Package com.google.api.client.util
Class SecurityUtils
java.lang.Object
com.google.api.client.util.SecurityUtils
Utilities related to Java security.
- Since:
- 1.14
-
Constructor Summary
Constructors -
Method Summary
Modifier and TypeMethodDescriptionstatic KeyStore
createMtlsKeyStore
(InputStream certAndKey) Beta
Create a keystore for mutual TLS with the certificate and private key provided.static KeyStore
Returns the default key store usingKeyStore.getDefaultType()
.static Signature
Returns the SHA-256 with ECDSA signature algorithmstatic KeyStore
Returns the Java KeyStore (JKS).static KeyStore
Returns the PKCS12 key store.static PrivateKey
getPrivateKey
(KeyStore keyStore, String alias, String keyPass) Returns the private key from the key store.static KeyFactory
Returns the RSA key factory.static Signature
Returns the SHA-1 with RSA signature algorithm.static Signature
Returns the SHA-256 with RSA signature algorithm.static CertificateFactory
Returns the X.509 certificate factory.static void
loadKeyStore
(KeyStore keyStore, InputStream keyStream, String storePass) Loads a key store from a stream.static void
loadKeyStoreFromCertificates
(KeyStore keyStore, CertificateFactory certificateFactory, InputStream certificateStream) Loads a key store with certificates generated from the specified stream usingCertificateFactory.generateCertificates(InputStream)
.static PrivateKey
loadPrivateKeyFromKeyStore
(KeyStore keyStore, InputStream keyStream, String storePass, String alias, String keyPass) Retrieves a private key from the specified key store stream and specified key store.static byte[]
sign
(Signature signatureAlgorithm, PrivateKey privateKey, byte[] contentBytes) Signs content using a private key.static boolean
verify
(Signature signatureAlgorithm, PublicKey publicKey, byte[] signatureBytes, byte[] contentBytes) Verifies the signature of signed content based on a public key.static X509Certificate
verify
(Signature signatureAlgorithm, X509TrustManager trustManager, List<String> certChainBase64, byte[] signatureBytes, byte[] contentBytes) Verifies the signature of signed content based on a certificate chain.
-
Constructor Details
-
SecurityUtils
private SecurityUtils()
-
-
Method Details
-
getDefaultKeyStore
Returns the default key store usingKeyStore.getDefaultType()
.- Throws:
KeyStoreException
-
getJavaKeyStore
Returns the Java KeyStore (JKS).- Throws:
KeyStoreException
-
getPkcs12KeyStore
Returns the PKCS12 key store.- Throws:
KeyStoreException
-
loadKeyStore
public static void loadKeyStore(KeyStore keyStore, InputStream keyStream, String storePass) throws IOException, GeneralSecurityException Loads a key store from a stream.Example usage:
KeyStore keyStore = SecurityUtils.getJavaKeyStore(); SecurityUtils.loadKeyStore(keyStore, new FileInputStream("certs.jks"), "password");
- Parameters:
keyStore
- key storekeyStream
- input stream to the key store stream (closed at the end of this method in a finally block)storePass
- password protecting the key store file- Throws:
IOException
GeneralSecurityException
-
getPrivateKey
public static PrivateKey getPrivateKey(KeyStore keyStore, String alias, String keyPass) throws GeneralSecurityException Returns the private key from the key store.- Parameters:
keyStore
- key storealias
- alias under which the key is storedkeyPass
- password protecting the key- Returns:
- private key
- Throws:
GeneralSecurityException
-
loadPrivateKeyFromKeyStore
public static PrivateKey loadPrivateKeyFromKeyStore(KeyStore keyStore, InputStream keyStream, String storePass, String alias, String keyPass) throws IOException, GeneralSecurityException Retrieves a private key from the specified key store stream and specified key store.- Parameters:
keyStore
- key storekeyStream
- input stream to the key store (closed at the end of this method in a finally block)storePass
- password protecting the key store filealias
- alias under which the key is storedkeyPass
- password protecting the key- Returns:
- key from the key store
- Throws:
IOException
GeneralSecurityException
-
getRsaKeyFactory
Returns the RSA key factory.- Throws:
NoSuchAlgorithmException
-
getSha1WithRsaSignatureAlgorithm
Returns the SHA-1 with RSA signature algorithm.- Throws:
NoSuchAlgorithmException
-
getSha256WithRsaSignatureAlgorithm
Returns the SHA-256 with RSA signature algorithm.- Throws:
NoSuchAlgorithmException
-
getEs256SignatureAlgorithm
Returns the SHA-256 with ECDSA signature algorithm- Throws:
NoSuchAlgorithmException
-
sign
public static byte[] sign(Signature signatureAlgorithm, PrivateKey privateKey, byte[] contentBytes) throws InvalidKeyException, SignatureException Signs content using a private key.- Parameters:
signatureAlgorithm
- signature algorithmprivateKey
- private keycontentBytes
- content to sign- Returns:
- signed content
- Throws:
InvalidKeyException
SignatureException
-
verify
public static boolean verify(Signature signatureAlgorithm, PublicKey publicKey, byte[] signatureBytes, byte[] contentBytes) throws InvalidKeyException, SignatureException Verifies the signature of signed content based on a public key.- Parameters:
signatureAlgorithm
- signature algorithmpublicKey
- public keysignatureBytes
- signature bytescontentBytes
- content bytes- Returns:
- whether the signature was verified
- Throws:
InvalidKeyException
SignatureException
-
verify
public static X509Certificate verify(Signature signatureAlgorithm, X509TrustManager trustManager, List<String> certChainBase64, byte[] signatureBytes, byte[] contentBytes) throws InvalidKeyException, SignatureException Verifies the signature of signed content based on a certificate chain.- Parameters:
signatureAlgorithm
- signature algorithmtrustManager
- trust manager used to verify the certificate chaincertChainBase64
- Certificate chain used for verification. The certificates must be base64 encoded DER, the leaf certificate must be the first element.signatureBytes
- signature bytescontentBytes
- content bytes- Returns:
- The signature certificate if the signature could be verified, null otherwise.
- Throws:
InvalidKeyException
SignatureException
- Since:
- 1.19.1.
-
getX509CertificateFactory
Returns the X.509 certificate factory.- Throws:
CertificateException
-
loadKeyStoreFromCertificates
public static void loadKeyStoreFromCertificates(KeyStore keyStore, CertificateFactory certificateFactory, InputStream certificateStream) throws GeneralSecurityException Loads a key store with certificates generated from the specified stream usingCertificateFactory.generateCertificates(InputStream)
.For each certificate,
KeyStore.setCertificateEntry(String, Certificate)
is called with an alias that is the string form of incrementing non-negative integers starting with 0 (0, 1, 2, 3, ...).Example usage:
KeyStore keyStore = SecurityUtils.getJavaKeyStore(); SecurityUtils.loadKeyStoreFromCertificates(keyStore, SecurityUtils.getX509CertificateFactory(), new FileInputStream(pemFile));
- Parameters:
keyStore
- key store (for examplegetJavaKeyStore()
)certificateFactory
- certificate factory (for examplegetX509CertificateFactory()
)certificateStream
- certificate stream- Throws:
GeneralSecurityException
-
createMtlsKeyStore
@Beta public static KeyStore createMtlsKeyStore(InputStream certAndKey) throws GeneralSecurityException, IOException Beta
Create a keystore for mutual TLS with the certificate and private key provided.- Parameters:
certAndKey
- Certificate and private key input stream. The stream should contain one certificate and one unencrypted private key. If there are multiple certificates, only the first certificate will be used.- Returns:
- keystore for mutual TLS.
- Throws:
GeneralSecurityException
IOException
- Since:
- 1.38
-