private List < TCert > processTCertBatch ( GetTCertBatchRequest req , TCertCreateSetResp resp ) throws NoSuchPaddingException , InvalidKeyException , NoSuchAlgorithmException , IllegalBlockSizeException , BadPaddingException , InvalidAlgorithmParameterException , CryptoException , IOException { String enrollKey = req . getEnrollment ( ) . getKey ( ) ; byte [ ] tCertOwnerKDFKey = resp . getCerts ( ) . getKey ( ) . toByteArray ( ) ; List < Ca . TCert > tCerts = resp . getCerts ( ) . getCertsList ( ) ; byte [ ] byte1 = new byte [ ] { 1 } ; byte [ ] byte2 = new byte [ ] { 2 } ; byte [ ] tCertOwnerEncryptKey = Arrays . copyOfRange ( cryptoPrimitives . calculateMac ( tCertOwnerKDFKey , byte1 ) , 0 , 32 ) ; byte [ ] expansionKey = cryptoPrimitives . calculateMac ( tCertOwnerKDFKey , byte2 ) ; List < TCert > tCertBatch = new ArrayList <> ( tCerts . size ( ) ) ; // Loop through certs and extract private keys for ( Ca . TCert tCert : tCerts ) { X509Certificate x509Certificate ; try { CertificateFactory cf = CertificateFactory . getInstance ( "X.509" ) ; x509Certificate = ( X509Certificate ) cf . generateCertificate ( tCert . getCert ( ) . newInput ( ) ) ; } catch ( Exception ex ) { logger . debug ( "Warning: problem parsing certificate bytes; retrying ... " , ex ) ; continue ; } // extract the encrypted bytes from extension attribute byte [ ] tCertIndexCT = fromDer ( x509Certificate . getExtensionValue ( TCERT_ENC_TCERT_INDEX ) ) ; byte [ ] tCertIndex = cryptoPrimitives . aesCBCPKCS7Decrypt ( tCertOwnerEncryptKey , tCertIndexCT ) ; byte [ ] expansionValue = cryptoPrimitives . calculateMac ( expansionKey , tCertIndex ) ; // compute the private key BigInteger k = new BigInteger ( 1 , expansionValue ) ; BigInteger n = ( ( ECPrivateKey ) cryptoPrimitives . ecdsaKeyFromPrivate ( Hex . decode ( enrollKey ) ) ) . getParameters ( ) . getN ( ) . subtract ( BigInteger . ONE ) ; k = k . mod ( n ) . add ( BigInteger . ONE ) ; BigInteger D = ( ( ECPrivateKey ) cryptoPrimitives . ecdsaKeyFromPrivate ( Hex . decode ( enrollKey ) ) ) . getD ( ) . add ( k ) ; D = D . mod ( ( ( ECPrivateKey ) cryptoPrimitives . ecdsaKeyFromPrivate ( Hex . decode ( enrollKey ) ) ) . getParameters ( ) . getN ( ) ) ; // Put private and public key in returned tcert TCert tcert = new TCert ( tCert . getCert ( ) . toByteArray ( ) , cryptoPrimitives . ecdsaKeyFromBigInt ( D ) ) ; tCertBatch . add ( tcert ) ; } if ( tCertBatch . size ( ) == 0 ) { throw new RuntimeException ( "Failed fetching TCertBatch. No valid TCert received." ) ; } return tCertBatch ; }
Process a batch of tcerts after having retrieved them from the TCA .