From aa39354dbbf9df404f6ad374c837db0c421f2705 Mon Sep 17 00:00:00 2001

From: Christina Fu <cfu@redhat.com>

Date: Mon, 5 Jun 2017 08:50:25 -0700

Subject: [PATCH 01/14] Ticket #2617 part2: add revocation check to signing

 cert

---

 .../cms/authentication/CMCUserSignedAuth.java         | 19 +++++++++++++++++++

 .../authentication/CertUserDBAuthentication.java      |  2 +-

 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/base/server/cms/src/com/netscape/cms/authentication/CMCUserSignedAuth.java b/base/server/cms/src/com/netscape/cms/authentication/CMCUserSignedAuth.java

index 2128c1e..a18c25e 100644

--- a/base/server/cms/src/com/netscape/cms/authentication/CMCUserSignedAuth.java

+++ b/base/server/cms/src/com/netscape/cms/authentication/CMCUserSignedAuth.java

@@ -29,6 +29,7 @@ import java.io.ByteArrayInputStream;

 import java.io.ByteArrayOutputStream;

 import java.io.IOException;

 import java.math.BigInteger;

+import java.security.cert.CertificateExpiredException;

 import java.security.MessageDigest;

 import java.security.PublicKey;

 import java.util.Enumeration;

@@ -1076,7 +1077,10 @@ public class CMCUserSignedAuth implements IAuthManager, IExtendedPluginInfo,

                             si.verify(digest, id, pubK);

                         }

                         CMS.debug(method + "finished checking signature");

+

                         // verify signer's certificate using the revocator

+                        // ...or not;  I think it just checks usage and

+                        // validity, but not revocation status

                         if (!cm.isCertValid(certByteArray, true, CryptoManager.CertUsage.SSLClient)) {

                             CMS.debug(method + "CMC signature failed to be verified");

                             s.close();

@@ -1086,6 +1090,21 @@ public class CMCUserSignedAuth implements IAuthManager, IExtendedPluginInfo,

                         }

                         // At this point, the signature has been verified;

+                        // now check revocation status of the cert

+                        if (CMS.isRevoked(x509Certs)) {

+                            CMS.debug(method + "CMC signing cert is a revoked certificate");

+                            throw new EInvalidCredentials(CMS.getUserMessage("CMS_AUTHENTICATION_INVALID_CREDENTIAL"));

+                        }

+                        try { //do this again anyways

+                            cert.checkValidity();

+                        } catch (CertificateExpiredException e) {

+                            CMS.debug(method + "CMC signing cert is an expired certificate");

+                            throw new EInvalidCredentials(CMS.getUserMessage("CMS_AUTHENTICATION_INVALID_CREDENTIAL"));

+                        } catch (Exception e) {

+                            CMS.debug(method + e.toString());

+                            throw new EInvalidCredentials(CMS.getUserMessage("CMS_AUTHENTICATION_INVALID_CREDENTIAL"));

+                        }

+

                         IAuthToken tempToken = new AuthToken(null);

 /*

                         netscape.security.x509.X500Name tempPrincipal = (X500Name) x509Certs[0].getSubjectDN();

diff --git a/base/server/cmscore/src/com/netscape/cmscore/authentication/CertUserDBAuthentication.java b/base/server/cmscore/src/com/netscape/cmscore/authentication/CertUserDBAuthentication.java

index 998d7e2..ae450fa 100644

--- a/base/server/cmscore/src/com/netscape/cmscore/authentication/CertUserDBAuthentication.java

+++ b/base/server/cmscore/src/com/netscape/cmscore/authentication/CertUserDBAuthentication.java

@@ -168,7 +168,7 @@ public class CertUserDBAuthentication implements IAuthManager, ICertUserDBAuthen

         try {

             user = (User) mCULocator.locateUser(certs);

         } catch (EUsrGrpException e) {

-            CMS.debug("CertUserDBAuthentication: cannot map certificate to any user");

+            CMS.debug("CertUserDBAuthentication: cannot map certificate to any user" + e);

             log(ILogger.LL_FAILURE, CMS.getLogMessage("CMSCORE_AUTH_AGENT_AUTH_FAILED", x509Certs[0].getSerialNumber()

                     .toString(16), x509Certs[0].getSubjectDN().toString(), e.toString()));

             throw new EInvalidCredentials(CMS.getUserMessage("CMS_AUTHENTICATION_INVALID_CREDENTIAL"));

-- 

1.8.3.1

From 30fb7bf49ce0f4c726f937b3984a4e27abb39959 Mon Sep 17 00:00:00 2001

From: Jack Magne <jmagne@dhcp-16-206.sjc.redhat.com>

Date: Tue, 6 Jun 2017 16:16:32 -0700

Subject: [PATCH 04/14] Minor fix to already fixed issue:

The problem was that a tiny piece of the original patch didn't get checked in. This resolves this issue.

---

 base/native-tools/src/tkstool/key.c | 11 ++++++-----

 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/base/native-tools/src/tkstool/key.c b/base/native-tools/src/tkstool/key.c

index e63da93..f208cbd 100644

--- a/base/native-tools/src/tkstool/key.c

+++ b/base/native-tools/src/tkstool/key.c

@@ -1219,13 +1219,14 @@ TKS_StoreSymmetricKeyAndNameIt( char              *symmetricKeyName,

     rvExtractSymmetricKey = PK11_ExtractKeyValue( /* symmetric key */ symKey );

     if( rvExtractSymmetricKey != SECSuccess ) {

         PR_fprintf( PR_STDERR,

-                    "ERROR:  Failed to extract the %s key!\n\n",

+                    "ERROR:  Failed to extract the %s key for final display, OK if in FIPs mode!\n\n",

                     symmetricKeyName );

-        goto destroyHexSymmetricKey;

-    }

+        symmetricKey = NULL;

+    } else {

-    /* If present, retrieve the raw key data */

-    symmetricKey = PK11_GetKeyData( /* symmetric key */  symKey );

+        /* If present, retrieve the raw key data */

+        symmetricKey = PK11_GetKeyData( /* symmetric key */  symKey );

+    }

 #if defined(DEBUG)

     /* For convenience, display the final symmetric key and */

-- 

1.8.3.1

From 38df4274214938ceece85627abb6d4fe77b960ff Mon Sep 17 00:00:00 2001

From: Ade Lee <alee@redhat.com>

Date: Fri, 26 May 2017 13:06:18 -0400

Subject: [PATCH 06/14] Refactor client to not use keysets

It is simpler to simply tell the client which

algorithm to use for key wrapping and encryption, rather

than use key sets.  Therefore:

* KRAInfo and CAInfo are refactored to provide the

  algorithms required for key wrapping and encryption.

* Client is modified to use these parameters to determine

  which algorithms to use.

* We specify the OIDs that will be used in the PKIARchiveOptions

  more correctly.  The options are basically:

  AES-128-CBC, DES3-CBC, AES KeyWrap/Pad

Change-Id: Ic3fca902bbc45f7f72bcd4676c994f8a89c3a409

---

 base/common/src/org/dogtagpki/common/CAInfo.java   |  34 +++--

 base/common/src/org/dogtagpki/common/KRAInfo.java  |  34 +++++

 .../src/com/netscape/cmstools/CRMFPopClient.java   | 153 ++++++++++-----------

 .../cmstools/client/ClientCertRequestCLI.java      |  34 +----

 .../org/dogtagpki/server/rest/CAInfoService.java   |  18 +--

 .../org/dogtagpki/server/rest/KRAInfoService.java  |  40 +++++-

 .../com/netscape/cmsutil/crypto/CryptoUtil.java    |  22 +++

 7 files changed, 206 insertions(+), 129 deletions(-)

diff --git a/base/common/src/org/dogtagpki/common/CAInfo.java b/base/common/src/org/dogtagpki/common/CAInfo.java

index f21dcd0..0f68c7a 100644

--- a/base/common/src/org/dogtagpki/common/CAInfo.java

+++ b/base/common/src/org/dogtagpki/common/CAInfo.java

@@ -54,7 +54,8 @@ public class CAInfo extends ResourceMessage {

     }

     String archivalMechanism;

-    String wrappingKeySet;

+    String encryptAlgorithm;

+    String keyWrapAlgorithm;

     @XmlElement(name="ArchivalMechanism")

     public String getArchivalMechanism() {

@@ -65,13 +66,20 @@ public class CAInfo extends ResourceMessage {

         this.archivalMechanism = archivalMechanism;

     }

-    @XmlElement(name="WrappingKeySet")

-    public String getWrappingKeySet() {

-        return wrappingKeySet;

+    public String getEncryptAlgorithm() {

+        return encryptAlgorithm;

     }

-    public void setWrappingKeySet(String wrappingKeySet) {

-        this.wrappingKeySet = wrappingKeySet;

+    public void setEncryptAlgorithm(String encryptAlgorithm) {

+        this.encryptAlgorithm = encryptAlgorithm;

+    }

+

+    public String getKeyWrapAlgorithm() {

+        return keyWrapAlgorithm;

+    }

+

+    public void setKeyWrapAlgorithm(String keyWrapAlgorithm) {

+        this.keyWrapAlgorithm = keyWrapAlgorithm;

     }

     @Override

@@ -79,7 +87,8 @@ public class CAInfo extends ResourceMessage {

         final int prime = 31;

         int result = super.hashCode();

         result = prime * result + ((archivalMechanism == null) ? 0 : archivalMechanism.hashCode());

-        result = prime * result + ((wrappingKeySet == null) ? 0 : wrappingKeySet.hashCode());

+        result = prime * result + ((encryptAlgorithm == null) ? 0 : encryptAlgorithm.hashCode());

+        result = prime * result + ((keyWrapAlgorithm == null) ? 0 : keyWrapAlgorithm.hashCode());

         return result;

     }

@@ -97,10 +106,15 @@ public class CAInfo extends ResourceMessage {

                 return false;

         } else if (!archivalMechanism.equals(other.archivalMechanism))

             return false;

-        if (wrappingKeySet == null) {

-            if (other.wrappingKeySet != null)

+        if (encryptAlgorithm == null) {

+            if (other.encryptAlgorithm != null)

+                return false;

+        } else if (!encryptAlgorithm.equals(other.encryptAlgorithm))

+            return false;

+        if (keyWrapAlgorithm == null) {

+            if (other.keyWrapAlgorithm != null)

                 return false;

-        } else if (!wrappingKeySet.equals(other.wrappingKeySet))

+        } else if (!keyWrapAlgorithm.equals(other.keyWrapAlgorithm))

             return false;

         return true;

     }

diff --git a/base/common/src/org/dogtagpki/common/KRAInfo.java b/base/common/src/org/dogtagpki/common/KRAInfo.java

index e17bd64..66fb992 100644

--- a/base/common/src/org/dogtagpki/common/KRAInfo.java

+++ b/base/common/src/org/dogtagpki/common/KRAInfo.java

@@ -55,6 +55,8 @@ public class KRAInfo extends ResourceMessage {

     String archivalMechanism;

     String recoveryMechanism;

+    String encryptAlgorithm;

+    String wrapAlgorithm;

     @XmlElement(name="ArchivalMechanism")

     public String getArchivalMechanism() {

@@ -74,12 +76,32 @@ public class KRAInfo extends ResourceMessage {

         this.recoveryMechanism = recoveryMechanism;

     }

+    @XmlElement(name="EncryptAlgorithm")

+    public String getEncryptAlgorithm() {

+        return encryptAlgorithm;

+    }

+

+    public void setEncryptAlgorithm(String encryptAlgorithm) {

+        this.encryptAlgorithm = encryptAlgorithm;

+    }

+

+    @XmlElement(name="WrapAlgorithm")

+    public String getWrapAlgorithm() {

+        return wrapAlgorithm;

+    }

+

+    public void setWrapAlgorithm(String wrapAlgorithm) {

+        this.wrapAlgorithm = wrapAlgorithm;

+    }

+

     @Override

     public int hashCode() {

         final int prime = 31;

         int result = super.hashCode();

         result = prime * result + ((archivalMechanism == null) ? 0 : archivalMechanism.hashCode());

+        result = prime * result + ((encryptAlgorithm == null) ? 0 : encryptAlgorithm.hashCode());

         result = prime * result + ((recoveryMechanism == null) ? 0 : recoveryMechanism.hashCode());

+        result = prime * result + ((wrapAlgorithm == null) ? 0 : wrapAlgorithm.hashCode());

         return result;

     }

@@ -97,11 +119,21 @@ public class KRAInfo extends ResourceMessage {

                 return false;

         } else if (!archivalMechanism.equals(other.archivalMechanism))

             return false;

+        if (encryptAlgorithm == null) {

+            if (other.encryptAlgorithm != null)

+                return false;

+        } else if (!encryptAlgorithm.equals(other.encryptAlgorithm))

+            return false;

         if (recoveryMechanism == null) {

             if (other.recoveryMechanism != null)

                 return false;

         } else if (!recoveryMechanism.equals(other.recoveryMechanism))

             return false;

+        if (wrapAlgorithm == null) {

+            if (other.wrapAlgorithm != null)

+                return false;

+        } else if (!wrapAlgorithm.equals(other.wrapAlgorithm))

+            return false;

         return true;

     }

@@ -125,6 +157,8 @@ public class KRAInfo extends ResourceMessage {

         KRAInfo before = new KRAInfo();

         before.setArchivalMechanism("encrypt");

         before.setRecoveryMechanism("keywrap");

+        before.setEncryptAlgorithm("AES/CBC/Pad");

+        before.setWrapAlgorithm("AES KeyWrap/Padding");

         String string = before.toString();

         System.out.println(string);

diff --git a/base/java-tools/src/com/netscape/cmstools/CRMFPopClient.java b/base/java-tools/src/com/netscape/cmstools/CRMFPopClient.java

index 0057a1d..b06faa6 100644

--- a/base/java-tools/src/com/netscape/cmstools/CRMFPopClient.java

+++ b/base/java-tools/src/com/netscape/cmstools/CRMFPopClient.java

@@ -190,11 +190,7 @@ public class CRMFPopClient {

         option.setArgName("extractable");

         options.addOption(option);

-        option = new Option("g", true, "KeyWrap");

-        option.setArgName("keyWrap");

-        options.addOption(option);

-

-        option = new Option("w", true, "Wrapping Keyset");

+        option = new Option("w", true, "Algorithm to be used for key wrapping");

         option.setArgName("keySet");

         options.addOption(option);

@@ -231,10 +227,7 @@ public class CRMFPopClient {

         System.out.println("                               - POP_NONE: without POP");

         System.out.println("                               - POP_SUCCESS: with valid POP");

         System.out.println("                               - POP_FAIL: with invalid POP (for testing)");

-        System.out.println("  -g <true|false>              Use KeyWrapping to wrap private key (default: true)");

-        System.out.println("                               - true: use a key wrapping algorithm");

-        System.out.println("                               - false: use an encryption algorithm");

-        System.out.println("  -w <keyset_id>               Key set ID to use when wrapping the private key");

+        System.out.println("  -w <keywrap algorithm>       Algorithm to use for key wrapping");

         System.out.println("  -b <transport cert>          PEM transport certificate (default: transport.txt)");

         System.out.println("  -v, --verbose                Run in verbose mode.");

         System.out.println("      --help                   Show help message.");

@@ -329,20 +322,17 @@ public class CRMFPopClient {

         boolean self_sign = cmd.hasOption("y");

-        // get the key wrapping mechanism

-        boolean keyWrap = true;

-        if (cmd.hasOption("g")) {

-            keyWrap = Boolean.parseBoolean(cmd.getOptionValue("g"));

+        // get the keywrap algorithm

+        KeyWrapAlgorithm keyWrapAlgorithm = null;

+        String kwAlg = KeyWrapAlgorithm.AES_KEY_WRAP_PAD.toString();

+        if (cmd.hasOption("w")) {

+            kwAlg = cmd.getOptionValue("w");

         } else {

-            String useKeyWrap = System.getenv("KEY_ARCHIVAL_USE_KEY_WRAPPING");

-            if (useKeyWrap != null) {

-                keyWrap = Boolean.parseBoolean(useKeyWrap);

+            String alg = System.getenv("KEY_ARCHIVAL_KEYWRAP_ALGORITHM");

+            if (alg != null) {

+                kwAlg = alg;

             }

         }

-        String archivalMechanism = keyWrap ? KRAInfoResource.KEYWRAP_MECHANISM :

-            KRAInfoResource.ENCRYPT_MECHANISM;

-

-        String wrappingKeySet = cmd.getOptionValue("w");

         String output = cmd.getOptionValue("o");

@@ -351,12 +341,11 @@ public class CRMFPopClient {

         String requestor = cmd.getOptionValue("r");

         if (hostPort != null) {

-            if (cmd.hasOption("g") || cmd.hasOption("w")) {

-                printError("Wrapping Key Set (-g) and keywrap (-w) options should " +

-                        "not be specified when hostport is specified.  " +

-                        "CRMFPopClient will contact the server to " +

-                        "determine the correct values for these parameters");

-                System.exit(1);

+            if (cmd.hasOption("w")) {

+                printError("Any value specified for the key wrap parameter (-w) " +

+                        "will be overriden.  CRMFPopClient will contact the " +

+                        "CA to determine the supported algorithm when " +

+                        "hostport is specified");

             }

         }

@@ -493,9 +482,9 @@ public class CRMFPopClient {

             System.out.println("Keypair private key id: " + kid);

             if (hostPort != null) {

-                // check the CA for the required keyset and archival mechanism

+                // check the CA for the required key wrap algorithm

                 // if found, override whatever has been set by the command line

-                // options or environment for archivalMechanism and wrappingKeySet

+                // options for the key wrap algorithm

                 ClientConfig config = new ClientConfig();

                 String host = hostPort.substring(0, hostPort.indexOf(':'));

@@ -503,31 +492,17 @@ public class CRMFPopClient {

                 config.setServerURL("http", host, port);

                 PKIClient pkiclient = new PKIClient(config);

-

-                // get archival mechanism

-                CAInfoClient infoClient = new CAInfoClient(pkiclient, "ca");

-                try {

-                    CAInfo info = infoClient.getInfo();

-                    archivalMechanism = info.getArchivalMechanism();

-                    wrappingKeySet = info.getWrappingKeySet();

-                } catch (PKIException e) {

-                    if (e.getCode() == 404) {

-                        // assume this is an older server,

-                        archivalMechanism = KRAInfoResource.KEYWRAP_MECHANISM;

-                        wrappingKeySet = "0";

-                    } else {

-                        throw new Exception("Failed to retrieve archive wrapping information from the CA: " + e, e);

-                    }

-                } catch (Exception e) {

-                    throw new Exception("Failed to retrieve archive wrapping information from the CA: " + e, e);

-                }

+                kwAlg = getKeyWrapAlgotihm(pkiclient);

             }

+            if (verbose) System.out.println("Using key wrap algorithm: " + kwAlg);

+            keyWrapAlgorithm = KeyWrapAlgorithm.fromString(kwAlg);

+

             if (verbose) System.out.println("Creating certificate request");

             CertRequest certRequest = client.createCertRequest(

                     self_sign,

                     token, transportCert, algorithm, keyPair,

-                    subject, archivalMechanism, wrappingKeySet);

+                    subject, keyWrapAlgorithm);

             ProofOfPossession pop = null;

@@ -592,6 +567,36 @@ public class CRMFPopClient {

         }

     }

+    public static String getKeyWrapAlgotihm(PKIClient pkiclient)

+            throws Exception {

+        String kwAlg = null;

+        CAInfoClient infoClient = new CAInfoClient(pkiclient, "ca");

+        String archivalMechanism = KRAInfoResource.KEYWRAP_MECHANISM;

+

+        try {

+            CAInfo info = infoClient.getInfo();

+            archivalMechanism = info.getArchivalMechanism();

+            kwAlg = info.getKeyWrapAlgorithm();

+        } catch (PKIException e) {

+            if (e.getCode() == 404) {

+                // assume this is an older server,

+                archivalMechanism = KRAInfoResource.KEYWRAP_MECHANISM;

+                kwAlg = KeyWrapAlgorithm.DES3_CBC_PAD.toString();

+            } else {

+                throw new Exception("Failed to retrieve archive wrapping information from the CA: " + e, e);

+            }

+        } catch (Exception e) {

+            throw new Exception("Failed to retrieve archive wrapping information from the CA: " + e, e);

+        }

+

+        if (!archivalMechanism.equals(KRAInfoResource.KEYWRAP_MECHANISM)) {

+            // new server with encryption set.  Use something we know will

+            // work.  AES-128-CBC

+            kwAlg = KeyWrapAlgorithm.AES_CBC_PAD.toString();

+        }

+        return kwAlg;

+    }

+

     public void setVerbose(boolean verbose) {

         this.verbose = verbose;

     }

@@ -637,10 +642,9 @@ public class CRMFPopClient {

             String algorithm,

             KeyPair keyPair,

             Name subject,

-            String archivalMechanism,

-            String wrappingKeySet) throws Exception {

+            KeyWrapAlgorithm keyWrapAlgorithm) throws Exception {

         return createCertRequest(false, token, transportCert, algorithm, keyPair,

-            subject, archivalMechanism, wrappingKeySet);

+            subject, keyWrapAlgorithm);

     }

     public CertRequest createCertRequest(

@@ -650,24 +654,15 @@ public class CRMFPopClient {

             String algorithm,

             KeyPair keyPair,

             Name subject,

-            String archivalMechanism,

-            String wrappingKeySet) throws Exception {

-        EncryptionAlgorithm encryptAlg = null;

-

-        if (wrappingKeySet == null) {

-            wrappingKeySet = System.getenv("KEY_WRAP_PARAMETER_SET");

+            KeyWrapAlgorithm keyWrapAlgorithm) throws Exception {

+        byte[] iv = null;

+        if (keyWrapAlgorithm.getParameterClasses() != null) {

+            iv = CryptoUtil.getNonceData(keyWrapAlgorithm.getBlockSize());

         }

+        OBJECT_IDENTIFIER kwOID = CryptoUtil.getOID(keyWrapAlgorithm);

-        if (wrappingKeySet != null && wrappingKeySet.equalsIgnoreCase("0")) {

-            // talking to an old server?

-            encryptAlg = EncryptionAlgorithm.DES3_CBC;

-        } else {

-            encryptAlg = EncryptionAlgorithm.AES_128_CBC;

-        }

-

-        byte[] iv = CryptoUtil.getNonceData(encryptAlg.getIVLength());

-        AlgorithmIdentifier aid = new AlgorithmIdentifier(encryptAlg.toOID(), new OCTET_STRING(iv));

-        WrappingParams params = getWrappingParams(encryptAlg, iv, archivalMechanism);

+        AlgorithmIdentifier aid = new AlgorithmIdentifier(kwOID, new OCTET_STRING(iv));

+        WrappingParams params = getWrappingParams(keyWrapAlgorithm, iv);

         PKIArchiveOptions opts = CryptoUtil.createPKIArchiveOptions(

                 token,

@@ -698,29 +693,21 @@ public class CRMFPopClient {

         return new CertRequest(new INTEGER(1), certTemplate, seq);

     }

-    private WrappingParams getWrappingParams(EncryptionAlgorithm encryptAlg, byte[] wrapIV,

-            String archivalMechanism) throws Exception {

-        if (encryptAlg.getAlg().toString().equalsIgnoreCase("AES")) {

-            KeyWrapAlgorithm wrapAlg = null;

-            IVParameterSpec wrapIVS = null;

-            if (archivalMechanism.equals(KRAInfoResource.ENCRYPT_MECHANISM)) {

-                // We will use AES_CBC_PAD as the a key wrap mechanism.  This

-                // can be decrypted using the same mechanism on the server.

-                wrapAlg = KeyWrapAlgorithm.AES_CBC_PAD;

-                wrapIVS = new IVParameterSpec(wrapIV);

-            } else {

-                wrapAlg = KeyWrapAlgorithm.AES_KEY_WRAP_PAD;

-            }

+    private WrappingParams getWrappingParams(KeyWrapAlgorithm kwAlg, byte[] iv) throws Exception {

+        IVParameterSpec ivps = iv != null ? new IVParameterSpec(iv): null;

+

+        if (kwAlg == KeyWrapAlgorithm.AES_KEY_WRAP_PAD ||

+            kwAlg == KeyWrapAlgorithm.AES_CBC_PAD) {

             return new WrappingParams(

                 SymmetricKey.AES, KeyGenAlgorithm.AES, 128,

-                KeyWrapAlgorithm.RSA, encryptAlg,

-                wrapAlg, wrapIVS, wrapIVS);

-        } else if (encryptAlg.getAlg().toString().equalsIgnoreCase("DESede")) {

+                KeyWrapAlgorithm.RSA, EncryptionAlgorithm.AES_128_CBC_PAD,

+                kwAlg, ivps, ivps);

+        } else if (kwAlg == KeyWrapAlgorithm.DES3_CBC_PAD) {

             return new WrappingParams(

                     SymmetricKey.DES3, KeyGenAlgorithm.DES3, 168,

                     KeyWrapAlgorithm.RSA, EncryptionAlgorithm.DES3_CBC_PAD,

                     KeyWrapAlgorithm.DES3_CBC_PAD,

-                    new IVParameterSpec(wrapIV), new IVParameterSpec(wrapIV));

+                    ivps, ivps);

         } else {

             throw new Exception("Invalid encryption algorithm");

         }

diff --git a/base/java-tools/src/com/netscape/cmstools/client/ClientCertRequestCLI.java b/base/java-tools/src/com/netscape/cmstools/client/ClientCertRequestCLI.java

index a14bb24..9a0cfcc 100644

--- a/base/java-tools/src/com/netscape/cmstools/client/ClientCertRequestCLI.java

+++ b/base/java-tools/src/com/netscape/cmstools/client/ClientCertRequestCLI.java

@@ -29,18 +29,15 @@ import java.util.Vector;

 import org.apache.commons.cli.CommandLine;

 import org.apache.commons.cli.Option;

 import org.apache.commons.io.FileUtils;

-import org.dogtagpki.common.CAInfo;

-import org.dogtagpki.common.CAInfoClient;

-import org.dogtagpki.common.KRAInfoResource;

 import org.mozilla.jss.CryptoManager;

 import org.mozilla.jss.crypto.CryptoToken;

+import org.mozilla.jss.crypto.KeyWrapAlgorithm;

 import org.mozilla.jss.crypto.Signature;

 import org.mozilla.jss.crypto.X509Certificate;

 import org.mozilla.jss.pkix.crmf.CertRequest;

 import org.mozilla.jss.pkix.crmf.ProofOfPossession;

 import org.mozilla.jss.pkix.primitive.Name;

-import com.netscape.certsrv.base.PKIException;

 import com.netscape.certsrv.cert.CertClient;

 import com.netscape.certsrv.cert.CertEnrollmentRequest;

 import com.netscape.certsrv.cert.CertRequestInfos;

@@ -249,29 +246,13 @@ public class ClientCertRequestCLI extends CLI {

             CryptoManager manager = CryptoManager.getInstance();

             X509Certificate transportCert = manager.importCACertPackage(transportCertData);

-            // get archival mechanism

-            CAInfoClient infoClient = new CAInfoClient(client, "ca");

-            String archivalMechanism = KRAInfoResource.KEYWRAP_MECHANISM;

-            String wrappingKeySet = "1";

-            try {

-                CAInfo info = infoClient.getInfo();

-                archivalMechanism = info.getArchivalMechanism();

-                wrappingKeySet = info.getWrappingKeySet();

-            } catch (PKIException e) {

-                if (e.getCode() == 404) {

-                    // assume this is an older server,

-                    archivalMechanism = KRAInfoResource.KEYWRAP_MECHANISM;

-                    wrappingKeySet = "0";

-                } else {

-                    throw new Exception("Failed to retrieve archive wrapping information from the CA: " + e, e);

-                }

-            } catch (Exception e) {

-                throw new Exception("Failed to retrieve archive wrapping information from the CA: " + e, e);

-            }

+            // get archival and key wrap mechanisms from CA

+            String kwAlg = CRMFPopClient.getKeyWrapAlgotihm(client);

+            KeyWrapAlgorithm keyWrapAlgorithm = KeyWrapAlgorithm.fromString(kwAlg);

             csr = generateCrmfRequest(transportCert, subjectDN, attributeEncoding,

                     algorithm, length, curve, sslECDH, temporary, sensitive, extractable, withPop,

-                    archivalMechanism, wrappingKeySet);

+                    keyWrapAlgorithm);

         } else {

             throw new Exception("Unknown request type: " + requestType);

@@ -411,8 +392,7 @@ public class ClientCertRequestCLI extends CLI {

             int sensitive,

             int extractable,

             boolean withPop,

-            String archivalMechanism,

-            String wrappingKeySet

+            KeyWrapAlgorithm keyWrapAlgorithm

             ) throws Exception {

         CryptoManager manager = CryptoManager.getInstance();

@@ -434,7 +414,7 @@ public class ClientCertRequestCLI extends CLI {

         }

         CertRequest certRequest = client.createCertRequest(

-                token, transportCert, algorithm, keyPair, subject, archivalMechanism, wrappingKeySet);

+                token, transportCert, algorithm, keyPair, subject, keyWrapAlgorithm);

         ProofOfPossession pop = null;

         if (withPop) {

diff --git a/base/server/cms/src/org/dogtagpki/server/rest/CAInfoService.java b/base/server/cms/src/org/dogtagpki/server/rest/CAInfoService.java

index 398f499..52c9ca0 100644

--- a/base/server/cms/src/org/dogtagpki/server/rest/CAInfoService.java

+++ b/base/server/cms/src/org/dogtagpki/server/rest/CAInfoService.java

@@ -28,6 +28,8 @@ import org.dogtagpki.common.CAInfo;

 import org.dogtagpki.common.CAInfoResource;

 import org.dogtagpki.common.KRAInfo;

 import org.dogtagpki.common.KRAInfoClient;

+import org.mozilla.jss.crypto.EncryptionAlgorithm;

+import org.mozilla.jss.crypto.KeyWrapAlgorithm;

 import org.slf4j.Logger;

 import org.slf4j.LoggerFactory;

@@ -73,7 +75,8 @@ public class CAInfoService extends PKIService implements CAInfoResource {

     // KRA-related fields (the initial values are only used if we

     // did not yet receive authoritative info from KRA)

     private static String archivalMechanism = KRAInfoService.KEYWRAP_MECHANISM;

-    private static String wrappingKeySet = "0";

+    private static String encryptAlgorithm;

+    private static String keyWrapAlgorithm;

     @Override

     public Response getInfo() throws Exception {

@@ -116,7 +119,8 @@ public class CAInfoService extends PKIService implements CAInfoResource {

             }

             info.setArchivalMechanism(archivalMechanism);

-            info.setWrappingKeySet(wrappingKeySet);

+            info.setEncryptAlgorithm(encryptAlgorithm);

+            info.setKeyWrapAlgorithm(keyWrapAlgorithm);

         }

     }

@@ -125,10 +129,8 @@ public class CAInfoService extends PKIService implements CAInfoResource {

             KRAInfo kraInfo = getKRAInfoClient(connInfo).getInfo();

             archivalMechanism = kraInfo.getArchivalMechanism();

-

-            // request succeeded; the KRA is 10.4 or higher,

-            // therefore supports key set v1

-            wrappingKeySet = "1";

+            encryptAlgorithm = kraInfo.getEncryptAlgorithm();

+            keyWrapAlgorithm = kraInfo.getWrapAlgorithm();

             // mark info as authoritative

             kraInfoAuthoritative = true;

@@ -137,8 +139,8 @@ public class CAInfoService extends PKIService implements CAInfoResource {

                 // The KRAInfoResource was added in 10.4,

                 // so we are talking to a pre-10.4 KRA

-                // pre-10.4 only supports key set v0

-                wrappingKeySet = "0";

+                encryptAlgorithm = EncryptionAlgorithm.DES3_CBC_PAD.toString();

+                keyWrapAlgorithm = KeyWrapAlgorithm.DES3_CBC_PAD.toString();

                 // pre-10.4 KRA does not advertise the archival

                 // mechanism; look for the old knob in CA's config

diff --git a/base/server/cms/src/org/dogtagpki/server/rest/KRAInfoService.java b/base/server/cms/src/org/dogtagpki/server/rest/KRAInfoService.java

index c4b3252..a9c3cdf 100644

--- a/base/server/cms/src/org/dogtagpki/server/rest/KRAInfoService.java

+++ b/base/server/cms/src/org/dogtagpki/server/rest/KRAInfoService.java

@@ -29,14 +29,25 @@ import org.slf4j.LoggerFactory;

 import com.netscape.certsrv.apps.CMS;

 import com.netscape.certsrv.base.EBaseException;

 import com.netscape.certsrv.base.IConfigStore;

+import com.netscape.certsrv.kra.IKeyRecoveryAuthority;

+import com.netscape.certsrv.security.IStorageKeyUnit;

 import com.netscape.cms.servlet.base.PKIService;

+import netscape.security.util.WrappingParams;

+

 /**

  * @author Ade Lee

  */

 public class KRAInfoService extends PKIService implements KRAInfoResource {

     private static Logger logger = LoggerFactory.getLogger(InfoService.class);

+    private IKeyRecoveryAuthority kra;

+    private IStorageKeyUnit storageUnit;

+

+    public KRAInfoService() {

+        kra = (IKeyRecoveryAuthority) CMS.getSubsystem("kra");

+        storageUnit = kra.getStorageKeyUnit();

+    }

     @Override

     public Response getInfo() throws Exception {

@@ -47,7 +58,8 @@ public class KRAInfoService extends PKIService implements KRAInfoResource {

         KRAInfo info = new KRAInfo();

         info.setArchivalMechanism(getArchivalMechanism());

         info.setRecoveryMechanism(getRecoveryMechanism());

-

+        info.setEncryptAlgorithm(getEncryptAlgorithm());

+        info.setArchivalMechanism(getWrapAlgorithm());

         return createOKResponse(info);

     }

@@ -63,5 +75,31 @@ public class KRAInfoService extends PKIService implements KRAInfoResource {

         boolean encrypt_recovery = cs.getBoolean("kra.allowEncDecrypt.recovery", false);

         return encrypt_recovery ? KRAInfoResource.ENCRYPT_MECHANISM : KRAInfoResource.KEYWRAP_MECHANISM;

     }

+

+    String getWrapAlgorithm() throws EBaseException {

+        IConfigStore cs = CMS.getConfigStore();

+        boolean encrypt_archival = cs.getBoolean("kra.allowEncDecrypt.archival", false);

+        WrappingParams params = null;

+        try {

+            params = storageUnit.getWrappingParams(encrypt_archival);

+        } catch (Exception e) {