[cp-patches] PR 27228

[Casey Marshall]

This is a fix for PR 27228, which is a problem with our Diffie- Hellman key pair generator interacting with jsch. Our implementation was doing something very wrong: if you passed in a `DHParameterSpec' -- which contains the DH parameters you need to generate a DH key pair -- we were throwing out these parameters, and using the *size* of those parameters to generate new ones. This is obviously wrong; if in my protocol I've agreed to use parameters P and G in the key exchange, I can't very well generate a different P and G and expect the key exchange to work.

2006-04-22  Casey Marshall  <[EMAIL PROTECTED]>

        Fixes PR classpath/27228.
        * gnu/javax/crypto/jce/sig/DHKeyPairGeneratorSpi.java
        (initialize): also accept `DHParameterSpec.'
        * gnu/javax/crypto/key/dh/GnuDHKeyPairGenerator.java (setup):
        handle a passed-in `DHParameterSpec' properly.
        (generate): don't check if the random exponent is less than `q -
        1' if no `q' was specified.

Committed.


Index: gnu/javax/crypto/jce/sig/DHKeyPairGeneratorSpi.java
===================================================================
RCS file: 
/cvsroot/classpath/classpath/gnu/javax/crypto/jce/sig/DHKeyPairGeneratorSpi.java,v
retrieving revision 1.1
diff -u -B -b -r1.1 DHKeyPairGeneratorSpi.java
--- gnu/javax/crypto/jce/sig/DHKeyPairGeneratorSpi.java 12 Feb 2006 08:57:57 
-0000      1.1
+++ gnu/javax/crypto/jce/sig/DHKeyPairGeneratorSpi.java 22 Apr 2006 17:47:51 
-0000
@@ -44,6 +44,7 @@
 import java.util.HashMap;
 
 import javax.crypto.spec.DHGenParameterSpec;
+import javax.crypto.spec.DHParameterSpec;
 
 import gnu.java.security.Registry;
 import gnu.java.security.jce.sig.KeyPairGeneratorAdapter;
@@ -75,7 +76,8 @@
     HashMap attributes = new HashMap();
     if (params != null)
       {
-        if (! (params instanceof DHGenParameterSpec))
+        if (! (params instanceof DHGenParameterSpec) &&
+            ! (params instanceof DHParameterSpec))
           throw new InvalidAlgorithmParameterException("params");
 
         attributes.put(GnuDHKeyPairGenerator.DH_PARAMETERS, params);
Index: gnu/javax/crypto/key/dh/GnuDHKeyPairGenerator.java
===================================================================
RCS file: 
/cvsroot/classpath/classpath/gnu/javax/crypto/key/dh/GnuDHKeyPairGenerator.java,v
retrieving revision 1.4
diff -u -B -b -r1.4 GnuDHKeyPairGenerator.java
--- gnu/javax/crypto/key/dh/GnuDHKeyPairGenerator.java  23 Feb 2006 12:54:46 
-0000      1.4
+++ gnu/javax/crypto/key/dh/GnuDHKeyPairGenerator.java  22 Apr 2006 17:47:51 
-0000
@@ -187,9 +187,19 @@
       }
     else if (params instanceof DHParameterSpec)
       {
+        // FIXME: I'm not sure this is correct. It seems to behave the
+        // same way as Sun's RI, but I don't know if this behavior is
+        // documented anywhere.
         DHParameterSpec jceSpec = (DHParameterSpec) params;
-        l = jceSpec.getP().bitLength();
+        p = jceSpec.getP();
+        g = jceSpec.getG();
+        l = p.bitLength();
         m = jceSpec.getL();
+
+        // If no exponent size was given, generate an exponent as
+        // large as the prime.
+        if (m == 0)
+          m = l;
       }
     else
       {
@@ -242,7 +252,12 @@
       }
 
     // generate a private number x of length m such as: 1 < x < q - 1
-    BigInteger q_minus_1 = q.subtract(BigInteger.ONE);
+    BigInteger q_minus_1 = null;
+    if (q != null)
+      q_minus_1 = q.subtract(BigInteger.ONE);
+
+    // We already check if m is modulo 8 in `setup.' This could just
+    // be m >>> 3.
     byte[] mag = new byte[(m + 7) / 8];
     BigInteger x;
     while (true)
@@ -250,7 +265,7 @@
         nextRandomBytes(mag);
         x = new BigInteger(1, mag);
         if (x.bitLength() == m && x.compareTo(BigInteger.ONE) > 0
-            && x.compareTo(q_minus_1) < 0)
+            && (q_minus_1 == null || x.compareTo(q_minus_1) < 0))
           {
             break;
           }

The behavior of our DH key pair generator seems to produce the same output as Sun's RI, at least for the test case attached to the bug.

PGP.sig
Description: This is a digitally signed message part