public class YubiHSM extends Object
YubiHSM the main class to use for YubiHSM commands| Modifier and Type | Field and Description |
|---|---|
static int |
minHashLength
The hash length used when generating or validating an AEAD, default length is 20
|
| Constructor and Description |
|---|
YubiHSM()
Constructor that opens /dev/ttyACM0
|
YubiHSM(String device)
Constructor
|
YubiHSM(String device,
float timeout)
Constructor
|
| Modifier and Type | Method and Description |
|---|---|
boolean |
compareAES_ECB(int keyHandle,
String cipherText,
String plaintext)
AES ECB decrypt a cipher text using a specific key handle, and then compare it with the supplied plaintext.
|
Map<String,Integer> |
decodeYubikeyOtp(String publicId,
int keyHandle,
String aead,
String otp)
Decrypt a YubiKey OTP using an AEAD.
|
String |
decryptAES_ECB(String cipherText,
int keyHandle)
AES ECB decrypt a cipher text using a specific key handle.
|
boolean |
drainData()
Drain all remaining output from the YubiHSM, used for debugging.
|
String |
echo(String str)
Test the YubiHSM by sending a string that the YubiHSM will echo back.
|
String |
encryptAES_ECB(String plaintext,
int keyHandle)
AES ECB encrypt a plaintext string using a specific key handle.
|
void |
exitMonitorDebugMode()
Tell the YubiHSM to exit to configuration mode (requires 'debug' mode enabled).
|
Map<String,String> |
generateAEAD(String nonce,
int keyHandle,
byte[] data)
Generate AEAD block from the data for a specific key handle and nonce.
|
Map<String,String> |
generateAEAD(String nonce,
int keyHandle,
String data)
Generate AEAD block from the data for a specific key handle and nonce.
|
Map<String,String> |
generateBufferAEAD(String nonce,
int keyHandle)
Generate AEAD block of data buffer for a specific key.
|
byte[] |
generateHMACSHA1(byte[] bytes,
int keyHandle,
boolean toBuffer)
Generate HMAC SHA1 using a key handle in the YubiHSM.
|
Map<String,String> |
generateHMACSHA1(byte[] data,
int keyHandle,
boolean last,
boolean toBuffer)
Generate HMAC SHA1 using a key handle in the YubiHSM.
|
Map<String,String> |
generateHMACSHA1(byte[] data,
int keyHandle,
byte flags,
boolean last,
boolean toBuffer)
Generate HMAC SHA1 using a key handle in the YubiHSM.
|
Map<String,String> |
generateHMACSHA1(String data,
int keyHandle,
boolean last,
boolean toBuffer)
Generate HMAC SHA1 using a key handle in the YubiHSM.
|
Map<String,String> |
generateHMACSHA1(String data,
int keyHandle,
byte flags,
boolean last,
boolean toBuffer)
Generate HMAC SHA1 using a key handle in the YubiHSM.
|
Map<String,String> |
generateHMACSHA1Next(byte[] data,
int keyHandle,
boolean last,
boolean toBuffer)
Add more input to the HMAC SHA1, used after calling
generateHMACSHA1(byte[], int, boolean) with last set to false. |
Map<String,String> |
generateHMACSHA1Next(String data,
int keyHandle,
boolean last,
boolean toBuffer)
Add more input to the HMAC SHA1, used after calling
generateHMACSHA1(byte[], int, boolean) with last set to false. |
String |
generateOathAEAD(String nonce,
int keyHandle,
String tokenSeed)
Generate AEAD block which can be used for OATH OTP validation, see
validateOathHOTP and
validateOathTOTP. |
Map<String,String> |
generateRandomAEAD(String nonce,
int keyHandle,
int length)
Generate a random AEAD block using the YubiHSM internal TRNG.
|
SystemInfoCmd |
getInfo()
Get the firmware version and unique ID from the YubiHSM.
|
int |
getMinHashLength()
Get the minimum hash length used when generating or validating an AEAD.
|
Nonce |
getNonce(short increment)
Get a nonce from the YubiHSM.
|
byte[] |
getRandom(int bytes)
Tell the YubiHSM to generate a number of random bytes.
|
DeviceHandler |
getRawDevice()
Get the raw device, used for debugging.
|
boolean |
keyStorageUnlock(String password)
Unlock the YubiHSM key storage using the HSM password.
|
boolean |
keyStoreDecrypt(String key)
Decrypt the YubiHSM key storage using the Master key.
|
int |
loadBufferData(byte[] data,
int offset)
Load data into the YubiHSMs internal buffer.
|
int |
loadBufferData(String data,
int offset)
Load data into the YubiHSMs internal buffer.
|
int |
loadRandomBufferData(int length,
int offset)
Load random data into the YubiHSMs internal buffer.
|
boolean |
loadTemporaryKey(String nonce,
int keyHandle,
String aead)
Load the content of an AEAD into the phantom key handle 0xffffffff.
|
boolean |
randomReseed(String seed)
Provide YubiHSM DRBG_CTR with a new seed.
|
void |
setMinHashLength(int value)
Set the minimum hash length generating or validating an AEAD.
|
boolean |
unlock(String password)
Generic key store unlock method that calls the appropriate unlock function for this YubiHSM.
|
boolean |
unlockOtp(String publicId,
String otp)
Have the YubiHSM unlock the HSM operations (those involving the keystore) with a YubiKey OTP.
|
boolean |
validateAEAD(String nonce,
int keyHandle,
String aead,
byte[] plaintext)
Validate an AEAD using the YubiHSM, matching it against some known plain text.
|
boolean |
validateAEAD(String nonce,
int keyHandle,
String aead,
String plaintext)
Validate an AEAD using the YubiHSM, matching it against some known plain text.
|
int |
validateOathHOTP(int keyHandle,
String nonce,
String aead,
int counter,
String otp,
int lookAhead)
Validate OATH-HOTP by a token whose seed is available to the YubiHSM through an AEAD.
|
boolean |
validateOathTOTP(int keyHandle,
String nonce,
String aead,
String otp)
Validate OATH-TOTP by a token whose seed is available to the YubiHSM through an AEAD.
|
boolean |
validateOathTOTP(int keyHandle,
String nonce,
String aead,
String otp,
int period,
int drift,
int backwardDrift,
int forwardDrift)
Validate OATH-TOTP by a token whose seed is available to the YubiHSM through an AEAD.
|
public static int minHashLength
public YubiHSM(String device, float timeout) throws YubiHSMErrorException
device - the YubiHSM device name ie /dev/ttyACM0timeout - the command read timeout (default is 0.5 sec)YubiHSMErrorException - if the YubiHSM reset command failpublic YubiHSM(String device) throws YubiHSMErrorException
device - the YubiHSM device name ie /dev/ttyACM0YubiHSMErrorException - if the YubiHSM reset command failpublic YubiHSM()
throws YubiHSMErrorException
YubiHSMErrorException - if the YubiHSM reset command failpublic String echo(String str) throws YubiHSMErrorException
str - the string that the YubiHSM should returnYubiHSMErrorException - if the YubiHSM echo command failpublic SystemInfoCmd getInfo()
public Map<String,String> generateAEAD(String nonce, int keyHandle, byte[] data) throws YubiHSMCommandFailedException, YubiHSMErrorException, YubiHSMInputException
nonce - the noncekeyHandle - the key to usedata - is the data to turn into an AEADYubiHSMCommandFailedException - if the YubiHSM fail to execute the commandYubiHSMErrorException - if validation fail for some values returned by the YubiHSMYubiHSMInputException - if an argument does not validatepublic Map<String,String> generateAEAD(String nonce, int keyHandle, String data) throws YubiHSMCommandFailedException, YubiHSMErrorException, YubiHSMInputException
nonce - the noncekeyHandle - the key to usedata - is the data to turn into an AEADYubiHSMCommandFailedException - if the YubiHSM fail to execute the commandYubiHSMErrorException - if validation fail for some values returned by the YubiHSMYubiHSMInputException - if an argument does not validatepublic Map<String,String> generateRandomAEAD(String nonce, int keyHandle, int length) throws YubiHSMCommandFailedException, YubiHSMErrorException, YubiHSMInputException
nonce - the nonce or public_idkeyHandle - the key to uselength - the resulting byte length of the AEADYubiHSMCommandFailedException - if the YubiHSM fail to execute the commandYubiHSMErrorException - if validation fail for some values returned by the YubiHSMYubiHSMInputException - if an argument does not validatepublic Map<String,String> generateBufferAEAD(String nonce, int keyHandle) throws YubiHSMCommandFailedException, YubiHSMErrorException, YubiHSMInputException
nonce - the noncekeyHandle - the key to useYubiHSMCommandFailedException - if the YubiHSM fail to execute the commandYubiHSMErrorException - if validation fail for some values returned by the YubiHSMYubiHSMInputException - if an argument does not validatepublic String generateOathAEAD(String nonce, int keyHandle, String tokenSeed) throws YubiHSMInputException, YubiHSMErrorException, YubiHSMCommandFailedException
validateOathHOTP and
validateOathTOTP.nonce - the noncekeyHandle - the key handle with permission to generateBufferAEADtokenSeed - the OATH token seedYubiHSMInputException - thrown if an argument fail to validateYubiHSMErrorException - thrown if an error have occurredYubiHSMCommandFailedException - thrown if the YubiHSM fail to execute a commandpublic boolean validateAEAD(String nonce, int keyHandle, String aead, byte[] plaintext) throws YubiHSMInputException, YubiHSMCommandFailedException, YubiHSMErrorException
nonce - the nonce or public_idkeyHandle - the key to useaead - the AEAD (hex string)plaintext - the plain text dataYubiHSMCommandFailedException - if the YubiHSM fail to execute the commandYubiHSMErrorException - if validation fail for some values returned by the YubiHSMYubiHSMInputException - if an argument does not validatepublic boolean validateAEAD(String nonce, int keyHandle, String aead, String plaintext) throws YubiHSMInputException, YubiHSMCommandFailedException, YubiHSMErrorException
nonce - the nonce or public_idkeyHandle - the key to useaead - the AEAD (hex string)plaintext - the plain text dataYubiHSMCommandFailedException - if the YubiHSM fail to execute the commandYubiHSMErrorException - if validation fail for some values returned by the YubiHSMYubiHSMInputException - if an argument does not validatepublic int loadBufferData(String data, int offset) throws YubiHSMErrorException
data - the data to load into the internal bufferoffset - the offset where to load the data, if set to 0 the buffer will reset before loading the dataYubiHSMErrorException - if validation fail for some values returned by the YubiHSMpublic int loadBufferData(byte[] data,
int offset)
throws YubiHSMErrorException
data - the data to load into the internal bufferoffset - the offset where to load the data, if set to 0 the buffer will reset before loading the dataYubiHSMErrorException - if validation fail for some values returned by the YubiHSMpublic int loadRandomBufferData(int length,
int offset)
throws YubiHSMErrorException
length - the length of the generated dataoffset - the offset where to load the data, if set to 0 the buffer will reset before loading the dataYubiHSMErrorException - if validation fail for some values returned by the YubiHSMpublic void exitMonitorDebugMode()
throws YubiHSMErrorException
YubiHSMErrorException - if the YubiHSM exit monitor command failpublic boolean loadTemporaryKey(String nonce, int keyHandle, String aead) throws YubiHSMCommandFailedException, YubiHSMErrorException, YubiHSMInputException
nonce - the noncekeyHandle - the key handle with permission to use YSM_TEMP_KEY_LOADaead - the AEAD to load into the phantom key handleYubiHSMCommandFailedException - command fail exceptionYubiHSMErrorException - error exceptionYubiHSMInputException - argument exceptionspublic byte[] generateHMACSHA1(byte[] bytes,
int keyHandle,
boolean toBuffer)
throws YubiHSMInputException,
YubiHSMCommandFailedException,
YubiHSMErrorException
bytes - the data used to generate the SHA1keyHandle - the key handle to use in the YubiHSMtoBuffer - set to true to get the SHA1 stored into the internal buffer, for use in some other cryptographic operations.YubiHSMCommandFailedException - if the YubiHSM fail to execute the commandYubiHSMErrorException - if validation fail for some values returned by the YubiHSMYubiHSMInputException - if an argument does not validatepublic Map<String,String> generateHMACSHA1(String data, int keyHandle, boolean last, boolean toBuffer) throws YubiHSMInputException, YubiHSMCommandFailedException, YubiHSMErrorException
data - the data used to generate the SHA1keyHandle - the key handle to use in the YubiHSMlast - set to false to not get a hash generated for the initial requesttoBuffer - set to true to get the SHA1 stored into the internal buffer, for use in some other cryptographic operations.YubiHSMCommandFailedException - if the YubiHSM fail to execute the commandYubiHSMErrorException - if validation fail for some values returned by the YubiHSMYubiHSMInputException - if an argument does not validatepublic Map<String,String> generateHMACSHA1(byte[] data, int keyHandle, boolean last, boolean toBuffer) throws YubiHSMInputException, YubiHSMCommandFailedException, YubiHSMErrorException
data - the data used to generate the SHA1keyHandle - the key handle to use in the YubiHSMlast - set to false to not get a hash generated for the initial requesttoBuffer - set to true to get the SHA1 stored into the internal buffer, for use in some other cryptographic operations.YubiHSMCommandFailedException - if the YubiHSM fail to execute the commandYubiHSMErrorException - if validation fail for some values returned by the YubiHSMYubiHSMInputException - if an argument does not validatepublic Map<String,String> generateHMACSHA1(String data, int keyHandle, byte flags, boolean last, boolean toBuffer) throws YubiHSMInputException, YubiHSMCommandFailedException, YubiHSMErrorException
data - the data used to generate the SHA1keyHandle - the key handle to use in the YubiHSMflags - set custom flags to be used when generating a SHA1, if set to (byte) 0 defaults will be used.last - set to false to not get a hash generated for the initial requesttoBuffer - set to true to get the SHA1 stored into the internal buffer, for use in some other cryptographic operations.YubiHSMCommandFailedException - if the YubiHSM fail to execute the commandYubiHSMErrorException - if validation fail for some values returned by the YubiHSMYubiHSMInputException - if an argument does not validatepublic Map<String,String> generateHMACSHA1(byte[] data, int keyHandle, byte flags, boolean last, boolean toBuffer) throws YubiHSMInputException, YubiHSMCommandFailedException, YubiHSMErrorException
data - the data used to generate the SHA1keyHandle - the key handle to use in the YubiHSMflags - set custom flags to be used when generating a SHA1, if set to (byte) 0 defaults will be used.last - set to false to not get a hash generated for the initial requesttoBuffer - set to true to get the SHA1 stored into the internal buffer, for use in some other cryptographic operations.YubiHSMCommandFailedException - if the YubiHSM fail to execute the commandYubiHSMErrorException - if validation fail for some values returned by the YubiHSMYubiHSMInputException - if an argument does not validatepublic Map<String,String> generateHMACSHA1Next(String data, int keyHandle, boolean last, boolean toBuffer) throws YubiHSMInputException, YubiHSMCommandFailedException, YubiHSMErrorException
generateHMACSHA1(byte[], int, boolean) with last set to false.data - the data to add before generating SHA1keyHandle - the key handle to use in the YubiHSMlast - set to false to not get a hash generated after this calltoBuffer - set to true to get the SHA1 stored into the internal buffer, for use in some other cryptographic operations.YubiHSMCommandFailedException - if the YubiHSM fail to execute the commandYubiHSMErrorException - if validation fail for some values returned by the YubiHSMYubiHSMInputException - if an argument does not validatepublic Map<String,String> generateHMACSHA1Next(byte[] data, int keyHandle, boolean last, boolean toBuffer) throws YubiHSMInputException, YubiHSMCommandFailedException, YubiHSMErrorException
generateHMACSHA1(byte[], int, boolean) with last set to false.data - the data to add before generating SHA1keyHandle - the key handle to use in the YubiHSMlast - set to false to not get a hash generated after this calltoBuffer - set to true to get the SHA1 stored into the internal buffer, for use in some other cryptographic operations.YubiHSMCommandFailedException - if the YubiHSM fail to execute the commandYubiHSMErrorException - if validation fail for some values returned by the YubiHSMYubiHSMInputException - if an argument does not validatepublic String encryptAES_ECB(String plaintext, int keyHandle) throws YubiHSMErrorException, YubiHSMInputException, YubiHSMCommandFailedException
keyHandle - the key handle to use when encrypting AES ECBplaintext - the plaintext stringYubiHSMInputException - if an argument does not validateYubiHSMErrorException - if validation fail for some values returned by the YubiHSMYubiHSMCommandFailedException - if the YubiHSM fail to execute the commandpublic String decryptAES_ECB(String cipherText, int keyHandle) throws YubiHSMErrorException, YubiHSMInputException, YubiHSMCommandFailedException
keyHandle - the key handle to use when decrypting AES ECBcipherText - the cipher stringYubiHSMInputException - if an argument does not validateYubiHSMErrorException - if validation fail for some values returned by the YubiHSMYubiHSMCommandFailedException - if the YubiHSM fail to execute the commandpublic boolean compareAES_ECB(int keyHandle,
String cipherText,
String plaintext)
throws YubiHSMCommandFailedException,
YubiHSMErrorException,
YubiHSMInputException
keyHandle - the key handle to use when comparing AES ECB cipher with plaintextcipherText - the cipher stringplaintext - the plaintext stringYubiHSMInputException - if an argument does not validateYubiHSMErrorException - if validation fail for some values returned by the YubiHSMYubiHSMCommandFailedException - if the YubiHSM fail to execute the commandpublic boolean unlock(String password) throws YubiHSMErrorException, YubiHSMCommandFailedException, YubiHSMInputException
password - the Master key/HSM password in hex formatYubiHSMCommandFailedException - command failed exceptionYubiHSMErrorException - error exceptionYubiHSMInputException - argument exceptionkeyStoreDecrypt(String),
keyStorageUnlock(String)public boolean keyStoreDecrypt(String key) throws YubiHSMCommandFailedException, YubiHSMErrorException, YubiHSMInputException
key - the Master key in hex format (see output of automatic Master key generation during HSM configuration)YubiHSMCommandFailedException - command failed exceptionYubiHSMErrorException - error exceptionYubiHSMInputException - argument exceptionpublic boolean keyStorageUnlock(String password) throws YubiHSMCommandFailedException, YubiHSMErrorException, YubiHSMInputException
password - the password in hex format (see output of automatic password generation during HSM configuration)YubiHSMCommandFailedException - command failed exceptionYubiHSMErrorException - error exceptionYubiHSMInputException - argument exceptionpublic boolean unlockOtp(String publicId, String otp) throws YubiHSMCommandFailedException, YubiHSMErrorException, YubiHSMInputException
publicId - the YubiKey public id (in hex)otp - the YubiKey OTP (in hex)YubiHSMErrorException - error exceptionsYubiHSMInputException - argument exceptionsYubiHSMCommandFailedException - command failed exceptionpublic int validateOathHOTP(int keyHandle,
String nonce,
String aead,
int counter,
String otp,
int lookAhead)
throws YubiHSMCommandFailedException,
YubiHSMErrorException,
YubiHSMInputException
keyHandle - a keyHandle with the permission YSM_TEMP_KEY_LOAD enablednonce - the nonce used to generate the AEADaead - the AEAD based on the token seedcounter - the current OTP counterotp - the token OTPlookAhead - the number of iterations to run to find the current users OTPYubiHSMInputException - argument exceptionsYubiHSMCommandFailedException - command failed exceptionYubiHSMErrorException - error exceptionpublic boolean validateOathTOTP(int keyHandle,
String nonce,
String aead,
String otp,
int period,
int drift,
int backwardDrift,
int forwardDrift)
throws YubiHSMInputException,
YubiHSMCommandFailedException,
YubiHSMErrorException
keyHandle - a keyHandle with the permission YSM_TEMP_KEY_LOAD enablednonce - the nonce used to generate the AEADaead - the AEAD based on the token seedotp - the token OTPperiod - an integer giving the period between changes of the OTP value in secondsdrift - drift of the local clock to the client clock, can be used to adjust the time skew without
changing the size of @backwardDrift and @forwardDriftbackwardDrift - the number of @period's we allow to backstepforwardDrift - the number of @period's we allow to look aheadYubiHSMInputException - argument exceptionsYubiHSMCommandFailedException - command failed exceptionYubiHSMErrorException - error exceptionpublic boolean validateOathTOTP(int keyHandle,
String nonce,
String aead,
String otp)
throws YubiHSMInputException,
YubiHSMCommandFailedException,
YubiHSMErrorException
keyHandle - a keyHandle with the permission YSM_TEMP_KEY_LOAD enablednonce - the nonce used to generate the AEADaead - the AEAD based on the token seedotp - the token OTPYubiHSMInputException - argument exceptionsYubiHSMCommandFailedException - command failed exceptionYubiHSMErrorException - error exceptionpublic Nonce getNonce(short increment) throws YubiHSMErrorException, YubiHSMCommandFailedException
increment - the increment (short)YubiHSMErrorException - error exceptionYubiHSMCommandFailedException - command failed exceptionpublic byte[] getRandom(int bytes)
throws YubiHSMErrorException,
YubiHSMInputException
bytes - the number of bytes to generateYubiHSMErrorException - error exceptionYubiHSMInputException - invalid argument exceptionpublic boolean randomReseed(String seed) throws YubiHSMCommandFailedException, YubiHSMErrorException, YubiHSMInputException
seed - the seed string with a length of 32YubiHSMInputException - argument exceptionYubiHSMErrorException - error exceptionYubiHSMCommandFailedException - command failed exceptionpublic Map<String,Integer> decodeYubikeyOtp(String publicId, int keyHandle, String aead, String otp) throws YubiHSMInputException, YubiHSMErrorException, YubiHSMCommandFailedException
publicId - the nonce used to generate the AEAD (YubiKey publicId)keyHandle - a keyHandle with the permission YSM_AEAD_YUBIKEY_OTP_DECODE enabledaead - the AEAD based on the token seedotp - the token OTP (in hex)YubiHSMInputException - argument exceptionsYubiHSMCommandFailedException - command failed exceptionYubiHSMErrorException - error exceptionpublic boolean drainData()
public DeviceHandler getRawDevice()
public int getMinHashLength()
public void setMinHashLength(int value)
value - the minimum hash lengthCopyright © 2011-2016 United ID. All Rights Reserved.