<commit_before>/*
 * OpenRemote, the Home of the Digital Home.
 * Copyright 2008-2014, OpenRemote Inc.
 *
 * See the contributors.txt file in the distribution for a
 * full listing of individual contributors.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as
 * published by the Free Software Foundation, either version 3 of the
 * License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU Affero General Public License for more details.
 *
 * You should have received a copy of the GNU Affero General Public License
 * along with this program. If not, see <http://www.gnu.org/licenses/>.
 */
package org.openremote.security;

import java.io.ByteArrayOutputStream;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.Provider;
import java.security.UnrecoverableKeyException;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.InvalidAlgorithmParameterException;
import java.security.spec.ECGenParameterSpec;
import java.security.spec.RSAKeyGenParameterSpec;
import java.security.spec.AlgorithmParameterSpec;
import java.security.cert.CertificateException;
import java.security.cert.Certificate;
import java.io.InputStream;
import java.io.IOException;
import java.io.BufferedOutputStream;
import java.io.File;
import java.io.FileOutputStream;
import java.io.FileNotFoundException;
import java.io.FileInputStream;
import java.io.BufferedInputStream;
import java.io.OutputStream;
import java.math.BigInteger;
import java.util.Map;
import java.util.HashMap;

import org.bouncycastle.jce.provider.BouncyCastleProvider;

import org.openremote.logging.Logger;
import org.openremote.logging.Hierarchy;
import org.openremote.exception.OpenRemoteException;


/**
 * This is a convenience implementation based on standard Java security architecture and its
 * management of asymmetric key pairs. It provides some helper methods for generating asymmetric
 * key pairs (for example, elliptic curves, RSA) and associated public key X.509 certificates
 * for public key infrastructure. It also provides convenience methods for persistent and
 * in-memory private key stores.
 *
 * @author <a href="mailto:<EMAIL>"><NAME></a>
 */
public class AsymmetricKeyManager
{

  // Constants ------------------------------------------------------------------------------------

  /**
   * ASN.1 OID for NSA / NIST standard curve P-521. This is equivalent to SEC 2 prime curve
   * "secp521r1". OID = {@value}
   */
  public final static String ASN_OID_STD_CURVE_NSA_NIST_P521 = "1.3.132.0.35";

  /**
   * The default key algorithm used when generating self-signed key pairs : {@value}
   */
  public final static KeyAlgorithm DEFAULT_SELF_SIGNED_KEY_ALGORITHM = KeyAlgorithm.EC;


  /**
   * RSA key size : {@value} <p>
   *
   * This is recommended asymmetric RSA key size for classified, secret data, as per NSA Suite B.
   */
  public final static int DEFAULT_RSA_KEY_SIZE = 3072;

  /**
   * Public exponent value used in RSA algorithm (increase impacts performance): {@value)
   *
   * @see java.security.spec.RSAKeyGenParameterSpec#F4
   */
  public final static BigInteger DEFAULT_RSA_PUBLIC_EXPONENT = RSAKeyGenParameterSpec.F4;

  //
  // TODO : add dynamic classloading so we don't introduce mandatory runtime dependency
  //
  public final static Provider DEFAULT_SECURITY_PROVIDER = new BouncyCastleProvider();

<commit_msg>add ASN OIDs for other NSA / NIST EC curves and for certificate AlgorithmIdentifier field<commit_after>/*
 * OpenRemote, the Home of the Digital Home.
 * Copyright 2008-2014, OpenRemote Inc.
 *
 * See the contributors.txt file in the distribution for a
 * full listing of individual contributors.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as
 * published by the Free Software Foundation, either version 3 of the
 * License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU Affero General Public License for more details.
 *
 * You should have received a copy of the GNU Affero General Public License
 * along with this program. If not, see <http://www.gnu.org/licenses/>.
 */
package org.openremote.security;

import java.io.ByteArrayOutputStream;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.Provider;
import java.security.UnrecoverableKeyException;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.InvalidAlgorithmParameterException;
import java.security.spec.ECGenParameterSpec;
import java.security.spec.RSAKeyGenParameterSpec;
import java.security.spec.AlgorithmParameterSpec;
import java.security.cert.CertificateException;
import java.security.cert.Certificate;
import java.io.InputStream;
import java.io.IOException;
import java.io.BufferedOutputStream;
import java.io.File;
import java.io.FileOutputStream;
import java.io.FileNotFoundException;
import java.io.FileInputStream;
import java.io.BufferedInputStream;
import java.io.OutputStream;
import java.math.BigInteger;
import java.util.Map;
import java.util.HashMap;

import org.bouncycastle.jce.provider.BouncyCastleProvider;

import org.openremote.logging.Logger;
import org.openremote.logging.Hierarchy;
import org.openremote.exception.OpenRemoteException;


/**
 * This is a convenience implementation based on standard Java security architecture and its
 * management of asymmetric key pairs. It provides some helper methods for generating asymmetric
 * key pairs (for example, elliptic curves, RSA) and associated public key X.509 certificates
 * for public key infrastructure. It also provides convenience methods for persistent and
 * in-memory private key stores.
 *
 * @author <a href="mailto:<EMAIL>"><NAME></a>
 */
public class AsymmetricKeyManager
{

  // Constants ------------------------------------------------------------------------------------

  /**
   * ASN.1 OID for NSA / NIST standard curve P-521. This is equivalent to SEC 2 prime curve
   * "secp521r1". OID = {@value}
   */
  public final static String ASN_OID_STD_CURVE_NSA_NIST_P521 = "1.3.132.0.35";

  /**
   * ASN.1 OID for NSA / NIST standard curve P-384. This is equivalent to SEC 2 prime curve
   * "secp384r1". OID = {@value}
   */
  public final static String ASN_OID_STD_CURVE_NSA_NIST_P384 = "172.16.17.32.34";

  /**
   * ASN.1 OID for NSA / NIST standard curve P-256. This is equivalent to SEC 2 prime curve
   * "secp256r1" and ANSI X9.62 "prime256v1". OID = {@value}
   */
  public final static String ASN_OID_STD_CURVE_NSA_NIST_P256 = "1.2.840.10045.3.1.7";


  /**
   * ASN.1 OID for certificate signature algorithm 'ecdsa-with-SHA256' in certificate's
   * AlgorithmIdentifier field as defined in RFC5758 - http://tools.ietf.org/search/rfc5758.
   */
  public final static String ASN_OID_SIGNATURE_ALGORITHM_ECDSA_WITH_SHA256 = "1.2.840.10045.4.3.2";

  /**
   * ASN.1 OID for certificate signature algorithm 'ecdsa-with-SHA384' in certificate's
   * AlgorithmIdentifier field as defined in RFC5758 - http://tools.ietf.org/search/rfc5758.
   */
  public final static String ASN_OID_SIGNATURE_ALGORITHM_ECDSA_WITH_SHA384 = "1.2.840.10045.4.3.3";

  /**
   * ASN.1 OID for certificate signature algorithm 'ecdsa-with-SHA512' in certificate's
   * AlgorithmIdentifier field as defined in RFC5758 - http://tools.ietf.org/search/rfc5758.
   */
  public final static String ASN_OID_SIGNATURE_ALGORITHM_ECDSA_WITH_SHA512 = "1.2.840.10045.4.3.4";

  
  /**
   * The default key algorithm used when generating self-signed key pairs : {@value}
   */
  public final static KeyAlgorithm DEFAULT_SELF_SIGNED_KEY_ALGORITHM = KeyAlgorithm.EC;


  /**
   * RSA key size : {@value} <p>
   *
   * This is recommended asymmetric RSA key size for classified, secret data, as per NSA Suite B.
   */
  public final static int DEFAULT_RSA_KEY_SIZE = 3072;

  /**
   * Public exponent value used in RSA algorithm (increase impacts performance): {@value)
   *
   * @see java.security.spec.RSAKeyGenParameterSpec#F4
   */
  public final static BigInteger DEFAULT_RSA_PUBLIC_EXPONENT = RSAKeyGenParameterSpec.F4;

  //
  // TODO : add dynamic classloading so we don't introduce mandatory runtime dependency
  //
  public final static Provider DEFAULT_SECURITY_PROVIDER = new BouncyCastleProvider();


{'fraction_non_alphanumeric': 0.10130571814497974, 'fraction_numerical': 0.02420081044574516, 'mean_word_length': 3.930632630410655, 'pattern_counts': {'":': 0, '<': 15, '<?xml version=': 0, '>': 15, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 7, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4669315', 'n_tokens_mistral': 2692, 'n_tokens_neox': 2487, 'n_words': 849}