Merge pull request #10 from FrancescoValentini/1.0.13

1.0.13

AES 256 GCM set as default algorithm
Improved automatic algorithm detection system
Added validation of certificate key usages
Added form to import keys

Author: FrancescoValentini

pom.xml

@@ -4,7 +4,7 @@
 	<modelVersion>4.0.0</modelVersion>
 	<groupId>HackerInside_EncryptionToolkit</groupId>
 	<artifactId>HackerInside_EncryptionToolkit</artifactId>
-	<version>1.0.12</version>
+	<version>1.0.13</version>
 	<name>HackerInside EncryptionToolkit</name>
 	<properties>
     	<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
@@ -28,14 +28,25 @@
 				<plugin>
 				    <groupId>org.springframework.boot</groupId>
 				    <artifactId>spring-boot-maven-plugin</artifactId>
-				    <version>4.0.1</version> <executions>
+				    <version>4.0.1</version>
+				    <executions>
 				        <execution>
 				            <goals>
 				                <goal>repackage</goal>
 				            </goals>
 				            <configuration>
 				                <mainClass>it.hackerinside.etk.GUI.forms.ETKMain</mainClass>
 				                <layout>JAR</layout>
+				                <requiresUnpack>
+				                    <dependency>
+				                        <groupId>org.bouncycastle</groupId>
+				                        <artifactId>bcprov-jdk18on</artifactId>
+				                    </dependency>
+				                    <dependency>
+				                        <groupId>org.bouncycastle</groupId>
+				                        <artifactId>bcpkix-jdk18on</artifactId>
+				                    </dependency>
+				                </requiresUnpack>
 				            </configuration>
 				        </execution>
 				    </executions>
@@ -47,13 +58,13 @@
 		<dependency>
 			<groupId>org.bouncycastle</groupId>
 			<artifactId>bcprov-jdk18on</artifactId>
-			<version>1.83</version>
+			<version>1.84</version>
 		</dependency>
 		<!-- https://mvnrepository.com/artifact/org.bouncycastle/bcpkix-jdk18on -->
 		<dependency>
 			<groupId>org.bouncycastle</groupId>
 			<artifactId>bcpkix-jdk18on</artifactId>
-			<version>1.83</version>
+			<version>1.84</version>
 		</dependency>
 		<!-- https://mvnrepository.com/artifact/com.formdev/flatlaf -->
 		<dependency>

src/it/hackerinside/etk/GUI/ETKContext.java

@@ -28,7 +28,7 @@
  */
 public class ETKContext {
 
-	public static final String ETK_VERSION = "1.0.12";
+	public static final String ETK_VERSION = "1.0.13";
 
     /**
      * Singleton instance of ETKContext.
@@ -671,7 +671,29 @@ public boolean useRsaOaep() {
         );
         return Boolean.parseBoolean(vUseRsaOaep);
     }
-
+    
+    /**
+     * Sets whether x.509 key usages should be validated
+     * @param vValKeyUsage
+     */
+    public void setValidateKeyUsages(boolean vValKeyUsage) {
+        preferences.put(
+            ApplicationPreferences.VALIDATE_KEY_USAGES.getKey(),
+            Boolean.toString(vValKeyUsage)
+        );
+    }
+    
+    /**
+     * Return whether x.509 key usages should be validated
+     * @return
+     */
+    public boolean validateKeyUsages() {
+        String vValKeyUsage = preferences.get(
+            ApplicationPreferences.VALIDATE_KEY_USAGES.getKey(),
+            ApplicationPreferences.VALIDATE_KEY_USAGES.getValue()
+        );
+        return Boolean.parseBoolean(vValKeyUsage);
+    }
 
 
     /**
@@ -752,6 +774,7 @@ public String toString() {
 	            - getTrustStore()=%s
 	            - isPkcs11SignOnly()=%s
 	            - useRsaOaep()=%s
+	            - validateKeyUsages()=%s
 	        """.formatted(
 	            keystore,
 	            knownCerts,
@@ -773,7 +796,8 @@ public String toString() {
 	            getTrustStorePath(),
 	            getTrustStore(),
 	            isPkcs11SignOnly(),
-	            useRsaOaep()
+	            useRsaOaep(),
+	            validateKeyUsages()
 	        );
 	}
 

src/it/hackerinside/etk/GUI/Utils.java

@@ -15,6 +15,8 @@
 import org.bouncycastle.util.Arrays;
 
 import it.hackerinside.etk.GUI.DTOs.CertificateWrapper;
+import it.hackerinside.etk.Utils.X509KeyUsageValidator;
+import it.hackerinside.etk.core.Models.KeyUsageProfile;
 import it.hackerinside.etk.core.keystore.AbstractKeystore;
 
 public class Utils {
@@ -40,7 +42,20 @@ public static boolean acceptX509Certificate(X509Certificate cert) {
 					);
 		}
 	}
-
+	
+	public static boolean validateCertFlags(X509Certificate cert, KeyUsageProfile keyProfile) {
+		if(!X509KeyUsageValidator.hasKeyUsage(cert, X509KeyUsageValidator.Mode.ANY, keyProfile)) {
+			return DialogUtils.showConfirmBox(
+					null,
+					"Invalid certificate!", 
+					"The certificate has INVALID key usages, accept the risk?", 
+					"Press OK to accept the certificate, cancel otherwise.",
+					JOptionPane.WARNING_MESSAGE
+					);
+		}
+		return true;
+	}
+	
 	/**
 	 * Retrieves the password for the given alias.
 	 * This method checks if the password is already cached for the given alias. 

src/it/hackerinside/etk/GUI/forms/ETKMain.java

@@ -865,43 +865,10 @@ private void importKeypair() {
 		}
 
 		if(ctx.getKeystore() == null) return;
-	    File sourceKeystore = FileDialogUtils.openFileDialog(
-		        null,
-		        "Import KeyPairs",
-		        ".",
-		        DefaultExtensions.CRYPTO_P12,
-		        DefaultExtensions.CRYPTO_PFX
-		    );
 
-	    if(sourceKeystore == null) return; 
-	    kms.setCertificateValidationProvider((crt) -> Utils.acceptX509Certificate(crt));
-	    kms.setPwdProvider(() -> DialogUtils.showPasswordInputBox(
-	    		null,
-	    		"Unlock Source Keystore",
-	    		sourceKeystore.getName(),
-	    		"Password:"
-	    		));
-
-	    kms.setPwdProvider((alias) -> askUnlockPrivateKey(alias));
-	    try {
-	    	kms.importKeyPair(sourceKeystore);
-
-	    } catch (UnsupportedOperationException e) {
-	    	DialogUtils.showMessageBox(
-	    			null,
-	    			"Operation not supported!",
-	    			e.getMessage(),
-	    			"",
-	    			JOptionPane.WARNING_MESSAGE
-	    			);
-	    }catch (Exception e) {
-	    	e.printStackTrace();
-	    	DialogUtils.showMessageBox(null, "Error importing Keys!", "Error importing Keys!", 
-	    			e.getMessage(), 
-	    			JOptionPane.ERROR_MESSAGE);
-	    }
-	    
-	    updateTable();
+		KeyPairImportForm kpImport = new KeyPairImportForm(null);
+		kpImport.setVisible();
+		kpImport.setCallback(() -> {updateTable();});
 	}
 
 	/**
@@ -1142,7 +1109,7 @@ private void newKeyPair() {
 	private void filesChecksum() {
 		FileHashForm fh = new FileHashForm();
 		fh.setVisible();
-		
+
 	}
 
 	private void notLoggedInError() {

src/it/hackerinside/etk/GUI/forms/EncryptForm.java

@@ -33,9 +33,11 @@
 import it.hackerinside.etk.GUI.DTOs.CertificateTableRow;
 import it.hackerinside.etk.GUI.DTOs.CertificateWrapper;
 import it.hackerinside.etk.Utils.X509CertificateLoader;
+import it.hackerinside.etk.Utils.X509KeyUsageValidator;
 import it.hackerinside.etk.Utils.X509Utils;
 import it.hackerinside.etk.core.Models.DefaultExtensions;
 import it.hackerinside.etk.core.Models.EncodingOption;
+import it.hackerinside.etk.core.Models.KeyUsageProfile;
 import it.hackerinside.etk.core.Models.SymmetricAlgorithms;
 import it.hackerinside.etk.core.Services.EncryptionService;
 import it.hackerinside.etk.core.keystore.AbstractKeystore;
@@ -330,7 +332,7 @@ public void actionPerformed(ActionEvent e) {
 
 		btnAddRecipient.addActionListener(new ActionListener() {
 			public void actionPerformed(ActionEvent e) {
-				if(recipient != null && Utils.acceptX509Certificate(recipient)) {
+				if(recipient != null && Utils.acceptX509Certificate(recipient) && (ctx.validateKeyUsages() ? Utils.validateCertFlags(recipient, KeyUsageProfile.ENCRYPTION) : true)) {
 					recipients.add(recipient);
 					Object selectedCert = cmbRecipientCert.getSelectedItem();
 					if(selectedCert != null) {
@@ -402,7 +404,8 @@ private void populateKnowCerts(JComboBox<CertificateWrapper> combo) {
 			    cert -> {
 			        String alg = cert.getPublicKey().getAlgorithm();
 			        boolean validCert = ctx.hideInvalidCerts() ? X509Utils.checkTimeValidity(cert) : true;
-			        return alg != null && validCert && !alg.toUpperCase().contains("DSA");
+				    boolean validKeyUsages = ctx.validateKeyUsages() ? X509KeyUsageValidator.hasKeyUsage(cert, X509KeyUsageValidator.Mode.ANY, KeyUsageProfile.ENCRYPTION) : true;
+			        return alg != null && validCert && !alg.toUpperCase().contains("DSA") && validKeyUsages;
 			    }
 			);
 	}