Tay Thotheolh

Some interesting links to read:

https://wiki.jasig.org/display/CASUM/SSL+Troubleshooting+and+Reference+Guide

http://www.java-samples.com/showtutorial.php?tutorialid=210

http://www.webapper.com/blog/index.php/2007/02/09/troubleshooting-javaxnetsslsslhandshakeexception/

Hi. I have a theoretical problem here. is it possible for a class to impersonate it's identity ? E.g. Class A attempts to access Class B methods. Class B methods uses a getClass().getName(); method to attempt to check Class A to ensure it is who it is. Can impersonation take place ? e.g. Class C impersonates Class A to get pass the getclass().getName(); Class B uses for checks ?

If Class B wants to implement getClass().getName() for checks effective on the sample method below, how do I implement it properly in the sample code below ?

public byte[] getStoragePrivateKey(String application){ if(application.getClass().getName().equals("correctClass"){ //Allow access to Private Key. }else{ //Access denied ! } }

The above example is a simulation of a plugin applet in the system trying to access an internal key server database in the system.

What warning is it ? Is it an invalid certificate or something like that ?

The android project in netbeans couldn't clean nor build nor run.

I am using NetBeans 6.9 with a newly installed 'nbandroid' package while following the instructions from http://wiki.netbeans.org/IntroAndroidDevNetBeans. I have the Android SDK installed and it's fully updated.

I am using Linux platform by the way.

I get this error when I try to build and run my Android application.

W/asset ( 7441): Asset path ${platforms.Android.bootclasspath1} is neither a directory nor file (type=1). ERROR: Asset package include '${platforms.Android.bootclasspath1}' not found.

How do I fix the above error ?

Thanks.

Hi. I am wondering if it is possible to create an internal access control model in a Java application based on classes that attempt to access certain methods or classes ?

My idea is that a Java application with plugin capabilities may have certain methods or classes too sensitive for plugin classes to access. E.g. secure storage or user password authentication classes shouldn't be accessed by plugins at all.

I was wondering if it is possible to use XXXClass.getClass() which returns a "Class" class object to do checking against an access control list for the system ?

Is it practically safe to do so too ?

I am wondering maybe some malicious classes may try to spoof a Class object to gain access or maybe is it possible for some malicious class to take control of a legitimate class to access restricted areas in an application system ?

If using "Class" class objects to determine the ability to access restricted classes or methods are not safe, is there a set of samples that can be created to proof that this method of access control between classes and methods are not safe ?

Thanks.

Hi. May I know if there's anyway to change java look and feel dynamically without restarting java apps ?

Thanks.

Regards,
Thotheolh.

Hi. I have a DH key agreement and i made a test and run it and an exception was raised. I am using BC as provider. It was all ok until it hit some weird exceptions.

SEVERE: null java.security.InvalidKeyException: DHPublicKey not for this KeyAgreement! at org.bouncycastle.jce.provider.JCEDHKeyAgreement.engineDoPhase(Unknown Source) at javax.crypto.KeyAgreement.doPhase(DashoA13*..) at DH.doFinals(DH.java:100) at DHTest.doTest(DHTest.java:58) at DHTest.main(DHTest.java:88)

The DH functions are found in DH class and the testing is found in DHTest class. Apparently I could not attachment zips nor txt nor java files so I am sry but I have to post the whole java codes here which I wished I could avoid.

DH.java

/* * Diffie Hellman */ import java.math.BigInteger; import java.security.AlgorithmParameterGenerator; import java.security.AlgorithmParameters; import java.security.InvalidAlgorithmParameterException; import java.security.InvalidKeyException; import java.security.KeyFactory; import java.security.KeyPair; import java.security.KeyPairGenerator; import java.security.NoSuchAlgorithmException; import java.security.NoSuchProviderException; import java.security.PublicKey; import java.security.SecureRandom; import java.security.Security; import java.security.spec.EncodedKeySpec; import java.security.spec.InvalidKeySpecException; import java.security.spec.InvalidParameterSpecException; import java.security.spec.X509EncodedKeySpec; import java.util.logging.Level; import java.util.logging.Logger; import javax.crypto.KeyAgreement; import javax.crypto.SecretKey; import javax.crypto.spec.DHParameterSpec; /** * * @author thotheolh */ public class DH { private SecureRandom random; private BigInteger g = null; private BigInteger p = null; //private int l = 512; private DHParameterSpec params; private KeyPairGenerator keyGen; private KeyAgreement keyAgree; private KeyPair keyPair; private PublicKey pubKey; private AlgorithmParameterGenerator paramGen; private AlgorithmParameters algoParams; public DH() { try { random = SecureRandom.getInstance("SHA1PRNG"); Security.addProvider(new org.bouncycastle.jce.provider.BouncyCastleProvider()); } catch (NoSuchAlgorithmException ex) { Logger.getLogger(DH.class.getName()).log(Level.SEVERE, null, ex); } } public void setPG(BigInteger p, BigInteger g) { setP(p); setG(g); } public void initDH() {// Only init after setting P and G. Your client need to getPubKey() and send the public key over before doFinals(). try { // Only init after setting P and G. System.out.println("Setting DH params..."); paramGen = AlgorithmParameterGenerator.getInstance("DH","BC"); System.out.println("Init DH Param Gen..."); paramGen.init(512);//new System.out.println("Init DH Algo..."); algoParams = paramGen.generateParameters();//new System.out.println("Init DH Algo Spec..."); params = algoParams.getParameterSpec(new DHParameterSpec(p, g).getClass()); //System.out.println("Get DH params - L: " + params.getL());//Diagnostic keyGen = KeyPairGenerator.getInstance("DH", "BC"); System.out.println("Init DH Key Gen..."); keyGen.initialize(params, random); System.out.println("Setting DH Key Agree..."); keyAgree = KeyAgreement.getInstance("DH", "BC"); System.out.println("Gen DH Key Pair..."); keyPair = keyGen.generateKeyPair(); System.out.println("Gettimg DH Priv Key..."); keyAgree.init(keyPair.getPrivate()); System.out.println("Setting DH Pub Key..."); setPubKey(keyPair.getPublic()); } catch (InvalidParameterSpecException ex) { Logger.getLogger(DH.class.getName()).log(Level.SEVERE, null, ex); } catch (InvalidKeyException ex) { Logger.getLogger(DH.class.getName()).log(Level.SEVERE, null, ex); } catch (InvalidAlgorithmParameterException ex) { Logger.getLogger(DH.class.getName()).log(Level.SEVERE, null, ex); } catch (NoSuchAlgorithmException ex) { Logger.getLogger(DH.class.getName()).log(Level.SEVERE, null, ex); } catch (NoSuchProviderException ex) { Logger.getLogger(DH.class.getName()).log(Level.SEVERE, null, ex); } } public SecretKey doFinals(PublicKey partnerKey) {//After exchanging public key, insert partner's public key as parameter. try { keyAgree.doPhase(partnerKey, true); return keyAgree.generateSecret("AES"); } catch (NoSuchAlgorithmException ex) { Logger.getLogger(DH.class.getName()).log(Level.SEVERE, null, ex); } catch (InvalidKeyException ex) { Logger.getLogger(DH.class.getName()).log(Level.SEVERE, null, ex); } catch (IllegalStateException ex) { Logger.getLogger(DH.class.getName()).log(Level.SEVERE, null, ex); } return null; } public void generateRandomPG() { p = new BigInteger(32, random); g = new BigInteger(32, random); } public PublicKey generateDHPublicKeyFromBytes(byte[] encodedPublicKeyBytes){ try { KeyFactory keyFactory = KeyFactory.getInstance("DH","BC"); EncodedKeySpec publicKeySpec = new X509EncodedKeySpec(encodedPublicKeyBytes); return keyFactory.generatePublic(publicKeySpec); } catch (NoSuchProviderException ex) { Logger.getLogger(DH.class.getName()).log(Level.SEVERE, null, ex); } catch (InvalidKeySpecException ex) { Logger.getLogger(DH.class.getName()).log(Level.SEVERE, null, ex); } catch (NoSuchAlgorithmException ex) { Logger.getLogger(DH.class.getName()).log(Level.SEVERE, null, ex); } return null; } /** * @return the random */ public SecureRandom getRandom() { return random; } /** * @param random the random to set */ public void setRandom(SecureRandom random) { this.random = random; } /** * @return the g */ public BigInteger getG() { return g; } /** * @param g the g to set */ public void setG(BigInteger g) { this.g = g; } /** * @return the p */ public BigInteger getP() { return p; } /** * @param p the p to set */ public void setP(BigInteger p) { this.p = p; } /** * @return the pubKey */ public PublicKey getPubKey() { return pubKey; } /** * @param pubKey the pubKey to set */ public void setPubKey(PublicKey pubKey) { this.pubKey = pubKey; } }

DHTest.java

/* * To change this template, choose Tools | Templates * and open the template in the editor. */ import java.math.BigInteger; import java.security.PublicKey; import javax.crypto.SecretKey; /** * * @author thotheolh */ public class DHTest { DH alice = new DH(); DH bob = new DH(); public DHTest() { } public void doTest() { System.out.println("Alice init with P and G..."); alice.generateRandomPG();//alice starts conversation. //Setting P and G values System.out.println("Setting P and G..."); alice.setPG(alice.getP(), alice.getG()); bob.setPG(alice.getP(), alice.getG()); //Start off DH System.out.println("Init DH..."); alice.initDH(); bob.initDH(); // //Some experiment on the Public Key encoding // PublicKey alicePubKey = alice.generateDHPublicKeyFromBytes(alice.getPubKey().getEncoded()); // PublicKey bobPubKey = bob.generateDHPublicKeyFromBytes(bob.getPubKey().getEncoded()); // // //Finals with experiment // SecretKey aliceSecret = alice.doFinals(bobPubKey); // SecretKey bobSecret = bob.doFinals(alicePubKey); //No experiment System.out.println("Generating Secret Keys..."); System.out.println("Alice\nAlgo: "+alice.getPubKey().getAlgorithm()+"\nFormat: "+alice.getPubKey().getFormat()); System.out.println("Bob\nAlgo: "+bob.getPubKey().getAlgorithm()+"\nFormat: "+bob.getPubKey().getFormat()); SecretKey aliceSecret = alice.doFinals(bob.getPubKey()); SecretKey bobSecret = bob.doFinals(alice.getPubKey()); System.out.println("Alice Secret: " + ByteToHex(aliceSecret.getEncoded())); System.out.println("Bob Secret: " + ByteToHex(bobSecret.getEncoded())); if (aliceSecret.equals(bobSecret)) { System.out.println("Secret Key matches !!!"); } else { System.out.println("Scret Key DOES NOT match !!!"); } } public String ByteToHex(byte[] byteArray) { String result = ""; for (int i = 0; i < byteArray.length; i++) { result += Integer.toString((byteArray[i] & 0xff) + 0x100, 16).substring(1); } return result; } public byte[] HexToByte(String hexcode) { byte[] bytes = new byte[hexcode.length() / 2]; for (int i = 0; i < bytes.length; i++) { bytes[i] = (byte) Integer.parseInt(hexcode.substring(2 * i, 2 * i + 2), 16); } return bytes; } public static void main(String[] args) { new DHTest().doTest(); } }



Thanks.

Regards,
Thotheolh.

Thanks. I have found a way to convert bytes to public key.

It's in "http://www.exampledepot.com/egs/javax.crypto/KeyAgree.html" and "http://www.javafaq.nu/java-example-code-189.html".

Thanks for the reply. I understand DH is used to exchange keys or insecure channels. The public key I am talking about is the Alice and Bob public keys they exchange during their DH besides the P and G values.

The problem I am having now is not how to extract the byte[] from the public key but how do I recreate the byte[] of the public key sent across the network into a PublicKey object again. I have looked through the PublicKey java doc but it seems like there is no direct way for using the transfered byte[] and re-assemble them back to PublicKey objects.

Thanks. Got it.

Hi. I am implementing a network based diffie hellman. The two communicating parties need to exchange their public keys. How do I encode/decode them as hex string so I can conveniently send the public keys over the network in string packets ?

Thanks.

Regards,
Thotheolh.

Hi.

May I know how do I find out if the selected JTable row is empty of values ?

When I do the following code:

System.out.println("selected: "+(String) Table.getValueAt(Table.getSelectedRow(), 0));

I get the following exceptions:

Exception in thread "AWT-EventQueue-0" java.lang.ArrayIndexOutOfBoundsException: -1 at javax.swing.DefaultRowSorter.convertRowIndexToModel(DefaultRowSorter.java:501) at javax.swing.JTable.convertRowIndexToModel(JTable.java:2611) at javax.swing.JTable.getValueAt(JTable.java:2686) ...

The exception is too to list down here.

How do I do a check to ensure that the selected row is not empty so it doesn't throw an exception ?

Thanks.

Hi. I have a JEditorPane that uses a HTMLEditorKit for rendering HTML. I set it to render "http://www.webstandards.org/files/acid2/test.html#top" url which is the Acid 2 html test kit and it threw me the following exception:
java.security.AccessControlException: access denied (java.security.AllPermission <all permissions> <all actions>) at java.security.AccessControlContext.checkPermission(AccessControlContext.java:323) at java.security.AccessController.checkPermission(AccessController.java:546) at java.lang.SecurityManager.checkPermission(SecurityManager.java:532) at sun.awt.SunToolkit.createImage(SunToolkit.java:908) at javax.swing.text.html.CSS$BackgroundImage.getImage(CSS.java:2496) at javax.swing.text.html.StyleSheet.getBackgroundImage(StyleSheet.java:967) at javax.swing.text.html.StyleSheet$BoxPainter.<init>(StyleSheet.java:1761) at javax.swing.text.html.StyleSheet.getBoxPainter(StyleSheet.java:903) at javax.swing.text.html.BlockView.setPropertiesFromAttributes(BlockView.java:390) at javax.swing.text.html.BlockView.setParent(BlockView.java:57) at javax.swing.text.CompositeView.replace(CompositeView.java:200) at javax.swing.text.BoxView.replace(BoxView.java:164) at javax.swing.text.CompositeView.loadChildren(CompositeView.java:97) at javax.swing.text.CompositeView.setParent(CompositeView.java:122) at javax.swing.text.html.BlockView.setParent(BlockView.java:55) at javax.swing.text.CompositeView.replace(CompositeView.java:200) at javax.swing.text.BoxView.replace(BoxView.java:164) at javax.swing.text.CompositeView.loadChildren(CompositeView.java:97) at javax.swing.text.CompositeView.setParent(CompositeView.java:122) at javax.swing.text.html.BlockView.setParent(BlockView.java:55) at javax.swing.text.html.HTMLEditorKit$HTMLFactory$BodyBlockView.setParent(HTMLEditorKit.java:1277) at javax.swing.text.CompositeView.replace(CompositeView.java:200) at javax.swing.text.BoxView.replace(BoxView.java:164) at javax.swing.text.View.updateChildren(View.java:1095) at javax.swing.text.View.insertUpdate(View.java:679) at javax.swing.plaf.basic.BasicTextUI$RootView.insertUpdate(BasicTextUI.java:1590) at javax.swing.plaf.basic.BasicTextUI$UpdateHandler.insertUpdate(BasicTextUI.java:1849) at javax.swing.text.AbstractDocument.fireInsertUpdate(AbstractDocument.java:185) at javax.swing.text.DefaultStyledDocument.create(DefaultStyledDocument.java:145) at javax.swing.text.html.HTMLDocument.create(HTMLDocument.java:281) at javax.swing.text.html.HTMLDocument$HTMLReader.flushBuffer(HTMLDocument.java:3323) at javax.swing.text.html.HTMLDocument$HTMLReader.addContent(HTMLDocument.java:3265) at javax.swing.text.html.HTMLDocument$HTMLReader.blockClose(HTMLDocument.java:3196) at javax.swing.text.html.HTMLDocument$HTMLReader$BlockAction.end(HTMLDocument.java:2391) at javax.swing.text.html.HTMLDocument$HTMLReader.handleEndTag(HTMLDocument.java:2290) at javax.swing.text.html.parser.DocumentParser.handleEndTag(DocumentParser.java:223) at javax.swing.text.html.parser.Parser.endTag(Parser.java:436) at javax.swing.text.html.parser.Parser.parseTag(Parser.java:1807) at javax.swing.text.html.parser.Parser.parseContent(Parser.java:2044) at javax.swing.text.html.parser.Parser.parse(Parser.java:2211) at javax.swing.text.html.parser.DocumentParser.parse(DocumentParser.java:105) at javax.swing.text.html.parser.ParserDelegator.parse(ParserDelegator.java:73) at javax.swing.text.html.HTMLEditorKit.read(HTMLEditorKit.java:230) at javax.swing.JEditorPane.read(JEditorPane.java:555) at javax.swing.JEditorPane$PageLoader.run(JEditorPane.java:646) Exception in thread "Thread-2" java.lang.ArrayIndexOutOfBoundsException at java.lang.System.arraycopy(Native Method) at javax.swing.text.BoxView.updateLayoutArray(BoxView.java:196) at javax.swing.text.BoxView.replace(BoxView.java:168) at javax.swing.text.View.updateChildren(View.java:1095) at javax.swing.text.View.changedUpdate(View.java:761) at javax.swing.text.html.BlockView.changedUpdate(BlockView.java:324) at javax.swing.plaf.basic.BasicTextUI$RootView.changedUpdate(BasicTextUI.java:1618) at javax.swing.plaf.basic.BasicTextUI$UpdateHandler.changedUpdate(BasicTextUI.java:1879) at javax.swing.text.AbstractDocument.fireChangedUpdate(AbstractDocument.java:214) at javax.swing.text.html.HTMLDocument.fireChangedUpdate(HTMLDocument.java:1332) at javax.swing.text.html.HTMLDocument$HTMLReader.adjustEndElement(HTMLDocument.java:2073) at javax.swing.text.html.HTMLDocument$HTMLReader.flush(HTMLDocument.java:2128) at javax.swing.text.html.HTMLEditorKit.read(HTMLEditorKit.java:231) at javax.swing.JEditorPane.read(JEditorPane.java:555) at javax.swing.JEditorPane$PageLoader.run(JEditorPane.java:646)

Here are my code fragments:
public void initSwingHTML() { try { JEditorPane editor = new JEditorPane(); editor.setEditorKit(new HTMLEditorKit()); editor.setPage("http://www.webstandards.org/files/acid2/test.html#top"); } catch (IOException ex) { Logger.getLogger(HTMLFrame.class.getName()).log(Level.SEVERE, null, ex); } }

How do I grant it's permission in hard code.

Thanks... got it.