Package com.google.api.client.util
Class SecurityUtils
- java.lang.Object
-
- com.google.api.client.util.SecurityUtils
-
public final class SecurityUtils extends java.lang.Object
Utilities related to Java security.- Since:
- 1.14
-
-
Constructor Summary
Constructors Modifier Constructor Description private
SecurityUtils()
-
Method Summary
All Methods Static Methods Concrete Methods Modifier and Type Method Description static java.security.KeyStore
createMtlsKeyStore(java.io.InputStream certAndKey)
Beta
Create a keystore for mutual TLS with the certificate and private key provided.static java.security.KeyStore
getDefaultKeyStore()
Returns the default key store usingKeyStore.getDefaultType()
.static java.security.Signature
getEs256SignatureAlgorithm()
Returns the SHA-256 with ECDSA signature algorithmstatic java.security.KeyStore
getJavaKeyStore()
Returns the Java KeyStore (JKS).static java.security.KeyStore
getPkcs12KeyStore()
Returns the PKCS12 key store.static java.security.PrivateKey
getPrivateKey(java.security.KeyStore keyStore, java.lang.String alias, java.lang.String keyPass)
Returns the private key from the key store.static java.security.KeyFactory
getRsaKeyFactory()
Returns the RSA key factory.static java.security.Signature
getSha1WithRsaSignatureAlgorithm()
Returns the SHA-1 with RSA signature algorithm.static java.security.Signature
getSha256WithRsaSignatureAlgorithm()
Returns the SHA-256 with RSA signature algorithm.static java.security.cert.CertificateFactory
getX509CertificateFactory()
Returns the X.509 certificate factory.static void
loadKeyStore(java.security.KeyStore keyStore, java.io.InputStream keyStream, java.lang.String storePass)
Loads a key store from a stream.static void
loadKeyStoreFromCertificates(java.security.KeyStore keyStore, java.security.cert.CertificateFactory certificateFactory, java.io.InputStream certificateStream)
Loads a key store with certificates generated from the specified stream usingCertificateFactory.generateCertificates(InputStream)
.static java.security.PrivateKey
loadPrivateKeyFromKeyStore(java.security.KeyStore keyStore, java.io.InputStream keyStream, java.lang.String storePass, java.lang.String alias, java.lang.String keyPass)
Retrieves a private key from the specified key store stream and specified key store.static byte[]
sign(java.security.Signature signatureAlgorithm, java.security.PrivateKey privateKey, byte[] contentBytes)
Signs content using a private key.static boolean
verify(java.security.Signature signatureAlgorithm, java.security.PublicKey publicKey, byte[] signatureBytes, byte[] contentBytes)
Verifies the signature of signed content based on a public key.static java.security.cert.X509Certificate
verify(java.security.Signature signatureAlgorithm, javax.net.ssl.X509TrustManager trustManager, java.util.List<java.lang.String> certChainBase64, byte[] signatureBytes, byte[] contentBytes)
Verifies the signature of signed content based on a certificate chain.
-
-
-
Method Detail
-
getDefaultKeyStore
public static java.security.KeyStore getDefaultKeyStore() throws java.security.KeyStoreException
Returns the default key store usingKeyStore.getDefaultType()
.- Throws:
java.security.KeyStoreException
-
getJavaKeyStore
public static java.security.KeyStore getJavaKeyStore() throws java.security.KeyStoreException
Returns the Java KeyStore (JKS).- Throws:
java.security.KeyStoreException
-
getPkcs12KeyStore
public static java.security.KeyStore getPkcs12KeyStore() throws java.security.KeyStoreException
Returns the PKCS12 key store.- Throws:
java.security.KeyStoreException
-
loadKeyStore
public static void loadKeyStore(java.security.KeyStore keyStore, java.io.InputStream keyStream, java.lang.String storePass) throws java.io.IOException, java.security.GeneralSecurityException
Loads a key store from a stream.Example usage:
KeyStore keyStore = SecurityUtils.getJavaKeyStore(); SecurityUtils.loadKeyStore(keyStore, new FileInputStream("certs.jks"), "password");
- Parameters:
keyStore
- key storekeyStream
- input stream to the key store stream (closed at the end of this method in a finally block)storePass
- password protecting the key store file- Throws:
java.io.IOException
java.security.GeneralSecurityException
-
getPrivateKey
public static java.security.PrivateKey getPrivateKey(java.security.KeyStore keyStore, java.lang.String alias, java.lang.String keyPass) throws java.security.GeneralSecurityException
Returns the private key from the key store.- Parameters:
keyStore
- key storealias
- alias under which the key is storedkeyPass
- password protecting the key- Returns:
- private key
- Throws:
java.security.GeneralSecurityException
-
loadPrivateKeyFromKeyStore
public static java.security.PrivateKey loadPrivateKeyFromKeyStore(java.security.KeyStore keyStore, java.io.InputStream keyStream, java.lang.String storePass, java.lang.String alias, java.lang.String keyPass) throws java.io.IOException, java.security.GeneralSecurityException
Retrieves a private key from the specified key store stream and specified key store.- Parameters:
keyStore
- key storekeyStream
- input stream to the key store (closed at the end of this method in a finally block)storePass
- password protecting the key store filealias
- alias under which the key is storedkeyPass
- password protecting the key- Returns:
- key from the key store
- Throws:
java.io.IOException
java.security.GeneralSecurityException
-
getRsaKeyFactory
public static java.security.KeyFactory getRsaKeyFactory() throws java.security.NoSuchAlgorithmException
Returns the RSA key factory.- Throws:
java.security.NoSuchAlgorithmException
-
getSha1WithRsaSignatureAlgorithm
public static java.security.Signature getSha1WithRsaSignatureAlgorithm() throws java.security.NoSuchAlgorithmException
Returns the SHA-1 with RSA signature algorithm.- Throws:
java.security.NoSuchAlgorithmException
-
getSha256WithRsaSignatureAlgorithm
public static java.security.Signature getSha256WithRsaSignatureAlgorithm() throws java.security.NoSuchAlgorithmException
Returns the SHA-256 with RSA signature algorithm.- Throws:
java.security.NoSuchAlgorithmException
-
getEs256SignatureAlgorithm
public static java.security.Signature getEs256SignatureAlgorithm() throws java.security.NoSuchAlgorithmException
Returns the SHA-256 with ECDSA signature algorithm- Throws:
java.security.NoSuchAlgorithmException
-
sign
public static byte[] sign(java.security.Signature signatureAlgorithm, java.security.PrivateKey privateKey, byte[] contentBytes) throws java.security.InvalidKeyException, java.security.SignatureException
Signs content using a private key.- Parameters:
signatureAlgorithm
- signature algorithmprivateKey
- private keycontentBytes
- content to sign- Returns:
- signed content
- Throws:
java.security.InvalidKeyException
java.security.SignatureException
-
verify
public static boolean verify(java.security.Signature signatureAlgorithm, java.security.PublicKey publicKey, byte[] signatureBytes, byte[] contentBytes) throws java.security.InvalidKeyException, java.security.SignatureException
Verifies the signature of signed content based on a public key.- Parameters:
signatureAlgorithm
- signature algorithmpublicKey
- public keysignatureBytes
- signature bytescontentBytes
- content bytes- Returns:
- whether the signature was verified
- Throws:
java.security.InvalidKeyException
java.security.SignatureException
-
verify
public static java.security.cert.X509Certificate verify(java.security.Signature signatureAlgorithm, javax.net.ssl.X509TrustManager trustManager, java.util.List<java.lang.String> certChainBase64, byte[] signatureBytes, byte[] contentBytes) throws java.security.InvalidKeyException, java.security.SignatureException
Verifies the signature of signed content based on a certificate chain.- Parameters:
signatureAlgorithm
- signature algorithmtrustManager
- trust manager used to verify the certificate chaincertChainBase64
- Certificate chain used for verification. The certificates must be base64 encoded DER, the leaf certificate must be the first element.signatureBytes
- signature bytescontentBytes
- content bytes- Returns:
- The signature certificate if the signature could be verified, null otherwise.
- Throws:
java.security.InvalidKeyException
java.security.SignatureException
- Since:
- 1.19.1.
-
getX509CertificateFactory
public static java.security.cert.CertificateFactory getX509CertificateFactory() throws java.security.cert.CertificateException
Returns the X.509 certificate factory.- Throws:
java.security.cert.CertificateException
-
loadKeyStoreFromCertificates
public static void loadKeyStoreFromCertificates(java.security.KeyStore keyStore, java.security.cert.CertificateFactory certificateFactory, java.io.InputStream certificateStream) throws java.security.GeneralSecurityException
Loads a key store with certificates generated from the specified stream usingCertificateFactory.generateCertificates(InputStream)
.For each certificate,
KeyStore.setCertificateEntry(String, Certificate)
is called with an alias that is the string form of incrementing non-negative integers starting with 0 (0, 1, 2, 3, ...).Example usage:
KeyStore keyStore = SecurityUtils.getJavaKeyStore(); SecurityUtils.loadKeyStoreFromCertificates(keyStore, SecurityUtils.getX509CertificateFactory(), new FileInputStream(pemFile));
- Parameters:
keyStore
- key store (for examplegetJavaKeyStore()
)certificateFactory
- certificate factory (for examplegetX509CertificateFactory()
)certificateStream
- certificate stream- Throws:
java.security.GeneralSecurityException
-
createMtlsKeyStore
@Beta public static java.security.KeyStore createMtlsKeyStore(java.io.InputStream certAndKey) throws java.security.GeneralSecurityException, java.io.IOException
Beta
Create a keystore for mutual TLS with the certificate and private key provided.- Parameters:
certAndKey
- Certificate and private key input stream. The stream should contain one certificate and one unencrypted private key. If there are multiple certificates, only the first certificate will be used.- Returns:
- keystore for mutual TLS.
- Throws:
java.security.GeneralSecurityException
java.io.IOException
- Since:
- 1.38
-
-