PGSC: JCE implementation

Author: vanitasvitae

build.gradle

@@ -297,7 +297,7 @@ configure(subprojects.findAll {it.name != 'bom'}) {
     }
 
     tasks.withType(JavaCompile).configureEach {
-        options.debug = releaseDebug;
+        options.debug = true;
     }
 
     tasks.withType(Test).configureEach {

pg/src/main/java/org/bouncycastle/openpgp/operator/bc/RFC6637KDFCalculator.java

@@ -15,7 +15,7 @@
 /**
  * Calculator for the EC based KDF algorithm described in RFC 6637
  */
-class RFC6637KDFCalculator
+public class RFC6637KDFCalculator
 {
     // "Anonymous Sender    ", which is the octet sequence
     private static final byte[] ANONYMOUS_SENDER = Hex.decode("416E6F6E796D6F75732053656E64657220202020");

pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JcaPGPKeyConverter.java

@@ -669,7 +669,7 @@ public BCPGKey getBCPGKey(byte[] key)
         }
     }
 
-    private BCPGKey getPublicBCPGKey(int algorithm, PGPAlgorithmParameters algorithmParameters, PublicKey pubKey)
+    public BCPGKey getPublicBCPGKey(int algorithm, PGPAlgorithmParameters algorithmParameters, PublicKey pubKey)
         throws PGPException
     {
         switch (algorithm)

pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JceExternalPublicKeyDataDecryptorFactoryBuilder.java

@@ -0,0 +1,4 @@
+package org.bouncycastle.openpgp.operator.jcajce;
+
+public class JcePublicKeyDataDecryptorFactory {
+}

pg/src/main/java/org/bouncycastle/openpgp/operator/jcajce/JcePublicKeyDataDecryptorFactory.java

@@ -1,7 +1,6 @@
 package org.bouncycastle.bcpg.test;
 
 import org.bouncycastle.bcpg.ArmoredInputStream;
-import org.bouncycastle.bcpg.ArmoredOutputStream;
 import org.bouncycastle.bcpg.BCPGInputStream;
 import org.bouncycastle.bcpg.BCPGOutputStream;
 import org.bouncycastle.bcpg.ContainedPacket;

pg/src/test/java/org/bouncycastle/bcpg/test/ExternalSecretKeyPacketTest.java

@@ -1,6 +1,5 @@
 package org.bouncycastle.openpgp.smartcard;
 
-import org.bouncycastle.bcpg.KeyIdentifier;
 import org.bouncycastle.bcpg.PublicKeyPacket;
 import org.bouncycastle.openpgp.PGPException;
 import org.bouncycastle.openpgp.PGPPublicKey;

pgsc/src/main/java/org/bouncycastle/openpgp/smartcard/OpenPGPSmartCardBackend.java

@@ -61,7 +61,7 @@ public YubikeyOpenPGPSmartCard(YubikeySmartCardBackend backend,
         }
         catch (ApduException | IOException | BadResponseException e)
         {
-            throw new CardException("Cannot perform initial read from Yubikey", e);
+            throw new CardException("Cannot perform initial read from Yubikey " + getSerialNumber(), e);
         }
     }
 

pgsc/src/main/java/org/bouncycastle/openpgp/smartcard/yubikey/YubikeyOpenPGPSmartCard.java

@@ -11,7 +11,6 @@
 import org.bouncycastle.jce.provider.BouncyCastleProvider;
 import org.bouncycastle.openpgp.PGPException;
 import org.bouncycastle.openpgp.PGPKeyPair;
-import org.bouncycastle.openpgp.PGPPrivateKey;
 import org.bouncycastle.openpgp.PGPPublicKey;
 import org.bouncycastle.openpgp.api.KeyPassphraseProvider;
 import org.bouncycastle.openpgp.api.OpenPGPKey;
@@ -20,7 +19,8 @@
 import org.bouncycastle.openpgp.operator.jcajce.JcaPGPKeyConverter;
 import org.bouncycastle.openpgp.smartcard.OpenPGPSmartCardBackend;
 import org.bouncycastle.openpgp.smartcard.card.CardException;
-import org.bouncycastle.openpgp.smartcard.yubikey.operator.YubikeyPublicKeyDataDecryptorFactory;
+import org.bouncycastle.openpgp.smartcard.yubikey.operator.bc.BcYubikeyPublicKeyDataDecryptorFactory;
+import org.bouncycastle.openpgp.smartcard.yubikey.operator.jcajce.JceYubikeyPublicKeyDataDecryptorFactoryBuilder;
 import org.bouncycastle.util.Arrays;
 
 import java.security.NoSuchAlgorithmException;
@@ -40,42 +40,57 @@ public class YubikeySmartCardBackend
 {
     private static final int X25519_SCALAR_SIZE = 32;
 
+    private final YubikeyDecryptorFactoryProvider decryptorFactoryProvider;
     private final JcaPGPKeyConverter converter;
     private final JcaKeyFingerprintCalculator fingerprintCalculator;
     private final Set<Integer> allowedCardSerials = new HashSet<>();
     private final YubiKitManager manager;
 
     public static YubikeySmartCardBackend createInstance()
     {
-        return createInstance(new YubiKitManager());
+        return createInstance(bcImpl());
     }
 
-    public static YubikeySmartCardBackend createInstance(YubiKitManager yubiKitManager)
+    public static YubikeySmartCardBackend createInstance(YubikeyDecryptorFactoryProvider decryptorFactoryProvider)
     {
-        return createInstance(yubiKitManager, new BouncyCastleProvider());
+        return createInstance(new YubiKitManager(),
+                decryptorFactoryProvider);
     }
 
     public static YubikeySmartCardBackend createInstance(YubiKitManager yubiKitManager,
-                                                         BouncyCastleProvider provider)
+                                                         YubikeyDecryptorFactoryProvider decryptorFactoryProvider)
     {
-        return new YubikeySmartCardBackend(yubiKitManager,
+        return createInstance(yubiKitManager,
+                new BouncyCastleProvider(),
+                decryptorFactoryProvider);
+    }
+
+    public static YubikeySmartCardBackend createInstance(YubiKitManager yubiKitManager,
+                                                         BouncyCastleProvider provider,
+                                                         YubikeyDecryptorFactoryProvider decryptorFactoryProvider)
+    {
+        return new YubikeySmartCardBackend(
+                yubiKitManager,
                 new JcaPGPKeyConverter().setProvider(provider),
-                new JcaKeyFingerprintCalculator().setProvider(provider));
+                new JcaKeyFingerprintCalculator().setProvider(provider),
+                decryptorFactoryProvider);
     }
 
     public YubikeySmartCardBackend(YubiKitManager yubiKitManager,
                                    JcaPGPKeyConverter keyConverter,
-                                   JcaKeyFingerprintCalculator fingerprintCalculator)
+                                   JcaKeyFingerprintCalculator fingerprintCalculator,
+                                   YubikeyDecryptorFactoryProvider decryptorFactoryProvider)
     {
         this.manager = yubiKitManager;
         this.converter = keyConverter;
         this.fingerprintCalculator = fingerprintCalculator;
+        this.decryptorFactoryProvider = decryptorFactoryProvider;
     }
 
     @Override
     public String getName()
     {
-        return "Yubikit";
+        return "Yubikit " + decryptorFactoryProvider.getName();
     }
 
     /**
@@ -130,7 +145,7 @@ public PublicKeyDataDecryptorFactory providePublicKeyDataDecryptorFactory(
             KeyPassphraseProvider userPinProvider)
             throws PGPException
     {
-        return new YubikeyPublicKeyDataDecryptorFactory(secretKey, card, userPinProvider);
+        return decryptorFactoryProvider.provide(secretKey, card, userPinProvider);
     }
 
     /**
@@ -276,4 +291,58 @@ private PGPPublicKey bruteForcePublicKey(PublicKey pk, Date creationTime,
         }
         return null;
     }
+
+    public interface YubikeyDecryptorFactoryProvider
+    {
+        PublicKeyDataDecryptorFactory provide(OpenPGPKey.OpenPGPSecretKey secretKey,
+                                              YubikeyOpenPGPSmartCard card,
+                                              KeyPassphraseProvider userPinProvider)
+                throws PGPException;
+
+        String getName();
+    }
+
+    public static YubikeyDecryptorFactoryProvider bcImpl()
+    {
+        return new YubikeyDecryptorFactoryProvider()
+        {
+            @Override
+            public PublicKeyDataDecryptorFactory provide(OpenPGPKey.OpenPGPSecretKey secretKey,
+                                                         YubikeyOpenPGPSmartCard card,
+                                                         KeyPassphraseProvider userPinProvider)
+                    throws PGPException
+            {
+                return new BcYubikeyPublicKeyDataDecryptorFactory(secretKey, card, userPinProvider);
+            }
+
+            @Override
+            public String getName()
+            {
+                return "BCYK";
+            }
+        };
+    }
+
+    public static YubikeyDecryptorFactoryProvider jceImpl()
+    {
+        return new YubikeyDecryptorFactoryProvider()
+        {
+            @Override
+            public PublicKeyDataDecryptorFactory provide(OpenPGPKey.OpenPGPSecretKey secretKey,
+                                                         YubikeyOpenPGPSmartCard card,
+                                                         KeyPassphraseProvider userPinProvider)
+                    throws PGPException
+            {
+                return new JceYubikeyPublicKeyDataDecryptorFactoryBuilder(card, userPinProvider)
+                        .setProvider(new BouncyCastleProvider())
+                        .build(secretKey);
+            }
+
+            @Override
+            public String getName()
+            {
+                return "JCYK";
+            }
+        };
+    }
 }

pgsc/src/main/java/org/bouncycastle/openpgp/smartcard/yubikey/YubikeySmartCardBackend.java

@@ -1,4 +1,4 @@
-package org.bouncycastle.openpgp.smartcard.yubikey.operator;
+package org.bouncycastle.openpgp.smartcard.yubikey.operator.bc;
 
 import com.yubico.yubikit.core.application.InvalidPinException;
 import com.yubico.yubikit.core.keys.PublicKeyValues;
@@ -39,13 +39,13 @@
  * unwrap work stays in {@link org.bouncycastle.openpgp.operator.bc.BcPublicKeyDataDecryptorFactory}.
  * ElGamal and X448 are not supported by the applet and are rejected.
  */
-public class YubikeyPublicKeyDataDecryptorFactory
+public class BcYubikeyPublicKeyDataDecryptorFactory
     extends BcExternalPublicKeyDataDecryptorFactory
 {
     private final KeyPassphraseProvider userPinProvider;
     private final YubikeyOpenPGPSmartCard yubikey;
 
-    public YubikeyPublicKeyDataDecryptorFactory(OpenPGPKey.OpenPGPSecretKey secretKey,
+    public BcYubikeyPublicKeyDataDecryptorFactory(OpenPGPKey.OpenPGPSecretKey secretKey,
                                                 YubikeyOpenPGPSmartCard yubikey,
                                                 KeyPassphraseProvider userPinProvider)
         throws PGPException