diff --git openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/P11Signature.java openjdk/jdk/src/share/classes/sun/security/pkcs11/P11Signature.java
--- openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/P11Signature.java
+++ openjdk/jdk/src/share/classes/sun/security/pkcs11/P11Signature.java
@@ -87,8 +87,8 @@
// name of the key algorithm, currently either RSA or DSA
private final String keyAlgorithm;
- // mechanism id
- private final long mechanism;
+ // mechanism
+ private final CK_MECHANISM mechanism;
// digest algorithm OID, if we encode RSA signature ourselves
private final ObjectIdentifier digestOID;
@@ -138,11 +138,62 @@
super();
this.token = token;
this.algorithm = algorithm;
- this.mechanism = mechanism;
+ CK_MECHANISM ckMechanism = new CK_MECHANISM(mechanism);
+ final CK_RSA_PKCS_PSS_PARAMS mechParams;
byte[] buffer = null;
ObjectIdentifier digestOID = null;
MessageDigest md = null;
switch ((int)mechanism) {
+ case (int)CKM_SHA1_RSA_PKCS_PSS:
+ mechParams = new CK_RSA_PKCS_PSS_PARAMS();
+ mechParams.hashAlg = CKM_SHA_1;
+ mechParams.mgf = CKG_MGF1_SHA1;
+ mechParams.sLen = 20;
+ ckMechanism = new CK_MECHANISM(mechanism, mechParams);
+ this.keyAlgorithm = "RSA";
+ this.type = T_UPDATE;
+ buffer = new byte[1];
+ break;
+ case (int)CKM_SHA224_RSA_PKCS_PSS:
+ mechParams = new CK_RSA_PKCS_PSS_PARAMS();
+ mechParams.hashAlg = CKM_SHA224;
+ mechParams.mgf = CKG_MGF1_SHA224;
+ mechParams.sLen = 28;
+ ckMechanism = new CK_MECHANISM(mechanism, mechParams);
+ this.keyAlgorithm = "RSA";
+ this.type = T_UPDATE;
+ buffer = new byte[1];
+ break;
+ case (int)CKM_SHA256_RSA_PKCS_PSS:
+ mechParams = new CK_RSA_PKCS_PSS_PARAMS();
+ mechParams.hashAlg = CKM_SHA256;
+ mechParams.mgf = CKG_MGF1_SHA256;
+ mechParams.sLen = 32;
+ ckMechanism = new CK_MECHANISM(mechanism, mechParams);
+ this.keyAlgorithm = "RSA";
+ this.type = T_UPDATE;
+ buffer = new byte[1];
+ break;
+ case (int)CKM_SHA384_RSA_PKCS_PSS:
+ mechParams = new CK_RSA_PKCS_PSS_PARAMS();
+ mechParams.hashAlg = CKM_SHA384;
+ mechParams.mgf = CKG_MGF1_SHA384;
+ mechParams.sLen = 48;
+ ckMechanism = new CK_MECHANISM(mechanism, mechParams);
+ this.keyAlgorithm = "RSA";
+ this.type = T_UPDATE;
+ buffer = new byte[1];
+ break;
+ case (int)CKM_SHA512_RSA_PKCS_PSS:
+ mechParams = new CK_RSA_PKCS_PSS_PARAMS();
+ mechParams.hashAlg = CKM_SHA512;
+ mechParams.mgf = CKG_MGF1_SHA512;
+ mechParams.sLen = 64;
+ ckMechanism = new CK_MECHANISM(mechanism, mechParams);
+ this.keyAlgorithm = "RSA";
+ this.type = T_UPDATE;
+ buffer = new byte[1];
+ break;
case (int)CKM_MD2_RSA_PKCS:
case (int)CKM_MD5_RSA_PKCS:
case (int)CKM_SHA1_RSA_PKCS:
@@ -232,6 +283,7 @@
default:
throw new ProviderException("Unknown mechanism: " + mechanism);
}
+ this.mechanism = ckMechanism;
this.buffer = buffer;
this.digestOID = digestOID;
this.md = md;
@@ -314,10 +366,10 @@
}
if (mode == M_SIGN) {
token.p11.C_SignInit(session.id(),
- new CK_MECHANISM(mechanism), p11Key.keyID);
+ mechanism, p11Key.keyID);
} else {
token.p11.C_VerifyInit(session.id(),
- new CK_MECHANISM(mechanism), p11Key.keyID);
+ mechanism, p11Key.keyID);
}
initialized = true;
} catch (PKCS11Exception e) {
@@ -399,7 +451,8 @@
} else if (algorithm.equals("SHA512withRSA")) {
encodedLength = 83;
} else {
- throw new ProviderException("Unknown signature algo: " + algorithm);
+ encodedLength = 0;
+ //throw new ProviderException("Unknown signature algo: " + algorithm);
}
if (encodedLength > maxDataSize) {
throw new InvalidKeyException
@@ -568,7 +621,7 @@
if (type == T_DIGEST) {
digest = md.digest();
} else { // T_RAW
- if (mechanism == CKM_DSA) {
+ if (mechanism.mechanism == CKM_DSA) {
if (bytesProcessed != buffer.length) {
throw new SignatureException
("Data for RawDSA must be exactly 20 bytes long");
@@ -588,7 +641,7 @@
signature = token.p11.C_Sign(session.id(), digest);
} else { // RSA
byte[] data = encodeSignature(digest);
- if (mechanism == CKM_RSA_X_509) {
+ if (mechanism.mechanism == CKM_RSA_X_509) {
data = pkcs1Pad(data);
}
signature = token.p11.C_Sign(session.id(), data);
@@ -623,7 +676,7 @@
if (type == T_DIGEST) {
digest = md.digest();
} else { // T_RAW
- if (mechanism == CKM_DSA) {
+ if (mechanism.mechanism == CKM_DSA) {
if (bytesProcessed != buffer.length) {
throw new SignatureException
("Data for RawDSA must be exactly 20 bytes long");
@@ -643,7 +696,7 @@
token.p11.C_Verify(session.id(), digest, signature);
} else { // RSA
byte[] data = encodeSignature(digest);
- if (mechanism == CKM_RSA_X_509) {
+ if (mechanism.mechanism == CKM_RSA_X_509) {
data = pkcs1Pad(data);
}
token.p11.C_Verify(session.id(), data, signature);
diff --git openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java openjdk/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
--- openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
+++ openjdk/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
@@ -729,6 +729,16 @@
d(SIG, "SHA512withRSA", P11Signature,
s("1.2.840.113549.1.1.13", "OID.1.2.840.113549.1.1.13"),
m(CKM_SHA512_RSA_PKCS, CKM_RSA_PKCS, CKM_RSA_X_509));
+ d(SIG, "SHA1withRSAandMGF1", P11Signature,
+ m(CKM_SHA1_RSA_PKCS_PSS));
+ d(SIG, "SHA224withRSAandMGF1", P11Signature,
+ m(CKM_SHA224_RSA_PKCS_PSS));
+ d(SIG, "SHA256withRSAandMGF1", P11Signature,
+ m(CKM_SHA256_RSA_PKCS_PSS));
+ d(SIG, "SHA384withRSAandMGF1", P11Signature,
+ m(CKM_SHA384_RSA_PKCS_PSS));
+ d(SIG, "SHA512withRSAandMGF1", P11Signature,
+ m(CKM_SHA512_RSA_PKCS_PSS));
d(KG, "SunTlsRsaPremasterSecret",
"sun.security.pkcs11.P11TlsRsaPremasterSecretGenerator",
diff --git openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/Token.java openjdk/jdk/src/share/classes/sun/security/pkcs11/Token.java
--- openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/Token.java
+++ openjdk/jdk/src/share/classes/sun/security/pkcs11/Token.java
@@ -377,6 +377,10 @@
return keyStore;
}
+ CK_MECHANISM_INFO getMechanismInfo(CK_MECHANISM mechanism) throws PKCS11Exception {
+ return getMechanismInfo(mechanism.mechanism);
+ }
+
CK_MECHANISM_INFO getMechanismInfo(long mechanism) throws PKCS11Exception {
CK_MECHANISM_INFO result = mechInfoMap.get(mechanism);
if (result == null) {
diff --git openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/wrapper/CK_MECHANISM.java openjdk/jdk/src/share/classes/sun/security/pkcs11/wrapper/CK_MECHANISM.java
--- openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/wrapper/CK_MECHANISM.java
+++ openjdk/jdk/src/share/classes/sun/security/pkcs11/wrapper/CK_MECHANISM.java
@@ -116,6 +116,10 @@
init(mechanism, params);
}
+ public CK_MECHANISM(long mechanism, CK_RSA_PKCS_PSS_PARAMS params) {
+ init(mechanism, params);
+ }
+
public CK_MECHANISM(long mechanism, CK_SSL3_KEY_MAT_PARAMS params) {
init(mechanism, params);
}
diff --git openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/wrapper/PKCS11Constants.java openjdk/jdk/src/share/classes/sun/security/pkcs11/wrapper/PKCS11Constants.java
--- openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/wrapper/PKCS11Constants.java
+++ openjdk/jdk/src/share/classes/sun/security/pkcs11/wrapper/PKCS11Constants.java
@@ -458,6 +458,12 @@
public static final long CKM_SHA384_RSA_PKCS = 0x00000041L;
public static final long CKM_SHA512_RSA_PKCS = 0x00000042L;
+ // v2.30
+ public static final long CKM_SHA256_RSA_PKCS_PSS = 0x00000043L;
+ public static final long CKM_SHA384_RSA_PKCS_PSS = 0x00000044L;
+ public static final long CKM_SHA512_RSA_PKCS_PSS = 0x00000045L;
+
+
public static final long CKM_RC2_KEY_GEN = 0x00000100L;
public static final long CKM_RC2_ECB = 0x00000101L;
public static final long CKM_RC2_CBC = 0x00000102L;
@@ -919,6 +925,10 @@
/* The following MGFs are defined */
public static final long CKG_MGF1_SHA1 = 0x00000001L;
+ public static final long CKG_MGF1_SHA256 = 0x00000002L;
+ public static final long CKG_MGF1_SHA384 = 0x00000003L;
+ public static final long CKG_MGF1_SHA512 = 0x00000004L;
+
// new for v2.20 amendment 3
public static final long CKG_MGF1_SHA224 = 0x00000005L;