Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add fake mapping from JKS/PKCS12 KeyStore to WKS for FIPS Compliance #83

Merged
merged 2 commits into from
Dec 4, 2024

Conversation

cconlon
Copy link
Member

@cconlon cconlon commented Nov 13, 2024

This PR adds support for two new Java Security properties:

  • wolfjce.mapJKStoWKS
  • wolfjce.mapPKCS12toWKS

Setting these to "true" will cause wolfJCE to register support for either a JKS or PKCS12 KeyStore type. But, if one or both of these are registered it will be a fake mapping which maps down to the WolfSSLKeyStore (WKS) type internal to wolfJCE.

This should not be used in most cases, but can be helpful in scenarios where FIPS compliance is required and there is existing code which calls KeyStore.getInstance("JKS") or KeyStore.getInstance("PKCS12"), but that existing code cannot be changed. This assumes that even though the code can not be changed, the caller/user has the ability to load actual WKS files into those fake "JKS" or "PKCS12" KeyStore objects.

With these properties set, loading real JKS or PKCS12 files into their appropriate KeyStore object types will fail with an IOException.

Calling code may wish to dynamically set this to true or false at runtime for a brief period of time. This can be done by setting the properties then refreshing the services in the wolfJCE provider:

Security.setProperty("wolfjce.mapJKStoWKS", "true");
Security.setProperty("wolfjce.mapPKCS12toWKS", "true");
WolfCryptProvider prov = (WolfCryptProvider)Security.getProvider("wolfJCE");
prov.refreshServices();

@cconlon cconlon self-assigned this Nov 13, 2024
@cconlon cconlon force-pushed the wksMapping branch 5 times, most recently from 02ab8ae to badf602 Compare November 13, 2024 19:25
@JacobBarthelmeh JacobBarthelmeh merged commit 3b627be into wolfSSL:master Dec 4, 2024
36 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants