Skip to content

Commit 38a9ec0

Browse files
kyonRayLucasLi1024
kyonRay
authored and
LucasLi1024
committed
add API for HSM
作者： LucasLi Date： Thu Feb 16 20:00:33 2023 +0800
1 parent a2d6b01 commit 38a9ec0

File tree

9 files changed

+342
-33
lines changed

9 files changed

+342
-33
lines changed

‎build.gradle‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ ext {
2525
junitVersion = '4.13.2'
2626
commonsCollections4Version = "4.4"
2727
guavaVersion = '30.1.1-jre'
28-
bcosSdkJniVersion = "3.2.0"
28+
bcosSdkJniVersion = "3.3.0-SNAPSHOT"
2929
slf4jApiVerison = '1.7.36'
3030
mockitoVersion = '4.8.0'
3131
gsonVersion = '2.10'
@@ -135,6 +135,7 @@ dependencies {
135135
exclude group : "org.slf4j"
136136
exclude group : "com.fasterxml.jackson.core"
137137
}
138+
138139
api("org.bouncycastle:bcprov-jdk15on:${bcprovJDK15onVersion}")
139140
api("com.google.code.gson:gson:${gsonVersion}")
140141
api("org.apache.commons:commons-lang3:${commonsLang3Version}")

‎src/main/java/org/fisco/bcos/sdk/v3/client/ClientImpl.java‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -155,8 +155,13 @@ protected ClientImpl(String groupID, ConfigOption configOption, long nativePoint
155155

156156
// init crypto suite
157157
if (smCrypto) {
158-
this.cryptoSuite = new CryptoSuite(CryptoType.SM_TYPE, configOption);
159-
158+
// init HSM crypto suite
159+
if (configOption.getCryptoMaterialConfig() != null
160+
&& configOption.getCryptoMaterialConfig().getEnableHsm()) {
161+
this.cryptoSuite = new CryptoSuite(CryptoType.HSM_TYPE, configOption);
162+
} else {
163+
this.cryptoSuite = new CryptoSuite(CryptoType.SM_TYPE, configOption);
164+
}
160165
} else {
161166
this.cryptoSuite = new CryptoSuite(CryptoType.ECDSA_TYPE, configOption);
162167
}

‎src/main/java/org/fisco/bcos/sdk/v3/config/model/CryptoMaterialConfig.java‎

Lines changed: 60 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ public class CryptoMaterialConfig {
2727

2828
private Boolean useSmCrypto = false;
2929
private Boolean disableSsl = false;
30+
private Boolean enableHsm = false;
3031
private String certPath = "conf";
3132

3233
private String caCertPath;
@@ -41,23 +42,43 @@ public class CryptoMaterialConfig {
4142
private String enSdkCert;
4243
private String enSdkPrivateKey;
4344

45+
private String hsmLibPath;
46+
private String hsmKeyIndex;
47+
private String hsmPassword;
48+
4449
public CryptoMaterialConfig() {}
4550

4651
public CryptoMaterialConfig(ConfigProperty configProperty) throws ConfigException {
4752

4853
Map<String, Object> cryptoMaterialProperty = configProperty.getCryptoMaterial();
4954
String useSMCrypto = (String) cryptoMaterialProperty.get("useSMCrypto");
5055
String disableSsl = (String) cryptoMaterialProperty.get("disableSsl");
56+
String enableHsm = (String) cryptoMaterialProperty.get("enableHsm");
5157

5258
this.useSmCrypto = Boolean.valueOf(useSMCrypto);
5359
this.disableSsl = Boolean.valueOf(disableSsl);
60+
this.enableHsm = Boolean.valueOf(enableHsm);
61+
62+
if (this.enableHsm) {
63+
this.hsmLibPath = (String) cryptoMaterialProperty.get("hsmLibPath");
64+
this.hsmKeyIndex = (String) cryptoMaterialProperty.get("hsmKeyIndex");
65+
this.hsmPassword = (String) cryptoMaterialProperty.get("hsmPassword");
66+
67+
if (this.hsmLibPath == null || this.hsmKeyIndex == null || this.hsmPassword == null) {
68+
throw new ConfigException(
69+
"hsmLibPath hsmKeyIndex and hsmPassword, must be set in HSM model");
70+
}
71+
}
5472

5573
if (this.disableSsl) {
5674
logger.info("Load cryptoMaterial, disableSsl has been set");
5775
return;
5876
}
5977

60-
int cryptoType = this.useSmCrypto ? CryptoType.SM_TYPE : CryptoType.ECDSA_TYPE;
78+
int cryptoType =
79+
this.useSmCrypto
80+
? (this.enableHsm ? CryptoType.HSM_TYPE : CryptoType.SM_TYPE)
81+
: CryptoType.ECDSA_TYPE;
6182
this.certPath =
6283
ConfigProperty.getConfigFilePath(
6384
ConfigProperty.getValue(cryptoMaterialProperty, "certPath", this.certPath));
@@ -117,8 +138,10 @@ public CryptoMaterialConfig(ConfigProperty configProperty) throws ConfigExceptio
117138
}
118139

119140
logger.debug(
120-
"Load cryptoMaterial, useSmCrypto: {}, caCertPath: {}, sdkCertPath: {}, sdkPrivateKeyPath:{}, enSSLCertPath: {}, enSSLPrivateKeyPath:{}",
141+
"Load cryptoMaterial, useSmCrypto: {}, useHSMCrypto: {}, cryptoType: {}, caCertPath: {}, sdkCertPath: {}, sdkPrivateKeyPath:{}, enSSLCertPath: {}, enSSLPrivateKeyPath:{}",
121142
this.useSmCrypto,
143+
this.enableHsm,
144+
cryptoType,
122145
this.getCaCertPath(),
123146
this.getSdkCertPath(),
124147
this.getSdkPrivateKeyPath(),
@@ -134,7 +157,7 @@ public CryptoMaterialConfig getDefaultCaCertPath(int cryptoType, String certPath
134157
cryptoMaterialConfig.setCaCertPath(certPath + "/" + "ca.crt");
135158
cryptoMaterialConfig.setSdkCertPath(certPath + "/" + "sdk.crt");
136159
cryptoMaterialConfig.setSdkPrivateKeyPath(certPath + "/" + "sdk.key");
137-
} else if (cryptoType == CryptoType.SM_TYPE) {
160+
} else if (cryptoType == CryptoType.SM_TYPE || cryptoType == CryptoType.HSM_TYPE) {
138161
cryptoMaterialConfig.setCaCertPath(certPath + "/" + "sm_ca.crt");
139162
cryptoMaterialConfig.setSdkCertPath(certPath + "/" + "sm_sdk.crt");
140163
cryptoMaterialConfig.setSdkPrivateKeyPath(certPath + "/" + "sm_sdk.key");
@@ -220,6 +243,38 @@ public boolean isUseSmCrypto() {
220243
return useSmCrypto;
221244
}
222245

246+
public Boolean getEnableHsm() {
247+
return enableHsm;
248+
}
249+
250+
public void setEnableHsm(Boolean enableHsm) {
251+
this.enableHsm = enableHsm;
252+
}
253+
254+
public String getHsmLibPath() {
255+
return hsmLibPath;
256+
}
257+
258+
public void setHsmLibPath(String hsmLibPath) {
259+
this.hsmLibPath = hsmLibPath;
260+
}
261+
262+
public String getHsmKeyIndex() {
263+
return hsmKeyIndex;
264+
}
265+
266+
public void setHsmKeyIndex(String hsmKeyIndex) {
267+
this.hsmKeyIndex = hsmKeyIndex;
268+
}
269+
270+
public String getHsmPassword() {
271+
return hsmPassword;
272+
}
273+
274+
public void setHsmPassword(String hsmPassword) {
275+
this.hsmPassword = hsmPassword;
276+
}
277+
223278
public String getCaCertPath() {
224279
return caCertPath;
225280
}
@@ -265,6 +320,8 @@ public String toString() {
265320
return "CryptoMaterialConfig{"
266321
+ "useSmCrypto="
267322
+ useSmCrypto
323+
+ "useHSMCrypto="
324+
+ enableHsm
268325
+ ", certPath='"
269326
+ certPath
270327
+ '\''

‎src/main/java/org/fisco/bcos/sdk/v3/crypto/CryptoSuite.java‎

Lines changed: 60 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,13 @@
2323
import org.fisco.bcos.sdk.v3.crypto.hash.SM3Hash;
2424
import org.fisco.bcos.sdk.v3.crypto.keypair.CryptoKeyPair;
2525
import org.fisco.bcos.sdk.v3.crypto.keypair.ECDSAKeyPair;
26+
import org.fisco.bcos.sdk.v3.crypto.keypair.HsmSM2KeyPair;
2627
import org.fisco.bcos.sdk.v3.crypto.keypair.SM2KeyPair;
2728
import org.fisco.bcos.sdk.v3.crypto.keystore.KeyTool;
2829
import org.fisco.bcos.sdk.v3.crypto.keystore.P12KeyStore;
2930
import org.fisco.bcos.sdk.v3.crypto.keystore.PEMKeyStore;
3031
import org.fisco.bcos.sdk.v3.crypto.signature.ECDSASignature;
32+
import org.fisco.bcos.sdk.v3.crypto.signature.HsmSM2Signature;
3133
import org.fisco.bcos.sdk.v3.crypto.signature.SM2Signature;
3234
import org.fisco.bcos.sdk.v3.crypto.signature.Signature;
3335
import org.fisco.bcos.sdk.v3.crypto.signature.SignatureResult;
@@ -39,11 +41,10 @@ public class CryptoSuite {
3941

4042
private static final Logger logger = LoggerFactory.getLogger(CryptoSuite.class);
4143

42-
public final int cryptoTypeConfig;
43-
44-
public final Signature signatureImpl;
45-
public final Hash hashImpl;
46-
private final CryptoKeyPair keyPairFactory;
44+
public int cryptoTypeConfig;
45+
public Signature signatureImpl;
46+
public Hash hashImpl;
47+
private CryptoKeyPair keyPair;
4748
private CryptoKeyPair cryptoKeyPair;
4849
private ConfigOption config;
4950

@@ -54,7 +55,7 @@ public CryptoSuite(int cryptoTypeConfig, CryptoKeyPair cryptoKeyPair) {
5455

5556
public CryptoSuite(int cryptoTypeConfig, String hexedPrivateKey) {
5657
this(cryptoTypeConfig);
57-
this.cryptoKeyPair = this.keyPairFactory.createKeyPair(hexedPrivateKey);
58+
this.cryptoKeyPair = this.keyPair.createKeyPair(hexedPrivateKey);
5859
}
5960

6061
/**
@@ -64,12 +65,17 @@ public CryptoSuite(int cryptoTypeConfig, String hexedPrivateKey) {
6465
* @param configOption the configuration of account.
6566
*/
6667
public CryptoSuite(int cryptoTypeConfig, ConfigOption configOption) {
67-
this(cryptoTypeConfig);
6868
logger.info("init CryptoSuite, cryptoType: {}", cryptoTypeConfig);
6969
this.setConfig(configOption);
70+
this.initCryptoSuite(cryptoTypeConfig);
7071
// doesn't set the account name, generate the keyPair randomly
7172
if (!configOption.getAccountConfig().isAccountConfigured()) {
72-
this.generateRandomKeyPair();
73+
if (configOption.getCryptoMaterialConfig().getEnableHsm()) {
74+
HsmSM2KeyPair hsmKeyPair = (HsmSM2KeyPair) this.keyPair;
75+
this.cryptoKeyPair = hsmKeyPair.useKeyPair();
76+
} else {
77+
this.generateRandomKeyPair();
78+
}
7379
return;
7480
}
7581
this.loadAccount(configOption);
@@ -81,27 +87,44 @@ public CryptoSuite(int cryptoTypeConfig, ConfigOption configOption) {
8187
* @param cryptoTypeConfig the crypto type config number
8288
*/
8389
public CryptoSuite(int cryptoTypeConfig) {
90+
initCryptoSuite(cryptoTypeConfig);
91+
}
92+
93+
public void initCryptoSuite(int cryptoTypeConfig) {
8494
this.cryptoTypeConfig = cryptoTypeConfig;
8595
if (this.cryptoTypeConfig == CryptoType.ECDSA_TYPE) {
8696
this.signatureImpl = new ECDSASignature();
8797
this.hashImpl = new Keccak256();
88-
this.keyPairFactory = new ECDSAKeyPair();
89-
98+
this.keyPair = new ECDSAKeyPair();
99+
this.generateRandomKeyPair();
90100
} else if (this.cryptoTypeConfig == CryptoType.SM_TYPE) {
91101
this.signatureImpl = new SM2Signature();
92102
this.hashImpl = new SM3Hash();
93-
this.keyPairFactory = new SM2KeyPair();
94-
103+
this.keyPair = new SM2KeyPair();
104+
this.generateRandomKeyPair();
105+
} else if (this.cryptoTypeConfig == CryptoType.HSM_TYPE) {
106+
String hsmLibPath = this.config.getCryptoMaterialConfig().getHsmLibPath();
107+
int hsmKeyIndex =
108+
Integer.parseInt(this.config.getCryptoMaterialConfig().getHsmKeyIndex());
109+
String hsmPassword = this.config.getCryptoMaterialConfig().getHsmPassword();
110+
111+
HsmSM2Signature hsmSM2Signature = new HsmSM2Signature();
112+
hsmSM2Signature.setHsmLibPath(hsmLibPath);
113+
this.signatureImpl = hsmSM2Signature;
114+
this.hashImpl = new SM3Hash();
115+
this.keyPair = new HsmSM2KeyPair(hsmLibPath, hsmKeyIndex, hsmPassword);
116+
HsmSM2KeyPair hsmKeyPair = (HsmSM2KeyPair) this.keyPair;
117+
this.cryptoKeyPair = hsmKeyPair.useKeyPair();
95118
} else {
96119
throw new UnsupportedCryptoTypeException(
97120
"only support "
98121
+ CryptoType.ECDSA_TYPE
99122
+ "/"
100123
+ CryptoType.SM_TYPE
124+
+ "/"
125+
+ CryptoType.HSM_TYPE
101126
+ " crypto type");
102127
}
103-
// create keyPair randomly
104-
this.generateRandomKeyPair();
105128
}
106129

107130
/**
@@ -115,16 +138,19 @@ public void loadAccount(String accountFileFormat, String accountFilePath, String
115138
KeyTool keyTool = null;
116139
if (accountFileFormat.compareToIgnoreCase("p12") == 0) {
117140
keyTool = new P12KeyStore(accountFilePath, password);
141+
this.loadKeyPair(keyTool.getKeyPair());
118142
} else if (accountFileFormat.compareToIgnoreCase("pem") == 0) {
119143
keyTool = new PEMKeyStore(accountFilePath);
144+
this.loadKeyPair(keyTool.getKeyPair());
145+
} else if (accountFileFormat.compareToIgnoreCase("HSM") == 0) {
146+
this.loadHsmKeyPair();
120147
} else {
121148
throw new LoadKeyStoreException(
122149
"unsupported account file format : "
123150
+ accountFileFormat
124151
+ ", current supported are p12 and pem");
125152
}
126153
logger.debug("Load account from {}", accountFilePath);
127-
this.loadKeyPair(keyTool.getKeyPair());
128154
}
129155

130156
/**
@@ -138,12 +164,10 @@ private void loadAccount(ConfigOption configOption) {
138164
if (accountFilePath == null || accountFilePath.equals("")) {
139165
if (accountConfig.getAccountFileFormat().compareToIgnoreCase("p12") == 0) {
140166
accountFilePath =
141-
this.keyPairFactory.getP12KeyStoreFilePath(
142-
accountConfig.getAccountAddress());
167+
this.keyPair.getP12KeyStoreFilePath(accountConfig.getAccountAddress());
143168
} else if (accountConfig.getAccountFileFormat().compareToIgnoreCase("pem") == 0) {
144169
accountFilePath =
145-
this.keyPairFactory.getPemKeyStoreFilePath(
146-
accountConfig.getAccountAddress());
170+
this.keyPair.getPemKeyStoreFilePath(accountConfig.getAccountAddress());
147171
}
148172
}
149173
this.loadAccount(
@@ -159,7 +183,6 @@ private void loadAccount(ConfigOption configOption) {
159183
*/
160184
public void setConfig(ConfigOption config) {
161185
this.config = config;
162-
this.keyPairFactory.setConfig(config);
163186
}
164187

165188
public int getCryptoTypeConfig() {
@@ -231,7 +254,7 @@ public SignatureResult sign(final String message, final CryptoKeyPair keyPair) {
231254
* @return the string type signature
232255
*/
233256
public String sign(KeyTool keyTool, String message) {
234-
CryptoKeyPair cryptoKeyPair = this.keyPairFactory.createKeyPair(keyTool.getKeyPair());
257+
CryptoKeyPair cryptoKeyPair = this.keyPair.createKeyPair(keyTool.getKeyPair());
235258
return this.signatureImpl.signWithStringSignature(message, cryptoKeyPair);
236259
}
237260

@@ -289,7 +312,7 @@ public boolean verify(final String publicKey, final byte[] message, final byte[]
289312
* @return a generated key pair
290313
*/
291314
public CryptoKeyPair generateRandomKeyPair() {
292-
this.cryptoKeyPair = this.keyPairFactory.generateKeyPair();
315+
this.cryptoKeyPair = this.keyPair.generateKeyPair();
293316
this.cryptoKeyPair.setConfig(this.config);
294317
return this.cryptoKeyPair;
295318
}
@@ -301,7 +324,7 @@ public CryptoKeyPair generateRandomKeyPair() {
301324
* @return CryptoKeyPair type key pair
302325
*/
303326
public CryptoKeyPair loadKeyPair(KeyPair keyPair) {
304-
this.cryptoKeyPair = this.keyPairFactory.createKeyPair(keyPair);
327+
this.cryptoKeyPair = this.keyPair.createKeyPair(keyPair);
305328
this.cryptoKeyPair.setConfig(this.config);
306329
return this.cryptoKeyPair;
307330
}
@@ -313,11 +336,23 @@ public CryptoKeyPair loadKeyPair(KeyPair keyPair) {
313336
* @return CryptoKeyPair type key pair
314337
*/
315338
public CryptoKeyPair loadKeyPair(String hexedPrivateKey) {
316-
this.cryptoKeyPair = this.keyPairFactory.createKeyPair(hexedPrivateKey);
339+
this.cryptoKeyPair = this.keyPair.createKeyPair(hexedPrivateKey);
317340
this.cryptoKeyPair.setConfig(this.config);
318341
return this.cryptoKeyPair;
319342
}
320343

344+
/**
345+
* Create key pair from a private key string
346+
*
347+
* @param hexedPrivateKey a hex string of private key
348+
* @return CryptoKeyPair type key pair
349+
*/
350+
public CryptoKeyPair loadHsmKeyPair() {
351+
HsmSM2KeyPair hsmSM2KeyPair = (HsmSM2KeyPair) this.keyPair;
352+
this.cryptoKeyPair = hsmSM2KeyPair.useKeyPair();
353+
return this.cryptoKeyPair;
354+
}
355+
321356
/**
322357
* Set the key pair in CryptoSuite
323358
*
@@ -352,7 +387,7 @@ public ConfigOption getConfig() {
352387
* @return CryptoKeyPair
353388
*/
354389
public CryptoKeyPair getKeyPairFactory() {
355-
return this.keyPairFactory;
390+
return this.keyPair;
356391
}
357392

358393
public void destroy() {

0 commit comments

Comments
 (0)