001/*
002 * Licensed to the Apache Software Foundation (ASF) under one
003 * or more contributor license agreements.  See the NOTICE file
004 * distributed with this work for additional information
005 * regarding copyright ownership.  The ASF licenses this file
006 * to you under the Apache License, Version 2.0 (the
007 * "License"); you may not use this file except in compliance
008 * with the License.  You may obtain a copy of the License at
009 *
010 *     http://www.apache.org/licenses/LICENSE-2.0
011 *
012 * Unless required by applicable law or agreed to in writing, software
013 * distributed under the License is distributed on an "AS IS" BASIS,
014 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
015 * See the License for the specific language governing permissions and
016 * limitations under the License.
017 */
018package org.apache.hadoop.hbase.io.crypto.aes;
019
020import static org.junit.Assert.assertEquals;
021import static org.junit.Assert.assertTrue;
022import static org.junit.Assert.fail;
023
024import java.io.ByteArrayInputStream;
025import java.io.ByteArrayOutputStream;
026import java.io.OutputStream;
027import java.security.AccessController;
028import java.security.NoSuchAlgorithmException;
029import java.security.PrivilegedAction;
030import java.security.Provider;
031import java.security.SecureRandom;
032import java.security.SecureRandomSpi;
033import java.security.Security;
034import javax.crypto.spec.SecretKeySpec;
035import org.apache.commons.io.IOUtils;
036import org.apache.hadoop.conf.Configuration;
037import org.apache.hadoop.hbase.HBaseClassTestRule;
038import org.apache.hadoop.hbase.HBaseConfiguration;
039import org.apache.hadoop.hbase.io.crypto.Cipher;
040import org.apache.hadoop.hbase.io.crypto.DefaultCipherProvider;
041import org.apache.hadoop.hbase.io.crypto.Encryption;
042import org.apache.hadoop.hbase.io.crypto.Encryptor;
043import org.apache.hadoop.hbase.testclassification.MiscTests;
044import org.apache.hadoop.hbase.testclassification.SmallTests;
045import org.apache.hadoop.hbase.util.Bytes;
046import org.junit.ClassRule;
047import org.junit.Test;
048import org.junit.experimental.categories.Category;
049
050@Category({ MiscTests.class, SmallTests.class })
051public class TestAES {
052
053  @ClassRule
054  public static final HBaseClassTestRule CLASS_RULE = HBaseClassTestRule.forClass(TestAES.class);
055
056  // Validation for AES in CTR mode with a 128 bit key
057  // From NIST Special Publication 800-38A
058  @Test
059  public void testAESAlgorithm() throws Exception {
060    Configuration conf = HBaseConfiguration.create();
061    Cipher aes = Encryption.getCipher(conf, "AES");
062    assertEquals(AES.KEY_LENGTH, aes.getKeyLength());
063    assertEquals(AES.IV_LENGTH, aes.getIvLength());
064    Encryptor e = aes.getEncryptor();
065    e.setKey(new SecretKeySpec(Bytes.fromHex("2b7e151628aed2a6abf7158809cf4f3c"), "AES"));
066    e.setIv(Bytes.fromHex("f0f1f2f3f4f5f6f7f8f9fafbfcfdfeff"));
067
068    ByteArrayOutputStream out = new ByteArrayOutputStream();
069    OutputStream cout = e.createEncryptionStream(out);
070    cout.write(Bytes.fromHex("6bc1bee22e409f96e93d7e117393172a"));
071    cout.write(Bytes.fromHex("ae2d8a571e03ac9c9eb76fac45af8e51"));
072    cout.write(Bytes.fromHex("30c81c46a35ce411e5fbc1191a0a52ef"));
073    cout.write(Bytes.fromHex("f69f2445df4f9b17ad2b417be66c3710"));
074    cout.close();
075
076    ByteArrayInputStream in = new ByteArrayInputStream(out.toByteArray());
077    byte[] b = new byte[16];
078    IOUtils.readFully(in, b);
079    assertTrue("Failed #1", Bytes.equals(b, Bytes.fromHex("874d6191b620e3261bef6864990db6ce")));
080    IOUtils.readFully(in, b);
081    assertTrue("Failed #2", Bytes.equals(b, Bytes.fromHex("9806f66b7970fdff8617187bb9fffdff")));
082    IOUtils.readFully(in, b);
083    assertTrue("Failed #3", Bytes.equals(b, Bytes.fromHex("5ae4df3edbd5d35e5b4f09020db03eab")));
084    IOUtils.readFully(in, b);
085    assertTrue("Failed #4", Bytes.equals(b, Bytes.fromHex("1e031dda2fbe03d1792170a0f3009cee")));
086  }
087
088  @Test
089  public void testAlternateRNG() throws Exception {
090    Security.addProvider(new TestProvider());
091
092    Configuration conf = new Configuration();
093    conf.set(AES.RNG_ALGORITHM_KEY, "TestRNG");
094    conf.set(AES.RNG_PROVIDER_KEY, "TEST");
095    DefaultCipherProvider.getInstance().setConf(conf);
096
097    AES aes = new AES(DefaultCipherProvider.getInstance());
098    assertEquals("AES did not find alternate RNG", "TestRNG", aes.getRNG().getAlgorithm());
099  }
100
101  static class TestProvider extends Provider {
102    private static final long serialVersionUID = 1L;
103
104    public TestProvider() {
105      super("TEST", 1.0, "Test provider");
106      AccessController.doPrivileged(new PrivilegedAction<Object>() {
107        @Override
108        public Object run() {
109          put("SecureRandom.TestRNG", TestAES.class.getName() + "$TestRNG");
110          return null;
111        }
112      });
113    }
114  }
115
116  // Must be public for instantiation by the SecureRandom SPI
117  public static class TestRNG extends SecureRandomSpi {
118    private static final long serialVersionUID = 1L;
119    private SecureRandom rng;
120
121    public TestRNG() {
122      try {
123        rng = java.security.SecureRandom.getInstance("SHA1PRNG");
124      } catch (NoSuchAlgorithmException e) {
125        fail("Unable to create SecureRandom instance");
126      }
127    }
128
129    @Override
130    protected void engineSetSeed(byte[] seed) {
131      rng.setSeed(seed);
132    }
133
134    @Override
135    protected void engineNextBytes(byte[] bytes) {
136      rng.nextBytes(bytes);
137    }
138
139    @Override
140    protected byte[] engineGenerateSeed(int numBytes) {
141      return rng.generateSeed(numBytes);
142    }
143  }
144
145}