org.jgroups.protocols

Class ENCRYPT

public class ENCRYPT extends Protocol

ENCRYPT layer. Encrypt and decrypt the group communication in JGroups The file can be used in two ways:

Each message is identified as encrypted with a specific encryption header which identifies the type of encrypt header and an MD5 digest that identifies the version of the key being used to encrypt/decrypt the messages.

Option 1


This is the simplest option and can be used by simply inserting the Encryption layer at any point in the JGroup stack - it will encrypt all Events of a type MSG that have a non-null message buffer. The format of the entry in this form is:
<ENCRYPT key_store_name="defaultStore.keystore" store_password="changeit" alias="myKey"/>
An example bare-bones.xml file showing the keystore version can be found in the conf ina file called EncryptKeyStore.xml - along with a defaultStore.keystore file.
In order to use the Encrypt layer in this manner it is necessary to have the secretKey already generated in a keystore file. The directory containing the keystore file must be on the application's classpath. You cannot create a SecretKey keystore file using the keytool application shipped with the JDK. A java file called KeyStoreGenerator is included in the demo package that can be used from the command line (or IDE) to generate a suitable keystore.

Option 2


This option is suited to an application that does not ship with a known key but instead it is generated and distributed by the controller. The secret key is first generated by the Controller (in JGroup terms). When a view change occurs a peer will request the secret key by sending a key request with its own public key. The controller encrypts the secret key with this key and sends it back to the peer who then decrypts it and installs the key as its own secret key.
All encryption and decryption of Messages is done using this key. When a peer receives a view change that shows a different keyserver it will repeat this process - the view change event also trigger the encrypt layer to queue up and down messages until the new key is installed. The previous keys are retained so that messages sent before the view change that are queued can be decrypted if the key is different.
An example EncryptNoKeyStore.xml is included in the conf file as a guide.


Note: the current version does not support the concept of perfect forward encryption (PFE) which means that if a peer leaves the group the keys are re-generated preventing the departed peer from decrypting future messages if it chooses to listen in on the group. This is not included as it really requires a suitable authentication scheme as well to make this feature useful as there is nothing to stop the peer rejoining and receiving the new key. A future release will address this issue.

Author: Steve Woodcock

Nested Class Summary
static classENCRYPT.EncryptHeader
Constructor Summary
ENCRYPT()
Method Summary
voiddown(Event evt)
protected StringgetAsymAlgorithm()
protected CiphergetAsymCipher()
protected intgetAsymInit()
protected StringgetAsymProvider()
protected SecretKeygetDesKey()
protected AddressgetKeyServerAddr()
protected StringgetKeyStoreName()
protected KeyPairgetKpair()
protected AddressgetLocal_addr()
StringgetName()
protected PublicKeygetServerPubKey()
protected StringgetSymAlgorithm()
protected CiphergetSymDecodingCipher()
protected CiphergetSymEncodingCipher()
protected intgetSymInit()
protected StringgetSymProvider()
voidinit()
voidinitKeyPair()
Generates the public/private key pair from the init params
voidinitSymKey()
Used to initialise the symmetric key if none is supplied in a keystore.
voidreset()
Just remove if you don't need to reset any state
protected voidsetKeyServerAddr(Address keyServerAddr)
protected voidsetLocal_addr(Address local_addr)
booleansetProperties(Properties props)
voidup(Event evt)

Constructor Detail

ENCRYPT

public ENCRYPT()

Method Detail

down

public void down(Event evt)

getAsymAlgorithm

protected String getAsymAlgorithm()

Returns: Returns the asymAlgorithm.

getAsymCipher

protected Cipher getAsymCipher()

Returns: Returns the asymCipher.

getAsymInit

protected int getAsymInit()

Returns: Returns the asymInit.

getAsymProvider

protected String getAsymProvider()

Returns: Returns the asymProvider.

getDesKey

protected SecretKey getDesKey()

Returns: Returns the desKey.

getKeyServerAddr

protected Address getKeyServerAddr()

Returns: Returns the keyServerAddr.

getKeyStoreName

protected String getKeyStoreName()

Returns: Returns the keyStoreName.

getKpair

protected KeyPair getKpair()

Returns: Returns the kpair.

getLocal_addr

protected Address getLocal_addr()

Returns: Returns the local_addr.

getName

public String getName()

getServerPubKey

protected PublicKey getServerPubKey()

Returns: Returns the serverPubKey.

getSymAlgorithm

protected String getSymAlgorithm()

Returns: Returns the symAlgorithm.

getSymDecodingCipher

protected Cipher getSymDecodingCipher()

Returns: Returns the symDecodingCipher.

getSymEncodingCipher

protected Cipher getSymEncodingCipher()

Returns: Returns the symEncodingCipher.

getSymInit

protected int getSymInit()

Returns: Returns the symInit.

getSymProvider

protected String getSymProvider()

Returns: Returns the symProvider.

init

public void init()

initKeyPair

public void initKeyPair()
Generates the public/private key pair from the init params

Throws: Exception

initSymKey

public void initSymKey()
Used to initialise the symmetric key if none is supplied in a keystore.

Throws: Exception

reset

public void reset()
Just remove if you don't need to reset any state

setKeyServerAddr

protected void setKeyServerAddr(Address keyServerAddr)

Parameters: keyServerAddr The keyServerAddr to set.

setLocal_addr

protected void setLocal_addr(Address local_addr)

Parameters: local_addr The local_addr to set.

setProperties

public boolean setProperties(Properties props)

up

public void up(Event evt)
Copyright ? 1998-2005 Bela Ban. All Rights Reserved.