Class OpenPGPSmartCardBackend<T extends OpenPGPSmartCard>

java.lang.Object
org.bouncycastle.openpgp.smartcard.OpenPGPSmartCardBackend<T>
Direct Known Subclasses:
SimulatorSmartCardBackend, YubikeySmartCardBackend
public abstract class OpenPGPSmartCardBackend<T extends OpenPGPSmartCard> extends Object

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    protected static final int
    SHORTENED_IDENTIFIER_LENGTH
    Number of leading octets of a v6 fingerprint carried by a shortened legacy-hardware identifier.
    protected static final int
    STORED_FINGERPRINT_LENGTH
    Size of the fingerprint field of an OpenPGP smart card.

  • Constructor Summary

    Constructors
    Constructor
    Description
    OpenPGPSmartCardBackend()
     

  • Method Summary

    Modifier and Type
    Method
    Description
    T
    findSmartCard(Integer serialNumber)
     
    boolean
    fingerprintMatches(byte[] storedFingerprint, byte[] fullFingerprint)
    Return true if the full fingerprint matches the stored fingerprint.
    abstract String
    getName()
    Return the name of the backend.
    abstract List<T>
    listSmartCards()
    Return a List of all smart cards managed by this backend.
    org.bouncycastle.openpgp.operator.PublicKeyDataDecryptorFactory
    providePublicKeyDataDecryptorFactory(org.bouncycastle.openpgp.api.OpenPGPKey.OpenPGPSecretKey secretKey, org.bouncycastle.openpgp.api.KeyPassphraseProvider userPinProvider)
    Provide a PublicKeyDataDecryptorFactory for the given OpenPGPKey.OpenPGPSecretKey which has its private key material stored on a OpenPGPSmartCard managed by this backend.
    abstract org.bouncycastle.openpgp.operator.PublicKeyDataDecryptorFactory
    providePublicKeyDataDecryptorFactory(org.bouncycastle.openpgp.api.OpenPGPKey.OpenPGPSecretKey secretKey, T card, org.bouncycastle.openpgp.api.KeyPassphraseProvider userPinProvider)
     
    protected boolean
    shortenedIdentifierForLegacyHardwareMatches(byte[] storedFingerprint, byte[] fullFingerprint)
    Compare the full OpenPGP key fingerprint to the 20-octets fingerprint field of a smart card according to the method described in the draft "Shortened OpenPGP identifiers for legacy hardware devices".
    byte[]
    toStoredFingerprint(byte[] fullFingerprint, int version)
    Convert the keys full fingerprint into a potentially shortened, 20-octets fingerprint.
    byte[]
    toStoredFingerprint(org.bouncycastle.openpgp.api.OpenPGPCertificate.OpenPGPComponentKey key)
    Convert the keys full fingerprint into a potentially shortened, 20-octets fingerprint.
    byte[]
    toStoredFingerprint(org.bouncycastle.openpgp.PGPPublicKey key)
    Convert the keys full fingerprint into a potentially shortened, 20-octets fingerprint.

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

    • STORED_FINGERPRINT_LENGTH

      protected static final int STORED_FINGERPRINT_LENGTH
      Size of the fingerprint field of an OpenPGP smart card.
      See Also:

    • SHORTENED_IDENTIFIER_LENGTH

      protected static final int SHORTENED_IDENTIFIER_LENGTH
      Number of leading octets of a v6 fingerprint carried by a shortened legacy-hardware identifier.
      See Also:

  • Constructor Details

    • OpenPGPSmartCardBackend

      public OpenPGPSmartCardBackend()

  • Method Details

    • getName

      public abstract String getName()
      Return the name of the backend.
      Returns:
      backend name

    • listSmartCards

      public abstract List<T> listSmartCards() throws CardException, IOException
      Return a List of all smart cards managed by this backend.
      Returns:
      list of smart cards
      Throws:
      CardException - if communication with a smart card fails
      IOException - if an IO error occurs while communicating with a card

    • providePublicKeyDataDecryptorFactory

      public org.bouncycastle.openpgp.operator.PublicKeyDataDecryptorFactory providePublicKeyDataDecryptorFactory(org.bouncycastle.openpgp.api.OpenPGPKey.OpenPGPSecretKey secretKey, org.bouncycastle.openpgp.api.KeyPassphraseProvider userPinProvider) throws org.bouncycastle.openpgp.PGPException
      Provide a PublicKeyDataDecryptorFactory for the given OpenPGPKey.OpenPGPSecretKey which has its private key material stored on a OpenPGPSmartCard managed by this backend.
      Parameters:
      secretKey - OpenPGP secret key
      userPinProvider - callback to provide the keys user pin
      Returns:
      public key data decryptor factory using the decryption key, or null if no matching key or card is available.
      Throws:
      org.bouncycastle.openpgp.PGPException - if the key is not usable or if communication with the card fails

    • providePublicKeyDataDecryptorFactory

      public abstract org.bouncycastle.openpgp.operator.PublicKeyDataDecryptorFactory providePublicKeyDataDecryptorFactory(org.bouncycastle.openpgp.api.OpenPGPKey.OpenPGPSecretKey secretKey, T card, org.bouncycastle.openpgp.api.KeyPassphraseProvider userPinProvider) throws org.bouncycastle.openpgp.PGPException
      Throws:
      org.bouncycastle.openpgp.PGPException

    • fingerprintMatches

      public boolean fingerprintMatches(byte[] storedFingerprint, byte[] fullFingerprint)
      Return true if the full fingerprint matches the stored fingerprint.

      Note: The stored fingerprint (OpenPGPHardwareKey.getFingerprint()) is a 20-octet field. OpenPGP v6 keys have a 32-octet fingerprint, so they will not match exactly and therefore need to be compared in a standardized way. This method has not yet been decided upon, see the links below.

      Parameters:
      storedFingerprint - 20 octet fingerprint from the cards fingerprint field.
      fullFingerprint - full fingerprint of the key (v4 keys have 20, v6 keys 32 octets)
      Returns:
      true if fingerprints match, false otherwise
      See Also:

    • shortenedIdentifierForLegacyHardwareMatches

      protected boolean shortenedIdentifierForLegacyHardwareMatches(byte[] storedFingerprint, byte[] fullFingerprint)
      Compare the full OpenPGP key fingerprint to the 20-octets fingerprint field of a smart card according to the method described in the draft "Shortened OpenPGP identifiers for legacy hardware devices".
      Parameters:
      storedFingerprint - 20 octets stored fingerprint from smart card
      fullFingerprint - calculated, full OpenPGP key fingerprint
      Returns:
      true if the fingerprint matches according to the comparison method described in
      See Also:

    • toStoredFingerprint

      public byte[] toStoredFingerprint(org.bouncycastle.openpgp.api.OpenPGPCertificate.OpenPGPComponentKey key)
      Convert the keys full fingerprint into a potentially shortened, 20-octets fingerprint. If the keys fingerprint is already 20 octets long, return it as is. Otherwise, shorten it according to the method described in the draft linked below.
      Parameters:
      key - OpenPGP key
      Returns:
      20 octets fingerprint
      See Also:

    • toStoredFingerprint

      public byte[] toStoredFingerprint(org.bouncycastle.openpgp.PGPPublicKey key)
      Convert the keys full fingerprint into a potentially shortened, 20-octets fingerprint. If the keys fingerprint is already 20 octets long, return it as is. Otherwise, shorten it according to the method described in the draft linked below.
      Parameters:
      key - OpenPGP key
      Returns:
      20 octets fingerprint
      See Also:

    • toStoredFingerprint

      public byte[] toStoredFingerprint(byte[] fullFingerprint, int version)
      Convert the keys full fingerprint into a potentially shortened, 20-octets fingerprint. If the keys fingerprint is already 20 octets long, return it as is. Otherwise, shorten it according to the method described in the draft linked below.
      Parameters:
      fullFingerprint - full key fingerprint
      version - key version
      Returns:
      20 octets fingerprint
      See Also:

    • findSmartCard

      public T findSmartCard(Integer serialNumber) throws CardException, IOException
      Throws:
      CardException
      IOException