Changeset fea5bd4

Timestamp:

Mar 23, 2019 2:26:29 PM (17 months ago)

Author:

zzz <zzz@…>

Branches:

master

Children:

ce043943

Parents:

00d4525

Message:

SelfSignedGenerator?:

• Fix generation with Ed25519ph keys (ticket #2465)
• Increase serial number from 63 to 71 bits

File:

• core/java/src/net/i2p/crypto/SelfSignedGenerator.java (modified) (4 diffs)

core/java/src/net/i2p/crypto/SelfSignedGenerator.java

@@ -15 +15 @@
 import java.security.cert.X509Certificate;
 import java.security.cert.X509CRL;
+import java.security.spec.InvalidKeySpecException;
 import java.security.spec.X509EncodedKeySpec;
 import java.text.SimpleDateFormat;
@@ -33 +34 @@
 
 import static net.i2p.crypto.SigUtil.intToASN1;
+import net.i2p.crypto.eddsa.EdDSAPublicKey;
 import net.i2p.data.DataHelper;
 import net.i2p.data.Signature;
@@ -246 +248 @@
         PublicKey cpub = cert.getPublicKey();
         cert.verify(cpub);
-        if (!cpub.equals(jpub))
-            throw new GeneralSecurityException("pubkey mismatch");
+        if (!cpub.equals(jpub)) {
+            boolean ok = false;
+            if (cpub.getClass().getName().equals("sun.security.x509.X509Key")) {
+                // X509Certificate will sometimes contain an X509Key rather than the EdDSAPublicKey itself; the contained
+                // key is valid but needs to be instanced as an EdDSAPublicKey before it can be used.
+                try {
+                    cpub = new EdDSAPublicKey(new X509EncodedKeySpec(cpub.getEncoded()));
+                    ok = cpub.equals(jpub);
+                } catch (InvalidKeySpecException ex) {}
+            }
+            if (!ok)
+                throw new GeneralSecurityException("pubkey mismatch, in: " + jpub.getClass() + " cert: " + cpub.getClass());
+        }
         // todo crl tests
 
@@ -363 +376 @@
 
         // positive serial number (long)
-        byte[] serial = new byte[10];
+        byte[] serial = new byte[11];
         serial[0] = 2;
-        serial[1] = 8;
-        RandomSource.getInstance().nextBytes(serial, 2, 8);
+        serial[1] = 9;
+        RandomSource.getInstance().nextBytes(serial, 2, 9);
         serial[2] &= 0x7f;