com.gu.pandomainauth.service.Crypto.scala Maven / Gradle / Ivy

Go to download

Show more of this group Show more artifacts with this name
Show all versions of pan-domain-auth-verification_2.11 Show documentation

pan-domain-auth-verification

There is a newer version: 0.4.0

Show newest version

package com.gu.pandomainauth.service

import java.security.spec.{PKCS8EncodedKeySpec, X509EncodedKeySpec}
import java.security.{KeyFactory, Security, Signature}

import com.gu.pandomainauth.{PrivateKey, PublicKey}
import org.apache.commons.codec.binary.Base64._
import org.bouncycastle.jce.provider.BouncyCastleProvider


object Crypto {
  /**
   * You can generate a das key pair as follows:
   *
   * openssl genrsa -out private_key.pem 4096
   * openssl rsa -pubout -in private_key.pem -out public_key.pem
   *
   * Note: you only need to pass the key ie the blob of base64 between the start and end markers in the pem file.
   */

  Security.addProvider(new BouncyCastleProvider())

  val signatureAlgorithm: String = "SHA256withRSA"
  val keyFactory = KeyFactory.getInstance("RSA")

  def signData(data: Array[Byte], prvKey: PrivateKey): Array[Byte] = {
    val rsa = Signature.getInstance(signatureAlgorithm, "BC")
    val privateKey = keyFactory.generatePrivate(new PKCS8EncodedKeySpec(decodeBase64(prvKey.key)))
    rsa.initSign(privateKey)

    rsa.update(data)
    rsa.sign()
  }

  def verifySignature(data: Array[Byte], signature: Array[Byte], pubKey: PublicKey) : Boolean = {
    val rsa = Signature.getInstance(signatureAlgorithm, "BC")
    val publicKey = keyFactory.generatePublic(new X509EncodedKeySpec(decodeBase64(pubKey.key)))
    rsa.initVerify(publicKey)

    rsa.update(data)
    rsa.verify(signature)
  }
}