def build_key(logger, object_type, key_format_type):
key_value = build_secret_value(logger, object_type)
cryptographic_algorithm = build_cryptographic_algorithm(
logger, object_type)
cryptographic_length = build_cryptographic_length(logger, object_type)
key_block = build_key_block(
key_format_type,
key_value,
cryptographic_algorithm,
cryptographic_length)
if object_type == ObjectType.SYMMETRIC_KEY:
return SymmetricKey(key_block)
elif object_type == ObjectType.PUBLIC_KEY:
return PublicKey(key_block)
elif object_type == ObjectType.PRIVATE_KEY:
return PrivateKey(key_block)
elif object_type == ObjectType.SECRET_DATA:
kind = SecretData.SecretDataType(SecretDataType.PASSWORD)
return SecretData(secret_data_type=kind,
key_block=key_block)
else:
logger.error("Unrecognized object type, could not build key")
sys.exit()
def _get_kmip_secret(self, secret_dto):
"""Builds a KMIP object from a SecretDTO
This is needed for register calls. The Barbican object needs to be
converted to KMIP object before it can be stored
:param secret_dto: SecretDTO of secret to be stored
:returns: KMIP object
"""
secret_type = secret_dto.type
object_type, key_format_type = (self._map_type_ss_to_kmip(secret_type))
normalized_secret = self._normalize_secret(secret_dto.secret,
secret_type)
kmip_object = None
if object_type == enums.ObjectType.CERTIFICATE:
kmip_object = Certificate(
certificate_type=enums.CertificateTypeEnum.X_509,
certificate_value=normalized_secret)
elif object_type == enums.ObjectType.OPAQUE_DATA:
opaque_type = Opaque.OpaqueDataType(enums.OpaqueDataType.NONE)
opaque_value = Opaque.OpaqueDataValue(normalized_secret)
kmip_object = Opaque(opaque_type, opaque_value)
elif (object_type == enums.ObjectType.SYMMETRIC_KEY
or object_type == enums.ObjectType.SECRET_DATA
or object_type == enums.ObjectType.PRIVATE_KEY
or object_type == enums.ObjectType.PUBLIC_KEY):
key_material = KeyMaterial(normalized_secret)
key_value = KeyValue(key_material)
key_spec = secret_dto.key_spec
algorithm = None
if key_spec.alg is not None:
algorithm_name = self._map_algorithm_ss_to_kmip(
key_spec.alg.lower())
algorithm = CryptographicAlgorithm(algorithm_name)
bit_length = None
if key_spec.bit_length is not None:
bit_length = CryptographicLength(key_spec.bit_length)
key_block = KeyBlock(
key_format_type=misc.KeyFormatType(key_format_type),
key_compression_type=None,
key_value=key_value,
cryptographic_algorithm=algorithm,
cryptographic_length=bit_length,
key_wrapping_data=None)
if object_type == enums.ObjectType.SYMMETRIC_KEY:
kmip_object = SymmetricKey(key_block)
elif object_type == enums.ObjectType.PRIVATE_KEY:
kmip_object = PrivateKey(key_block)
elif object_type == enums.ObjectType.PUBLIC_KEY:
kmip_object = PublicKey(key_block)
elif object_type == enums.ObjectType.SECRET_DATA:
kind = SecretData.SecretDataType(enums.SecretDataType.PASSWORD)
return SecretData(secret_data_type=kind, key_block=key_block)
return kmip_object
def test_public_key_register_get_destroy(self):
"""
Tests that public keys are properly registered, retrieved,
and destroyed.
"""
pub_key_object_type = ObjectType.PUBLIC_KEY
mask_flags = [
CryptographicUsageMask.ENCRYPT, CryptographicUsageMask.DECRYPT
]
attribute_type = AttributeType.CRYPTOGRAPHIC_USAGE_MASK
usage_mask = self.attr_factory.create_attribute(
attribute_type, mask_flags)
name = Attribute.AttributeName('Name')
key_name = 'Integration Test - Register-Get-Destroy Key -'
pub_name_value = Name.NameValue(key_name + " Public")
name_type = Name.NameType(NameType.UNINTERPRETED_TEXT_STRING)
pub_value = Name(name_value=pub_name_value, name_type=name_type)
pub_name = Attribute(attribute_name=name, attribute_value=pub_value)
pub_key_attributes = [usage_mask, pub_name]
public_template_attribute = TemplateAttribute(
attributes=pub_key_attributes)
key_format_type = KeyFormatType(KeyFormatTypeEnum.RAW)
key_data = (
b'\x30\x81\x9F\x30\x0D\x06\x09\x2A\x86\x48\x86\xF7\x0D\x01\x01\x01'
b'\x05\x00\x03\x81\x8D\x00\x30\x81\x89\x02\x81\x81\x00\x93\x04\x51'
b'\xC9\xEC\xD9\x4F\x5B\xB9\xDA\x17\xDD\x09\x38\x1B\xD2\x3B\xE4\x3E'
b'\xCA\x8C\x75\x39\xF3\x01\xFC\x8A\x8C\xD5\xD5\x27\x4C\x3E\x76\x99'
b'\xDB\xDC\x71\x1C\x97\xA7\xAA\x91\xE2\xC5\x0A\x82\xBD\x0B\x10\x34'
b'\xF0\xDF\x49\x3D\xEC\x16\x36\x24\x27\xE5\x8A\xCC\xE7\xF6\xCE\x0F'
b'\x9B\xCC\x61\x7B\xBD\x8C\x90\xD0\x09\x4A\x27\x03\xBA\x0D\x09\xEB'
b'\x19\xD1\x00\x5F\x2F\xB2\x65\x52\x6A\xAC\x75\xAF\x32\xF8\xBC\x78'
b'\x2C\xDE\xD2\xA5\x7F\x81\x1E\x03\xEA\xF6\x7A\x94\x4D\xE5\xE7\x84'
b'\x13\xDC\xA8\xF2\x32\xD0\x74\xE6\xDC\xEA\x4C\xEC\x9F\x02\x03\x01'
b'\x00\x01')
key_material = KeyMaterial(key_data)
key_value = KeyValue(key_material)
algorithm_value = CryptoAlgorithmEnum.RSA
cryptographic_algorithm = CryptographicAlgorithm(algorithm_value)
cryptographic_length = CryptographicLength(2048)
key_block = KeyBlock(key_format_type=key_format_type,
key_compression_type=None,
key_value=key_value,
cryptographic_algorithm=cryptographic_algorithm,
cryptographic_length=cryptographic_length,
key_wrapping_data=None)
pub_secret = PublicKey(key_block)
pub_key_result = self.client.register(pub_key_object_type,
public_template_attribute,
pub_secret,
credential=None)
self._check_result_status(pub_key_result, ResultStatus,
ResultStatus.SUCCESS)
# Check that the returned key bytes match what was provided
pub_uuid = pub_key_result.uuid.value
pub_key_result = self.client.get(uuid=pub_uuid, credential=None)
self._check_result_status(pub_key_result, ResultStatus,
ResultStatus.SUCCESS)
self._check_object_type(pub_key_result.object_type.value, ObjectType,
ObjectType.PUBLIC_KEY)
self._check_uuid(pub_key_result.uuid.value, str)
# Check the secret type
pub_secret = pub_key_result.secret
pub_expected = PublicKey
self.assertIsInstance(pub_secret, pub_expected)
pub_key_block = pub_key_result.secret.key_block
pub_key_value = pub_key_block.key_value
pub_key_material = pub_key_value.key_material
expected = key_data
pub_observed = pub_key_material.value
self.assertEqual(expected, pub_observed)
self.logger.debug('Destroying key: ' + key_name + " Public" +
'\nWith " "UUID: ' + pub_key_result.uuid.value)
pub_result = self.client.destroy(pub_key_result.uuid.value)
self._check_result_status(pub_result, ResultStatus,
ResultStatus.SUCCESS)
self._check_uuid(pub_result.uuid.value, str)
pub_key_destroyed_result = self.client.get(uuid=pub_uuid,
credential=None)
self._check_result_status(pub_key_destroyed_result, ResultStatus,
ResultStatus.OPERATION_FAILED)
expected = ResultReason
pub_observed = type(pub_key_destroyed_result.result_reason.value)
self.assertEqual(expected, pub_observed)
def _create_public_key(self, value):
if value is None:
return PublicKey()
else:
key_block = self._build_key_block(value)
return PublicKey(key_block)