snellspace.com

So the thing folks are talking about this week is security in REST. I figured it would be a good opportunity to once again highlight one of the cool features of Abdera… the fact that you can Digitally sign and/or Encrypt Atom feeds and entries with generally very little effort.

Update: Someone asked for a sample of the output from the listings…

• Signed entry document
• Encrypted entry document
• The decrypted entry document

Listing 1: Digitally Signing an Atom Entry:

public class DSig {

  private static final String keystoreFile = "/key.jks";
  private static final String keystoreType = "JKS";
  private static final String keystorePass = "testing";
  private static final String privateKeyAlias = "James";
  private static final String privateKeyPass = "testing";
  private static final String certificateAlias = "James";

  public static void main(String[] args) throws Exception {

    // Initialize the keystore
    KeyStore ks = KeyStore.getInstance(keystoreType);
    InputStream in = DSig.class.getResourceAsStream(keystoreFile);
    ks.load(in, keystorePass.toCharArray());
    PrivateKey signingKey =
      (PrivateKey) ks.getKey(
        privateKeyAlias,
        privateKeyPass.toCharArray());
    X509Certificate cert =
      (X509Certificate) ks.getCertificate(
        certificateAlias);

    // Create the entry to sign
    Abdera abdera = new Abdera();
    AbderaSecurity absec = new AbderaSecurity(abdera);
    Factory factory = abdera.getFactory();

    Entry entry = factory.newEntry();
    entry.setId(”http://example.org/foo/entry”);
    entry.setUpdated(new java.util.Date());
    entry.setTitle(”This is an entry”);
    entry.setContentAsXhtml(”This <b>is</b> <i>markup</i>”);
    entry.addAuthor(”James”);
    entry.addLink(”http://www.example.org”);

    // Prepare the digital signature options
    Signature sig = absec.getSignature();
    SignatureOptions options = sig.getDefaultSignatureOptions();
    options.setCertificate(cert);
    options.setSigningKey(signingKey);  

    // Sign the entry
    entry = sig.sign(entry, options);

    // Check the round trip
    ByteArrayOutputStream out = new ByteArrayOutputStream();
    entry.writeTo(out); // do not use the pretty writer, it will break the signature
    ByteArrayInputStream bais = new ByteArrayInputStream(out.toByteArray());
    Document<Entry> entry_doc = abdera.getParser().parse(bais);
    entry = entry_doc.getRoot();

    System.out.println(”Valid? ” + sig.verify(entry,null));

    entry.setTitle(”Change the title”);

    System.out.println(”Valid after changing the title? ” + sig.verify(entry,null));

  }

}

Listing 2: Encrypting and Decrypting an Atom document

public class Enc {

  @SuppressWarnings("unchecked")
  public static void main(String[] args) throws Exception {

    // Prepare the crypto provider
    try {
      Class.forName("org.bouncycastle.LICENSE");
      Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider());
    } catch (Exception e) {
      throw new RuntimeException("The Bouncy Castle JCE Provider is not available");
    }

    // Generate Encryption Key
    String jceAlgorithmName = “AES”;
    KeyGenerator keyGenerator =
        KeyGenerator.getInstance(jceAlgorithmName);
    keyGenerator.init(128);
    SecretKey key = keyGenerator.generateKey();

    // Create the entry to encrypt
    Abdera abdera = new Abdera();
    AbderaSecurity absec = new AbderaSecurity(abdera);
    Factory factory = abdera.getFactory();

    Entry entry = factory.newEntry();
    entry.setId(”http://example.org/foo/entry”);
    entry.setUpdated(new java.util.Date());
    entry.setTitle(”This is an entry”);
    entry.setContentAsXhtml(”This <b>is</b> <i>markup</i>”);
    entry.addAuthor(”James”);
    entry.addLink(”http://www.example.org”);

    // Prepare the encryption options
    Encryption enc = absec.getEncryption();
    EncryptionOptions options = enc.getDefaultEncryptionOptions();
    options.setDataEncryptionKey(key);

    // Encrypt the document using the generated key
    Document enc_doc = enc.encrypt(entry.getDocument(), options);

    enc_doc.writeTo(System.out);

    System.out.println(”nn”);

    // Decrypt the document using the generated key
    Document<Entry> entry_doc = enc.decrypt(enc_doc, options);

    entry_doc.writeTo(System.out);

  }

}

Listing 3: Abdera also provides (mostly as an example) a HTTP Servlet Filter that will digitally sign any Atom document served up by a server. Just add the following to your web.xml:

<filter>
  <filter-name>signing filter</filter-name>
  <filter-class>org.apache.abdera.security.util.servlet.SignedResponseFilter</filter-class>
  <init-param>
    <param-name>org.apache.abdera.security.util.servlet.Keystore</param-name>
    <param-value>/key.jks</param-value>
  </init-param>
  <init-param>
    <param-name>org.apache.abdera.security.util.servlet.KeystorePassword</param-name>
    <param-value>testing</param-value>
  </init-param>
  <init-param>
    <param-name>org.apache.abdera.security.util.servlet.PrivateKeyAlias</param-name>
    <param-value>James</param-value>
  </init-param>
  <init-param>
    <param-name>org.apache.abdera.security.util.servlet.PrivateKeyPassword</param-name>
    <param-value>testing</param-value>
  </init-param>
  <init-param>
    <param-name>org.apache.abdera.security.util.servlet.CertificateAlias</param-name>
    <param-value>James</param-value>
  </init-param>
</filter>
<filter-mapping id="signing-filter">
  <filter-name>signing filter</filter-name>
  <servlet-name>Abdera</servlet-name>
</filter-mapping>

This entry was posted on Saturday, December 2nd, 2006 at 9:49 amand is filed under Technology, Atom 1.0, Abdera, Java, dW, security.
You can follow any responses to this entry through the Atom Comments feed. Responses are currently closed, but you can trackback from your own site.