Merge pull request #8 from DirectProjectJavaRI/develop

Fixing HSM OAEP error.

Author: Greg Meyer

pom.xml

@@ -4,7 +4,7 @@
     <modelVersion>4.0.0</modelVersion>
     <artifactId>agent</artifactId>    
     <name>Direct Project Security And Trust Agent</name>
-    <version>6.1-SNAPSHOT</version>
+    <version>6.0.2</version>
     <description>Direct Project Security And Trust Agent</description>
     <inceptionYear>2010</inceptionYear>
     <url>https://github.com/DirectProjectJavaRI/agent</url> 

src/main/java/org/nhindirect/stagent/cryptography/bc/DirectNamedJcaJceExtHelper.java

@@ -4,6 +4,8 @@
 
 import javax.crypto.SecretKey;
 
+import org.apache.commons.lang3.StringUtils;
+import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
 import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
 import org.bouncycastle.jcajce.util.NamedJcaJceHelper;
 import org.bouncycastle.operator.SymmetricKeyUnwrapper;
@@ -20,7 +22,19 @@ public DirectNamedJcaJceExtHelper(String providerName)
 
     public JceAsymmetricKeyUnwrapper createAsymmetricUnwrapper(AlgorithmIdentifier keyEncryptionAlgorithm, PrivateKey keyEncryptionKey)
     {
-        return new DirectJceAsymmetricKeyUnwrapper(keyEncryptionAlgorithm, keyEncryptionKey).setProvider(providerName);
+    	final JceAsymmetricKeyUnwrapper retVal = new DirectJceAsymmetricKeyUnwrapper(keyEncryptionAlgorithm, keyEncryptionKey);
+    	retVal.setProvider(providerName);
+    	
+    	/*
+    	 * For a non-BC provider, we need to map the OAEP algorithm OID to a name.  Many HSMs do not recognized the algorithm OID and explicitly
+    	 * need the name.  May need to get sophisticated in later versions to map names for specific HSMs. 
+    	 */
+    	if (!StringUtils.isEmpty(providerName) && !providerName.equalsIgnoreCase("BC"))
+    	{
+    		retVal.setAlgorithmMapping(PKCSObjectIdentifiers.id_RSAES_OAEP, "RSA/None/OAEPWithSHA1AndMGF1Padding");
+    	}
+    	
+        return retVal;
     }
 
     public JceKTSKeyUnwrapper createAsymmetricUnwrapper(AlgorithmIdentifier keyEncryptionAlgorithm, PrivateKey keyEncryptionKey, byte[] partyUInfo, byte[] partyVInfo)

src/main/java/org/nhindirect/stagent/cryptography/bc/DirectProviderJcaJceExtHelper.java

@@ -5,6 +5,8 @@
 
 import javax.crypto.SecretKey;
 
+import org.apache.commons.lang3.StringUtils;
+import org.bouncycastle.asn1.pkcs.PKCSObjectIdentifiers;
 import org.bouncycastle.asn1.x509.AlgorithmIdentifier;
 import org.bouncycastle.jcajce.util.ProviderJcaJceHelper;
 import org.bouncycastle.operator.SymmetricKeyUnwrapper;
@@ -22,7 +24,19 @@ public DirectProviderJcaJceExtHelper(Provider provider)
 
     public JceAsymmetricKeyUnwrapper createAsymmetricUnwrapper(AlgorithmIdentifier keyEncryptionAlgorithm, PrivateKey keyEncryptionKey)
     {
-        return new DirectJceAsymmetricKeyUnwrapper(keyEncryptionAlgorithm, keyEncryptionKey).setProvider(provider);
+    	final JceAsymmetricKeyUnwrapper retVal = new DirectJceAsymmetricKeyUnwrapper(keyEncryptionAlgorithm, keyEncryptionKey);
+    	retVal.setProvider(provider);
+    	
+    	/*
+    	 * For a non-BC provider, we need to map the OAEP algorithm OID to a name.  Many HSMs do not recognized the algorithm OID and explicitly
+    	 * need the name.  May need to get sophisticated in later versions to map names for specific HSMs. 
+    	 */
+    	if (provider != null && !StringUtils.isEmpty(provider.getName()) && !provider.getName().equalsIgnoreCase("BC"))
+    	{
+    		retVal.setAlgorithmMapping(PKCSObjectIdentifiers.id_RSAES_OAEP, "RSA/None/OAEPWithSHA1AndMGF1Padding");
+    	}    	
+    	
+        return retVal;
     }
 
     public JceKTSKeyUnwrapper createAsymmetricUnwrapper(AlgorithmIdentifier keyEncryptionAlgorithm, PrivateKey keyEncryptionKey, byte[] partyUInfo, byte[] partyVInfo)