Package org.apache.wss4j.common.derivedKey

Class DerivedKeyUtils

java.lang.Object
org.apache.wss4j.common.derivedKey.DerivedKeyUtils
public final class DerivedKeyUtils extends Object

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final int
    MAXIMUM_DERIVED_KEY_LENGTH
    The maximum length in bytes of a derived key. wsc:Length and wsc:Offset are attacker-controlled message content, and the P_SHA-1 derivation allocates offset+length bytes and performs one HMAC operation per 20 output bytes.
    static final int
    MAXIMUM_DERIVED_KEY_OFFSET
    The maximum value in bytes of the wsc:Offset of a derived key.
    static final int
    MINIMUM_DERIVED_KEY_LENGTH
    The minimum length in bytes of a derived key (128 bits).

  • Method Summary

    Modifier and Type
    Method
    Description
    static byte[]
    deriveKey(String algorithm, String label, int length, byte[] secret, byte[] nonce, int offset)
    Derive a key from this DerivedKeyToken instance

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • MINIMUM_DERIVED_KEY_LENGTH

      public static final int MINIMUM_DERIVED_KEY_LENGTH
      The minimum length in bytes of a derived key (128 bits). The wsc:Length value is attacker-controlled message content: a shorter derived key (e.g. Length=1) reduces an HMAC signature key to a trivially brute-forceable keyspace. No standard WS-SecurityPolicy algorithm suite derives keys shorter than 128 bits, so this is enforced as a hard engine-level floor, independent of any configured AlgorithmSuite.
      See Also:

    • MAXIMUM_DERIVED_KEY_LENGTH

      public static final int MAXIMUM_DERIVED_KEY_LENGTH
      The maximum length in bytes of a derived key. wsc:Length and wsc:Offset are attacker-controlled message content, and the P_SHA-1 derivation allocates offset+length bytes and performs one HMAC operation per 20 output bytes.
      See Also:

    • MAXIMUM_DERIVED_KEY_OFFSET

      public static final int MAXIMUM_DERIVED_KEY_OFFSET
      The maximum value in bytes of the wsc:Offset of a derived key.
      See Also:

  • Method Details

    • deriveKey

      public static byte[] deriveKey(String algorithm, String label, int length, byte[] secret, byte[] nonce, int offset) throws WSSecurityException
      Derive a key from this DerivedKeyToken instance
      Parameters:
      length -
      secret -
      Throws:
      org.apache.wss4j.stax.wss.ext.WSSecurityException
      WSSecurityException