Package org.jivesoftware.openfire.auth

Class ScramUtils

java.lang.Object

org.jivesoftware.openfire.auth.ScramUtils

public class ScramUtils
extends Object

A utility class that provides methods that are useful for dealing with Salted Challenge Response Authentication Mechanism (SCRAM). The HMAC algorithm to be used is provided as an argument (in the form of a JCA standard name, such as HmacSHA1 or HmacSHA256), allowing these utilities to serve any SCRAM mechanism.

Author:

Richard Midwinter

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	ScramUtils.ScramKeys	The derived SCRAM keys for a password.

Field Summary

Fields

Modifier and Type	Field	Description
static final int	DEFAULT_ITERATION_COUNT

Method Summary

Modifier and Type	Method	Description
static byte[]	computeHmac(byte[] key, String string)	Deprecated, for removal: This API element is subject to removal in a future version. Use computeHmac(byte[], String, String), providing an explicit HMAC algorithm.
static byte[]	computeHmac(byte[] key, String string, String hmacAlgorithm)	Computes an HMAC over the UTF-8 bytes of the provided string, using the provided HMAC algorithm.
static Mac	createHmac(byte[] keyBytes, String hmacAlgorithm)	Creates an initialized Mac instance for the provided HMAC algorithm.
static byte[]	createSaltedPassword(byte[] salt, String password, int iters)	Deprecated, for removal: This API element is subject to removal in a future version. Use createSaltedPassword(byte[], String, int, String), providing an explicit HMAC algorithm.
static byte[]	createSaltedPassword(byte[] salt, String password, int iters, String hmacAlgorithm)	Computes a salted password (Hi(password, salt, iterations) as defined in RFC 5802), using the provided HMAC algorithm.
static Mac	createSha1Hmac(byte[] keyBytes)	Deprecated, for removal: This API element is subject to removal in a future version. Use createHmac(byte[], String), providing an explicit HMAC algorithm.
static ScramUtils.ScramKeys	deriveScramKeys(byte[] salt, String password, int iterations, String hmacAlgorithm, String digestAlgorithm)	Derives the stored key and server key for a SCRAM credential.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

DEFAULT_ITERATION_COUNT

public static final int DEFAULT_ITERATION_COUNT

See Also:

• Constant Field Values

Method Details

deriveScramKeys

public static ScramUtils.ScramKeys deriveScramKeys(byte[] salt,
 String password,
 int iterations,
 String hmacAlgorithm,
 String digestAlgorithm)
                                            throws SaslException,
NoSuchAlgorithmException

Derives the stored key and server key for a SCRAM credential. The keys are derived from the supplied password using the specified salt, iteration count, HMAC algorithm and digest algorithm, as defined by the SCRAM specification.

Parameters:

salt - the salt.

password - the plaintext password.

iterations - the SCRAM iteration count.

hmacAlgorithm - the HMAC algorithm (for example HmacSHA1 or HmacSHA256).

digestAlgorithm - the digest algorithm corresponding to the HMAC algorithm (for example SHA-1 or SHA-256).

Returns:

the derived stored key and server key.

Throws:

SaslException - if the salted password or HMAC values cannot be derived.

NoSuchAlgorithmException - if the requested digest algorithm is unavailable.

createSaltedPassword

public static byte[] createSaltedPassword(byte[] salt,
 String password,
 int iters,
 String hmacAlgorithm)
                                   throws SaslException

Computes a salted password (Hi(password, salt, iterations) as defined in RFC 5802), using the provided HMAC algorithm.

Parameters:

salt - the salt.

password - the password.

iters - the iteration count.

hmacAlgorithm - the JCA name of the HMAC algorithm to use (for example: HmacSHA1).

Returns:

the salted password.

Throws:

SaslException - if the HMAC could not be initialized.

computeHmac

public static byte[] computeHmac(byte[] key,
 String string,
 String hmacAlgorithm)
                          throws SaslException

Computes an HMAC over the UTF-8 bytes of the provided string, using the provided HMAC algorithm.

Parameters:

key - the key.

string - the value to compute the HMAC over.

hmacAlgorithm - the JCA name of the HMAC algorithm to use (for example: HmacSHA1).

Returns:

the computed HMAC.

Throws:

SaslException - if the HMAC could not be initialized.

createHmac

public static Mac createHmac(byte[] keyBytes,
 String hmacAlgorithm)
                      throws SaslException

Creates an initialized Mac instance for the provided HMAC algorithm.

Parameters:

keyBytes - the key.

hmacAlgorithm - the JCA name of the HMAC algorithm to use (for example: HmacSHA1).

Returns:

an initialized Mac.

Throws:

SaslException - if the HMAC could not be initialized.

createSaltedPassword

@Deprecated(forRemoval=true)
public static byte[] createSaltedPassword(byte[] salt,
 String password,
 int iters)
                                   throws SaslException

Deprecated, for removal: This API element is subject to removal in a future version.

Use createSaltedPassword(byte[], String, int, String), providing an explicit HMAC algorithm.

Computes a SHA-1 salted password (Hi(password, salt, iterations) as defined in RFC 5802).

Parameters:

salt - the salt.

password - the password.

iters - the iteration count.

Returns:

the salted password.

Throws:

SaslException - if the HMAC could not be initialized.

computeHmac

@Deprecated(forRemoval=true)
public static byte[] computeHmac(byte[] key,
 String string)
                          throws SaslException

Deprecated, for removal: This API element is subject to removal in a future version.

Use computeHmac(byte[], String, String), providing an explicit HMAC algorithm.

Computes an HMAC-SHA-1 over the UTF-8 bytes of the provided string.

Parameters:

key - the key.

string - the value to compute the HMAC over.

Returns:

the computed HMAC.

Throws:

SaslException - if the HMAC could not be initialized.

createSha1Hmac

@Deprecated(forRemoval=true)
public static Mac createSha1Hmac(byte[] keyBytes)
                          throws SaslException

Deprecated, for removal: This API element is subject to removal in a future version.

Use createHmac(byte[], String), providing an explicit HMAC algorithm.

Creates an initialized Mac instance for HMAC-SHA-1.

Parameters:

keyBytes - the key.

Returns:

an initialized Mac.

Throws:

SaslException - if the HMAC could not be initialized.