Skip to content

Commit

Permalink
Merge pull request #952 from /issues/950-broken-ecies-3.2
Browse files Browse the repository at this point in the history
  • Loading branch information
@hvge
hvge authored Aug 2, 2023
2 parents ac97c2d + b0620e2 commit e27b718
Show file tree
Hide file tree
Showing 12 changed files with 7 additions and 25 deletions.
1 change: 0 additions & 1 deletion ...java/com/wultra/security/powerauth/client/model/response/ConfirmRecoveryCodeResponse.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,6 @@ public class ConfirmRecoveryCodeResponse {
private String userId;
private String encryptedData;
private String mac;
private String ephemeralPublicKey;
@ToString.Exclude
private String nonce;
private Long timestamp;
Expand Down
1 change: 0 additions & 1 deletion ...in/java/com/wultra/security/powerauth/client/model/response/CreateActivationResponse.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,6 @@ public class CreateActivationResponse {
private String applicationId;
private String encryptedData;
private String mac;
private String ephemeralPublicKey;
@ToString.Exclude
private String nonce;
private Long timestamp;
Expand Down
1 change: 0 additions & 1 deletion ...rc/main/java/com/wultra/security/powerauth/client/model/response/CreateTokenResponse.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,6 @@ public class CreateTokenResponse {

private String encryptedData;
private String mac;
private String ephemeralPublicKey;
@ToString.Exclude
private String nonce;
private Long timestamp;
Expand Down
1 change: 0 additions & 1 deletion ...n/java/com/wultra/security/powerauth/client/model/response/PrepareActivationResponse.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,6 @@ public class PrepareActivationResponse {
private String applicationId;
private String encryptedData;
private String mac;
private String ephemeralPublicKey;
@ToString.Exclude
private String nonce;
private Long timestamp;
Expand Down
1 change: 0 additions & 1 deletion ...a/com/wultra/security/powerauth/client/model/response/RecoveryCodeActivationResponse.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,6 @@ public class RecoveryCodeActivationResponse {
private String applicationId;
private String encryptedData;
private String mac;
private String ephemeralPublicKey;
@ToString.Exclude
private String nonce;
private Long timestamp;
Expand Down
1 change: 0 additions & 1 deletion ...c/main/java/com/wultra/security/powerauth/client/model/response/StartUpgradeResponse.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,6 @@ public class StartUpgradeResponse {

private String encryptedData;
private String mac;
private String ephemeralPublicKey;
@ToString.Exclude
private String nonce;
private Long timestamp;
Expand Down
1 change: 0 additions & 1 deletion ...rc/main/java/com/wultra/security/powerauth/client/model/response/VaultUnlockResponse.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,6 @@ public class VaultUnlockResponse {

private String encryptedData;
private String mac;
private String ephemeralPublicKey;
private boolean signatureValid;
@ToString.Exclude
private String nonce;
Expand Down
12 changes: 3 additions & 9 deletions ...tlime/security/powerauth/app/server/service/behavior/tasks/ActivationServiceBehavior.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -983,7 +983,7 @@ public PrepareActivationResponse prepareActivation(String activationCode, String
final byte[] responseData = objectMapper.writeValueAsBytes(layer2Response);

// Encrypt response data
final byte[] nonceBytesResponse = ("3.2".equals(version) || "3.1".equals(version)) ? keyGenerator.generateRandomBytes(16) : null;
final byte[] nonceBytesResponse = "3.2".equals(version) ? keyGenerator.generateRandomBytes(16) : null;
final Long timestampResponse = "3.2".equals(version) ? new Date().getTime() : null;
final EciesParameters parametersResponse = EciesParameters.builder().nonce(nonceBytesResponse).associatedData(eciesPayload.getParameters().getAssociatedData()).timestamp(timestampResponse).build();
final EciesEncryptor encryptorResponse = eciesFactory.getEciesEncryptor(EciesScope.APPLICATION_SCOPE,
Expand All @@ -992,7 +992,6 @@ public PrepareActivationResponse prepareActivation(String activationCode, String
final EciesPayload responseEciesPayload = encryptorResponse.encrypt(responseData, parametersResponse);
final String encryptedData = Base64.getEncoder().encodeToString(responseEciesPayload.getCryptogram().getEncryptedData());
final String mac = Base64.getEncoder().encodeToString(responseEciesPayload.getCryptogram().getMac());
final String ephemeralPublicKey = Base64.getEncoder().encodeToString(responseEciesPayload.getCryptogram().getEphemeralPublicKey());

// Persist activation report and notify listeners
activationHistoryServiceBehavior.saveActivationAndLogChange(activation);
Expand All @@ -1005,7 +1004,6 @@ public PrepareActivationResponse prepareActivation(String activationCode, String
encryptedResponse.setApplicationId(applicationId);
encryptedResponse.setEncryptedData(encryptedData);
encryptedResponse.setMac(mac);
encryptedResponse.setEphemeralPublicKey(ephemeralPublicKey);
encryptedResponse.setNonce(nonceBytesResponse != null ? Base64.getEncoder().encodeToString(nonceBytesResponse) : null);
encryptedResponse.setTimestamp(timestampResponse);
encryptedResponse.setActivationStatus(activationStatusConverter.convert(activationStatus));
Expand Down Expand Up @@ -1195,7 +1193,7 @@ public CreateActivationResponse createActivation(
final byte[] responseData = objectMapper.writeValueAsBytes(layer2Response);

// Encrypt response data
final byte[] nonceBytesResponse = ("3.2".equals(version) || "3.1".equals(version)) ? keyGenerator.generateRandomBytes(16) : null;
final byte[] nonceBytesResponse = "3.2".equals(version) ? keyGenerator.generateRandomBytes(16) : null;
final Long timestampResponse = "3.2".equals(version) ? new Date().getTime() : null;
final byte[] associatedData = "3.2".equals(version) ? EciesUtils.deriveAssociatedData(EciesScope.APPLICATION_SCOPE, version, applicationKey, null) : null;
final EciesParameters parametersResponse = EciesParameters.builder().nonce(nonceBytesResponse).associatedData(associatedData).timestamp(timestampResponse).build();
Expand All @@ -1205,7 +1203,6 @@ public CreateActivationResponse createActivation(
final EciesPayload responseEciesPayload = encryptorResponse.encrypt(responseData, parametersResponse);
final String encryptedData = Base64.getEncoder().encodeToString(responseEciesPayload.getCryptogram().getEncryptedData());
final String mac = Base64.getEncoder().encodeToString(responseEciesPayload.getCryptogram().getMac());
final String ephemeralPublicKey = Base64.getEncoder().encodeToString(responseEciesPayload.getCryptogram().getEphemeralPublicKey());

// Generate encrypted response
final CreateActivationResponse encryptedResponse = new CreateActivationResponse();
Expand All @@ -1214,7 +1211,6 @@ public CreateActivationResponse createActivation(
encryptedResponse.setApplicationId(applicationId);
encryptedResponse.setEncryptedData(encryptedData);
encryptedResponse.setMac(mac);
encryptedResponse.setEphemeralPublicKey(ephemeralPublicKey);
encryptedResponse.setNonce(nonceBytesResponse != null ? Base64.getEncoder().encodeToString(nonceBytesResponse) : null);
encryptedResponse.setTimestamp(timestampResponse);
encryptedResponse.setActivationStatus(activationStatusConverter.convert(activation.getActivationStatus()));
Expand Down Expand Up @@ -1870,7 +1866,7 @@ public RecoveryCodeActivationResponse createActivationUsingRecoveryCode(Recovery
final byte[] responseData = objectMapper.writeValueAsBytes(layer2Response);

// Encrypt response data
final byte[] nonceBytesResponse = ("3.2".equals(version) || "3.1".equals(version)) ? keyGenerator.generateRandomBytes(16) : null;
final byte[] nonceBytesResponse = "3.2".equals(version) ? keyGenerator.generateRandomBytes(16) : null;
final Long timestampResponse = "3.2".equals(version) ? new Date().getTime() : null;
final EciesParameters parametersResponse = EciesParameters.builder().nonce(nonceBytesResponse).associatedData(eciesPayload.getParameters().getAssociatedData()).timestamp(timestampResponse).build();
final EciesEncryptor encryptorResponse = eciesFactory.getEciesEncryptor(EciesScope.APPLICATION_SCOPE,
Expand All @@ -1879,15 +1875,13 @@ public RecoveryCodeActivationResponse createActivationUsingRecoveryCode(Recovery
final EciesPayload responseEciesPayload = encryptorResponse.encrypt(responseData, parametersResponse);
final String encryptedDataResponse = Base64.getEncoder().encodeToString(responseEciesPayload.getCryptogram().getEncryptedData());
final String macResponse = Base64.getEncoder().encodeToString(responseEciesPayload.getCryptogram().getMac());
final String ephemeralPublicKeyResponse = Base64.getEncoder().encodeToString(responseEciesPayload.getCryptogram().getEphemeralPublicKey());

final RecoveryCodeActivationResponse encryptedResponse = new RecoveryCodeActivationResponse();
encryptedResponse.setActivationId(activation.getActivationId());
encryptedResponse.setUserId(activation.getUserId());
encryptedResponse.setApplicationId(applicationId);
encryptedResponse.setEncryptedData(encryptedDataResponse);
encryptedResponse.setMac(macResponse);
encryptedResponse.setEphemeralPublicKey(ephemeralPublicKeyResponse);
encryptedResponse.setNonce(nonceBytesResponse != null ? Base64.getEncoder().encodeToString(nonceBytesResponse) : null);
encryptedResponse.setTimestamp(timestampResponse);
encryptedResponse.setActivationStatus(activationStatusConverter.convert(activation.getActivationStatus()));
Expand Down
3 changes: 1 addition & 2 deletions ...getlime/security/powerauth/app/server/service/behavior/tasks/RecoveryServiceBehavior.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -400,7 +400,7 @@ public ConfirmRecoveryCodeResponse confirmRecoveryCode(ConfirmRecoveryCodeReques
final byte[] responseBytes = objectMapper.writeValueAsBytes(responsePayload);

// Encrypt response using ECIES encryptor
final byte[] nonceBytesResponse = ("3.2".equals(version) || "3.1".equals(version)) ? keyGenerator.generateRandomBytes(16) : null;
final byte[] nonceBytesResponse = "3.2".equals(version) ? keyGenerator.generateRandomBytes(16) : null;
final Long timestampResponse = "3.2".equals(version) ? new Date().getTime() : null;

final EciesParameters parametersResponse = EciesParameters.builder().nonce(nonceBytesResponse).associatedData(associatedData).timestamp(timestampResponse).build();
Expand All @@ -417,7 +417,6 @@ public ConfirmRecoveryCodeResponse confirmRecoveryCode(ConfirmRecoveryCodeReques
response.setUserId(recoveryCodeEntity.getUserId());
response.setEncryptedData(encryptedDataResponse);
response.setMac(macResponse);
response.setEphemeralPublicKey(ephemeralPublicKey);
response.setNonce(nonceBytesResponse != null ? Base64.getEncoder().encodeToString(nonceBytesResponse) : null);
response.setTimestamp(timestampResponse);

Expand Down
3 changes: 1 addition & 2 deletions ...n/java/io/getlime/security/powerauth/app/server/service/behavior/tasks/TokenBehavior.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -147,7 +147,6 @@ public CreateTokenResponse createToken(CreateTokenRequest request, KeyConvertor
final CreateTokenResponse response = new CreateTokenResponse();
response.setMac(Base64.getEncoder().encodeToString(responseEciesPayload.getCryptogram().getMac()));
response.setEncryptedData(Base64.getEncoder().encodeToString(responseEciesPayload.getCryptogram().getEncryptedData()));
response.setEphemeralPublicKey(Base64.getEncoder().encodeToString(responseEciesPayload.getCryptogram().getEphemeralPublicKey()));
response.setNonce(responseEciesPayload.getParameters().getNonce() != null ? Base64.getEncoder().encodeToString(responseEciesPayload.getParameters().getNonce()) : null);
response.setTimestamp(responseEciesPayload.getParameters().getTimestamp());
return response;
Expand Down Expand Up @@ -248,7 +247,7 @@ private EciesPayload createToken(String activationId, String applicationKey, Eci
final byte[] tokenBytes = objectMapper.writeValueAsBytes(tokenInfo);

// Encrypt response using previously created ECIES decryptor
final byte[] nonceBytesResponse = ("3.1".equals(version) || "3.2".equals(version)) ? keyGenerator.generateRandomBytes(16) : null;
final byte[] nonceBytesResponse = "3.2".equals(version) ? keyGenerator.generateRandomBytes(16) : null;
final Long timestampResponse = "3.2".equals(version) ? new Date().getTime() : null;
final EciesParameters parametersResponse = EciesParameters.builder().nonce(nonceBytesResponse).associatedData(eciesPayload.getParameters().getAssociatedData()).timestamp(timestampResponse).build();
final EciesEncryptor encryptorResponse = eciesFactory.getEciesEncryptor(EciesScope.ACTIVATION_SCOPE,
Expand Down
3 changes: 1 addition & 2 deletions .../getlime/security/powerauth/app/server/service/behavior/tasks/UpgradeServiceBehavior.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -226,7 +226,7 @@ public StartUpgradeResponse startUpgrade(StartUpgradeRequest request) throws Gen
// Encrypt response payload and return it
final byte[] payloadBytes = objectMapper.writeValueAsBytes(payload);

final byte[] nonceBytesResponse = ("3.2".equals(version) || "3.1".equals(version)) ? keyGenerator.generateRandomBytes(16) : null;
final byte[] nonceBytesResponse = "3.2".equals(version) ? keyGenerator.generateRandomBytes(16) : null;
final Long timestampResponse = "3.2".equals(version) ? new Date().getTime() : null;
final EciesParameters parametersResponse = EciesParameters.builder().nonce(nonceBytesResponse).associatedData(eciesPayload.getParameters().getAssociatedData()).timestamp(timestampResponse).build();
final EciesEncryptor encryptorResponse = eciesFactory.getEciesEncryptor(EciesScope.ACTIVATION_SCOPE,
Expand All @@ -236,7 +236,6 @@ public StartUpgradeResponse startUpgrade(StartUpgradeRequest request) throws Gen
final StartUpgradeResponse response = new StartUpgradeResponse();
response.setEncryptedData(Base64.getEncoder().encodeToString(payloadResponse.getCryptogram().getEncryptedData()));
response.setMac(Base64.getEncoder().encodeToString(payloadResponse.getCryptogram().getMac()));
response.setEphemeralPublicKey(Base64.getEncoder().encodeToString(payloadResponse.getCryptogram().getEphemeralPublicKey()));
response.setNonce(nonceBytesResponse != null ? Base64.getEncoder().encodeToString(nonceBytesResponse) : null);
response.setTimestamp(timestampResponse);

Expand Down
4 changes: 1 addition & 3 deletions ...lime/security/powerauth/app/server/service/behavior/tasks/VaultUnlockServiceBehavior.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -225,7 +225,7 @@ public VaultUnlockResponse unlockVault(String activationId, String applicationKe
final byte[] reponsePayloadBytes = objectMapper.writeValueAsBytes(responsePayload);

// Encrypt response payload
final byte[] nonceBytesResponse = ("3.2".equals(signatureVersion) || "3.1".equals(signatureVersion)) ? keyGenerator.generateRandomBytes(16) : null;
final byte[] nonceBytesResponse = "3.2".equals(signatureVersion) ? keyGenerator.generateRandomBytes(16) : null;
final Long timestampResponse = "3.2".equals(signatureVersion) ? new Date().getTime() : null;
final EciesParameters parametersResponse = EciesParameters.builder().nonce(nonceBytesResponse).associatedData(eciesPayload.getParameters().getAssociatedData()).timestamp(timestampResponse).build();
final EciesEncryptor encryptorResponse = eciesFactory.getEciesEncryptor(EciesScope.ACTIVATION_SCOPE,
Expand All @@ -234,13 +234,11 @@ public VaultUnlockResponse unlockVault(String activationId, String applicationKe
final EciesPayload responseEciesPayload = encryptorResponse.encrypt(reponsePayloadBytes, parametersResponse);
final String dataResponse = Base64.getEncoder().encodeToString(responseEciesPayload.getCryptogram().getEncryptedData());
final String macResponse = Base64.getEncoder().encodeToString(responseEciesPayload.getCryptogram().getMac());
final String ephemeralPublicKeyResponse = Base64.getEncoder().encodeToString(responseEciesPayload.getCryptogram().getEphemeralPublicKey());

// Return vault unlock response, set signature validity
final VaultUnlockResponse response = new VaultUnlockResponse();
response.setEncryptedData(dataResponse);
response.setMac(macResponse);
response.setEphemeralPublicKey(ephemeralPublicKeyResponse);
response.setNonce(nonceBytesResponse != null ? Base64.getEncoder().encodeToString(nonceBytesResponse) : null);
response.setTimestamp(timestampResponse);
response.setSignatureValid(signatureResponse.isSignatureValid());
Expand Down

0 comments on commit e27b718

Please sign in to comment.