Skip to content

Commit aa12cea

Browse files
kyonRayLucasLi1024
kyonRay
authored and
LucasLi1024
committed
add API for HSM
作者： LucasLi Date： Thu Feb 9 14:42:33 2023 +0800
1 parent a2d6b01 commit aa12cea

File tree

8 files changed

+341
-33
lines changed

8 files changed

+341
-33
lines changed

‎src/main/java/org/fisco/bcos/sdk/v3/client/ClientImpl.java‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -155,8 +155,13 @@ protected ClientImpl(String groupID, ConfigOption configOption, long nativePoint
155155

156156
// init crypto suite
157157
if (smCrypto) {
158-
this.cryptoSuite = new CryptoSuite(CryptoType.SM_TYPE, configOption);
159-
158+
// init HSM crypto suite
159+
if(configOption.getCryptoMaterialConfig() != null && configOption.getCryptoMaterialConfig().getEnableHsm()) {
160+
this.cryptoSuite = new CryptoSuite(CryptoType.HSM_TYPE, configOption);
161+
}
162+
else {
163+
this.cryptoSuite = new CryptoSuite(CryptoType.SM_TYPE, configOption);
164+
}
160165
} else {
161166
this.cryptoSuite = new CryptoSuite(CryptoType.ECDSA_TYPE, configOption);
162167
}

‎src/main/java/org/fisco/bcos/sdk/v3/config/model/CryptoMaterialConfig.java‎

Lines changed: 63 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,17 +16,21 @@
1616
package org.fisco.bcos.sdk.v3.config.model;
1717

1818
import java.util.Map;
19+
1920
import org.fisco.bcos.sdk.v3.config.exceptions.ConfigException;
2021
import org.fisco.bcos.sdk.v3.model.CryptoType;
2122
import org.slf4j.Logger;
2223
import org.slf4j.LoggerFactory;
2324

24-
/** Crypto material configuration, include certs and keys */
25+
/**
26+
* Crypto material configuration, include certs and keys
27+
*/
2528
public class CryptoMaterialConfig {
2629
private static final Logger logger = LoggerFactory.getLogger(CryptoMaterialConfig.class);
2730

2831
private Boolean useSmCrypto = false;
2932
private Boolean disableSsl = false;
33+
private Boolean enableHsm = false;
3034
private String certPath = "conf";
3135

3236
private String caCertPath;
@@ -41,23 +45,41 @@ public class CryptoMaterialConfig {
4145
private String enSdkCert;
4246
private String enSdkPrivateKey;
4347

44-
public CryptoMaterialConfig() {}
48+
private String hsmLibPath;
49+
private String hsmKeyIndex;
50+
private String hsmPassword;
51+
52+
public CryptoMaterialConfig() {
53+
}
4554

4655
public CryptoMaterialConfig(ConfigProperty configProperty) throws ConfigException {
4756

4857
Map<String, Object> cryptoMaterialProperty = configProperty.getCryptoMaterial();
4958
String useSMCrypto = (String) cryptoMaterialProperty.get("useSMCrypto");
5059
String disableSsl = (String) cryptoMaterialProperty.get("disableSsl");
60+
String enableHsm = (String) cryptoMaterialProperty.get("enableHsm");
5161

5262
this.useSmCrypto = Boolean.valueOf(useSMCrypto);
5363
this.disableSsl = Boolean.valueOf(disableSsl);
64+
this.enableHsm = Boolean.valueOf(enableHsm);
65+
66+
if (this.enableHsm) {
67+
this.hsmLibPath = (String) cryptoMaterialProperty.get("hsmLibPath");
68+
this.hsmKeyIndex = (String) cryptoMaterialProperty.get("hsmKeyIndex");
69+
this.hsmPassword = (String) cryptoMaterialProperty.get("hsmPassword");
70+
71+
if (this.hsmLibPath == null || this.hsmKeyIndex == null || this.hsmPassword == null)
72+
{
73+
throw new ConfigException("hsmLibPath hsmKeyIndex and hsmPassword, must be set in HSM model");
74+
}
75+
}
5476

5577
if (this.disableSsl) {
5678
logger.info("Load cryptoMaterial, disableSsl has been set");
5779
return;
5880
}
5981

60-
int cryptoType = this.useSmCrypto ? CryptoType.SM_TYPE : CryptoType.ECDSA_TYPE;
82+
int cryptoType = this.useSmCrypto ? (this.enableHsm ? CryptoType.HSM_TYPE : CryptoType.SM_TYPE) : CryptoType.ECDSA_TYPE;
6183
this.certPath =
6284
ConfigProperty.getConfigFilePath(
6385
ConfigProperty.getValue(cryptoMaterialProperty, "certPath", this.certPath));
@@ -117,8 +139,10 @@ public CryptoMaterialConfig(ConfigProperty configProperty) throws ConfigExceptio
117139
}
118140

119141
logger.debug(
120-
"Load cryptoMaterial, useSmCrypto: {}, caCertPath: {}, sdkCertPath: {}, sdkPrivateKeyPath:{}, enSSLCertPath: {}, enSSLPrivateKeyPath:{}",
142+
"Load cryptoMaterial, useSmCrypto: {}, useHSMCrypto: {}, cryptoType: {}, caCertPath: {}, sdkCertPath: {}, sdkPrivateKeyPath:{}, enSSLCertPath: {}, enSSLPrivateKeyPath:{}",
121143
this.useSmCrypto,
144+
this.enableHsm,
145+
cryptoType,
122146
this.getCaCertPath(),
123147
this.getSdkCertPath(),
124148
this.getSdkPrivateKeyPath(),
@@ -134,7 +158,7 @@ public CryptoMaterialConfig getDefaultCaCertPath(int cryptoType, String certPath
134158
cryptoMaterialConfig.setCaCertPath(certPath + "/" + "ca.crt");
135159
cryptoMaterialConfig.setSdkCertPath(certPath + "/" + "sdk.crt");
136160
cryptoMaterialConfig.setSdkPrivateKeyPath(certPath + "/" + "sdk.key");
137-
} else if (cryptoType == CryptoType.SM_TYPE) {
161+
} else if (cryptoType == CryptoType.SM_TYPE || cryptoType == CryptoType.HSM_TYPE) {
138162
cryptoMaterialConfig.setCaCertPath(certPath + "/" + "sm_ca.crt");
139163
cryptoMaterialConfig.setSdkCertPath(certPath + "/" + "sm_sdk.crt");
140164
cryptoMaterialConfig.setSdkPrivateKeyPath(certPath + "/" + "sm_sdk.key");
@@ -220,6 +244,38 @@ public boolean isUseSmCrypto() {
220244
return useSmCrypto;
221245
}
222246

247+
public Boolean getEnableHsm() {
248+
return enableHsm;
249+
}
250+
251+
public void setEnableHsm(Boolean enableHsm) {
252+
this.enableHsm = enableHsm;
253+
}
254+
255+
public String getHsmLibPath() {
256+
return hsmLibPath;
257+
}
258+
259+
public void setHsmLibPath(String hsmLibPath) {
260+
this.hsmLibPath = hsmLibPath;
261+
}
262+
263+
public String getHsmKeyIndex() {
264+
return hsmKeyIndex;
265+
}
266+
267+
public void setHsmKeyIndex(String hsmKeyIndex) {
268+
this.hsmKeyIndex = hsmKeyIndex;
269+
}
270+
271+
public String getHsmPassword() {
272+
return hsmPassword;
273+
}
274+
275+
public void setHsmPassword(String hsmPassword) {
276+
this.hsmPassword = hsmPassword;
277+
}
278+
223279
public String getCaCertPath() {
224280
return caCertPath;
225281
}
@@ -265,6 +321,8 @@ public String toString() {
265321
return "CryptoMaterialConfig{"
266322
+ "useSmCrypto="
267323
+ useSmCrypto
324+
+ "useHSMCrypto="
325+
+ enableHsm
268326
+ ", certPath='"
269327
+ certPath
270328
+ '\''

‎src/main/java/org/fisco/bcos/sdk/v3/crypto/CryptoSuite.java‎

Lines changed: 61 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,13 @@
2323
import org.fisco.bcos.sdk.v3.crypto.hash.SM3Hash;
2424
import org.fisco.bcos.sdk.v3.crypto.keypair.CryptoKeyPair;
2525
import org.fisco.bcos.sdk.v3.crypto.keypair.ECDSAKeyPair;
26+
import org.fisco.bcos.sdk.v3.crypto.keypair.HsmSM2KeyPair;
2627
import org.fisco.bcos.sdk.v3.crypto.keypair.SM2KeyPair;
2728
import org.fisco.bcos.sdk.v3.crypto.keystore.KeyTool;
2829
import org.fisco.bcos.sdk.v3.crypto.keystore.P12KeyStore;
2930
import org.fisco.bcos.sdk.v3.crypto.keystore.PEMKeyStore;
3031
import org.fisco.bcos.sdk.v3.crypto.signature.ECDSASignature;
32+
import org.fisco.bcos.sdk.v3.crypto.signature.HsmSM2Signature;
3133
import org.fisco.bcos.sdk.v3.crypto.signature.SM2Signature;
3234
import org.fisco.bcos.sdk.v3.crypto.signature.Signature;
3335
import org.fisco.bcos.sdk.v3.crypto.signature.SignatureResult;
@@ -39,11 +41,10 @@ public class CryptoSuite {
3941

4042
private static final Logger logger = LoggerFactory.getLogger(CryptoSuite.class);
4143

42-
public final int cryptoTypeConfig;
43-
44-
public final Signature signatureImpl;
45-
public final Hash hashImpl;
46-
private final CryptoKeyPair keyPairFactory;
44+
public int cryptoTypeConfig;
45+
public Signature signatureImpl;
46+
public Hash hashImpl;
47+
private CryptoKeyPair keyPair;
4748
private CryptoKeyPair cryptoKeyPair;
4849
private ConfigOption config;
4950

@@ -54,7 +55,7 @@ public CryptoSuite(int cryptoTypeConfig, CryptoKeyPair cryptoKeyPair) {
5455

5556
public CryptoSuite(int cryptoTypeConfig, String hexedPrivateKey) {
5657
this(cryptoTypeConfig);
57-
this.cryptoKeyPair = this.keyPairFactory.createKeyPair(hexedPrivateKey);
58+
this.cryptoKeyPair = this.keyPair.createKeyPair(hexedPrivateKey);
5859
}
5960

6061
/**
@@ -64,12 +65,17 @@ public CryptoSuite(int cryptoTypeConfig, String hexedPrivateKey) {
6465
* @param configOption the configuration of account.
6566
*/
6667
public CryptoSuite(int cryptoTypeConfig, ConfigOption configOption) {
67-
this(cryptoTypeConfig);
6868
logger.info("init CryptoSuite, cryptoType: {}", cryptoTypeConfig);
6969
this.setConfig(configOption);
70+
this.initCryptoSuite(cryptoTypeConfig);
7071
// doesn't set the account name, generate the keyPair randomly
7172
if (!configOption.getAccountConfig().isAccountConfigured()) {
72-
this.generateRandomKeyPair();
73+
if (configOption.getCryptoMaterialConfig().getEnableHsm()) {
74+
HsmSM2KeyPair hsmKeyPair = (HsmSM2KeyPair)this.keyPair;
75+
this.cryptoKeyPair = hsmKeyPair.useKeyPair();
76+
} else {
77+
this.generateRandomKeyPair();
78+
}
7379
return;
7480
}
7581
this.loadAccount(configOption);
@@ -81,27 +87,43 @@ public CryptoSuite(int cryptoTypeConfig, ConfigOption configOption) {
8187
* @param cryptoTypeConfig the crypto type config number
8288
*/
8389
public CryptoSuite(int cryptoTypeConfig) {
90+
initCryptoSuite(cryptoTypeConfig);
91+
}
92+
93+
public void initCryptoSuite(int cryptoTypeConfig) {
8494
this.cryptoTypeConfig = cryptoTypeConfig;
8595
if (this.cryptoTypeConfig == CryptoType.ECDSA_TYPE) {
8696
this.signatureImpl = new ECDSASignature();
8797
this.hashImpl = new Keccak256();
88-
this.keyPairFactory = new ECDSAKeyPair();
89-
98+
this.keyPair = new ECDSAKeyPair();
99+
this.generateRandomKeyPair();
90100
} else if (this.cryptoTypeConfig == CryptoType.SM_TYPE) {
91101
this.signatureImpl = new SM2Signature();
92102
this.hashImpl = new SM3Hash();
93-
this.keyPairFactory = new SM2KeyPair();
94-
103+
this.keyPair = new SM2KeyPair();
104+
this.generateRandomKeyPair();
105+
} else if(this.cryptoTypeConfig == CryptoType.HSM_TYPE) {
106+
String hsmLibPath = this.config.getCryptoMaterialConfig().getHsmLibPath();
107+
int hsmKeyIndex = Integer.parseInt(this.config.getCryptoMaterialConfig().getHsmKeyIndex());
108+
String hsmPassword = this.config.getCryptoMaterialConfig().getHsmPassword();
109+
110+
HsmSM2Signature hsmSM2Signature = new HsmSM2Signature();
111+
hsmSM2Signature.setHsmLibPath(hsmLibPath);
112+
this.signatureImpl = hsmSM2Signature;
113+
this.hashImpl = new SM3Hash();
114+
this.keyPair = new HsmSM2KeyPair(hsmLibPath, hsmKeyIndex, hsmPassword);
115+
HsmSM2KeyPair hsmKeyPair = (HsmSM2KeyPair)this.keyPair;
116+
this.cryptoKeyPair = hsmKeyPair.useKeyPair();
95117
} else {
96118
throw new UnsupportedCryptoTypeException(
97119
"only support "
98120
+ CryptoType.ECDSA_TYPE
99121
+ "/"
100122
+ CryptoType.SM_TYPE
123+
+ "/"
124+
+ CryptoType.HSM_TYPE
101125
+ " crypto type");
102126
}
103-
// create keyPair randomly
104-
this.generateRandomKeyPair();
105127
}
106128

107129
/**
@@ -115,16 +137,20 @@ public void loadAccount(String accountFileFormat, String accountFilePath, String
115137
KeyTool keyTool = null;
116138
if (accountFileFormat.compareToIgnoreCase("p12") == 0) {
117139
keyTool = new P12KeyStore(accountFilePath, password);
140+
this.loadKeyPair(keyTool.getKeyPair());
118141
} else if (accountFileFormat.compareToIgnoreCase("pem") == 0) {
119142
keyTool = new PEMKeyStore(accountFilePath);
120-
} else {
143+
this.loadKeyPair(keyTool.getKeyPair());
144+
} else if (accountFileFormat.compareToIgnoreCase("HSM") == 0) {
145+
this.loadHsmKeyPair();
146+
}
147+
else {
121148
throw new LoadKeyStoreException(
122149
"unsupported account file format : "
123150
+ accountFileFormat
124151
+ ", current supported are p12 and pem");
125152
}
126153
logger.debug("Load account from {}", accountFilePath);
127-
this.loadKeyPair(keyTool.getKeyPair());
128154
}
129155

130156
/**
@@ -138,11 +164,11 @@ private void loadAccount(ConfigOption configOption) {
138164
if (accountFilePath == null || accountFilePath.equals("")) {
139165
if (accountConfig.getAccountFileFormat().compareToIgnoreCase("p12") == 0) {
140166
accountFilePath =
141-
this.keyPairFactory.getP12KeyStoreFilePath(
167+
this.keyPair.getP12KeyStoreFilePath(
142168
accountConfig.getAccountAddress());
143169
} else if (accountConfig.getAccountFileFormat().compareToIgnoreCase("pem") == 0) {
144170
accountFilePath =
145-
this.keyPairFactory.getPemKeyStoreFilePath(
171+
this.keyPair.getPemKeyStoreFilePath(
146172
accountConfig.getAccountAddress());
147173
}
148174
}
@@ -159,7 +185,6 @@ private void loadAccount(ConfigOption configOption) {
159185
*/
160186
public void setConfig(ConfigOption config) {
161187
this.config = config;
162-
this.keyPairFactory.setConfig(config);
163188
}
164189

165190
public int getCryptoTypeConfig() {
@@ -231,7 +256,7 @@ public SignatureResult sign(final String message, final CryptoKeyPair keyPair) {
231256
* @return the string type signature
232257
*/
233258
public String sign(KeyTool keyTool, String message) {
234-
CryptoKeyPair cryptoKeyPair = this.keyPairFactory.createKeyPair(keyTool.getKeyPair());
259+
CryptoKeyPair cryptoKeyPair = this.keyPair.createKeyPair(keyTool.getKeyPair());
235260
return this.signatureImpl.signWithStringSignature(message, cryptoKeyPair);
236261
}
237262

@@ -289,7 +314,7 @@ public boolean verify(final String publicKey, final byte[] message, final byte[]
289314
* @return a generated key pair
290315
*/
291316
public CryptoKeyPair generateRandomKeyPair() {
292-
this.cryptoKeyPair = this.keyPairFactory.generateKeyPair();
317+
this.cryptoKeyPair = this.keyPair.generateKeyPair();
293318
this.cryptoKeyPair.setConfig(this.config);
294319
return this.cryptoKeyPair;
295320
}
@@ -301,7 +326,7 @@ public CryptoKeyPair generateRandomKeyPair() {
301326
* @return CryptoKeyPair type key pair
302327
*/
303328
public CryptoKeyPair loadKeyPair(KeyPair keyPair) {
304-
this.cryptoKeyPair = this.keyPairFactory.createKeyPair(keyPair);
329+
this.cryptoKeyPair = this.keyPair.createKeyPair(keyPair);
305330
this.cryptoKeyPair.setConfig(this.config);
306331
return this.cryptoKeyPair;
307332
}
@@ -313,11 +338,23 @@ public CryptoKeyPair loadKeyPair(KeyPair keyPair) {
313338
* @return CryptoKeyPair type key pair
314339
*/
315340
public CryptoKeyPair loadKeyPair(String hexedPrivateKey) {
316-
this.cryptoKeyPair = this.keyPairFactory.createKeyPair(hexedPrivateKey);
341+
this.cryptoKeyPair = this.keyPair.createKeyPair(hexedPrivateKey);
317342
this.cryptoKeyPair.setConfig(this.config);
318343
return this.cryptoKeyPair;
319344
}
320345

346+
/**
347+
* Create key pair from a private key string
348+
*
349+
* @param hexedPrivateKey a hex string of private key
350+
* @return CryptoKeyPair type key pair
351+
*/
352+
public CryptoKeyPair loadHsmKeyPair() {
353+
HsmSM2KeyPair hsmSM2KeyPair = (HsmSM2KeyPair)this.keyPair;
354+
this.cryptoKeyPair = hsmSM2KeyPair.useKeyPair();
355+
return this.cryptoKeyPair;
356+
}
357+
321358
/**
322359
* Set the key pair in CryptoSuite
323360
*
@@ -352,7 +389,7 @@ public ConfigOption getConfig() {
352389
* @return CryptoKeyPair
353390
*/
354391
public CryptoKeyPair getKeyPairFactory() {
355-
return this.keyPairFactory;
392+
return this.keyPair;
356393
}
357394

358395
public void destroy() {

0 commit comments

Comments
 (0)