io.jsonwebtoken.impl.crypto

Class EllipticCurveProvider

java.lang.Object

io.jsonwebtoken.impl.crypto.EllipticCurveProvider

Direct Known Subclasses:

EllipticCurveSignatureValidator, EllipticCurveSigner

public abstract class EllipticCurveProvider
extends Object

ElliptiCurve crypto provider.

Since:

0.5

Field Summary

Fields

Modifier and Type	Field and Description
protected SignatureAlgorithm	alg
static SecureRandom	DEFAULT_SECURE_RANDOM JJWT's default SecureRandom number generator.
protected int	fieldByteLength
protected Key	key
protected int	requiredSignatureByteLength

Constructor Summary

Constructors

Modifier	Constructor and Description
protected	EllipticCurveProvider(SignatureAlgorithm alg, Key key)

Method Summary

Methods

Modifier and Type	Method and Description
protected static String	byteSizeString(int bytesLength)
protected Signature	createSignatureInstance()
static KeyPair	generateKeyPair() Generates a new secure-random key pair assuming strength enough for the SignatureAlgorithm.ES512 algorithm.
static KeyPair	generateKeyPair(SignatureAlgorithm alg) Generates a new secure-random key pair of sufficient strength for the specified Elliptic Curve SignatureAlgorithm (must be one of ES256, ES384 or ES512) using JJWT's default SecureRandom instance.
static KeyPair	generateKeyPair(SignatureAlgorithm alg, SecureRandom random) Generates a new secure-random key pair of sufficient strength for the specified Elliptic Curve SignatureAlgorithm (must be one of ES256, ES384 or ES512) using the specified SecureRandom random number generator.
static KeyPair	generateKeyPair(String jcaAlgorithmName, String jcaProviderName, SignatureAlgorithm alg, SecureRandom random) Generates a new secure-random key pair of sufficient strength for the specified Elliptic Curve SignatureAlgorithm (must be one of ES256, ES384 or ES512) using the specified SecureRandom random number generator via the specified JCA provider and algorithm name.
static int	getSignatureByteArrayLength(SignatureAlgorithm alg) Returns the expected signature byte array length (R + S parts) for the specified ECDSA algorithm.
protected Signature	getSignatureInstance()
protected boolean	isBouncyCastleAvailable()
static byte[]	transcodeConcatToDER(byte[] jwsSignature) Transcodes the ECDSA JWS signature into ASN.1/DER format for use by the JCA verifier.
static byte[]	transcodeDERToConcat(byte[] derSignature, int outputLength) Transcodes the JCA ASN.1/DER-encoded signature into the concatenated R + S format expected by ECDSA JWS.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

requiredSignatureByteLength

protected final int requiredSignatureByteLength

fieldByteLength

protected final int fieldByteLength

DEFAULT_SECURE_RANDOM

public static final SecureRandom DEFAULT_SECURE_RANDOM

JJWT's default SecureRandom number generator. This RNG is initialized using the JVM default as follows:

 static {
     DEFAULT_SECURE_RANDOM = new SecureRandom();
     DEFAULT_SECURE_RANDOM.nextBytes(new byte[64]);
 }
 

nextBytes is called to force the RNG to initialize itself if not already initialized. The byte array is not used and discarded immediately for garbage collection.

alg

protected final SignatureAlgorithm alg

key

protected final Key key

Constructor Detail

EllipticCurveProvider

protected EllipticCurveProvider(SignatureAlgorithm alg,
                     Key key)

Method Detail

byteSizeString

protected static String byteSizeString(int bytesLength)

generateKeyPair

public static KeyPair generateKeyPair()

Generates a new secure-random key pair assuming strength enough for the SignatureAlgorithm.ES512 algorithm. This is a convenience method that immediately delegates to generateKeyPair(SignatureAlgorithm) using SignatureAlgorithm.ES512 as the method argument.

Returns:

a new secure-randomly-generated key pair assuming strength enough for the SignatureAlgorithm.ES512 algorithm.

See Also:

generateKeyPair(SignatureAlgorithm), generateKeyPair(SignatureAlgorithm, SecureRandom), generateKeyPair(String, String, SignatureAlgorithm, SecureRandom)

generateKeyPair

public static KeyPair generateKeyPair(SignatureAlgorithm alg)

Generates a new secure-random key pair of sufficient strength for the specified Elliptic Curve SignatureAlgorithm (must be one of ES256, ES384 or ES512) using JJWT's default SecureRandom instance. This is a convenience method that immediately delegates to generateKeyPair(SignatureAlgorithm, SecureRandom).

Parameters:

alg - the algorithm indicating strength, must be one of ES256, ES384 or ES512

Returns:

a new secure-randomly generated key pair of sufficient strength for the specified SignatureAlgorithm (must be one of ES256, ES384 or ES512) using JJWT's default SecureRandom instance.

See Also:

generateKeyPair(), generateKeyPair(SignatureAlgorithm, SecureRandom), generateKeyPair(String, String, SignatureAlgorithm, SecureRandom)

generateKeyPair

public static KeyPair generateKeyPair(SignatureAlgorithm alg,
                      SecureRandom random)

Generates a new secure-random key pair of sufficient strength for the specified Elliptic Curve SignatureAlgorithm (must be one of ES256, ES384 or ES512) using the specified SecureRandom random number generator. This is a convenience method that immediately delegates to generateKeyPair(String, String, SignatureAlgorithm, SecureRandom) using "EC" as the jcaAlgorithmName.

Parameters:

alg - alg the algorithm indicating strength, must be one of ES256, ES384 or ES512

random - the SecureRandom generator to use during key generation.

Returns:

a new secure-randomly generated key pair of sufficient strength for the specified SignatureAlgorithm (must be one of ES256, ES384 or ES512) using the specified SecureRandom random number generator.

See Also:

generateKeyPair(), generateKeyPair(SignatureAlgorithm), generateKeyPair(String, String, SignatureAlgorithm, SecureRandom)

generateKeyPair

public static KeyPair generateKeyPair(String jcaAlgorithmName,
                      String jcaProviderName,
                      SignatureAlgorithm alg,
                      SecureRandom random)

Generates a new secure-random key pair of sufficient strength for the specified Elliptic Curve SignatureAlgorithm (must be one of ES256, ES384 or ES512) using the specified SecureRandom random number generator via the specified JCA provider and algorithm name.

Parameters:

jcaAlgorithmName - the JCA name of the algorithm to use for key pair generation, for example, ECDSA.

jcaProviderName - the JCA provider name of the algorithm implementation (for example "BC" for BouncyCastle) or null if the default provider should be used.

alg - alg the algorithm indicating strength, must be one of ES256, ES384 or ES512

random - the SecureRandom generator to use during key generation.

Returns:

a new secure-randomly generated key pair of sufficient strength for the specified Elliptic Curve SignatureAlgorithm (must be one of ES256, ES384 or ES512) using the specified SecureRandom random number generator via the specified JCA provider and algorithm name.

See Also:

generateKeyPair(), generateKeyPair(SignatureAlgorithm), generateKeyPair(SignatureAlgorithm, SecureRandom)

getSignatureByteArrayLength

public static int getSignatureByteArrayLength(SignatureAlgorithm alg)
                                       throws JwtException

Returns the expected signature byte array length (R + S parts) for the specified ECDSA algorithm. Expected lengths are mandated by JWA RFC 7518, Section 3.4.

Parameters:

alg - The ECDSA algorithm. Must be supported and not null.

Returns:

The expected byte array length for the signature.

Throws:

JwtException - If the algorithm is not supported.

transcodeDERToConcat

public static byte[] transcodeDERToConcat(byte[] derSignature,
                          int outputLength)
                                   throws JwtException

Transcodes the JCA ASN.1/DER-encoded signature into the concatenated R + S format expected by ECDSA JWS.

Parameters:

derSignature - The ASN1./DER-encoded. Must not be null.

outputLength - The expected length of the ECDSA JWS signature.

Returns:

The ECDSA JWS encoded signature.

Throws:

JwtException - If the ASN.1/DER signature format is invalid.

transcodeConcatToDER

public static byte[] transcodeConcatToDER(byte[] jwsSignature)
                                   throws JwtException

Transcodes the ECDSA JWS signature into ASN.1/DER format for use by the JCA verifier.

Parameters:

jwsSignature - The JWS signature, consisting of the concatenated R and S values. Must not be null.

Returns:

The ASN.1/DER encoded signature.

Throws:

JwtException - If the ECDSA JWS signature format is invalid.

createSignatureInstance

protected Signature createSignatureInstance()

getSignatureInstance

protected Signature getSignatureInstance()
                                  throws NoSuchAlgorithmException

Throws:

NoSuchAlgorithmException

isBouncyCastleAvailable

protected boolean isBouncyCastleAvailable()