1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
|
using System;
using System.Collections.Generic;
using System.IO;
using Org.BouncyCastle.Asn1;
using Org.BouncyCastle.Asn1.CryptoPro;
using Org.BouncyCastle.Asn1.Pkcs;
using Org.BouncyCastle.Asn1.X509;
using Org.BouncyCastle.Asn1.X9;
using Org.BouncyCastle.Crypto;
using Org.BouncyCastle.Crypto.Parameters;
using Org.BouncyCastle.Math;
using Org.BouncyCastle.Pkcs;
using Org.BouncyCastle.Security;
using Org.BouncyCastle.Security.Certificates;
using Org.BouncyCastle.Utilities;
using Org.BouncyCastle.Utilities.Encoders;
using Org.BouncyCastle.Utilities.IO.Pem;
using Org.BouncyCastle.X509;
namespace Org.BouncyCastle.OpenSsl
{
/**
* PEM generator for the original set of PEM objects used in Open SSL.
*/
public class MiscPemGenerator
: PemObjectGenerator
{
private readonly object obj;
private readonly string algorithm;
private readonly char[] password;
private readonly SecureRandom random;
public MiscPemGenerator(object obj)
{
this.obj = obj;
}
public MiscPemGenerator(
object obj,
string algorithm,
char[] password,
SecureRandom random)
{
this.obj = obj;
this.algorithm = algorithm;
this.password = password;
this.random = random;
}
private static PemObject CreatePemObject(object obj)
{
if (obj == null)
throw new ArgumentNullException("obj");
if (obj is AsymmetricCipherKeyPair keyPair)
{
return CreatePemObject(keyPair.Private);
}
string type;
byte[] encoding;
if (obj is PemObject pemObject)
return pemObject;
if (obj is PemObjectGenerator pemObjectGenerator)
return pemObjectGenerator.Generate();
if (obj is X509Certificate certificate)
{
// TODO Should we prefer "X509 CERTIFICATE" here?
type = "CERTIFICATE";
try
{
encoding = certificate.GetEncoded();
}
catch (CertificateEncodingException e)
{
throw new IOException("Cannot Encode object: " + e.ToString());
}
}
else if (obj is X509Crl crl)
{
type = "X509 CRL";
try
{
encoding = crl.GetEncoded();
}
catch (CrlException e)
{
throw new IOException("Cannot Encode object: " + e.ToString());
}
}
else if (obj is AsymmetricKeyParameter akp)
{
if (akp.IsPrivate)
{
encoding = EncodePrivateKey(akp, out type);
}
else
{
type = "PUBLIC KEY";
encoding = SubjectPublicKeyInfoFactory.CreateSubjectPublicKeyInfo(akp).GetDerEncoded();
}
}
else if (obj is X509V2AttributeCertificate attrCert)
{
type = "ATTRIBUTE CERTIFICATE";
encoding = attrCert.GetEncoded();
}
else if (obj is Pkcs10CertificationRequest certReq)
{
type = "CERTIFICATE REQUEST";
encoding = certReq.GetEncoded();
}
else if (obj is Asn1.Cms.ContentInfo contentInfo)
{
type = "PKCS7";
encoding = contentInfo.GetEncoded();
}
else
{
throw new PemGenerationException("Object type not supported: " + Platform.GetTypeName(obj));
}
return new PemObject(type, encoding);
}
#if NETCOREAPP2_1_OR_GREATER || NETSTANDARD2_1_OR_GREATER
private static PemObject CreatePemObject(object obj, string algorithm, ReadOnlySpan<char> password,
SecureRandom random)
{
if (obj == null)
throw new ArgumentNullException("obj");
if (algorithm == null)
throw new ArgumentNullException("algorithm");
if (random == null)
throw new ArgumentNullException("random");
if (obj is AsymmetricCipherKeyPair keyPair)
{
return CreatePemObject(keyPair.Private, algorithm, password, random);
}
string type = null;
byte[] keyData = null;
if (obj is AsymmetricKeyParameter akp)
{
if (akp.IsPrivate)
{
keyData = EncodePrivateKey(akp, out type);
}
}
if (type == null || keyData == null)
{
// TODO Support other types?
throw new PemGenerationException("Object type not supported: " + Platform.GetTypeName(obj));
}
string dekAlgName = algorithm.ToUpperInvariant();
// Note: For backward compatibility
if (dekAlgName == "DESEDE")
{
dekAlgName = "DES-EDE3-CBC";
}
int ivLength = Platform.StartsWith(dekAlgName, "AES-") ? 16 : 8;
byte[] iv = new byte[ivLength];
random.NextBytes(iv);
byte[] encData = PemUtilities.Crypt(true, keyData, password, dekAlgName, iv);
var headers = new List<PemHeader>(2);
headers.Add(new PemHeader("Proc-Type", "4,ENCRYPTED"));
headers.Add(new PemHeader("DEK-Info", dekAlgName + "," + Hex.ToHexString(iv).ToUpperInvariant()));
return new PemObject(type, headers, encData);
}
#else
private static PemObject CreatePemObject(
object obj,
string algorithm,
char[] password,
SecureRandom random)
{
if (obj == null)
throw new ArgumentNullException("obj");
if (algorithm == null)
throw new ArgumentNullException("algorithm");
if (password == null)
throw new ArgumentNullException("password");
if (random == null)
throw new ArgumentNullException("random");
if (obj is AsymmetricCipherKeyPair keyPair)
{
return CreatePemObject(keyPair.Private, algorithm, password, random);
}
string type = null;
byte[] keyData = null;
if (obj is AsymmetricKeyParameter akp)
{
if (akp.IsPrivate)
{
keyData = EncodePrivateKey(akp, out type);
}
}
if (type == null || keyData == null)
{
// TODO Support other types?
throw new PemGenerationException("Object type not supported: " + Platform.GetTypeName(obj));
}
string dekAlgName = algorithm.ToUpperInvariant();
// Note: For backward compatibility
if (dekAlgName == "DESEDE")
{
dekAlgName = "DES-EDE3-CBC";
}
int ivLength = Platform.StartsWith(dekAlgName, "AES-") ? 16 : 8;
byte[] iv = new byte[ivLength];
random.NextBytes(iv);
byte[] encData = PemUtilities.Crypt(true, keyData, password, dekAlgName, iv);
var headers = new List<PemHeader>(2);
headers.Add(new PemHeader("Proc-Type", "4,ENCRYPTED"));
headers.Add(new PemHeader("DEK-Info", dekAlgName + "," + Hex.ToHexString(iv).ToUpperInvariant()));
return new PemObject(type, headers, encData);
}
#endif
private static byte[] EncodePrivateKey(
AsymmetricKeyParameter akp,
out string keyType)
{
PrivateKeyInfo info = PrivateKeyInfoFactory.CreatePrivateKeyInfo(akp);
AlgorithmIdentifier algID = info.PrivateKeyAlgorithm;
DerObjectIdentifier oid = algID.Algorithm;
if (oid.Equals(X9ObjectIdentifiers.IdDsa))
{
keyType = "DSA PRIVATE KEY";
DsaParameter p = DsaParameter.GetInstance(algID.Parameters);
BigInteger x = ((DsaPrivateKeyParameters) akp).X;
BigInteger y = p.G.ModPow(x, p.P);
// TODO Create an ASN1 object somewhere for this?
return new DerSequence(
new DerInteger(0),
new DerInteger(p.P),
new DerInteger(p.Q),
new DerInteger(p.G),
new DerInteger(y),
new DerInteger(x)).GetEncoded();
}
if (oid.Equals(PkcsObjectIdentifiers.RsaEncryption))
{
keyType = "RSA PRIVATE KEY";
return info.ParsePrivateKey().GetEncoded();
}
else if (oid.Equals(CryptoProObjectIdentifiers.GostR3410x2001)
|| oid.Equals(X9ObjectIdentifiers.IdECPublicKey))
{
keyType = "EC PRIVATE KEY";
return info.ParsePrivateKey().GetEncoded();
}
else
{
keyType = "PRIVATE KEY";
return info.GetEncoded();
}
}
public PemObject Generate()
{
try
{
if (algorithm != null)
{
return CreatePemObject(obj, algorithm, password, random);
}
return CreatePemObject(obj);
}
catch (IOException e)
{
throw new PemGenerationException("encoding exception", e);
}
}
}
}
|
