Class User

java.lang.Object

org.kopi.ebics.client.User

All Implemented Interfaces:

EbicsUser, Savable

public class User
extends Object
implements EbicsUser, Savable

Simple implementation of an EBICS user. This object is not serializable, but it should be persisted every time it needs to be saved. Persistence is achieved via save(ObjectOutputStream) and the matching constructor.

Constructor Summary

Constructors

Constructor	Description
User(EbicsPartner partner, ObjectInputStream ois, PasswordCallback passwordCallback)	Reconstructs a persisted EBICS user.
User(EbicsPartner partner, String userId, String name, File keystorePath, PasswordCallback passwordCallback)	Reconstructs a an EBICS user by loading its certificate from a given key store.
User(EbicsPartner partner, String userId, String name, String email, String country, String organization, PasswordCallback passwordCallback)	First time constructor.

Method Summary

Modifier and Type	Method	Description
byte[]	authenticate(byte[] digest)	EBICS Specification 2.4.2 - 11.1.1 Process:
byte[]	decrypt(byte[] encryptedData, byte[] transactionKey)	EBICS IG CFONB VF 2.1.4 2012 02 24 - 2.1.3.2 Calcul de la signature:
byte[]	getA005Certificate()	Returns the signature certificate.
RSAPublicKey	getA005PublicKey()	Returns the public part of the signature key.
String	getDN()	Returns the distinguished name
byte[]	getE002Certificate()	Returns the encryption certificate.
RSAPublicKey	getE002PublicKey()	Returns the public part of the encryption key.
String	getName()	Returns the user name.
EbicsPartner	getPartner()	Returns the customer in whose name we operate.
PasswordCallback	getPasswordCallback()	Returns the password callback handler for the current user.
String	getSaveName()	Returns the save name of this savable object.
String	getSecurityMedium()	Returns the type to security medium used to store the A005 key.
String	getUserId()	Returns the (bank provided) user id.
byte[]	getX002Certificate()	Returns the authentication certificate.
RSAPublicKey	getX002PublicKey()	Return the public part of the transport authentication key.
boolean	isInitialized()	Has the users signature key been sent to the bank?
boolean	isInitializedHIA()	Have the users authentication and encryption keys been sent to the bank?
boolean	needsSave()	Did any persistable attribute change since last load/save operation.
static byte[]	removeOSSpecificChars(byte[] buf)	EBICS Specification 2.4.2 - 7.1 Process description:
void	save(ObjectOutputStream oos)	Writes all persistable attributes to the given stream.
void	saveUserCertificates(File directory)	Saves the user certificates in a given directory
void	setA005Certificate(X509Certificate a005Certificate)	Sets the signature certificate.
void	setA005PrivateKey(PrivateKey a005PrivateKey)	Sets the signature private key
void	setE002Certificate(X509Certificate e002Certificate)	Sets the encryption certificate.
void	setE002PrivateKey(PrivateKey e002PrivateKey)	Sets the encryption private key
void	setInitialized(boolean isInitialized)	The users signature key has been sent to the bank.
void	setInitializedHIA(boolean isInitializedHIA)	The users authentication and encryption keys have been sent to the bank.
void	setX002Certificate(X509Certificate x002Certificate)	Sets the authentication certificate.
void	setX002PrivateKey(PrivateKey x002PrivateKey)	Sets the authentication private key
byte[]	sign(byte[] digest)	EBICS Specification 2.4.2 - 14.1 Version A005/A006 of the electronic signature:
void	updateKeys(KeyManagement keymgmt, PasswordCallback passwordCallback)	Generates new keys for this user and sends them to the bank.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

User

public User(EbicsPartner partner,
 String userId,
 String name,
 String email,
 String country,
 String organization,
 PasswordCallback passwordCallback)
     throws GeneralSecurityException,
IOException

First time constructor. Use this constructor, if you want to prepare the first communication with the bank. For further communications you should recover persisted objects. All required signature keys will be generated now.

Parameters:

partner - customer in whose name we operate.

userId - UserId as obtained from the bank.

name - the user name,

email - the user email

country - the user country

organization - the user organization or company

passwordCallback - a callback-handler that supplies us with the password. This parameter can be null, in this case no password is used.

Throws:

IOException

GeneralSecurityException

User

public User(EbicsPartner partner,
 ObjectInputStream ois,
 PasswordCallback passwordCallback)
     throws IOException,
GeneralSecurityException,
ClassNotFoundException

Reconstructs a persisted EBICS user.

Parameters:

partner - the customer in whose name we operate.

ois - the object stream

passwordCallback - a callback-handler that supplies us with the password.

Throws:

IOException

GeneralSecurityException - if the supplies password is wrong.

ClassNotFoundException

User

public User(EbicsPartner partner,
 String userId,
 String name,
 File keystorePath,
 PasswordCallback passwordCallback)
     throws GeneralSecurityException,
IOException

Reconstructs a an EBICS user by loading its certificate from a given key store.

Parameters:

partner - the customer in whose name we operate.

userId - UserID as obtained from the bank.

keystorePath - the key store path

passwordCallback - a callback-handler that supplies us with the password.

Throws:

GeneralSecurityException

IOException

Method Details

saveUserCertificates

public void saveUserCertificates(File directory)
                          throws GeneralSecurityException,
IOException

Saves the user certificates in a given directory

Throws:

GeneralSecurityException

IOException

save

public void save(ObjectOutputStream oos)
          throws IOException

Description copied from interface: Savable

Writes all persistable attributes to the given stream.

Specified by:

save in interface Savable

Parameters:

oos - the given stream.

Throws:

IOException - save process failed

isInitialized

public boolean isInitialized()

Has the users signature key been sent to the bank?

Returns:

True if the users signature key been sent to the bank

setInitialized

public void setInitialized(boolean isInitialized)

The users signature key has been sent to the bank.

Parameters:

isInitialized - transfer successful?

isInitializedHIA

public boolean isInitializedHIA()

Have the users authentication and encryption keys been sent to the bank?

Returns:

True if the users authentication and encryption keys been sent to the bank.

setInitializedHIA

public void setInitializedHIA(boolean isInitializedHIA)

The users authentication and encryption keys have been sent to the bank.

Parameters:

isInitializedHIA - transfer successful?

updateKeys

public void updateKeys(KeyManagement keymgmt,
 PasswordCallback passwordCallback)
                throws EbicsException,
IOException

Generates new keys for this user and sends them to the bank.

Parameters:

keymgmt - the key management instance with the ebics session.

passwordCallback - the password-callback for the new keys.

Throws:

EbicsException - Exception during server request

IOException - Exception during server request

removeOSSpecificChars

public static byte[] removeOSSpecificChars(byte[] buf)

EBICS Specification 2.4.2 - 7.1 Process description:

In particular, so-called “white-space characters” such as spaces, tabs, carriage returns and line feeds (“CR/LF”) are not permitted.

All white-space characters should be removed from entry buffer buf.

Parameters:

buf - the given byte buffer

Returns:

The byte buffer portion corresponding to the given length and offset

needsSave

public boolean needsSave()

Did any persistable attribute change since last load/save operation.

Returns:

True if the object needs to be saved.

getA005Certificate

public byte[] getA005Certificate()
                          throws EbicsException

Description copied from interface: EbicsUser

Returns the signature certificate.

Specified by:

getA005Certificate in interface EbicsUser

Returns:

the encryption certificate.

Throws:

EbicsException

getE002Certificate

public byte[] getE002Certificate()
                          throws EbicsException

Description copied from interface: EbicsUser

Returns the encryption certificate.

Specified by:

getE002Certificate in interface EbicsUser

Returns:

the encryption certificate.

Throws:

EbicsException

getX002Certificate

public byte[] getX002Certificate()
                          throws EbicsException

Description copied from interface: EbicsUser

Returns the authentication certificate.

Specified by:

getX002Certificate in interface EbicsUser

Returns:

the encryption certificate.

Throws:

EbicsException

setA005Certificate

public void setA005Certificate(X509Certificate a005Certificate)

Description copied from interface: EbicsUser

Sets the signature certificate.

Specified by:

setA005Certificate in interface EbicsUser

Parameters:

a005Certificate - the signature certificate.

setE002Certificate

public void setE002Certificate(X509Certificate e002Certificate)

Description copied from interface: EbicsUser

Sets the encryption certificate.

Specified by:

setE002Certificate in interface EbicsUser

Parameters:

e002Certificate - the encryption certificate.

setX002Certificate

public void setX002Certificate(X509Certificate x002Certificate)

Description copied from interface: EbicsUser

Sets the authentication certificate.

Specified by:

setX002Certificate in interface EbicsUser

Parameters:

x002Certificate - the authentication certificate.

getA005PublicKey

public RSAPublicKey getA005PublicKey()

Description copied from interface: EbicsUser

Returns the public part of the signature key.

Specified by:

getA005PublicKey in interface EbicsUser

Returns:

the public part of the signature key.

getE002PublicKey

public RSAPublicKey getE002PublicKey()

Description copied from interface: EbicsUser

Returns the public part of the encryption key.

Specified by:

getE002PublicKey in interface EbicsUser

Returns:

the public part of the encryption key.

getX002PublicKey

public RSAPublicKey getX002PublicKey()

Description copied from interface: EbicsUser

Return the public part of the transport authentication key.

Specified by:

getX002PublicKey in interface EbicsUser

Returns:

the public part of the transport authentication key.

setA005PrivateKey

public void setA005PrivateKey(PrivateKey a005PrivateKey)

Description copied from interface: EbicsUser

Sets the signature private key

Specified by:

setA005PrivateKey in interface EbicsUser

Parameters:

a005PrivateKey - the signature private key

setX002PrivateKey

public void setX002PrivateKey(PrivateKey x002PrivateKey)

Description copied from interface: EbicsUser

Sets the authentication private key

Specified by:

setX002PrivateKey in interface EbicsUser

Parameters:

x002PrivateKey - the authentication private key

setE002PrivateKey

public void setE002PrivateKey(PrivateKey e002PrivateKey)

Description copied from interface: EbicsUser

Sets the encryption private key

Specified by:

setE002PrivateKey in interface EbicsUser

Parameters:

e002PrivateKey - the encryption private key

getSecurityMedium

public String getSecurityMedium()

Description copied from interface: EbicsUser

Returns the type to security medium used to store the A005 key.

Specified by:

getSecurityMedium in interface EbicsUser

Returns:

the type to security medium used to store the A005 key.

getPartner

public EbicsPartner getPartner()

Description copied from interface: EbicsUser

Returns the customer in whose name we operate.

Specified by:

getPartner in interface EbicsUser

Returns:

the customer in whose name we operate.

getUserId

public String getUserId()

Description copied from interface: EbicsUser

Returns the (bank provided) user id.

Specified by:

getUserId in interface EbicsUser

Returns:

the (bank provided) user id.

getName

public String getName()

Description copied from interface: EbicsUser

Returns the user name.

Specified by:

getName in interface EbicsUser

Returns:

the user name.

getDN

public String getDN()

Description copied from interface: EbicsUser

Returns the distinguished name

Specified by:

getDN in interface EbicsUser

Returns:

the distinguished name

getPasswordCallback

public PasswordCallback getPasswordCallback()

Description copied from interface: EbicsUser

Returns the password callback handler for the current user.

Specified by:

getPasswordCallback in interface EbicsUser

Returns:

the password callback handler.

getSaveName

public String getSaveName()

Description copied from interface: Savable

Returns the save name of this savable object.

Specified by:

getSaveName in interface Savable

Returns:

the save name

authenticate

public byte[] authenticate(byte[] digest)
                    throws GeneralSecurityException

EBICS Specification 2.4.2 - 11.1.1 Process:

Identification and authentication signatures are based on the RSA signature process. The following parameters determine the identification and authentication signature process:

1. Length of the (secret) RSA key
2. Hash algorithm
3. Padding process
4. Canonisation process.

For the identification and authentication process, EBICS defines the process “X002” with the following parameters:

1. Key length in Kbit >=1Kbit (1024 bit) and lesser than 16Kbit
2. Hash algorithm SHA-256
3. Padding process: PKCS#1
4. Canonisation process: http://www.w3.org/TR/2001/REC-xml-c14n-20010315

From EBICS 2.4 on, the customer system must use the hash value of the public bank key X002 in a request.

Notes:

1. The key length is defined else where.
2. The padding is performed by the Signature class.
3. The digest is already canonized in the sign(byte[])

Specified by:

authenticate in interface EbicsUser

Parameters:

digest - the given digest

Returns:

the signature.

Throws:

GeneralSecurityException

sign

public byte[] sign(byte[] digest)
            throws GeneralSecurityException

EBICS Specification 2.4.2 - 14.1 Version A005/A006 of the electronic signature:

For the signature processes A005 an interval of 1536 bit (minimum) and 4096 bit (maximum) is defined for the key length.

The digital signature mechanisms A005 is both based on the industry standard [PKCS1] using the hash algorithm SHA-256. They are both signature mechanisms without message recovery.

A hash algorithm maps bit sequences of arbitrary length (input bit sequences) to byte sequences of a fixed length, determined by the Hash algorithm. The result of the execution of a Hash algorithm to a bit sequence is defined as hash value.

The hash algorithm SHA-256 is specified in [FIPS H2]. SHA-256 maps input bit sequences of arbitrary length to byte sequences of 32 byte length. The padding of input bit sequences to a length being a multiple of 64 byte is part of the hash algorithm. The padding even is applied if the input bit sequence already has a length that is a multiple of 64 byte.

SHA-256 processes the input bit sequences in blocks of 64 byte length. The hash value of a bit sequence x under the hash algorithm SHA-256 is referred to as follows: SHA-256(x).

The digital signature mechanism A005 is identical to EMSA-PKCS1-v1_5 using the hash algorithm SHA-256. The byte length H of the hash value is 32. According [PKCS1] (using the method EMSA-PKCS1-v1_5) the following steps shall be performed for the computation of a signature for message M with bit length m.

1. The hash value HASH(M) of the byte length H shall be computed. In the case of A005 SHA-256(M) with a length of 32 bytes.
2. The DSI for the signature algorithm shall be generated.
3. A signature shall be computed using the DSI with the standard algorithm for the signature generation described in section 14.1.3.1 of the EBICS specification (V 2.4.2).

The Signature is a digital signature scheme with appendix (SSA) combining the RSA algorithm with the EMSA-PKCS1-v1_5 encoding method.

The digest will be signed with the RSA user signature key using the Signature that will be instantiated with the SHA-256 algorithm. This signature is then put in a UserSignature XML object that will be sent to the EBICS server.

Specified by:

sign in interface EbicsUser

Parameters:

digest -

Returns:

the signature

Throws:

GeneralSecurityException

decrypt

public byte[] decrypt(byte[] encryptedData,
 byte[] transactionKey)
               throws EbicsException,
GeneralSecurityException,
IOException

EBICS IG CFONB VF 2.1.4 2012 02 24 - 2.1.3.2 Calcul de la signature:

Il convient d’utiliser PKCS1 V1.5 pour chiffrer la clé de chiffrement.

EBICS Specification 2.4.2 - 15.2 Workflows at the recipient’s end:

Decryption of the DES key

The leading 256 null bits of the EDEK are removed and the remaining 768 bits are decrypted with the recipient’s secret key of the RSA key system. PDEK is then present. The secret DES key DEK is obtained from the lowest-value 128 bits of PDEK, this is split into the individual keys DEK_left and DEK_right.

Specified by:

decrypt in interface EbicsUser

Parameters:

encryptedData - the given secret key

transactionKey - a given transaction key

Returns:

the decrypted key;

Throws:

EbicsException

GeneralSecurityException

IOException