Reading OpenSSL generated, PEM/DER formatted, S/MIME messages in Java

Question

I need to be able to read in Java a S/MIME file generated from OpenSSL. The openssl command looks like

openssl smime -encrypt -in test_message.txt -out test_out.pem -outform pem certificate.pem

This creates a file that looks like

I am currently using BouncyCastle to try to read in test_out.pem,

....
MimeMessage mimeMessage = new MimeMessage(session, new FileInputStream("test_out.pem"));
SMIMEEnveloped smimeEnveloped = new SMIMEEnveloped(mimeMessage);
...

but I can't figure out how to make it accept a message without the MIME headers, as I get the following error:

java.lang.NullPointerException: null
    at org.bouncycastle.cms.CMSEnvelopedData.<init>(Unknown Source) ~[bcpkix-jdk15on-1.50.jar:1.50.0]
    at org.bouncycastle.cms.CMSEnvelopedData.<init>(Unknown Source) ~[bcpkix-jdk15on-1.50.jar:1.50.0]
    at org.bouncycastle.mail.smime.SMIMEEnveloped.<init>(Unknown Source) ~[bcmail-jdk15on-1.50.jar:1.50.0]

What would be the best way to read a PEM (or DER) formatted file like this in and be able to decrypt it with a java.security.PrivateKey?

You can base64-decode the data after stripping header and footer lines. This way you get binary PKCS#7 which you can then process. — Eugene Mayevski 'Callback, Feb 28 '14 at 06:07
@EugeneMayevski'EldoSCorp True, but I haven't found a way to process raw PKCS#7 binary data. Is BouncyCastle able to do that, or do I need a different library? — user3097988, Feb 28 '14 at 17:06
No idea about BouncyCastle. Our SecureBlackbox does the job well. — Eugene Mayevski 'Callback, Feb 28 '14 at 17:24

wheleph · Answer 1 · 2018-06-13T18:35:45.820

Here's how you can do the decryption using BouncyCastle 1.57 (inspired by this article):

import org.bouncycastle.cms.CMSEnvelopedData;
import org.bouncycastle.cms.CMSException;
import org.bouncycastle.cms.KeyTransRecipientInformation;
import org.bouncycastle.cms.RecipientInformation;
import org.bouncycastle.cms.jcajce.JceKeyTransEnvelopedRecipient;
import org.bouncycastle.cms.jcajce.JceKeyTransRecipient;
import org.bouncycastle.util.encoders.Base64;

import java.security.KeyFactory;
import java.security.NoSuchAlgorithmException;
import java.security.PrivateKey;
import java.security.spec.InvalidKeySpecException;
import java.security.spec.PKCS8EncodedKeySpec;
import java.util.Collection;

public class PKCS7Decryptor {

    private PrivateKey privateKey;

    public PKCS7Decryptor(String privateKeyStr) {
        try {
            byte[] privateKeyData = extractRawData(privateKeyStr, "PRIVATE KEY");
            PKCS8EncodedKeySpec kspec = new PKCS8EncodedKeySpec(privateKeyData);
            KeyFactory kf = KeyFactory.getInstance("RSA");
            privateKey = kf.generatePrivate(kspec);
        } catch (NoSuchAlgorithmException | InvalidKeySpecException e) {
            throw new RuntimeException("Unable to parse private key");
        }
    }

    public String decrypt(String encryptedText) throws CMSException {
        byte[] data = extractRawData(encryptedText, "PKCS7");

        CMSEnvelopedData envelopedData = new CMSEnvelopedData(data);

        Collection<RecipientInformation> recipients = envelopedData.getRecipientInfos().getRecipients();
        KeyTransRecipientInformation recipientInfo = (KeyTransRecipientInformation) recipients.iterator().next();
        JceKeyTransRecipient recipient = new JceKeyTransEnvelopedRecipient(privateKey);

        return new String(recipientInfo.getContent(recipient));
    }

    private byte[] extractRawData(String text, String dataType) {
        return Base64.decode(text
                .replace(String.format("-----BEGIN %s-----", dataType), "")
                .replace(String.format("-----END %s-----", dataType), ""));
    }
}

Some explanation:

In the class constructor the private key is converted to a proper format
Headers and footers (like "-----BEGIN PKCS7-----") are removed and the content is base64-decoded

Reading OpenSSL generated, PEM/DER formatted, S/MIME messages in Java

1 Answers1