Feature/enhance Cbom generation (#136)

* add test Signed-off-by: Nicklas Körtge <[email protected]> * add signature test case Signed-off-by: Nicklas Körtge <[email protected]> * add rsaOAEP test, add nonce and iv to cbom output Signed-off-by: Nicklas Körtge <[email protected]> * update tests for RSA PSS Signed-off-by: Nicklas Körtge <[email protected]> * add RSA PSS test Signed-off-by: Nicklas Körtge <[email protected]> * add curve to cbom, add tests Signed-off-by: Nicklas Körtge <[email protected]> * update signature naming, fix test in jca and python Signed-off-by: Nicklas Körtge <[email protected]> * update naming of algorithms, update tests Signed-off-by: Nicklas Körtge <[email protected]> --------- Signed-off-by: Nicklas Körtge <[email protected]>
IBM · Sep 5, 2024 · baa7a69 · baa7a69
1 parent e8bc9f9
commit baa7a69
Show file tree

Hide file tree

Showing 72 changed files with 632 additions and 425 deletions.
diff --git a/enricher/src/main/java/com/ibm/enricher/algorithm/RSAoaepEnricher.java b/enricher/src/main/java/com/ibm/enricher/algorithm/RSAoaepEnricher.java
@@ -23,7 +23,6 @@
 import com.ibm.mapper.model.INode;
 import com.ibm.mapper.model.Oid;
 import com.ibm.mapper.model.Padding;
-import com.ibm.mapper.model.Signature;
 import com.ibm.mapper.model.algorithms.RSA;
 import com.ibm.mapper.model.padding.OAEP;
 import java.util.Optional;
@@ -39,9 +38,8 @@ public class RSAoaepEnricher implements IEnricher {
                 return node;
             }
             if (padding.get() instanceof OAEP) {
-                final RSA newRSA = new RSA(Signature.class, rsa);
-                newRSA.put(new Oid("1.2.840.113549.1.1.7", rsa.getDetectionContext()));
-                return newRSA;
+                rsa.put(new Oid("1.2.840.113549.1.1.7", rsa.getDetectionContext()));
+                return rsa;
             }
         }
         return node;

diff --git a/...ection/jca/algorithmparametergenerator/JcaAlgorithmParameterGeneratorGetInstanceTest.java b/...ection/jca/algorithmparametergenerator/JcaAlgorithmParameterGeneratorGetInstanceTest.java
@@ -70,6 +70,6 @@ public void asserts(
         INode node = nodes.get(0);
         assertThat(node).isInstanceOf(PublicKeyEncryption.class);
         assertThat(node).isInstanceOf(DH.class);
-        assertThat(node.asString()).isEqualTo("DH");
+        assertThat(node.asString()).isEqualTo("DH-3072");
     }
 }
diff --git a/...les/detection/jca/algorithmparametergenerator/JcaAlgorithmParameterGeneratorInitTest.java b/...les/detection/jca/algorithmparametergenerator/JcaAlgorithmParameterGeneratorInitTest.java
@@ -84,7 +84,7 @@ public void asserts(
         INode publicKeyEncryptionNode = nodes.get(0);
         assertThat(publicKeyEncryptionNode.getKind()).isEqualTo(PublicKeyEncryption.class);
         assertThat(publicKeyEncryptionNode.getChildren()).hasSize(2);
-        assertThat(publicKeyEncryptionNode.asString()).isEqualTo("DH");
+        assertThat(publicKeyEncryptionNode.asString()).isEqualTo("DH-2048");
 
         // KeyLength under PublicKeyEncryption
         INode keyLengthNode = publicKeyEncryptionNode.getChildren().get(KeyLength.class);

diff --git a/...test/java/com/ibm/plugin/rules/detection/jca/algorithmspec/JcaDHGenParameterSpecTest.java b/...test/java/com/ibm/plugin/rules/detection/jca/algorithmspec/JcaDHGenParameterSpecTest.java
@@ -82,7 +82,7 @@ public void asserts(
         INode node = nodes.get(0);
         assertThat(node).isInstanceOf(PublicKeyEncryption.class);
         assertThat(node).isInstanceOf(DH.class);
-        assertThat(node.asString()).isEqualTo("DH");
+        assertThat(node.asString()).isEqualTo("DH-2048");
 
         INode defaultKeyLength = node.getChildren().get(KeyLength.class);
         assertThat(defaultKeyLength).isNotNull();

diff --git a/java/src/test/java/com/ibm/plugin/rules/detection/jca/cipher/JcaCipherInitTest.java b/java/src/test/java/com/ibm/plugin/rules/detection/jca/cipher/JcaCipherInitTest.java
@@ -30,6 +30,7 @@
 import com.ibm.mapper.model.KeyLength;
 import com.ibm.mapper.model.Mode;
 import com.ibm.mapper.model.Padding;
+import com.ibm.mapper.model.PublicKeyEncryption;
 import com.ibm.mapper.model.functionality.Decrypt;
 import com.ibm.plugin.TestBase;
 import java.util.List;
@@ -78,8 +79,8 @@ public void asserts(
          */
         assertThat(nodes).hasSize(1);
         INode node = nodes.get(0);
-        assertThat(node).isInstanceOf(com.ibm.mapper.model.Algorithm.class);
-        assertThat(node.asString()).isEqualTo("RSA");
+        assertThat(node).isInstanceOf(PublicKeyEncryption.class);
+        assertThat(node.asString()).isEqualTo("RSA-2048");
 
         INode mode = node.getChildren().get(Mode.class);
         assertThat(mode).isNotNull();

diff --git a/...m/plugin/rules/detection/jca/keyagreement/JcaKeyAgreementGenerateSecretAlgorithmTest.java b/...m/plugin/rules/detection/jca/keyagreement/JcaKeyAgreementGenerateSecretAlgorithmTest.java
@@ -81,7 +81,7 @@ public void asserts(
         assertThat(nodes).hasSize(1);
         INode node = nodes.get(0);
         assertThat(node).isNotNull();
-        assertThat(node.asString()).isEqualTo("DH");
+        assertThat(node.asString()).isEqualTo("DH-3072");
         assertThat(node.is(PublicKeyEncryption.class)).isTrue();
 
         INode oid = node.getChildren().get(Oid.class);

diff --git a/...ibm/plugin/rules/detection/jca/keyagreement/JcaKeyAgreementGenerateSecretKeySizeTest.java b/...ibm/plugin/rules/detection/jca/keyagreement/JcaKeyAgreementGenerateSecretKeySizeTest.java
@@ -78,7 +78,7 @@ public void asserts(
         assertThat(nodes).hasSize(1);
         INode node = nodes.get(0);
         assertThat(node).isNotNull();
-        assertThat(node.asString()).isEqualTo("DH");
+        assertThat(node.asString()).isEqualTo("DH-2048");
 
         INode oid = node.getChildren().get(Oid.class);
         assertThat(oid).isNotNull();

diff --git a/...va/com/ibm/plugin/rules/detection/jca/keyagreement/JcaKeyAgreementGenerateSecretTest.java b/...va/com/ibm/plugin/rules/detection/jca/keyagreement/JcaKeyAgreementGenerateSecretTest.java
@@ -70,7 +70,7 @@ public void asserts(
         assertThat(nodes).hasSize(1);
         INode node = nodes.get(0);
         assertThat(node).isNotNull();
-        assertThat(node.asString()).isEqualTo("DH");
+        assertThat(node.asString()).isEqualTo("DH-3072");
 
         INode oid = node.getChildren().get(Oid.class);
         assertThat(oid).isNotNull();

diff --git a/.../java/com/ibm/plugin/rules/detection/jca/keyagreement/JcaKeyAgreementGetInstanceTest.java b/.../java/com/ibm/plugin/rules/detection/jca/keyagreement/JcaKeyAgreementGetInstanceTest.java
@@ -25,7 +25,8 @@
 import com.ibm.engine.model.Algorithm;
 import com.ibm.engine.model.IValue;
 import com.ibm.engine.model.context.KeyAgreementContext;
-import com.ibm.mapper.model.*;
+import com.ibm.mapper.model.INode;
+import com.ibm.mapper.model.KeyLength;
 import com.ibm.plugin.TestBase;
 import java.util.List;
 import org.jetbrains.annotations.NotNull;
@@ -67,7 +68,7 @@ public void asserts(
         assertThat(nodes).hasSize(1);
         INode node = nodes.get(0);
         assertThat(node).isNotNull();
-        assertThat(node.asString()).isEqualTo("DH");
+        assertThat(node.asString()).isEqualTo("DH-3072");
 
         INode keyLength = node.getChildren().get(KeyLength.class);
         assertThat(keyLength).isNotNull();

diff --git a/...rc/test/java/com/ibm/plugin/rules/detection/jca/keyagreement/JcaKeyAgreementInitTest.java b/...rc/test/java/com/ibm/plugin/rules/detection/jca/keyagreement/JcaKeyAgreementInitTest.java
@@ -79,7 +79,7 @@ public void asserts(
         assertThat(nodes).hasSize(1);
         INode node = nodes.get(0);
         assertThat(node).isNotNull();
-        assertThat(node.asString()).isEqualTo("DH");
+        assertThat(node.asString()).isEqualTo("DH-512");
 
         INode keyLength = node.getChildren().get(KeyLength.class);
         assertThat(keyLength).isNotNull();

diff --git a/...rc/test/java/com/ibm/plugin/rules/detection/jca/keyfactory/JcaKeyFactoryGenerateTest.java b/...rc/test/java/com/ibm/plugin/rules/detection/jca/keyfactory/JcaKeyFactoryGenerateTest.java
@@ -104,7 +104,7 @@ public void asserts(
 
         INode algorithm = node.getChildren().get(com.ibm.mapper.model.PublicKeyEncryption.class);
         assertThat(algorithm).isNotNull();
-        assertThat(algorithm.asString()).isEqualTo("RSA");
+        assertThat(algorithm.asString()).isEqualTo("RSA-2048");
 
         INode defaultKeyLength = algorithm.getChildren().get(KeyLength.class);
         assertThat(defaultKeyLength).isNotNull();

diff --git a/...test/java/com/ibm/plugin/rules/detection/jca/keyfactory/JcaKeyFactoryGetInstanceTest.java b/...test/java/com/ibm/plugin/rules/detection/jca/keyfactory/JcaKeyFactoryGetInstanceTest.java
@@ -25,7 +25,10 @@
 import com.ibm.engine.model.Algorithm;
 import com.ibm.engine.model.IValue;
 import com.ibm.engine.model.context.KeyContext;
-import com.ibm.mapper.model.*;
+import com.ibm.mapper.model.INode;
+import com.ibm.mapper.model.Key;
+import com.ibm.mapper.model.KeyLength;
+import com.ibm.mapper.model.PublicKeyEncryption;
 import com.ibm.plugin.TestBase;
 import java.util.List;
 import javax.annotation.Nonnull;
@@ -75,7 +78,7 @@ public void asserts(
 
         INode blockCipher = node.getChildren().get(PublicKeyEncryption.class);
         assertThat(blockCipher).isNotNull();
-        assertThat(blockCipher.asString()).isEqualTo("RSA");
+        assertThat(blockCipher.asString()).isEqualTo("RSA-2048");
 
         INode defaultKeyLength = blockCipher.getChildren().get(KeyLength.class);
         assertThat(defaultKeyLength).isNotNull();

diff --git a/.../com/ibm/plugin/rules/detection/jca/keyfactory/JcaSecretKeyFactoryGenerateSecretTest.java b/.../com/ibm/plugin/rules/detection/jca/keyfactory/JcaSecretKeyFactoryGenerateSecretTest.java
@@ -85,7 +85,7 @@ public void asserts(
 
         INode blockCipher = node.getChildren().get(BlockCipher.class);
         assertThat(blockCipher).isNotNull();
-        assertThat(blockCipher.asString()).isEqualTo("DES");
+        assertThat(blockCipher.asString()).isEqualTo("DES56");
 
         INode defaultKeyLength = blockCipher.getChildren().get(KeyLength.class);
         assertThat(defaultKeyLength).isNotNull();

diff --git a/...ava/com/ibm/plugin/rules/detection/jca/keyfactory/JcaSecretKeyFactoryGetInstanceTest.java b/...ava/com/ibm/plugin/rules/detection/jca/keyfactory/JcaSecretKeyFactoryGetInstanceTest.java
@@ -25,7 +25,10 @@
 import com.ibm.engine.model.Algorithm;
 import com.ibm.engine.model.IValue;
 import com.ibm.engine.model.context.SecretKeyContext;
-import com.ibm.mapper.model.*;
+import com.ibm.mapper.model.BlockCipher;
+import com.ibm.mapper.model.INode;
+import com.ibm.mapper.model.KeyLength;
+import com.ibm.mapper.model.SecretKey;
 import com.ibm.plugin.TestBase;
 import java.util.List;
 import javax.annotation.Nonnull;
@@ -75,7 +78,7 @@ public void asserts(
 
         INode blockCipher = node.getChildren().get(BlockCipher.class);
         assertThat(blockCipher).isNotNull();
-        assertThat(blockCipher.asString()).isEqualTo("DES");
+        assertThat(blockCipher.asString()).isEqualTo("DES56");
 
         INode defaultKeyLength = blockCipher.getChildren().get(KeyLength.class);
         assertThat(defaultKeyLength).isNotNull();

diff --git a/...va/com/ibm/plugin/rules/detection/jca/keyfactory/JcaSecretKeyFactoryTranslateKeyTest.java b/...va/com/ibm/plugin/rules/detection/jca/keyfactory/JcaSecretKeyFactoryTranslateKeyTest.java
@@ -97,7 +97,7 @@ public void asserts(
 
             INode blockCipher = node.getChildren().get(BlockCipher.class);
             assertThat(blockCipher).isNotNull();
-            assertThat(blockCipher.asString()).isEqualTo("DES");
+            assertThat(blockCipher.asString()).isEqualTo("DES56");
 
             INode defaultKeyLength = blockCipher.getChildren().get(KeyLength.class);
             assertThat(defaultKeyLength).isNotNull();

diff --git a/...com/ibm/plugin/rules/detection/jca/keygenerator/JcaKeyGeneratorInitParameterSpecTest.java b/...com/ibm/plugin/rules/detection/jca/keygenerator/JcaKeyGeneratorInitParameterSpecTest.java
@@ -74,7 +74,7 @@ public void asserts(
 
         INode algorithm = node.getChildren().get(BlockCipher.class);
         assertThat(algorithm).isNotNull();
-        assertThat(algorithm.asString()).isEqualTo("DES");
+        assertThat(algorithm.asString()).isEqualTo("DES56");
 
         INode keyLength = algorithm.getChildren().get(KeyLength.class);
         assertThat(keyLength).isNotNull();

diff --git a/...a/com/ibm/plugin/rules/detection/jca/keygenerator/JcaKeyPairGeneratorGetInstanceTest.java b/...a/com/ibm/plugin/rules/detection/jca/keygenerator/JcaKeyPairGeneratorGetInstanceTest.java
@@ -25,7 +25,10 @@
 import com.ibm.engine.model.Algorithm;
 import com.ibm.engine.model.IValue;
 import com.ibm.engine.model.context.KeyContext;
-import com.ibm.mapper.model.*;
+import com.ibm.mapper.model.INode;
+import com.ibm.mapper.model.Key;
+import com.ibm.mapper.model.KeyLength;
+import com.ibm.mapper.model.PublicKeyEncryption;
 import com.ibm.plugin.TestBase;
 import java.util.List;
 import javax.annotation.Nonnull;
@@ -74,7 +77,7 @@ public void asserts(
 
         INode blockCipher = node.getChildren().get(PublicKeyEncryption.class);
         assertThat(blockCipher).isNotNull();
-        assertThat(blockCipher.asString()).isEqualTo("RSA");
+        assertThat(blockCipher.asString()).isEqualTo("RSA-2048");
 
         INode keyLength = blockCipher.getChildren().get(KeyLength.class);
         assertThat(keyLength).isNotNull();

diff --git a/...va/com/ibm/plugin/rules/detection/jca/keygenerator/JcaKeyPairGeneratorInitializeTest.java b/...va/com/ibm/plugin/rules/detection/jca/keygenerator/JcaKeyPairGeneratorInitializeTest.java
@@ -88,7 +88,7 @@ public void asserts(
 
         INode blockCipher = node.getChildren().get(PublicKeyEncryption.class);
         assertThat(blockCipher).isNotNull();
-        assertThat(blockCipher.asString()).isEqualTo("RSA");
+        assertThat(blockCipher.asString()).isEqualTo("RSA-2048");
 
         INode keyLength = blockCipher.getChildren().get(KeyLength.class);
         assertThat(keyLength).isNotNull();

diff --git a/java/src/test/java/com/ibm/plugin/rules/detection/jca/keyspec/JcaDESKeySpecTest.java b/java/src/test/java/com/ibm/plugin/rules/detection/jca/keyspec/JcaDESKeySpecTest.java
@@ -93,7 +93,7 @@ public void asserts(
 
         INode blockCipher = node.getChildren().get(BlockCipher.class);
         assertThat(blockCipher).isNotNull();
-        assertThat(blockCipher.asString()).isEqualTo("DES");
+        assertThat(blockCipher.asString()).isEqualTo("DES56");
 
         keyLength = blockCipher.getChildren().get(KeyLength.class);
         assertThat(keyLength).isNotNull();

diff --git a/...rc/test/java/com/ibm/plugin/rules/detection/jca/signature/JcaSignatureActionSignTest.java b/...rc/test/java/com/ibm/plugin/rules/detection/jca/signature/JcaSignatureActionSignTest.java
@@ -89,7 +89,7 @@ public void asserts(
         INode signatureNode = nodes.get(0);
         assertThat(signatureNode.getKind()).isEqualTo(Signature.class);
         assertThat(signatureNode.getChildren()).hasSize(4);
-        assertThat(signatureNode.asString()).isEqualTo("DSA");
+        assertThat(signatureNode.asString()).isEqualTo("SHA384withDSA");
 
         // KeyLength under Signature
         INode keyLengthNode = signatureNode.getChildren().get(KeyLength.class);

diff --git a/.../test/java/com/ibm/plugin/rules/detection/jca/signature/JcaSignatureActionVerifyTest.java b/.../test/java/com/ibm/plugin/rules/detection/jca/signature/JcaSignatureActionVerifyTest.java
@@ -89,7 +89,7 @@ public void asserts(
         INode signatureNode = nodes.get(0);
         assertThat(signatureNode.getKind()).isEqualTo(Signature.class);
         assertThat(signatureNode.getChildren()).hasSize(4);
-        assertThat(signatureNode.asString()).isEqualTo("DSA");
+        assertThat(signatureNode.asString()).isEqualTo("SHA384withDSA");
 
         // KeyLength under Signature
         INode keyLengthNode = signatureNode.getChildren().get(KeyLength.class);

diff --git a/...c/test/java/com/ibm/plugin/rules/detection/jca/signature/JcaSignatureGetInstanceTest.java b/...c/test/java/com/ibm/plugin/rules/detection/jca/signature/JcaSignatureGetInstanceTest.java
@@ -78,7 +78,7 @@ public void asserts(
         INode signatureNode = nodes.get(0);
         assertThat(signatureNode.getKind()).isEqualTo(Signature.class);
         assertThat(signatureNode.getChildren()).hasSize(3);
-        assertThat(signatureNode.asString()).isEqualTo("DSA");
+        assertThat(signatureNode.asString()).isEqualTo("SHA384withDSA");
 
         // KeyLength under Signature
         INode keyLengthNode = signatureNode.getChildren().get(KeyLength.class);

diff --git a/...test/java/com/ibm/plugin/rules/detection/jca/signature/JcaSignatureSetParameter2Test.java b/...test/java/com/ibm/plugin/rules/detection/jca/signature/JcaSignatureSetParameter2Test.java
@@ -27,12 +27,10 @@
 import com.ibm.engine.model.SaltSize;
 import com.ibm.engine.model.context.SignatureContext;
 import com.ibm.mapper.model.INode;
-import com.ibm.mapper.model.KeyLength;
 import com.ibm.mapper.model.MaskGenerationFunction;
 import com.ibm.mapper.model.MessageDigest;
 import com.ibm.mapper.model.Oid;
 import com.ibm.mapper.model.ProbabilisticSignatureScheme;
-import com.ibm.mapper.model.PublicKeyEncryption;
 import com.ibm.mapper.model.SaltLength;
 import com.ibm.mapper.model.Signature;
 import com.ibm.plugin.TestBase;
@@ -101,19 +99,7 @@ public void asserts(
         assertThat(node.is(ProbabilisticSignatureScheme.class)).isTrue();
         assertThat(node.asString()).isEqualTo("RSASSA-PSS");
 
-        INode algorithm = node.getChildren().get(PublicKeyEncryption.class);
-        assertThat(algorithm).isNotNull();
-        assertThat(algorithm.asString()).isEqualTo("RSA");
-
-        INode oid = algorithm.getChildren().get(Oid.class);
-        assertThat(oid).isNotNull();
-        assertThat(oid.asString()).isEqualTo("1.2.840.113549.1.1.1");
-
-        INode keyLength = algorithm.getChildren().get(KeyLength.class);
-        assertThat(keyLength).isNotNull();
-        assertThat(keyLength.asString()).isEqualTo("2048");
-
-        oid = node.getChildren().get(Oid.class);
+        INode oid = node.getChildren().get(Oid.class);
         assertThat(oid).isNotNull();
         assertThat(oid.asString()).isEqualTo("1.2.840.113549.1.1.10");
 

diff --git a/...test/java/com/ibm/plugin/rules/detection/jca/signature/JcaSignatureSetParameter3Test.java b/...test/java/com/ibm/plugin/rules/detection/jca/signature/JcaSignatureSetParameter3Test.java
@@ -29,12 +29,10 @@
 import com.ibm.mapper.model.BlockSize;
 import com.ibm.mapper.model.DigestSize;
 import com.ibm.mapper.model.INode;
-import com.ibm.mapper.model.KeyLength;
 import com.ibm.mapper.model.MaskGenerationFunction;
 import com.ibm.mapper.model.MessageDigest;
 import com.ibm.mapper.model.Oid;
 import com.ibm.mapper.model.ProbabilisticSignatureScheme;
-import com.ibm.mapper.model.PublicKeyEncryption;
 import com.ibm.mapper.model.SaltLength;
 import com.ibm.mapper.model.functionality.Digest;
 import com.ibm.plugin.TestBase;
@@ -104,28 +102,9 @@ public void asserts(
         INode probabilisticSignatureSchemeNode = nodes.get(0);
         assertThat(probabilisticSignatureSchemeNode.getKind())
                 .isEqualTo(ProbabilisticSignatureScheme.class);
-        assertThat(probabilisticSignatureSchemeNode.getChildren()).hasSize(5);
+        assertThat(probabilisticSignatureSchemeNode.getChildren()).hasSize(4);
         assertThat(probabilisticSignatureSchemeNode.asString()).isEqualTo("RSASSA-PSS");
 
-        // PublicKeyEncryption under ProbabilisticSignatureScheme
-        INode publicKeyEncryptionNode =
-                probabilisticSignatureSchemeNode.getChildren().get(PublicKeyEncryption.class);
-        assertThat(publicKeyEncryptionNode).isNotNull();
-        assertThat(publicKeyEncryptionNode.getChildren()).hasSize(2);
-        assertThat(publicKeyEncryptionNode.asString()).isEqualTo("RSA");
-
-        // KeyLength under PublicKeyEncryption under ProbabilisticSignatureScheme
-        INode keyLengthNode = publicKeyEncryptionNode.getChildren().get(KeyLength.class);
-        assertThat(keyLengthNode).isNotNull();
-        assertThat(keyLengthNode.getChildren()).isEmpty();
-        assertThat(keyLengthNode.asString()).isEqualTo("2048");
-
-        // Oid under PublicKeyEncryption under ProbabilisticSignatureScheme
-        INode oidNode = publicKeyEncryptionNode.getChildren().get(Oid.class);
-        assertThat(oidNode).isNotNull();
-        assertThat(oidNode.getChildren()).isEmpty();
-        assertThat(oidNode.asString()).isEqualTo("1.2.840.113549.1.1.1");
-
         // SaltLength under ProbabilisticSignatureScheme
         INode saltLengthNode = probabilisticSignatureSchemeNode.getChildren().get(SaltLength.class);
         assertThat(saltLengthNode).isNotNull();