/tls/TlsRsaUtilities.cs
@@ -5,7 +5,7 @@ using Org.BouncyCastle.Tls.Crypto;
namespace Org.BouncyCastle.Tls
{
- /// <summary>RSA Utility methods.</summary>
+ /// <summary>RSA utility methods.</summary>
public abstract class TlsRsaUtilities
{
/// <summary>Generate a pre_master_secret and send it encrypted to the server.</summary>
@@ -15,7 +15,9 @@ namespace Org.BouncyCastle.Tls
{
TlsSecret preMasterSecret = context.Crypto.GenerateRsaPreMasterSecret(context.RsaPreMasterSecretVersion);
- byte[] encryptedPreMasterSecret = preMasterSecret.Encrypt(certificate);
+ TlsEncryptor encryptor = certificate.CreateEncryptor(TlsCertificateRole.RsaEncryption);
+
+ byte[] encryptedPreMasterSecret = preMasterSecret.Encrypt(encryptor);
TlsUtilities.WriteEncryptedPms(context, encryptedPreMasterSecret, output);
return preMasterSecret;
diff --git a/crypto/src/tls/crypto/TlsCertificate.cs b/crypto/src/tls/crypto/TlsCertificate.cs
index 7bd8e0359..b9efe37b3 100644
--- a/crypto/src/tls/crypto/TlsCertificate.cs
+++ b/crypto/src/tls/crypto/TlsCertificate.cs
@@ -9,6 +9,12 @@ namespace Org.BouncyCastle.Tls.Crypto
/// <summary>Interface providing the functional representation of a single X.509 certificate.</summary>
public interface TlsCertificate
{
+ /// <summary>Return an encryptor based on the public key in this certificate.</summary>
+ /// <param name="tlsCertificateRole"><see cref="TlsCertificateRole"/></param>
+ /// <returns>a <see cref="TlsEncryptor"/> based on this certificate's public key.</returns>
+ /// <exception cref="IOException"/>
+ TlsEncryptor CreateEncryptor(int tlsCertificateRole);
+
/// <param name="signatureAlgorithm"><see cref="SignatureAlgorithm"/></param>
/// <exception cref="IOException"/>
TlsVerifier CreateVerifier(short signatureAlgorithm);
diff --git a/crypto/src/tls/crypto/impl/TlsEncryptor.cs b/crypto/src/tls/crypto/TlsEncryptor.cs
index 6e4ef0c44..53f1973fd 100644
--- a/crypto/src/tls/crypto/impl/TlsEncryptor.cs
+++ b/crypto/src/tls/crypto/TlsEncryptor.cs
@@ -1,9 +1,9 @@
using System;
using System.IO;
-namespace Org.BouncyCastle.Tls.Crypto.Impl
+namespace Org.BouncyCastle.Tls.Crypto
{
- /// <summary>Base interface for an encryptor based on a public key.</summary>
+ /// <summary>Base interface for an encryptor.</summary>
public interface TlsEncryptor
{
/// <summary>Encrypt data from the passed in input array.</summary>
diff --git a/crypto/src/tls/crypto/TlsSecret.cs b/crypto/src/tls/crypto/TlsSecret.cs
index 9b092fc40..0499d37c3 100644
--- a/crypto/src/tls/crypto/TlsSecret.cs
+++ b/crypto/src/tls/crypto/TlsSecret.cs
@@ -23,11 +23,10 @@ namespace Org.BouncyCastle.Tls.Crypto
void Destroy();
/// <summary>Return an encrypted copy of the data this secret is based on.</summary>
- /// <param name="certificate">the certificate containing the public key to use for protecting the internal
- /// data.</param>
+ /// <param name="encryptor">the encryptor to use for protecting the internal data.</param>
/// <returns>an encrypted copy of this secret's internal data.</returns>
/// <exception cref="IOException"/>
- byte[] Encrypt(TlsCertificate certificate);
+ byte[] Encrypt(TlsEncryptor encryptor);
/// <summary>Return the internal data from this secret.</summary>
/// <remarks>
diff --git a/crypto/src/tls/crypto/impl/AbstractTlsCrypto.cs b/crypto/src/tls/crypto/impl/AbstractTlsCrypto.cs
index f0b2b03f6..0a634fffe 100644
--- a/crypto/src/tls/crypto/impl/AbstractTlsCrypto.cs
+++ b/crypto/src/tls/crypto/impl/AbstractTlsCrypto.cs
@@ -80,11 +80,5 @@ namespace Org.BouncyCastle.Tls.Crypto.Impl
public abstract TlsSrp6VerifierGenerator CreateSrp6VerifierGenerator(TlsSrpConfig srpConfig);
public abstract TlsSecret HkdfInit(int cryptoHashAlgorithm);
-
- /// <summary>Return an encryptor based on the public key in certificate.</summary>
- /// <param name="certificate">the certificate carrying the public key.</param>
- /// <returns>a <see cref="TlsEncryptor"/> based on the certificate's public key.</returns>
- /// <exception cref="IOException"/>
- public abstract TlsEncryptor CreateEncryptor(TlsCertificate certificate);
}
}
diff --git a/crypto/src/tls/crypto/impl/AbstractTlsSecret.cs b/crypto/src/tls/crypto/impl/AbstractTlsSecret.cs
index 634b86732..e8298193f 100644
--- a/crypto/src/tls/crypto/impl/AbstractTlsSecret.cs
+++ b/crypto/src/tls/crypto/impl/AbstractTlsSecret.cs
@@ -42,13 +42,13 @@ namespace Org.BouncyCastle.Tls.Crypto.Impl
}
/// <exception cref="IOException"/>
- public virtual byte[] Encrypt(TlsCertificate certificate)
+ public virtual byte[] Encrypt(TlsEncryptor encryptor)
{
lock (this)
{
CheckAlive();
- return Crypto.CreateEncryptor(certificate).Encrypt(m_data, 0, m_data.Length);
+ return encryptor.Encrypt(m_data, 0, m_data.Length);
}
}
diff --git a/crypto/src/tls/crypto/impl/bc/BcTlsCertificate.cs b/crypto/src/tls/crypto/impl/bc/BcTlsCertificate.cs
index e1243087d..2f331a166 100644
--- a/crypto/src/tls/crypto/impl/bc/BcTlsCertificate.cs
+++ b/crypto/src/tls/crypto/impl/bc/BcTlsCertificate.cs
@@ -59,6 +59,29 @@ namespace Org.BouncyCastle.Tls.Crypto.Impl.BC
}
/// <exception cref="IOException"/>
+ public virtual TlsEncryptor CreateEncryptor(int tlsCertificateRole)
+ {
+ ValidateKeyUsage(KeyUsage.KeyEncipherment);
+
+ switch (tlsCertificateRole)
+ {
+ case TlsCertificateRole.RsaEncryption:
+ {
+ this.m_pubKeyRsa = GetPubKeyRsa();
+ return new BcTlsRsaEncryptor(m_crypto, m_pubKeyRsa);
+ }
+ // TODO[gmssl]
+ //case TlsCertificateRole.Sm2Encryption:
+ //{
+ // this.m_pubKeyEC = GetPubKeyEC();
+ // return new BcTlsSM2Encryptor(m_crypto, m_pubKeyEC);
+ //}
+ }
+
+ throw new TlsFatalAlert(AlertDescription.certificate_unknown);
+ }
+
+ /// <exception cref="IOException"/>
public virtual TlsVerifier CreateVerifier(short signatureAlgorithm)
{
switch (signatureAlgorithm)
diff --git a/crypto/src/tls/crypto/impl/bc/BcTlsCrypto.cs b/crypto/src/tls/crypto/impl/bc/BcTlsCrypto.cs
index aa9985ed9..69e353bae 100644
--- a/crypto/src/tls/crypto/impl/bc/BcTlsCrypto.cs
+++ b/crypto/src/tls/crypto/impl/bc/BcTlsCrypto.cs
@@ -1,11 +1,8 @@
using System;
-using System.IO;
-using Org.BouncyCastle.Asn1.X509;
using Org.BouncyCastle.Crypto;
using Org.BouncyCastle.Crypto.Agreement.Srp;
using Org.BouncyCastle.Crypto.Digests;
-using Org.BouncyCastle.Crypto.Encodings;
using Org.BouncyCastle.Crypto.Engines;
using Org.BouncyCastle.Crypto.Macs;
using Org.BouncyCastle.Crypto.Modes;
@@ -140,16 +137,6 @@ namespace Org.BouncyCastle.Tls.Crypto.Impl.BC
}
}
- public override TlsEncryptor CreateEncryptor(TlsCertificate certificate)
- {
- BcTlsCertificate bcCert = BcTlsCertificate.Convert(this, certificate);
- bcCert.ValidateKeyUsage(KeyUsage.KeyEncipherment);
-
- RsaKeyParameters pubKeyRsa = bcCert.GetPubKeyRsa();
-
- return new BcTlsRsaEncryptor(this, pubKeyRsa);
- }
-
public override TlsNonceGenerator CreateNonceGenerator(byte[] additionalSeedMaterial)
{
IDigest digest = CreateDigest(CryptoHashAlgorithm.sha256);
|
