Recently I’ve had some real fun with SafeNet HSM’s (Host Security Module or Hardware Security Module) and Tomcat 6 in the never ending process of PCIDSS compliance. People are probably going to line up to stone me after saying this but PCIDSS is a really great effort to make things safe and secure for all of us. In a lot of cases its the stick that drives organisations to adopt some good practices. One of which is the use of HSM’s for all things from the crypt.
Now this little rant won’t walk you through PCI compliance, rather its just about my experiences getting Safenet Eracom Orange or Blue HSM to work within Tomcat. Deployment is really easy:
- Install the latest version of Java,
- Install the Eracom Orange C runtime,
- Configure the Eracom Orange runtime to connect to the HSM,
- Configure the HSM with tokens, keys, certificates, users and whatever else you need,
- Install the Eracom Orange Java runtime,
- Install Apache Tomcat 6,
- Place the Eracom Orange ‘
jprov.jar‘ Tomcat’s server shared lib directory ‘CATALINE_HOME/lib‘, - Restart the Tomcat server if its already running or just start it if it is not,
- Deploy your webapp.
Apart from steps 7 and 8 simply follow the provider’s directions for all steps. The key in this thing is that the ‘jprov.jar‘ archive must be loaded when Tomcat starts. I imagine that it should be the same for other providers like for IBM’s toys.
Now for the development set up. Simply follow the same steps as above but install the SDK’s for the Eracom and include ‘jprov.jar’ as a library in your development environment. Typically your development environment will bundle the ‘jprov.jar‘ into the web application directory. It won’t do any harm there but to get it to work properly it will need to be in the Tomcat server’s common library directory as detailed above. In fact you don’t really need to install the SDK’s if you have an actual HSM to play with for development purposes, but the SDK’s do provide a software HSM simulator for those of us who don’t want the expense of buying one of these things for every developer on the floor. Plus the SDK’s will give you a good deal of documentation too.
So you are all set up and ready to build the next great crypt. Start by building a stand alone application to confirm that everything works before going any further. Lets get to the code:
/*
* Crypt.java
*
* A simple class to provide basic SDES encryption and decryption
*/
package crypt;
import java.io.IOException;
import java.security.InvalidAlgorithmParameterException;
import java.security.InvalidKeyException;
import java.security.Key;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;
import java.security.Security;
import java.security.UnrecoverableKeyException;
import java.security.cert.CertificateException;
import java.util.Properties;
import javax.crypto.BadPaddingException;
import javax.crypto.Cipher;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.NoSuchPaddingException;
import javax.crypto.spec.IvParameterSpec;
import org.apache.commons.codec.DecoderException;
import org.apache.commons.codec.binary.Base64;
import org.apache.commons.codec.binary.Hex;
import org.apache.commons.lang.StringUtils;
import org.apache.commons.logging.Log;
/**
*
* @author mc
*/
public class Crypt {
/**
* Creates a 3DES key cipher with the parameters in the config, valid
* modes are Cipher.ENCRYPT and Cipher.DECRYPT
*
* @param mode set the cipher to either encrypt or decrypt
* @param config the configuration parameters for this application
* @param log log to write debug output to
* @return a cipher that should be used then nulled to be thrown away
* @throws KeyStoreException
* @throws NoSuchProviderException
* @throws IOException
* @throws NoSuchAlgorithmException
* @throws CertificateException
* @throws UnrecoverableKeyException
* @throws NoSuchPaddingException
* @throws DecoderException
* @throws InvalidKeyException
* @throws InvalidAlgorithmParameterException
*/
private Cipher createCipher(int mode, Properties config, Log log)
throws
KeyStoreException,
NoSuchProviderException,
IOException,
NoSuchAlgorithmException,
CertificateException,
UnrecoverableKeyException,
NoSuchPaddingException,
DecoderException,
InvalidKeyException,
InvalidAlgorithmParameterException {
log.debug("Adding provider.");
// will gracefully not add provider if provider already loaded
Security.addProvider(
new au.com.eracom.crypto.provider.ERACOMProvider());
log.debug("Getting key store instance.");
KeyStore store = KeyStore.getInstance(
config.getProperty("crypt.keystore.type"),
config.getProperty("crypt.keystore.provider"));
log.debug("Loading key store.");
store.load(null, null);
log.debug("Retrieving key.");
Key key = store.getKey(
config.getProperty("crypt.keystore.entry"), null);
log.debug("Generating cipher.");
Cipher cipher = Cipher.getInstance(
config.getProperty("crypt.transformation"),
config.getProperty("crypt.provider"));
log.debug("Creating initialisation vector.");
IvParameterSpec i = new IvParameterSpec(Hex.decodeHex(
config.getProperty("crypt.vector").toCharArray()));
log.debug("Initialising cipher in the given mode.");
cipher.init(mode, key, i);
return cipher;
}
/**
* Takes a string and returns its equivalent Base64 encrypted string.
*
* @param data string to be encrypted
* @param config parameters for this application's encryption
* @param log log to write debug output to
* @return encrypted Base64 encoded form of the data string parameter
* @throws NoSuchAlgorithmException
* @throws NoSuchProviderException
* @throws NoSuchPaddingException
* @throws InvalidKeyException
* @throws IllegalBlockSizeException
* @throws BadPaddingException
* @throws InvalidAlgorithmParameterException
* @throws KeyStoreException
* @throws IOException
* @throws CertificateException
* @throws UnrecoverableKeyException
* @throws DecoderException
*/
public String b46Encrypt(String data, Properties config, Log log)
throws
NoSuchAlgorithmException,
NoSuchProviderException,
NoSuchPaddingException,
InvalidKeyException,
IllegalBlockSizeException,
BadPaddingException,
InvalidAlgorithmParameterException,
KeyStoreException,
IOException,
CertificateException,
UnrecoverableKeyException,
DecoderException {
log.debug("Encrypting data.");
byte[] encrypted =
createCipher(Cipher.ENCRYPT_MODE, config, log).doFinal(
data.getBytes());
log.debug("Base64 encoding data.");
String encoded = new String(Base64.encodeBase64(encrypted));
return encoded;
}
/**
* Takes a encrypted Base64 encoded string and returns its equivalent
* decrypted string.
*
* @param data string to be encrypted
* @param config parameters for this application's encryption
* @param log log to write debug output to
* @return encrypted Base64 encoded form of the data string parameter
* @throws NoSuchAlgorithmException
* @throws NoSuchProviderException
* @throws NoSuchPaddingException
* @throws InvalidKeyException
* @throws IllegalBlockSizeException
* @throws BadPaddingException
* @throws InvalidAlgorithmParameterException
* @throws KeyStoreException
* @throws IOException
* @throws CertificateException
* @throws UnrecoverableKeyException
* @throws DecoderException
*/
public String b64Decrypt(String data, Properties config, Log log)
throws
NoSuchAlgorithmException,
NoSuchProviderException,
NoSuchPaddingException,
InvalidKeyException,
IllegalBlockSizeException,
BadPaddingException,
InvalidAlgorithmParameterException,
KeyStoreException,
IOException,
CertificateException,
UnrecoverableKeyException,
DecoderException {
log.debug("Base64 decoding data.");
byte[] decoded = Base64.decodeBase64(data.getBytes());
log.debug("Decrypting data.");
byte[] decrypted =
createCipher(Cipher.DECRYPT_MODE, config, log).doFinal(decoded);
return new String(decrypted);
}
}
So that’s it, very straight forward but lets take time to look at one or two points of interest.
In a nutshell functionally this is a class that can be used to encrypt and decrypt data using stored 3DES keys. Note that the configuration information is all passed in via the properties parameter. Also note that the class uses base64 encoding because its easier to play with and store strings. Generally you would also want to replace unsafe base64 characters too if the storage unit required it.
On the encryption front there are a few things to note too. Take a look at the includes, as far as the crypt mechanisms it uses only the standard Java imports and practices. There is only one thing that is specifically from the Safenet SDK, the loading of the provider class in the following snippet:
// will gracefully not add provider if provider already loaded
Security.addProvider(
new au.com.eracom.crypto.provider.ERACOMProvider());
To complete the picture here is the main class and the configuration file to go with it. That’s the lot; three simple files and it should be all go to test your configuration.
/*
* main.java
*
* Test application for the Eracom encryption devices.
*/
package crypt;
import java.io.FileInputStream;
import java.io.IOException;
import java.util.Properties;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
/**
*
* @author mc
*/
public class Main {
/**
* @param args the command line arguments
*/
public static void main(String[] args) throws IOException {
Properties config = new Properties();
Log log = LogFactory.getLog(Main.class);
boolean encrypt = "encrypt".equalsIgnoreCase(args[0]);
config.loadFromXML(new FileInputStream(args[1]));
try {
if(encrypt)
System.out.println(
new Crypt().b46Encrypt(args[2], config, log));
else
System.out.println(
new Crypt().b64Decrypt(args[2], config, log));
} catch(Exception e) {
log.error(e.getLocalizedMessage(), e);
}
}
}
ERACOM au.com.eracom.crypto.provider.ERACOMProvider DESede/CBC/PKCS5Padding AAAAAAAA00000000 ERACOM CRYPTOKI KeyName
Once this is working it should be possible to use the same crypt class file in a Tomcat hosted web application with one slight adjustment. As the Tomcat service will load the provider you should not attempt to load the provider in your application. In fact if you try it will almost certainly fail as your application is unlikely, unless you have specifically configured it, will not have the privileges need to load classes. So just comment out the ‘Security.addProvider‘ call in the class.
So that’s it; all you needed to know to configure an HSM to start working with Tomcat. Simple wasn’t it? Now all you need to do is figure out how to use it to help you with PCIDSS and how to change the crypt file to suite your specific needs.