From 8d109e0b7ca6af60f862c641a6287d93a1dcb01b Mon Sep 17 00:00:00 2001

From: Jack Magne <jmagne@redhat.com>

Date: Tue, 7 Nov 2017 11:05:55 -0800

Subject: Fix #2735 Secure removal of secret data storage (phase 2)

This portion of the fix attempts to take care of the remaining secret data

storage issues that could be practically taken care of with respect to

servers and clients.

A new method was placed in CryptoUtil to server the needs of clients.

Change-Id: I1a14daabcad72e531572d1be8bc255e2e501b70a

(cherry picked from commit f5ec7c2af4a1fb44d5731c74672bf789e9240499)

---

 base/common/src/com/netscape/certsrv/key/Key.java  |   6 +

 .../src/com/netscape/cmstools/CMCRequest.java      |  23 ++-

 .../src/com/netscape/cmstools/CMCSharedToken.java  |   2 +

 .../src/com/netscape/cmstools/PasswordCache.java   |   1 +

 .../com/netscape/cmstools/key/KeyRetrieveCLI.java  | 162 +++++++++++----------

 .../cms/servlet/tks/SecureChannelProtocol.java     |  14 +-

 .../com/netscape/cmsutil/crypto/CryptoUtil.java    |  20 +++

 7 files changed, 139 insertions(+), 89 deletions(-)

diff --git a/base/common/src/com/netscape/certsrv/key/Key.java b/base/common/src/com/netscape/certsrv/key/Key.java

index 1afd54c..69b59f3 100644

--- a/base/common/src/com/netscape/certsrv/key/Key.java

+++ b/base/common/src/com/netscape/certsrv/key/Key.java

@@ -6,6 +6,7 @@ import javax.xml.bind.annotation.XmlElement;

 import javax.xml.bind.annotation.XmlRootElement;

 import com.netscape.certsrv.request.RequestId;

+import com.netscape.cmsutil.crypto.CryptoUtil;

 import com.netscape.cmsutil.util.Utils;

 /**

@@ -159,4 +160,9 @@ public class Key {

     public void setPublicKey(String publicKey) {

         this.publicKey = publicKey;

     }

+

+    public void clearSensitiveData() {

+        CryptoUtil.obscureBytes(data, "random");

+        data = null;

+    }

 }

diff --git a/base/java-tools/src/com/netscape/cmstools/CMCRequest.java b/base/java-tools/src/com/netscape/cmstools/CMCRequest.java

index 37752cd..fc58f4e 100644

--- a/base/java-tools/src/com/netscape/cmstools/CMCRequest.java

+++ b/base/java-tools/src/com/netscape/cmstools/CMCRequest.java

@@ -38,13 +38,6 @@ import java.util.Arrays;

 import java.util.Date;

 import java.util.StringTokenizer;

-import netscape.security.pkcs.PKCS10;

-import netscape.security.x509.KeyIdentifier;

-import netscape.security.x509.PKIXExtensions;

-import netscape.security.x509.SubjectKeyIdentifierExtension;

-import netscape.security.x509.X500Name;

-import netscape.security.x509.X509CertImpl;

-

 import org.mozilla.jss.CryptoManager;

 import org.mozilla.jss.asn1.ANY;

 import org.mozilla.jss.asn1.ASN1Util;

@@ -114,6 +107,13 @@ import com.netscape.cmsutil.util.Cert;

 import com.netscape.cmsutil.util.HMACDigest;

 import com.netscape.cmsutil.util.Utils;

+import netscape.security.pkcs.PKCS10;

+import netscape.security.x509.KeyIdentifier;

+import netscape.security.x509.PKIXExtensions;

+import netscape.security.x509.SubjectKeyIdentifierExtension;

+import netscape.security.x509.X500Name;

+import netscape.security.x509.X509CertImpl;

+

 /**

  * Tool for creating CMC full request

  *

@@ -1803,6 +1803,7 @@ public class CMCRequest {

             System.exit(1);

         }

+        byte challenge[] = null;

         try {

             TaggedRequest request = encryptedPop.getRequest();

             AlgorithmIdentifier thePOPAlgID = encryptedPop.getThePOPAlgID();

@@ -1838,7 +1839,7 @@ public class CMCRequest {

             }

             System.out.println(method + "symKey unwrapped.");

-            byte challenge[] = CryptoUtil.decryptUsingSymmetricKey(

+            challenge = CryptoUtil.decryptUsingSymmetricKey(

                     token,

                     ivps,

                     encCI.getEncryptedContent().toByteArray(),

@@ -1857,13 +1858,16 @@ public class CMCRequest {

                 MessageDigest hash = MessageDigest.getInstance(CryptoUtil.getNameFromHashAlgorithm(witnessAlgID));

                 byte[] digest = hash.digest(challenge);

                 boolean witnessChecked = Arrays.equals(digest, witness.toByteArray());

+                CryptoUtil.obscureBytes(digest,"random");

                 if (witnessChecked) {

                     System.out.println(method + "Yay! witness verified");

                 } else {

+                    CryptoUtil.obscureBytes(challenge, "random");

                     System.out.println(method + "Oops! witness failed to verify.  Must abort!");

                     System.exit(1);

                 }

             } catch (Exception ex) {

+                CryptoUtil.obscureBytes(challenge, "random");

                 System.out.println(method + ex);

                 System.exit(1);

             }

@@ -1877,6 +1881,7 @@ public class CMCRequest {

                 hmacDigest.update(ASN1Util.encode(request));

                 popProofValue = hmacDigest.digest();

             } catch (Exception ex) {

+                CryptoUtil.obscureBytes(challenge, "random");

                 System.out.println(method + "calculating POP Proof Value failed: " + ex);

                 System.exit(1);

             }

@@ -1912,6 +1917,8 @@ public class CMCRequest {

         } catch (Exception e) {

             System.out.println(method + e);

             System.exit(1);

+        } finally {

+            CryptoUtil.obscureBytes(challenge, "random");

         }

         System.out.println(method + " completes.");

diff --git a/base/java-tools/src/com/netscape/cmstools/CMCSharedToken.java b/base/java-tools/src/com/netscape/cmstools/CMCSharedToken.java

index a0a7651..d16dd0c 100644

--- a/base/java-tools/src/com/netscape/cmstools/CMCSharedToken.java

+++ b/base/java-tools/src/com/netscape/cmstools/CMCSharedToken.java

@@ -299,6 +299,8 @@ public class CMCSharedToken {

                 String ver_spassphrase = new String(ver_passphrase, "UTF-8");

+                CryptoUtil.obscureBytes(ver_passphrase, "random");

+

                 System.out.println("ver_passphrase String = " + ver_spassphrase);

                 System.out.println("ver_passphrase UTF-8 bytes = ");

                 System.out.println(Arrays.toString(ver_spassphrase.getBytes("UTF-8")));

diff --git a/base/java-tools/src/com/netscape/cmstools/PasswordCache.java b/base/java-tools/src/com/netscape/cmstools/PasswordCache.java

index 7f17c8f..859eda3 100644

--- a/base/java-tools/src/com/netscape/cmstools/PasswordCache.java

+++ b/base/java-tools/src/com/netscape/cmstools/PasswordCache.java

@@ -554,6 +554,7 @@ class PWsdrCache {

                 byte[] dcryptb = sdr.decrypt(bos.toByteArray());

                 dcrypts = new String(dcryptb, "UTF-8");

+                CryptoUtil.obscureBytes(dcryptb, "random");

             } catch (TokenException e) {

                 System.out.println("password cache decrypto failed " + e.toString());

                 e.printStackTrace();

diff --git a/base/java-tools/src/com/netscape/cmstools/key/KeyRetrieveCLI.java b/base/java-tools/src/com/netscape/cmstools/key/KeyRetrieveCLI.java

index 736c6e6..8339218 100644

--- a/base/java-tools/src/com/netscape/cmstools/key/KeyRetrieveCLI.java

+++ b/base/java-tools/src/com/netscape/cmstools/key/KeyRetrieveCLI.java

@@ -87,106 +87,116 @@ public class KeyRetrieveCLI extends CLI {

             throw new Exception("Incorrect number of parameters provided.");

         }

-        String keyId = cmd.getOptionValue("keyID");

-        String passphrase = cmd.getOptionValue("passphrase");

-        String requestId = cmd.getOptionValue("requestID");

-        String outputFilePath = cmd.getOptionValue("output");

-        String outputDataFile = cmd.getOptionValue("output-data");

-        String requestFile = cmd.getOptionValue("input");

-        String transportNickname = cmd.getOptionValue("transport");

-

-        KeyClient keyClient = keyCLI.getKeyClient(transportNickname);

         Key keyData = null;

-        if (requestFile != null) {

-            JAXBContext context = JAXBContext.newInstance(KeyRecoveryRequest.class);

-            Unmarshaller unmarshaller = context.createUnmarshaller();

-            FileInputStream fis = new FileInputStream(requestFile);

-            KeyRecoveryRequest req = (KeyRecoveryRequest) unmarshaller.unmarshal(fis);

-

-            if (req.getKeyId() == null) {

-                throw new Exception("Key ID must be specified in the request file.");

-            }

-

-            if (req.getCertificate() != null) {

-                keyData = keyClient.retrieveKeyByPKCS12(req.getKeyId(), req.getCertificate(),

-                        req.getPassphrase());

+        try {

+            String keyId = cmd.getOptionValue("keyID");

+            String passphrase = cmd.getOptionValue("passphrase");

+            String requestId = cmd.getOptionValue("requestID");

+            String outputFilePath = cmd.getOptionValue("output");

+            String outputDataFile = cmd.getOptionValue("output-data");

+            String requestFile = cmd.getOptionValue("input");

+            String transportNickname = cmd.getOptionValue("transport");

+

+            KeyClient keyClient = keyCLI.getKeyClient(transportNickname);

+

+            if (requestFile != null) {

+                JAXBContext context = JAXBContext.newInstance(KeyRecoveryRequest.class);

+                Unmarshaller unmarshaller = context.createUnmarshaller();

+                FileInputStream fis = new FileInputStream(requestFile);

+                KeyRecoveryRequest req = (KeyRecoveryRequest) unmarshaller.unmarshal(fis);

+

+                if (req.getKeyId() == null) {

+                    throw new Exception("Key ID must be specified in the request file.");

+                }

-            } else if (req.getPassphrase() != null) {

-                keyData = keyClient.retrieveKeyByPassphrase(req.getKeyId(), req.getPassphrase());

+                if (req.getCertificate() != null) {

+                    keyData = keyClient.retrieveKeyByPKCS12(req.getKeyId(), req.getCertificate(),

+                            req.getPassphrase());

-            } else if (req.getSessionWrappedPassphrase() != null) {

-                keyData = keyClient.retrieveKeyUsingWrappedPassphrase(req.getKeyId(),

-                        Utils.base64decode(req.getTransWrappedSessionKey()),

-                        Utils.base64decode(req.getSessionWrappedPassphrase()),

-                        Utils.base64decode(req.getNonceData()));

+                } else if (req.getPassphrase() != null) {

+                    keyData = keyClient.retrieveKeyByPassphrase(req.getKeyId(), req.getPassphrase());

-            } else if (req.getTransWrappedSessionKey() != null) {

-                keyData = keyClient.retrieveKey(req.getKeyId(),

-                        Utils.base64decode(req.getTransWrappedSessionKey()));

+                } else if (req.getSessionWrappedPassphrase() != null) {

+                    keyData = keyClient.retrieveKeyUsingWrappedPassphrase(req.getKeyId(),

+                            Utils.base64decode(req.getTransWrappedSessionKey()),

+                            Utils.base64decode(req.getSessionWrappedPassphrase()),

+                            Utils.base64decode(req.getNonceData()));

-            } else {

-                keyData = keyClient.retrieveKey(req.getKeyId());

-            }

+                } else if (req.getTransWrappedSessionKey() != null) {

+                    keyData = keyClient.retrieveKey(req.getKeyId(),

+                            Utils.base64decode(req.getTransWrappedSessionKey()));

-        } else {

-            // Using command line options.

-            if (requestId == null && keyId == null) {

-                throw new Exception("Either requestID or keyID must be specified");

-            }

-

-            if (passphrase != null) {

-                if (requestId != null) {

-                    keyData = keyClient.retrieveKeyByRequestWithPassphrase(

-                            new RequestId(requestId), passphrase);

                 } else {

-                    keyData = keyClient.retrieveKeyByPassphrase(new KeyId(keyId), passphrase);

+                    keyData = keyClient.retrieveKey(req.getKeyId());

                 }

             } else {

-                if (requestId != null) {

-                    keyData = keyClient.retrieveKeyByRequest(new RequestId(requestId));

-                } else {

-                    keyData = keyClient.retrieveKey(new KeyId(keyId));

+                // Using command line options.

+                if (requestId == null && keyId == null) {

+                    throw new Exception("Either requestID or keyID must be specified");

                 }

-                clientEncryption = false;

+                if (passphrase != null) {

+                    if (requestId != null) {

+                        keyData = keyClient.retrieveKeyByRequestWithPassphrase(

+                                new RequestId(requestId), passphrase);

+                    } else {

+                        keyData = keyClient.retrieveKeyByPassphrase(new KeyId(keyId), passphrase);

+                    }

+

+                } else {

+                    if (requestId != null) {

+                        keyData = keyClient.retrieveKeyByRequest(new RequestId(requestId));

+                    } else {

+                        keyData = keyClient.retrieveKey(new KeyId(keyId));

+                    }

+

+                    clientEncryption = false;

-                // No need to return the encrypted data since encryption

-                // is done locally.

-                keyData.setEncryptedData(null);

+                    // No need to return the encrypted data since encryption

+                    // is done locally.

+                    keyData.setEncryptedData(null);

+                }

             }

-        }

-        MainCLI.printMessage("Retrieve Key Information");

+            MainCLI.printMessage("Retrieve Key Information");

-        if (outputDataFile != null) {

+            if (outputDataFile != null) {

-            byte[] data;

-            if (clientEncryption) { // store encrypted data

-                data = keyData.getEncryptedData();

+                byte[] data;

+                if (clientEncryption) { // store encrypted data

+                    data = keyData.getEncryptedData();

-            } else { // store unencrypted data

-                data = keyData.getData();

-            }

+                } else { // store unencrypted data

+                    data = keyData.getData();

+                }

-            Path path = Paths.get(outputDataFile);

-            Files.write(path, data);

+                Path path = Paths.get(outputDataFile);

+                Files.write(path, data);

-            printKeyInfo(keyData);

-            System.out.println("  Output: " + outputDataFile);

+                printKeyInfo(keyData);

+                System.out.println("  Output: " + outputDataFile);

-        } else if (outputFilePath != null) {

-            JAXBContext context = JAXBContext.newInstance(Key.class);

-            Marshaller marshaller = context.createMarshaller();

-            marshaller.setProperty(Marshaller.JAXB_FORMATTED_OUTPUT, true);

-            marshaller.marshal(keyData, new File(outputFilePath));

+            } else if (outputFilePath != null) {

+                JAXBContext context = JAXBContext.newInstance(Key.class);

+                Marshaller marshaller = context.createMarshaller();

+                marshaller.setProperty(Marshaller.JAXB_FORMATTED_OUTPUT, true);

+                marshaller.marshal(keyData, new File(outputFilePath));

-            System.out.println("  Output: " + outputFilePath);

+                System.out.println("  Output: " + outputFilePath);

-        } else {

-            printKeyInfo(keyData);

-            printKeyData(keyData);

+            } else {

+                printKeyInfo(keyData);

+                printKeyData(keyData);

+            }

+

+        } catch (Exception e) {

+            throw e;

+        } finally {

+            if (keyData != null) {

+                keyData.clearSensitiveData();

+            }

         }

     }

diff --git a/base/server/cms/src/com/netscape/cms/servlet/tks/SecureChannelProtocol.java b/base/server/cms/src/com/netscape/cms/servlet/tks/SecureChannelProtocol.java

index c3b3952..1110cc6 100644

--- a/base/server/cms/src/com/netscape/cms/servlet/tks/SecureChannelProtocol.java

+++ b/base/server/cms/src/com/netscape/cms/servlet/tks/SecureChannelProtocol.java

@@ -25,12 +25,13 @@ import org.mozilla.jss.crypto.SymmetricKey.NotExtractableException;

 import org.mozilla.jss.crypto.SymmetricKeyDeriver;

 import org.mozilla.jss.crypto.TokenException;

-import sun.security.pkcs11.wrapper.PKCS11Constants;

-

 import com.netscape.certsrv.apps.CMS;

 import com.netscape.certsrv.base.EBaseException;

+import com.netscape.cmscore.security.JssSubsystem;

 import com.netscape.cmsutil.crypto.CryptoUtil;

+import sun.security.pkcs11.wrapper.PKCS11Constants;

+

 public class SecureChannelProtocol {

     static String sharedSecretKeyName = null;

@@ -341,7 +342,8 @@ public class SecureChannelProtocol {

                     byte[] finalKeyBytes = nistKdf.kdf_AES_CMAC_SCP03(divKey, context, constant, 16);

                     sessionKey = unwrapAESSymKeyOnToken(token, finalKeyBytes, false);

-                    Arrays.fill(finalKeyBytes,(byte) 0);

+                    JssSubsystem jssSubsystem = (JssSubsystem) CMS.getSubsystem(JssSubsystem.ID);

+                    jssSubsystem.obscureBytes(finalKeyBytes);

                     //The final session key is AES.

                 }

@@ -393,7 +395,8 @@ public class SecureChannelProtocol {

                     byte[] finalKeyBytes = nistKdf.kdf_AES_CMAC_SCP03(divKey, context, constant, 16);

                     sessionKey = unwrapAESSymKeyOnToken(token, finalKeyBytes, false);

-                    Arrays.fill(finalKeyBytes,(byte) 0);

+                    JssSubsystem jssSubsystem = (JssSubsystem) CMS.getSubsystem(JssSubsystem.ID);

+                    jssSubsystem.obscureBytes(finalKeyBytes);

                 }

             }

         }

@@ -908,7 +911,8 @@ public class SecureChannelProtocol {

             finalAESKey = keyUnWrap.unwrapSymmetric(wrappedKey, SymmetricKey.AES, 16);

-            Arrays.fill(wrappedKey,(byte) 0);

+            JssSubsystem jssSubsystem = (JssSubsystem) CMS.getSubsystem(JssSubsystem.ID);

+            jssSubsystem.obscureBytes(wrappedKey);

             //byte[] finalKeyBytes = finalAESKey.getKeyData();

             //displayByteArray(finalKeyBytes, false);

diff --git a/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java b/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java

index 1337803..8a0ea08 100644

--- a/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java

+++ b/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java

@@ -2176,6 +2176,26 @@ public class CryptoUtil {

     }

+    public static void obscureBytes(byte[] memory, String method) {

+        if (memory == null || memory.length == 0) {

+            //in case we want to log

+            return;

+        }

+

+        SecureRandom rnd;

+        try {

+            rnd = getRandomNumberGenerator();

+        } catch (GeneralSecurityException e) {

+            throw new RuntimeException(e);

+        }

+

+        if ("zeroes".equals(method)) {

+            Arrays.fill(memory, (byte)0);

+        } else {

+            rnd.nextBytes(memory);

+        }

+    }

+

     public static byte[] unwrapUsingPassphrase(byte[] wrappedRecoveredKey, String recoveryPassphrase)

             throws IOException, InvalidBERException, InvalidKeyException, IllegalStateException,

             NoSuchAlgorithmException, InvalidAlgorithmParameterException, NotInitializedException, TokenException,

-- 

1.8.3.1

From 0cbe30064861a9908475aa95a686e69e3012a841 Mon Sep 17 00:00:00 2001

From: Christian Heimes <cheimes@redhat.com>

Date: Wed, 8 Nov 2017 20:46:57 +0100

Subject: Ignore empty key in read_environment_files

Don't set empty key or key '_' (last command) in read_environment_files.

Fixes "ValueError: illegal environment variable name".

Change-Id: I22d295ebbf0845bcf8aab3019e1b1f5a3a731e10

Closes: https://pagure.io/dogtagpki/issue/2850

Signed-off-by: Christian Heimes <cheimes@redhat.com>

(cherry picked from commit a105341f777354429dfc9f28c7baf5bddd2d5e1f)

---

 base/common/python/pki/util.py | 2 ++

 1 file changed, 2 insertions(+)

diff --git a/base/common/python/pki/util.py b/base/common/python/pki/util.py

index 5832f55..871c899 100644

--- a/base/common/python/pki/util.py

+++ b/base/common/python/pki/util.py

@@ -272,4 +272,6 @@ def read_environment_files(env_file_list=None):

     for env_val in env_vals:

         (key, _, value) = env_val.partition("=")

+        if not key.strip() or key == u'_':

+            continue

         os.environ[key] = value

-- 

1.8.3.1

From 45c07d48a8a5f4acda8ce4ca3be5803c2596901e Mon Sep 17 00:00:00 2001

From: Jack Magne <jmagne@redhat.com>

Date: Fri, 10 Nov 2017 15:55:36 -0800

Subject: ReFix for  #2824 TPS new configuration to allow the protocol of the

 to determine applet loaded.

The problem discovered was that in only the external registration case, there was a problem obtaining the protocol

information for the token being enrolled. This simple fix makes sure the protocol info is obtained correctly for external

reg and non external reg enrollment cases.

Change-Id: Iccd40adbdafd5e94e04cbb8c391bd2706e483a1f

(cherry picked from commit e48374cd8a744fad5a03f64e8685ec3b3c465553)

---

 .../src/org/dogtagpki/server/tps/processor/TPSProcessor.java   | 10 ++++++----

 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/base/tps/src/org/dogtagpki/server/tps/processor/TPSProcessor.java b/base/tps/src/org/dogtagpki/server/tps/processor/TPSProcessor.java

index 57e5d79..a78db64 100644

--- a/base/tps/src/org/dogtagpki/server/tps/processor/TPSProcessor.java

+++ b/base/tps/src/org/dogtagpki/server/tps/processor/TPSProcessor.java

@@ -33,8 +33,6 @@ import java.util.List;

 import java.util.Map;

 import java.util.Set;

-import netscape.security.x509.RevocationReason;

-

 import org.dogtagpki.server.tps.TPSSession;

 import org.dogtagpki.server.tps.TPSSubsystem;

 import org.dogtagpki.server.tps.authentication.AuthUIParameter;

@@ -104,6 +102,8 @@ import com.netscape.cms.servlet.tks.SecureChannelProtocol;

 import com.netscape.cmsutil.crypto.CryptoUtil;

 import com.netscape.symkey.SessionKey;

+import netscape.security.x509.RevocationReason;

+

 public class TPSProcessor {

     private static Logger signedAuditLogger = SignedAuditLogger.getLogger();

@@ -558,8 +558,10 @@ public class TPSProcessor {

             CMS.debug("TPSProcessor.setupSecureChannel: obtained randomData");

         }

-        // We already do this when checking for applet upgrade earlier.

-        //acquireChannelPlatformAndProtocolInfo();

+        // Do this on behalf of external reg, which needs it

+        // If already called, the routine will return anyway.

+

+        acquireChannelPlatformAndProtocolInfo();

         TPSBuffer initUpdateResp = initializeUpdate(keyVersion, keyIndex, randomData);

-- 

1.8.3.1

From 23ce60193a31c070441f93238565a7250cff981b Mon Sep 17 00:00:00 2001

From: Jack Magne <jmagne@redhat.com>

Date: Fri, 10 Nov 2017 10:57:36 -0800

Subject: Fix #2735 Secure removal of secret data storage (phase 3)

Add more secure data removal with respect to passwords.

Concentrate on the CMC Shared Token area. Done by changing

String based passwords to char[] based password, which then can be cleaned.

Cleaned up a couple of minor review suggestions.

Change-Id: I898814000353978f403f19f679083474548edc5e

(cherry picked from commit daff3951340246d97a9877d5dde4782c8c675974)

---

 .../certsrv/authentication/ISharedToken.java       |  10 +-

 .../servlet/test/GeneratePKIArchiveOptions.java    |   9 +-

 base/kra/src/com/netscape/kra/RecoveryService.java |  30 +-

 .../com/netscape/kra/SecurityDataProcessor.java    |   8 +-

 .../netscape/cms/authentication/SharedSecret.java  |  24 +-

 .../netscape/cms/profile/common/EnrollProfile.java | 349 ++++++++++++---------

 .../cms/servlet/common/CMCOutputTemplate.java      |  19 +-

 .../cms/servlet/csadmin/ConfigurationUtils.java    | 266 +++++++++-------

 .../netscape/cmscore/security/JssSubsystem.java    |   8 +

 .../com/netscape/cmsutil/crypto/CryptoUtil.java    |  65 +++-

 10 files changed, 494 insertions(+), 294 deletions(-)

diff --git a/base/common/src/com/netscape/certsrv/authentication/ISharedToken.java b/base/common/src/com/netscape/certsrv/authentication/ISharedToken.java

index b33ae7b..761c344 100644

--- a/base/common/src/com/netscape/certsrv/authentication/ISharedToken.java

+++ b/base/common/src/com/netscape/certsrv/authentication/ISharedToken.java

@@ -16,24 +16,24 @@

 // All rights reserved.

 // --- END COPYRIGHT BLOCK ---

 package com.netscape.certsrv.authentication;

-import com.netscape.certsrv.base.EBaseException;

-

 import java.math.BigInteger;

 import org.mozilla.jss.pkix.cmc.PKIData;

+import com.netscape.certsrv.base.EBaseException;

+

 /**

  * Shared Token interface.

  */

 public interface ISharedToken {

     // support for id_cmc_identification

-    public String getSharedToken(String identification)

+    public char[] getSharedToken(String identification)

             throws EBaseException;

-    public String getSharedToken(PKIData cmcData)

+    public char[] getSharedToken(PKIData cmcData)

             throws EBaseException;

-    public String getSharedToken(BigInteger serialnum)

+    public char[] getSharedToken(BigInteger serialnum)

             throws EBaseException;

 }

diff --git a/base/kra/functional/src/com/netscape/cms/servlet/test/GeneratePKIArchiveOptions.java b/base/kra/functional/src/com/netscape/cms/servlet/test/GeneratePKIArchiveOptions.java

index e1a9816..5ccf7a8 100644

--- a/base/kra/functional/src/com/netscape/cms/servlet/test/GeneratePKIArchiveOptions.java

+++ b/base/kra/functional/src/com/netscape/cms/servlet/test/GeneratePKIArchiveOptions.java

@@ -213,8 +213,15 @@ public class GeneratePKIArchiveOptions {

                 new OCTET_STRING(ivps.getIV()));

         if (passphraseMode) {

+            char[] pwdChars = passphrase.toCharArray();

+            try {

             encoded = CryptoUtil.createEncodedPKIArchiveOptions(

-                    token, transportCert.getPublicKey(), passphrase, params, aid);

+                    token, transportCert.getPublicKey(), pwdChars, params, aid);

+            } catch (Exception e) {

+                throw e;

+            } finally {

+                CryptoUtil.obscureChars(pwdChars);

+            }

         } else {

             encoded = CryptoUtil.createEncodedPKIArchiveOptions(

                     token, transportCert.getPublicKey(), vek, params, aid);

diff --git a/base/kra/src/com/netscape/kra/RecoveryService.java b/base/kra/src/com/netscape/kra/RecoveryService.java

index d562c15..96ee73b 100644

--- a/base/kra/src/com/netscape/kra/RecoveryService.java

+++ b/base/kra/src/com/netscape/kra/RecoveryService.java

@@ -461,6 +461,7 @@ public class RecoveryService implements IService {

     public void createPFX(IRequest request, Hashtable<String, Object> params,

             PrivateKey priKey, CryptoToken ct) throws EBaseException {

         CMS.debug("RecoverService: createPFX() allowEncDecrypt_recovery=false");

+        org.mozilla.jss.util.Password pass = null;

         try {

             // create p12

             X509Certificate x509cert =

@@ -493,9 +494,14 @@ public class RecoveryService implements IService {

             // add key

             mKRA.log(ILogger.LL_INFO, "KRA adds key to P12");

             CMS.debug("RecoverService: createPFX() adds key to P12");

-            org.mozilla.jss.util.Password pass = new

+            char[] pwdChar = pwd.toCharArray();

+            pass = new

                     org.mozilla.jss.util.Password(

-                            pwd.toCharArray());

+                            pwdChar);

+            {

+                JssSubsystem jssSubsystem = (JssSubsystem) CMS.getSubsystem(JssSubsystem.ID);

+                jssSubsystem.obscureChars(pwdChar);

+            }

             SEQUENCE safeContents = new SEQUENCE();

             PasswordConverter passConverter = new

@@ -580,7 +586,6 @@ public class RecoveryService implements IService {

                     ByteArrayOutputStream();

             pfx.encode(fos);

-            pass.clear();

             // put final PKCS12 into volatile request

             params.put(ATTR_PKCS12, fos.toByteArray());

@@ -590,6 +595,10 @@ public class RecoveryService implements IService {

             CMS.debug("RecoverService: createPFX() exception caught:"+

                 e.toString());

             throw new EKRAException(CMS.getUserMessage("CMS_KRA_PKCS12_FAILED_1", e.toString()));

+        } finally {

+            if(pass != null) {

+                pass.clear();

+            }

         }

         // update request

@@ -637,6 +646,7 @@ public class RecoveryService implements IService {

     public void createPFX(IRequest request, Hashtable<String, Object> params,

             byte priData[]) throws EBaseException {

         CMS.debug("RecoverService: createPFX() allowEncDecrypt_recovery=true");

+        org.mozilla.jss.util.Password pass = null;

         try {

             // create p12

             X509Certificate x509cert =

@@ -667,9 +677,13 @@ public class RecoveryService implements IService {

             // add key

             mKRA.log(ILogger.LL_INFO, "KRA adds key to P12");

-            org.mozilla.jss.util.Password pass = new

-                    org.mozilla.jss.util.Password(

-                            pwd.toCharArray());

+            char[] pwdChars = pwd.toCharArray();

+            pass = new org.mozilla.jss.util.Password(

+                    pwdChars);

+

+            JssSubsystem jssSubsystem = (JssSubsystem) CMS.getSubsystem(JssSubsystem.ID);

+            jssSubsystem.obscureChars(pwdChars);

+

             SEQUENCE safeContents = new SEQUENCE();

             PrivateKeyInfo pki = (PrivateKeyInfo)

@@ -735,13 +749,15 @@ public class RecoveryService implements IService {

                     ByteArrayOutputStream();

             pfx.encode(fos);

-            pass.clear();

             // put final PKCS12 into volatile request

             params.put(ATTR_PKCS12, fos.toByteArray());

         } catch (Exception e) {

             mKRA.log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_KRA_CONSTRUCT_P12", e.toString()));

             throw new EKRAException(CMS.getUserMessage("CMS_KRA_PKCS12_FAILED_1", e.toString()));

+        } finally {

+            if(pass != null)

+                pass.clear();

         }

         // update request

diff --git a/base/kra/src/com/netscape/kra/SecurityDataProcessor.java b/base/kra/src/com/netscape/kra/SecurityDataProcessor.java

index 71d1233..8de1311 100644

--- a/base/kra/src/com/netscape/kra/SecurityDataProcessor.java

+++ b/base/kra/src/com/netscape/kra/SecurityDataProcessor.java

@@ -487,9 +487,11 @@ public class SecurityDataProcessor {

                         unwrappedSess,

                         wrapParams.getPayloadEncryptionAlgorithm());

-                String passStr = new String(unwrappedPass, "UTF-8");

-                pass = new Password(passStr.toCharArray());

-                passStr = null;

+                char[] passChars = CryptoUtil.bytesToChars(unwrappedPass);

+                pass = new Password(passChars);

+                JssSubsystem jssSubsystem = (JssSubsystem) CMS.getSubsystem(JssSubsystem.ID);

+                jssSubsystem.obscureChars(passChars);

+

                 if (dataType.equals(KeyRequestResource.SYMMETRIC_KEY_TYPE)) {

diff --git a/base/server/cms/src/com/netscape/cms/authentication/SharedSecret.java b/base/server/cms/src/com/netscape/cms/authentication/SharedSecret.java

index cf69975..ee7a7d7 100644

--- a/base/server/cms/src/com/netscape/cms/authentication/SharedSecret.java

+++ b/base/server/cms/src/com/netscape/cms/authentication/SharedSecret.java

@@ -240,7 +240,7 @@ public class SharedSecret extends DirBasedAuthentication

      * Note: caller should clear the memory for the returned token

      *       after each use

      */

-    public String getSharedToken(String identification)