From: Andreas Beeker Date: Tue, 1 Nov 2016 01:30:48 +0000 (+0000) Subject: Bug 60320 - issue opening password protected xlsx X-Git-Tag: REL_3_16_BETA1~31 X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=ff6f6bb7c4745add4983629598891d0f68afa3f6;p=poi.git Bug 60320 - issue opening password protected xlsx git-svn-id: https://svn.apache.org/repos/asf/poi/trunk@1767399 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/src/integrationtest/org/apache/poi/TestAllFiles.java b/src/integrationtest/org/apache/poi/TestAllFiles.java index e0e2c0bde2..dcce6269f1 100644 --- a/src/integrationtest/org/apache/poi/TestAllFiles.java +++ b/src/integrationtest/org/apache/poi/TestAllFiles.java @@ -210,6 +210,7 @@ public class TestAllFiles { //EXPECTED_FAILURES.add("poifs/extenxls_pwd123.xlsx"); //EXPECTED_FAILURES.add("poifs/protected_agile.docx"); EXPECTED_FAILURES.add("spreadsheet/58616.xlsx"); + EXPECTED_FAILURES.add("poifs/60320-protected.xlsx"); // TODO: fails XMLExportTest, is this ok? EXPECTED_FAILURES.add("spreadsheet/CustomXMLMapping-singleattributenamespace.xlsx"); diff --git a/src/java/org/apache/poi/poifs/crypt/EncryptionHeader.java b/src/java/org/apache/poi/poifs/crypt/EncryptionHeader.java index c52e87c62b..f13c116e0b 100644 --- a/src/java/org/apache/poi/poifs/crypt/EncryptionHeader.java +++ b/src/java/org/apache/poi/poifs/crypt/EncryptionHeader.java @@ -16,6 +16,9 @@ ==================================================================== */ package org.apache.poi.poifs.crypt; +import org.apache.poi.EncryptedDocumentException; +import org.apache.poi.util.Removal; + /** * Reads and processes OOXML Encryption Headers * The constants are largely based on ZIP constants. @@ -82,8 +85,19 @@ public abstract class EncryptionHeader implements Cloneable { protected void setCipherAlgorithm(CipherAlgorithm cipherAlgorithm) { this.cipherAlgorithm = cipherAlgorithm; + if (cipherAlgorithm.allowedKeySize.length == 1) { + setKeySize(cipherAlgorithm.defaultKeySize); + } + } + + public HashAlgorithm getHashAlgorithm() { + return hashAlgorithm; } + /** + * @deprecated POI 3.16 beta 1. use {@link #getHashAlgorithm()} + */ + @Removal(version="3.18") public HashAlgorithm getHashAlgorithmEx() { return hashAlgorithm; } @@ -96,8 +110,21 @@ public abstract class EncryptionHeader implements Cloneable { return keyBits; } + /** + * Sets the keySize (in bits). Before calling this method, make sure + * to set the cipherAlgorithm, as the amount of keyBits gets validated against + * the list of allowed keyBits of the corresponding cipherAlgorithm + * + * @param keyBits + */ protected void setKeySize(int keyBits) { this.keyBits = keyBits; + for (int allowedBits : getCipherAlgorithm().allowedKeySize) { + if (allowedBits == keyBits) { + return; + } + } + throw new EncryptedDocumentException("KeySize "+keyBits+" not allowed for cipher "+getCipherAlgorithm()); } public int getBlockSize() { diff --git a/src/java/org/apache/poi/poifs/crypt/EncryptionVerifier.java b/src/java/org/apache/poi/poifs/crypt/EncryptionVerifier.java index 6e8059261a..df216c0714 100644 --- a/src/java/org/apache/poi/poifs/crypt/EncryptionVerifier.java +++ b/src/java/org/apache/poi/poifs/crypt/EncryptionVerifier.java @@ -16,6 +16,8 @@ ==================================================================== */ package org.apache.poi.poifs.crypt; +import org.apache.poi.util.Removal; + /** * Used when checking if a key is valid for a document */ @@ -48,10 +50,17 @@ public abstract class EncryptionVerifier implements Cloneable { return spinCount; } + /** + * @deprecated POI 3.16 beta 1. use {@link #getChainingMode()} + */ + @Removal(version="3.18") public int getCipherMode() { return chainingMode.ecmaId; } + /** + * @deprecated POI 3.16 beta 1. use {@link #getCipherAlgorithm()} + */ public int getAlgorithm() { return cipherAlgorithm.ecmaId; } diff --git a/src/java/org/apache/poi/poifs/crypt/standard/StandardEncryptionHeader.java b/src/java/org/apache/poi/poifs/crypt/standard/StandardEncryptionHeader.java index 30f35581f7..a04f74d400 100644 --- a/src/java/org/apache/poi/poifs/crypt/standard/StandardEncryptionHeader.java +++ b/src/java/org/apache/poi/poifs/crypt/standard/StandardEncryptionHeader.java @@ -108,7 +108,7 @@ public class StandardEncryptionHeader extends EncryptionHeader implements Encryp bos.writeInt(getFlags()); bos.writeInt(0); // size extra bos.writeInt(getCipherAlgorithm().ecmaId); - bos.writeInt(getHashAlgorithmEx().ecmaId); + bos.writeInt(getHashAlgorithm().ecmaId); bos.writeInt(getKeySize()); bos.writeInt(getCipherProvider().ecmaId); bos.writeInt(0); // reserved1 diff --git a/src/java/org/apache/poi/poifs/crypt/standard/StandardEncryptionVerifier.java b/src/java/org/apache/poi/poifs/crypt/standard/StandardEncryptionVerifier.java index f00efecfb6..4fd284a86c 100644 --- a/src/java/org/apache/poi/poifs/crypt/standard/StandardEncryptionVerifier.java +++ b/src/java/org/apache/poi/poifs/crypt/standard/StandardEncryptionVerifier.java @@ -56,7 +56,7 @@ public class StandardEncryptionVerifier extends EncryptionVerifier implements En setCipherAlgorithm(header.getCipherAlgorithm()); setChainingMode(header.getChainingMode()); setEncryptedKey(null); - setHashAlgorithm(header.getHashAlgorithmEx()); + setHashAlgorithm(header.getHashAlgorithm()); } protected StandardEncryptionVerifier(CipherAlgorithm cipherAlgorithm, HashAlgorithm hashAlgorithm, int keyBits, int blockSize, ChainingMode chainingMode) { diff --git a/src/ooxml/java/org/apache/poi/poifs/crypt/agile/AgileDecryptor.java b/src/ooxml/java/org/apache/poi/poifs/crypt/agile/AgileDecryptor.java index 480137ef8a..ffe0cdf3f7 100644 --- a/src/ooxml/java/org/apache/poi/poifs/crypt/agile/AgileDecryptor.java +++ b/src/ooxml/java/org/apache/poi/poifs/crypt/agile/AgileDecryptor.java @@ -40,13 +40,13 @@ import javax.crypto.spec.RC2ParameterSpec; import javax.crypto.spec.SecretKeySpec; import org.apache.poi.EncryptedDocumentException; +import org.apache.poi.poifs.crypt.ChainingMode; import org.apache.poi.poifs.crypt.ChunkedCipherInputStream; import org.apache.poi.poifs.crypt.CipherAlgorithm; import org.apache.poi.poifs.crypt.CryptoFunctions; import org.apache.poi.poifs.crypt.Decryptor; import org.apache.poi.poifs.crypt.EncryptionHeader; import org.apache.poi.poifs.crypt.EncryptionInfo; -import org.apache.poi.poifs.crypt.EncryptionVerifier; import org.apache.poi.poifs.crypt.HashAlgorithm; import org.apache.poi.poifs.crypt.agile.AgileEncryptionVerifier.AgileCertificateEntry; import org.apache.poi.poifs.filesystem.DirectoryNode; @@ -93,10 +93,8 @@ public class AgileDecryptor extends Decryptor implements Cloneable { public boolean verifyPassword(String password) throws GeneralSecurityException { AgileEncryptionVerifier ver = (AgileEncryptionVerifier)getEncryptionInfo().getVerifier(); AgileEncryptionHeader header = (AgileEncryptionHeader)getEncryptionInfo().getHeader(); - HashAlgorithm hashAlgo = header.getHashAlgorithmEx(); - CipherAlgorithm cipherAlgo = header.getCipherAlgorithm(); + int blockSize = header.getBlockSize(); - int keySize = header.getKeySize()/8; byte[] pwHash = hashPassword(password, ver.getHashAlgorithm(), ver.getSalt(), ver.getSpinCount()); @@ -113,9 +111,9 @@ public class AgileDecryptor extends Decryptor implements Cloneable { * blockSize bytes. * 4. Use base64 to encode the result of step 3. */ - byte verfierInputEnc[] = hashInput(getEncryptionInfo(), pwHash, kVerifierInputBlock, ver.getEncryptedVerifier(), Cipher.DECRYPT_MODE); + byte verfierInputEnc[] = hashInput(ver, pwHash, kVerifierInputBlock, ver.getEncryptedVerifier(), Cipher.DECRYPT_MODE); setVerifier(verfierInputEnc); - MessageDigest hashMD = getMessageDigest(hashAlgo); + MessageDigest hashMD = getMessageDigest(ver.getHashAlgorithm()); byte[] verifierHash = hashMD.digest(verfierInputEnc); /** @@ -130,8 +128,8 @@ public class AgileDecryptor extends Decryptor implements Cloneable { * blockSize bytes, pad the hash value with 0x00 to an integral multiple of blockSize bytes. * 4. Use base64 to encode the result of step 3. */ - byte verifierHashDec[] = hashInput(getEncryptionInfo(), pwHash, kHashedVerifierBlock, ver.getEncryptedVerifierHash(), Cipher.DECRYPT_MODE); - verifierHashDec = getBlock0(verifierHashDec, hashAlgo.hashSize); + byte verifierHashDec[] = hashInput(ver, pwHash, kHashedVerifierBlock, ver.getEncryptedVerifierHash(), Cipher.DECRYPT_MODE); + verifierHashDec = getBlock0(verifierHashDec, ver.getHashAlgorithm().hashSize); /** * encryptedKeyValue: This attribute MUST be generated by using the following steps: @@ -146,9 +144,9 @@ public class AgileDecryptor extends Decryptor implements Cloneable { * blockSize bytes. * 4. Use base64 to encode the result of step 3. */ - byte keyspec[] = hashInput(getEncryptionInfo(), pwHash, kCryptoKeyBlock, ver.getEncryptedKey(), Cipher.DECRYPT_MODE); - keyspec = getBlock0(keyspec, keySize); - SecretKeySpec secretKey = new SecretKeySpec(keyspec, ver.getCipherAlgorithm().jceId); + byte keyspec[] = hashInput(ver, pwHash, kCryptoKeyBlock, ver.getEncryptedKey(), Cipher.DECRYPT_MODE); + keyspec = getBlock0(keyspec, header.getKeySize()/8); + SecretKeySpec secretKey = new SecretKeySpec(keyspec, header.getCipherAlgorithm().jceId); /** * 1. Obtain the intermediate key by decrypting the encryptedKeyValue from a KeyEncryptor @@ -163,10 +161,11 @@ public class AgileDecryptor extends Decryptor implements Cloneable { * array with 0x00 to the next integral multiple of blockSize bytes. * 4. Assign the encryptedHmacKey attribute to the base64-encoded form of the result of step 3. */ - byte vec[] = CryptoFunctions.generateIv(hashAlgo, header.getKeySalt(), kIntegrityKeyBlock, blockSize); - Cipher cipher = getCipher(secretKey, cipherAlgo, ver.getChainingMode(), vec, Cipher.DECRYPT_MODE); + byte vec[] = CryptoFunctions.generateIv(header.getHashAlgorithm(), header.getKeySalt(), kIntegrityKeyBlock, blockSize); + CipherAlgorithm cipherAlgo = header.getCipherAlgorithm(); + Cipher cipher = getCipher(secretKey, cipherAlgo, header.getChainingMode(), vec, Cipher.DECRYPT_MODE); byte hmacKey[] = cipher.doFinal(header.getEncryptedHmacKey()); - hmacKey = getBlock0(hmacKey, hashAlgo.hashSize); + hmacKey = getBlock0(hmacKey, header.getHashAlgorithm().hashSize); /** * 5. Generate an HMAC, as specified in [RFC2104], of the encrypted form of the data (message), @@ -177,10 +176,10 @@ public class AgileDecryptor extends Decryptor implements Cloneable { * 0xa0, 0x67, 0x7f, 0x02, 0xb2, 0x2c, 0x84, and 0x33. * 7. Assign the encryptedHmacValue attribute to the base64-encoded form of the result of step 6. */ - vec = CryptoFunctions.generateIv(hashAlgo, header.getKeySalt(), kIntegrityValueBlock, blockSize); + vec = CryptoFunctions.generateIv(header.getHashAlgorithm(), header.getKeySalt(), kIntegrityValueBlock, blockSize); cipher = getCipher(secretKey, cipherAlgo, ver.getChainingMode(), vec, Cipher.DECRYPT_MODE); byte hmacValue[] = cipher.doFinal(header.getEncryptedHmacValue()); - hmacValue = getBlock0(hmacValue, hashAlgo.hashSize); + hmacValue = getBlock0(hmacValue, header.getHashAlgorithm().hashSize); if (Arrays.equals(verifierHashDec, verifierHash)) { setSecretKey(secretKey); @@ -206,7 +205,7 @@ public class AgileDecryptor extends Decryptor implements Cloneable { public boolean verifyPassword(KeyPair keyPair, X509Certificate x509) throws GeneralSecurityException { AgileEncryptionVerifier ver = (AgileEncryptionVerifier)getEncryptionInfo().getVerifier(); AgileEncryptionHeader header = (AgileEncryptionHeader)getEncryptionInfo().getHeader(); - HashAlgorithm hashAlgo = header.getHashAlgorithmEx(); + HashAlgorithm hashAlgo = header.getHashAlgorithm(); CipherAlgorithm cipherAlgo = header.getCipherAlgorithm(); int blockSize = header.getBlockSize(); @@ -231,12 +230,12 @@ public class AgileDecryptor extends Decryptor implements Cloneable { byte certVerifier[] = x509Hmac.doFinal(ace.x509.getEncoded()); byte vec[] = CryptoFunctions.generateIv(hashAlgo, header.getKeySalt(), kIntegrityKeyBlock, blockSize); - cipher = getCipher(secretKey, cipherAlgo, ver.getChainingMode(), vec, Cipher.DECRYPT_MODE); + cipher = getCipher(secretKey, cipherAlgo, header.getChainingMode(), vec, Cipher.DECRYPT_MODE); byte hmacKey[] = cipher.doFinal(header.getEncryptedHmacKey()); hmacKey = getBlock0(hmacKey, hashAlgo.hashSize); vec = CryptoFunctions.generateIv(hashAlgo, header.getKeySalt(), kIntegrityValueBlock, blockSize); - cipher = getCipher(secretKey, cipherAlgo, ver.getChainingMode(), vec, Cipher.DECRYPT_MODE); + cipher = getCipher(secretKey, cipherAlgo, header.getChainingMode(), vec, Cipher.DECRYPT_MODE); byte hmacValue[] = cipher.doFinal(header.getEncryptedHmacValue()); hmacValue = getBlock0(hmacValue, hashAlgo.hashSize); @@ -257,18 +256,17 @@ public class AgileDecryptor extends Decryptor implements Cloneable { return fillSize; } - protected static byte[] hashInput(EncryptionInfo encryptionInfo, byte pwHash[], byte blockKey[], byte inputKey[], int cipherMode) { - EncryptionVerifier ver = encryptionInfo.getVerifier(); - AgileDecryptor dec = (AgileDecryptor)encryptionInfo.getDecryptor(); - int keySize = dec.getKeySizeInBytes(); - int blockSize = dec.getBlockSizeInBytes(); + /* package */ static byte[] hashInput(AgileEncryptionVerifier ver, byte pwHash[], byte blockKey[], byte inputKey[], int cipherMode) { + CipherAlgorithm cipherAlgo = ver.getCipherAlgorithm(); + ChainingMode chainMode = ver.getChainingMode(); + int keySize = ver.getKeySize()/8; + int blockSize = ver.getBlockSize(); HashAlgorithm hashAlgo = ver.getHashAlgorithm(); - byte[] salt = ver.getSalt(); - + byte intermedKey[] = generateKey(pwHash, hashAlgo, blockKey, keySize); - SecretKey skey = new SecretKeySpec(intermedKey, ver.getCipherAlgorithm().jceId); - byte[] iv = generateIv(hashAlgo, salt, null, blockSize); - Cipher cipher = getCipher(skey, ver.getCipherAlgorithm(), ver.getChainingMode(), iv, cipherMode); + SecretKey skey = new SecretKeySpec(intermedKey, cipherAlgo.jceId); + byte[] iv = generateIv(hashAlgo, ver.getSalt(), null, blockSize); + Cipher cipher = getCipher(skey, cipherAlgo, chainMode, iv, cipherMode); byte[] hashFinal; try { @@ -281,7 +279,6 @@ public class AgileDecryptor extends Decryptor implements Cloneable { } @Override - @SuppressWarnings("resource") public InputStream getDataStream(DirectoryNode dir) throws IOException, GeneralSecurityException { DocumentInputStream dis = dir.createDocumentInputStream(DEFAULT_POIFS_ENTRY); _length = dis.readLong(); @@ -307,7 +304,7 @@ public class AgileDecryptor extends Decryptor implements Cloneable { byte[] blockKey = new byte[4]; LittleEndian.putInt(blockKey, 0, block); - byte[] iv = generateIv(header.getHashAlgorithmEx(), header.getKeySalt(), blockKey, header.getBlockSize()); + byte[] iv = generateIv(header.getHashAlgorithm(), header.getKeySalt(), blockKey, header.getBlockSize()); AlgorithmParameterSpec aps; if (header.getCipherAlgorithm() == CipherAlgorithm.rc2) { diff --git a/src/ooxml/java/org/apache/poi/poifs/crypt/agile/AgileEncryptionHeader.java b/src/ooxml/java/org/apache/poi/poifs/crypt/agile/AgileEncryptionHeader.java index 88bccabf6c..ebb64cb5be 100644 --- a/src/ooxml/java/org/apache/poi/poifs/crypt/agile/AgileEncryptionHeader.java +++ b/src/ooxml/java/org/apache/poi/poifs/crypt/agile/AgileEncryptionHeader.java @@ -45,18 +45,18 @@ public class AgileEncryptionHeader extends EncryptionHeader implements Cloneable throw new EncryptedDocumentException("Unable to parse keyData"); } - setKeySize((int)keyData.getKeyBits()); - setFlags(0); - setSizeExtra(0); - setCspName(null); - setBlockSize(keyData.getBlockSize()); - int keyBits = (int)keyData.getKeyBits(); CipherAlgorithm ca = CipherAlgorithm.fromXmlId(keyData.getCipherAlgorithm().toString(), keyBits); setCipherAlgorithm(ca); setCipherProvider(ca.provider); + setKeySize(keyBits); + setFlags(0); + setSizeExtra(0); + setCspName(null); + setBlockSize(keyData.getBlockSize()); + switch (keyData.getCipherChaining().intValue()) { case STCipherChaining.INT_CHAINING_MODE_CBC: setChainingMode(ChainingMode.cbc); @@ -73,7 +73,7 @@ public class AgileEncryptionHeader extends EncryptionHeader implements Cloneable HashAlgorithm ha = HashAlgorithm.fromEcmaId(keyData.getHashAlgorithm().toString()); setHashAlgorithm(ha); - if (getHashAlgorithmEx().hashSize != hashSize) { + if (getHashAlgorithm().hashSize != hashSize) { throw new EncryptedDocumentException("Unsupported hash algorithm: " + keyData.getHashAlgorithm() + " @ " + hashSize + " bytes"); } diff --git a/src/ooxml/java/org/apache/poi/poifs/crypt/agile/AgileEncryptionVerifier.java b/src/ooxml/java/org/apache/poi/poifs/crypt/agile/AgileEncryptionVerifier.java index 53d4cd6ed2..6d9ec6d66f 100644 --- a/src/ooxml/java/org/apache/poi/poifs/crypt/agile/AgileEncryptionVerifier.java +++ b/src/ooxml/java/org/apache/poi/poifs/crypt/agile/AgileEncryptionVerifier.java @@ -21,6 +21,7 @@ import java.security.GeneralSecurityException; import java.security.cert.CertificateFactory; import java.security.cert.X509Certificate; import java.util.ArrayList; +import java.util.Arrays; import java.util.Iterator; import java.util.List; @@ -48,6 +49,8 @@ public class AgileEncryptionVerifier extends EncryptionVerifier implements Clone } private List certList = new ArrayList(); + private int keyBits = -1; + private int blockSize = -1; public AgileEncryptionVerifier(String descriptor) { this(AgileEncryptionInfoBuilder.parseDescriptor(descriptor)); @@ -66,10 +69,14 @@ public class AgileEncryptionVerifier extends EncryptionVerifier implements Clone } int keyBits = (int)keyData.getKeyBits(); - CipherAlgorithm ca = CipherAlgorithm.fromXmlId(keyData.getCipherAlgorithm().toString(), keyBits); setCipherAlgorithm(ca); + setKeySize(keyBits); + + int blockSize = keyData.getBlockSize(); + setBlockSize(blockSize); + int hashSize = keyData.getHashSize(); HashAlgorithm ha = HashAlgorithm.fromEcmaId(keyData.getHashAlgorithm().toString()); @@ -125,6 +132,8 @@ public class AgileEncryptionVerifier extends EncryptionVerifier implements Clone setCipherAlgorithm(cipherAlgorithm); setHashAlgorithm(hashAlgorithm); setChainingMode(chainingMode); + setKeySize(keyBits); + setBlockSize(blockSize); setSpinCount(100000); // TODO: use parameter } @@ -171,4 +180,60 @@ public class AgileEncryptionVerifier extends EncryptionVerifier implements Clone other.certList = new ArrayList(certList); return other; } + + + /** + * The keysize (in bits) of the verifier data. This usually equals the keysize of the header, + * but only on a few exceptions, like files generated by Office for Mac, can be + * different. + * + * @return the keysize (in bits) of the verifier. + */ + public int getKeySize() { + return keyBits; + } + + + /** + * The blockSize (in bytes) of the verifier data. + * This usually equals the blocksize of the header. + * + * @return the blockSize (in bytes) of the verifier, + */ + public int getBlockSize() { + return blockSize; + } + + /** + * Sets the keysize (in bits) of the verifier + * + * @param keyBits the keysize (in bits) + */ + protected void setKeySize(int keyBits) { + this.keyBits = keyBits; + for (int allowedBits : getCipherAlgorithm().allowedKeySize) { + if (allowedBits == keyBits) { + return; + } + } + throw new EncryptedDocumentException("KeySize "+keyBits+" not allowed for cipher "+getCipherAlgorithm()); + } + + + /** + * Sets the blockSize (in bytes) of the verifier + * + * @param blockSize the blockSize (in bytes) + */ + protected void setBlockSize(int blockSize) { + this.blockSize = blockSize; + } + + @Override + protected void setCipherAlgorithm(CipherAlgorithm cipherAlgorithm) { + super.setCipherAlgorithm(cipherAlgorithm); + if (cipherAlgorithm.allowedKeySize.length == 1) { + setKeySize(cipherAlgorithm.defaultKeySize); + } + } } diff --git a/src/ooxml/java/org/apache/poi/poifs/crypt/agile/AgileEncryptor.java b/src/ooxml/java/org/apache/poi/poifs/crypt/agile/AgileEncryptor.java index 5ff45ad814..96aa9b5f9f 100644 --- a/src/ooxml/java/org/apache/poi/poifs/crypt/agile/AgileEncryptor.java +++ b/src/ooxml/java/org/apache/poi/poifs/crypt/agile/AgileEncryptor.java @@ -86,9 +86,10 @@ public class AgileEncryptor extends Encryptor implements Cloneable { public void confirmPassword(String password) { // see [MS-OFFCRYPTO] - 2.3.3 EncryptionVerifier Random r = new SecureRandom(); - int blockSize = getEncryptionInfo().getHeader().getBlockSize(); - int keySize = getEncryptionInfo().getHeader().getKeySize()/8; - int hashSize = getEncryptionInfo().getHeader().getHashAlgorithmEx().hashSize; + AgileEncryptionHeader header = (AgileEncryptionHeader)getEncryptionInfo().getHeader(); + int blockSize = header.getBlockSize(); + int keySize = header.getKeySize()/8; + int hashSize = header.getHashAlgorithm().hashSize; byte[] newVerifierSalt = new byte[blockSize] , newVerifier = new byte[blockSize] @@ -107,14 +108,14 @@ public class AgileEncryptor extends Encryptor implements Cloneable { @Override public void confirmPassword(String password, byte keySpec[], byte keySalt[], byte verifier[], byte verifierSalt[], byte integritySalt[]) { AgileEncryptionVerifier ver = (AgileEncryptionVerifier)getEncryptionInfo().getVerifier(); - ver.setSalt(verifierSalt); AgileEncryptionHeader header = (AgileEncryptionHeader)getEncryptionInfo().getHeader(); + + ver.setSalt(verifierSalt); header.setKeySalt(keySalt); - HashAlgorithm hashAlgo = ver.getHashAlgorithm(); int blockSize = header.getBlockSize(); - pwHash = hashPassword(password, hashAlgo, verifierSalt, ver.getSpinCount()); + pwHash = hashPassword(password, ver.getHashAlgorithm(), verifierSalt, ver.getSpinCount()); /** * encryptedVerifierHashInput: This attribute MUST be generated by using the following steps: @@ -129,7 +130,7 @@ public class AgileEncryptor extends Encryptor implements Cloneable { * blockSize bytes. * 4. Use base64 to encode the result of step 3. */ - byte encryptedVerifier[] = hashInput(getEncryptionInfo(), pwHash, kVerifierInputBlock, verifier, Cipher.ENCRYPT_MODE); + byte encryptedVerifier[] = hashInput(ver, pwHash, kVerifierInputBlock, verifier, Cipher.ENCRYPT_MODE); ver.setEncryptedVerifier(encryptedVerifier); @@ -145,9 +146,9 @@ public class AgileEncryptor extends Encryptor implements Cloneable { * blockSize bytes, pad the hash value with 0x00 to an integral multiple of blockSize bytes. * 4. Use base64 to encode the result of step 3. */ - MessageDigest hashMD = getMessageDigest(hashAlgo); + MessageDigest hashMD = getMessageDigest(ver.getHashAlgorithm()); byte[] hashedVerifier = hashMD.digest(verifier); - byte encryptedVerifierHash[] = hashInput(getEncryptionInfo(), pwHash, kHashedVerifierBlock, hashedVerifier, Cipher.ENCRYPT_MODE); + byte encryptedVerifierHash[] = hashInput(ver, pwHash, kHashedVerifierBlock, hashedVerifier, Cipher.ENCRYPT_MODE); ver.setEncryptedVerifierHash(encryptedVerifierHash); /** @@ -163,10 +164,10 @@ public class AgileEncryptor extends Encryptor implements Cloneable { * blockSize bytes. * 4. Use base64 to encode the result of step 3. */ - byte encryptedKey[] = hashInput(getEncryptionInfo(), pwHash, kCryptoKeyBlock, keySpec, Cipher.ENCRYPT_MODE); + byte encryptedKey[] = hashInput(ver, pwHash, kCryptoKeyBlock, keySpec, Cipher.ENCRYPT_MODE); ver.setEncryptedKey(encryptedKey); - SecretKey secretKey = new SecretKeySpec(keySpec, ver.getCipherAlgorithm().jceId); + SecretKey secretKey = new SecretKeySpec(keySpec, header.getCipherAlgorithm().jceId); setSecretKey(secretKey); /* @@ -196,17 +197,17 @@ public class AgileEncryptor extends Encryptor implements Cloneable { this.integritySalt = integritySalt.clone(); try { - byte vec[] = CryptoFunctions.generateIv(hashAlgo, header.getKeySalt(), kIntegrityKeyBlock, header.getBlockSize()); - Cipher cipher = getCipher(secretKey, ver.getCipherAlgorithm(), ver.getChainingMode(), vec, Cipher.ENCRYPT_MODE); - byte filledSalt[] = getBlock0(this.integritySalt, getNextBlockSize(this.integritySalt.length, blockSize)); - byte encryptedHmacKey[] = cipher.doFinal(filledSalt); + byte vec[] = CryptoFunctions.generateIv(header.getHashAlgorithm(), header.getKeySalt(), kIntegrityKeyBlock, header.getBlockSize()); + Cipher cipher = getCipher(secretKey, header.getCipherAlgorithm(), header.getChainingMode(), vec, Cipher.ENCRYPT_MODE); + byte hmacKey[] = getBlock0(this.integritySalt, getNextBlockSize(this.integritySalt.length, blockSize)); + byte encryptedHmacKey[] = cipher.doFinal(hmacKey); header.setEncryptedHmacKey(encryptedHmacKey); cipher = Cipher.getInstance("RSA"); for (AgileCertificateEntry ace : ver.getCertificates()) { cipher.init(Cipher.ENCRYPT_MODE, ace.x509.getPublicKey()); ace.encryptedKey = cipher.doFinal(getSecretKey().getEncoded()); - Mac x509Hmac = CryptoFunctions.getMac(hashAlgo); + Mac x509Hmac = CryptoFunctions.getMac(header.getHashAlgorithm()); x509Hmac.init(getSecretKey()); ace.certVerifier = x509Hmac.doFinal(ace.x509.getEncoded()); } @@ -236,10 +237,12 @@ public class AgileEncryptor extends Encryptor implements Cloneable { // as the integrity hmac needs to contain the StreamSize, // it's not possible to calculate it on-the-fly while buffering // TODO: add stream size parameter to getDataStream() - AgileEncryptionVerifier ver = (AgileEncryptionVerifier)getEncryptionInfo().getVerifier(); - HashAlgorithm hashAlgo = ver.getHashAlgorithm(); + AgileEncryptionHeader header = (AgileEncryptionHeader)getEncryptionInfo().getHeader(); + int blockSize = header.getBlockSize(); + HashAlgorithm hashAlgo = header.getHashAlgorithm(); Mac integrityMD = CryptoFunctions.getMac(hashAlgo); - integrityMD.init(new SecretKeySpec(integritySalt, hashAlgo.jceHmacId)); + byte hmacKey[] = getBlock0(this.integritySalt, getNextBlockSize(this.integritySalt.length, blockSize)); + integrityMD.init(new SecretKeySpec(hmacKey, hashAlgo.jceHmacId)); byte buf[] = new byte[1024]; LittleEndian.putLong(buf, 0, oleStreamSize); @@ -256,12 +259,10 @@ public class AgileEncryptor extends Encryptor implements Cloneable { } byte hmacValue[] = integrityMD.doFinal(); + byte hmacValueFilled[] = getBlock0(hmacValue, getNextBlockSize(hmacValue.length, blockSize)); - AgileEncryptionHeader header = (AgileEncryptionHeader)getEncryptionInfo().getHeader(); - int blockSize = header.getBlockSize(); - byte iv[] = CryptoFunctions.generateIv(header.getHashAlgorithmEx(), header.getKeySalt(), kIntegrityValueBlock, blockSize); + byte iv[] = CryptoFunctions.generateIv(header.getHashAlgorithm(), header.getKeySalt(), kIntegrityValueBlock, blockSize); Cipher cipher = CryptoFunctions.getCipher(getSecretKey(), header.getCipherAlgorithm(), header.getChainingMode(), iv, Cipher.ENCRYPT_MODE); - byte hmacValueFilled[] = getBlock0(hmacValue, getNextBlockSize(hmacValue.length, blockSize)); byte encryptedHmacValue[] = cipher.doFinal(hmacValueFilled); header.setEncryptedHmacValue(encryptedHmacValue); @@ -288,18 +289,21 @@ public class AgileEncryptor extends Encryptor implements Cloneable { keyPass.setSpinCount(ver.getSpinCount()); keyData.setSaltSize(header.getBlockSize()); - keyPass.setSaltSize(header.getBlockSize()); + keyPass.setSaltSize(ver.getBlockSize()); keyData.setBlockSize(header.getBlockSize()); - keyPass.setBlockSize(header.getBlockSize()); + keyPass.setBlockSize(ver.getBlockSize()); keyData.setKeyBits(header.getKeySize()); - keyPass.setKeyBits(header.getKeySize()); + keyPass.setKeyBits(ver.getKeySize()); - HashAlgorithm hashAlgo = header.getHashAlgorithmEx(); - keyData.setHashSize(hashAlgo.hashSize); - keyPass.setHashSize(hashAlgo.hashSize); + keyData.setHashSize(header.getHashAlgorithm().hashSize); + keyPass.setHashSize(ver.getHashAlgorithm().hashSize); + // header and verifier have to have the same cipher algorithm + if (!header.getCipherAlgorithm().xmlId.equals(ver.getCipherAlgorithm().xmlId)) { + throw new EncryptedDocumentException("Cipher algorithm of header and verifier have to match"); + } STCipherAlgorithm.Enum xmlCipherAlgo = STCipherAlgorithm.Enum.forString(header.getCipherAlgorithm().xmlId); if (xmlCipherAlgo == null) { throw new EncryptedDocumentException("CipherAlgorithm "+header.getCipherAlgorithm()+" not supported."); @@ -320,12 +324,8 @@ public class AgileEncryptor extends Encryptor implements Cloneable { throw new EncryptedDocumentException("ChainingMode "+header.getChainingMode()+" not supported."); } - STHashAlgorithm.Enum xmlHashAlgo = STHashAlgorithm.Enum.forString(hashAlgo.ecmaString); - if (xmlHashAlgo == null) { - throw new EncryptedDocumentException("HashAlgorithm "+hashAlgo+" not supported."); - } - keyData.setHashAlgorithm(xmlHashAlgo); - keyPass.setHashAlgorithm(xmlHashAlgo); + keyData.setHashAlgorithm(mapHashAlgorithm(header.getHashAlgorithm())); + keyPass.setHashAlgorithm(mapHashAlgorithm(ver.getHashAlgorithm())); keyData.setSaltValue(header.getKeySalt()); keyPass.setSaltValue(ver.getSalt()); @@ -352,6 +352,14 @@ public class AgileEncryptor extends Encryptor implements Cloneable { return ed; } + + private static STHashAlgorithm.Enum mapHashAlgorithm(HashAlgorithm hashAlgo) { + STHashAlgorithm.Enum xmlHashAlgo = STHashAlgorithm.Enum.forString(hashAlgo.ecmaString); + if (xmlHashAlgo == null) { + throw new EncryptedDocumentException("HashAlgorithm "+hashAlgo+" not supported."); + } + return xmlHashAlgo; + } protected void marshallEncryptionDocument(EncryptionDocument ed, LittleEndianByteArrayOutputStream os) { XmlOptions xo = new XmlOptions(); @@ -371,7 +379,7 @@ public class AgileEncryptor extends Encryptor implements Cloneable { try { bos.write("\r\n".getBytes("UTF-8")); ed.save(bos, xo); - os.write(bos.toByteArray()); + bos.writeTo(os); } catch (IOException e) { throw new EncryptedDocumentException("error marshalling encryption info document", e); } diff --git a/src/ooxml/testcases/org/apache/poi/poifs/crypt/TestDecryptor.java b/src/ooxml/testcases/org/apache/poi/poifs/crypt/TestDecryptor.java index d2260dc998..19dc34b84e 100644 --- a/src/ooxml/testcases/org/apache/poi/poifs/crypt/TestDecryptor.java +++ b/src/ooxml/testcases/org/apache/poi/poifs/crypt/TestDecryptor.java @@ -37,10 +37,6 @@ import org.apache.poi.util.IOUtils; import org.apache.poi.xssf.XSSFTestDataSamples; import org.junit.Test; -/** - * @author Maxim Valyanskiy - * @author Gary King - */ public class TestDecryptor { @Test public void passwordVerification() throws IOException, GeneralSecurityException { @@ -162,4 +158,22 @@ public class TestDecryptor { //dec.verifyPassword(null); dec.getDataStream(pfs); } + + @Test + public void bug60320() throws IOException, GeneralSecurityException { + InputStream is = POIDataSamples.getPOIFSInstance().openResourceAsStream("60320-protected.xlsx"); + POIFSFileSystem fs = new POIFSFileSystem(is); + is.close(); + + EncryptionInfo info = new EncryptionInfo(fs); + + Decryptor d = Decryptor.getInstance(info); + + boolean b = d.verifyPassword("Test001!!"); + assertTrue(b); + + zipOk(fs.getRoot(), d); + + fs.close(); + } } \ No newline at end of file diff --git a/src/ooxml/testcases/org/apache/poi/poifs/crypt/TestEncryptionInfo.java b/src/ooxml/testcases/org/apache/poi/poifs/crypt/TestEncryptionInfo.java index 3227334429..204c2ed621 100644 --- a/src/ooxml/testcases/org/apache/poi/poifs/crypt/TestEncryptionInfo.java +++ b/src/ooxml/testcases/org/apache/poi/poifs/crypt/TestEncryptionInfo.java @@ -35,7 +35,7 @@ public class TestEncryptionInfo { assertEquals(2, info.getVersionMinor()); assertEquals(CipherAlgorithm.aes128, info.getHeader().getCipherAlgorithm()); - assertEquals(HashAlgorithm.sha1, info.getHeader().getHashAlgorithmEx()); + assertEquals(HashAlgorithm.sha1, info.getHeader().getHashAlgorithm()); assertEquals(128, info.getHeader().getKeySize()); assertEquals(32, info.getVerifier().getEncryptedVerifierHash().length); assertEquals(CipherProvider.aes, info.getHeader().getCipherProvider()); @@ -54,7 +54,7 @@ public class TestEncryptionInfo { assertEquals(4, info.getVersionMinor()); assertEquals(CipherAlgorithm.aes256, info.getHeader().getCipherAlgorithm()); - assertEquals(HashAlgorithm.sha512, info.getHeader().getHashAlgorithmEx()); + assertEquals(HashAlgorithm.sha512, info.getHeader().getHashAlgorithm()); assertEquals(256, info.getHeader().getKeySize()); assertEquals(64, info.getVerifier().getEncryptedVerifierHash().length); assertEquals(CipherProvider.aes, info.getHeader().getCipherProvider()); diff --git a/src/ooxml/testcases/org/apache/poi/poifs/crypt/TestEncryptor.java b/src/ooxml/testcases/org/apache/poi/poifs/crypt/TestEncryptor.java index 02e021d7d8..f3e6c97e4c 100644 --- a/src/ooxml/testcases/org/apache/poi/poifs/crypt/TestEncryptor.java +++ b/src/ooxml/testcases/org/apache/poi/poifs/crypt/TestEncryptor.java @@ -36,7 +36,9 @@ import javax.crypto.Cipher; import org.apache.poi.POIDataSamples; import org.apache.poi.openxml4j.opc.ContentTypes; import org.apache.poi.openxml4j.opc.OPCPackage; +import org.apache.poi.poifs.crypt.agile.AgileDecryptor; import org.apache.poi.poifs.crypt.agile.AgileEncryptionHeader; +import org.apache.poi.poifs.crypt.agile.AgileEncryptionVerifier; import org.apache.poi.poifs.filesystem.DirectoryNode; import org.apache.poi.poifs.filesystem.DocumentNode; import org.apache.poi.poifs.filesystem.Entry; @@ -87,7 +89,7 @@ public class TestEncryptor { assertArrayEquals(payloadExpected.toByteArray(), payloadActual.toByteArray()); } - + @Test public void agileEncryption() throws Exception { int maxKeyLen = Cipher.getMaxAllowedKeyLength("AES"); @@ -379,4 +381,142 @@ public class TestEncryptor { } } } + + /* + * this test simulates the generation of bugs 60320 sample file + * as the padding bytes of the EncryptedPackage stream are random or in POIs case PKCS5-padded + * one would need to mock those bytes to get the same hmacValues - see diff below + * + * this use-case is experimental - for the time being the setters of the encryption classes + * are spreaded between two packages and are protected - so you would need to violate + * the packages rules and provide a helper class in the *poifs.crypt package-namespace. + * the default way of defining the encryption settings is via the EncryptionInfo class + */ + @Test + public void bug60320CustomEncrypt() throws Exception { + // --- src/java/org/apache/poi/poifs/crypt/ChunkedCipherOutputStream.java (revision 1766745) + // +++ src/java/org/apache/poi/poifs/crypt/ChunkedCipherOutputStream.java (working copy) + // @@ -208,6 +208,13 @@ + // protected int invokeCipher(int posInChunk, boolean doFinal) throws GeneralSecurityException { + // byte plain[] = (_plainByteFlags.isEmpty()) ? null : _chunk.clone(); + // + // + if (posInChunk < 4096) { + // + _cipher.update(_chunk, 0, posInChunk, _chunk); + // + byte bla[] = { (byte)0x7A,(byte)0x0F,(byte)0x27,(byte)0xF0,(byte)0x17,(byte)0x6E,(byte)0x77,(byte)0x05,(byte)0xB9,(byte)0xDA,(byte)0x49,(byte)0xF9,(byte)0xD7,(byte)0x8E,(byte)0x03,(byte)0x1D }; + // + System.arraycopy(bla, 0, _chunk, posInChunk-2, bla.length); + // + return posInChunk-2+bla.length; + // + } + // + + // int ciLen = (doFinal) + // ? _cipher.doFinal(_chunk, 0, posInChunk, _chunk) + // : _cipher.update(_chunk, 0, posInChunk, _chunk); + // + // --- src/ooxml/java/org/apache/poi/poifs/crypt/agile/AgileDecryptor.java (revision 1766745) + // +++ src/ooxml/java/org/apache/poi/poifs/crypt/agile/AgileDecryptor.java (working copy) + // + // @@ -300,7 +297,7 @@ + // protected static Cipher initCipherForBlock(Cipher existing, int block, boolean lastChunk, EncryptionInfo encryptionInfo, SecretKey skey, int encryptionMode) + // throws GeneralSecurityException { + // EncryptionHeader header = encryptionInfo.getHeader(); + // - String padding = (lastChunk ? "PKCS5Padding" : "NoPadding"); + // + String padding = "NoPadding"; // (lastChunk ? "PKCS5Padding" : "NoPadding"); + // if (existing == null || !existing.getAlgorithm().endsWith(padding)) { + // existing = getCipher(skey, header.getCipherAlgorithm(), header.getChainingMode(), header.getKeySalt(), encryptionMode, padding); + // } + + InputStream is = POIDataSamples.getPOIFSInstance().openResourceAsStream("60320-protected.xlsx"); + POIFSFileSystem fsOrig = new POIFSFileSystem(is); + is.close(); + EncryptionInfo infoOrig = new EncryptionInfo(fsOrig); + Decryptor decOrig = infoOrig.getDecryptor(); + boolean b = decOrig.verifyPassword("Test001!!"); + assertTrue(b); + InputStream decIn = decOrig.getDataStream(fsOrig); + byte[] zipInput = IOUtils.toByteArray(decIn); + decIn.close(); + + InputStream epOrig = fsOrig.getRoot().createDocumentInputStream("EncryptedPackage"); + // ignore the 16 padding bytes + byte[] epOrigBytes = IOUtils.toByteArray(epOrig, 9400); + epOrig.close(); + + EncryptionInfo eiNew = new EncryptionInfo(EncryptionMode.agile); + AgileEncryptionHeader aehHeader = (AgileEncryptionHeader)eiNew.getHeader(); + aehHeader.setCipherAlgorithm(CipherAlgorithm.aes128); + aehHeader.setHashAlgorithm(HashAlgorithm.sha1); + AgileEncryptionVerifier aehVerifier = (AgileEncryptionVerifier)eiNew.getVerifier(); + + // this cast might look strange - if the setters would be public, it will become obsolete + // see http://stackoverflow.com/questions/5637650/overriding-protected-methods-in-java + ((EncryptionVerifier)aehVerifier).setCipherAlgorithm(CipherAlgorithm.aes256); + aehVerifier.setHashAlgorithm(HashAlgorithm.sha512); + + Encryptor enc = eiNew.getEncryptor(); + enc.confirmPassword("Test001!!", + infoOrig.getDecryptor().getSecretKey().getEncoded(), + infoOrig.getHeader().getKeySalt(), + infoOrig.getDecryptor().getVerifier(), + infoOrig.getVerifier().getSalt(), + infoOrig.getDecryptor().getIntegrityHmacKey() + ); + NPOIFSFileSystem fsNew = new NPOIFSFileSystem(); + OutputStream os = enc.getDataStream(fsNew); + os.write(zipInput); + os.close(); + + ByteArrayOutputStream bos = new ByteArrayOutputStream(); + fsNew.writeFilesystem(bos); + fsNew.close(); + + NPOIFSFileSystem fsReload = new NPOIFSFileSystem(new ByteArrayInputStream(bos.toByteArray())); + InputStream epReload = fsReload.getRoot().createDocumentInputStream("EncryptedPackage"); + byte[] epNewBytes = IOUtils.toByteArray(epReload, 9400); + epReload.close(); + + assertArrayEquals(epOrigBytes, epNewBytes); + + EncryptionInfo infoReload = new EncryptionInfo(fsOrig); + Decryptor decReload = infoReload.getDecryptor(); + b = decReload.verifyPassword("Test001!!"); + assertTrue(b); + + AgileEncryptionHeader aehOrig = (AgileEncryptionHeader)infoOrig.getHeader(); + AgileEncryptionHeader aehReload = (AgileEncryptionHeader)infoReload.getHeader(); + assertEquals(aehOrig.getBlockSize(), aehReload.getBlockSize()); + assertEquals(aehOrig.getChainingMode(), aehReload.getChainingMode()); + assertEquals(aehOrig.getCipherAlgorithm(), aehReload.getCipherAlgorithm()); + assertEquals(aehOrig.getCipherProvider(), aehReload.getCipherProvider()); + assertEquals(aehOrig.getCspName(), aehReload.getCspName()); + assertArrayEquals(aehOrig.getEncryptedHmacKey(), aehReload.getEncryptedHmacKey()); + // this only works, when the paddings are mocked to be the same ... + // assertArrayEquals(aehOrig.getEncryptedHmacValue(), aehReload.getEncryptedHmacValue()); + assertEquals(aehOrig.getFlags(), aehReload.getFlags()); + assertEquals(aehOrig.getHashAlgorithm(), aehReload.getHashAlgorithm()); + assertArrayEquals(aehOrig.getKeySalt(), aehReload.getKeySalt()); + assertEquals(aehOrig.getKeySize(), aehReload.getKeySize()); + + AgileEncryptionVerifier aevOrig = (AgileEncryptionVerifier)infoOrig.getVerifier(); + AgileEncryptionVerifier aevReload = (AgileEncryptionVerifier)infoReload.getVerifier(); + assertEquals(aevOrig.getBlockSize(), aevReload.getBlockSize()); + assertEquals(aevOrig.getChainingMode(), aevReload.getChainingMode()); + assertEquals(aevOrig.getCipherAlgorithm(), aevReload.getCipherAlgorithm()); + assertArrayEquals(aevOrig.getEncryptedKey(), aevReload.getEncryptedKey()); + assertArrayEquals(aevOrig.getEncryptedVerifier(), aevReload.getEncryptedVerifier()); + assertArrayEquals(aevOrig.getEncryptedVerifierHash(), aevReload.getEncryptedVerifierHash()); + assertEquals(aevOrig.getHashAlgorithm(), aevReload.getHashAlgorithm()); + assertEquals(aevOrig.getKeySize(), aevReload.getKeySize()); + assertArrayEquals(aevOrig.getSalt(), aevReload.getSalt()); + assertEquals(aevOrig.getSpinCount(), aevReload.getSpinCount()); + + AgileDecryptor adOrig = (AgileDecryptor)infoOrig.getDecryptor(); + AgileDecryptor adReload = (AgileDecryptor)infoReload.getDecryptor(); + + assertArrayEquals(adOrig.getIntegrityHmacKey(), adReload.getIntegrityHmacKey()); + // doesn't work without mocking ... see above + // assertArrayEquals(adOrig.getIntegrityHmacValue(), adReload.getIntegrityHmacValue()); + assertArrayEquals(adOrig.getSecretKey().getEncoded(), adReload.getSecretKey().getEncoded()); + assertArrayEquals(adOrig.getVerifier(), adReload.getVerifier()); + + fsReload.close(); + } } diff --git a/test-data/poifs/60320-protected.xlsx b/test-data/poifs/60320-protected.xlsx new file mode 100644 index 0000000000..71c6b4cbe8 Binary files /dev/null and b/test-data/poifs/60320-protected.xlsx differ