mil.dod.th.ose.remote/src/mil/dod/th/ose/remote/encryption/EncryptMessageServiceImpl.java
@Override
    public TerraHarvestMessage encryptMessage(final TerraHarvestMessage.Builder message,
                                              final TerraHarvestPayload payload)
         
    {
        if (message.getEncryptType().equals(EncryptType.NONE))
        {
            return message.setTerraHarvestPayload(payload.toByteString()).build();
        }

        final int remoteSystemId = message.getDestId();
        final int localSystemId = message.getSourceId();
        
        // One Pass Diffie-Hellman key exchange per "Suite B Implementers' Guide to NIST SP 800-56A" section 3.2
        // for store and forward applications. Basically, we generate an ephemeral (temporary) key pair for each
        // message and then use ECDH with the ephemeral private key and the recipient's static (preloaded) public
        // key to generate an AES key that is used to encrypt the message. The ephemeral public key is sent along
        // with the message, and is signed with the sender's static private key to allow the recipient to authenticate
        // the sender. The receiver uses ECDH with its static private key and the ephemeral public key received with the
        // message to generate the AES key used to decrypt the message as previously described. This is basically the
        // technique used for S/MIME email.
        //
        //create a ephemeral key pair for the source
        final AsymmetricCipherKeyPair ephemeralKeyPair = EncryptionUtility.createKeyPair();
        final byte[] ephemeralPublicKey = 
                ((ECPublicKeyParameters)ephemeralKeyPair.getPublic()).getQ().getEncoded(false);
        
        //Now sign the ephemeral public key with source private static key.
        // To follow the guidance exactly, we should use a separate private key for the signing operation and the
        // encryption operation (see the Suite B Implementer's Guide section 8.2 as well as NIST SP 800-57 section 5.2.)
        // We don't do this right now for simplicity. We may want to change this later 
        //(which would mean we'd need to load two sets of keys for each System.)
        
        final DSADigestSigner dsaSigner = new DSADigestSigner(new ECDSASigner(), new SHA256Digest()); 
        dsaSigner.init(true, getPrivateStaticKey());
        
        //If we realize it here, we don't use the whole message, instead just use the Ephemeral public key from source
        //and sign it using Astatic priv key. This is done because whole message signature would take a long time,
        //just signing the ephemeral public key with Source static private key will save time. 
        
        dsaSigner.update(ephemeralPublicKey, 0, ephemeralPublicKey.length);
        final byte[] ephemeralSignature = dsaSigner.generateSignature();
        
        //generate the shared KDF key
        final byte[] sharedKeyBytesEncrypt = EncryptionUtility.sharedEcdhKeyCreate(
                    (ECPrivateKeyParameters)ephemeralKeyPair.getPrivate(), getRemotePublicKey(remoteSystemId), 
                    localSystemId, remoteSystemId);
        final Key key = new SecretKeySpec(sharedKeyBytesEncrypt, ENCRYPT_ALGORITHM_AES);
        //create the initialization vector for length =12
        //final SecureRandom rngBC1 = new SecureRandom();
        final byte[] ivBytes = new byte[m_IvLength];
        EncryptionUtility.RANDOM_BC.nextBytes(ivBytes);
        final IvParameterSpec ivBytes_New = new IvParameterSpec(ivBytes);
        
        final byte[] encrypt;
        try
        {
            m_Input.init(Cipher.ENCRYPT_MODE, key, ivBytes_New);
            encrypt = m_Input.doFinal(payload.toByteArray());
        } 
        catch (final InvalidKeyException e) 
        {
            throw new IllegalArgumentException(" Key returned by KDF does not meet specification", e);
        } 
        catch (final InvalidAlgorithmParameterException e)
        {
            throw new IllegalArgumentException(" Inappropriate Algorithm parameters", e);
        }
        catch (final IllegalBlockSizeException e)
        {
            throw new IllegalArgumentException(" Data and block size are not aligned", e);
        }
        catch (final BadPaddingException e)
        {
            throw new IllegalArgumentException(" Data is not padded appropriately for the padding mechanism", e);
        }

        //build EncryptInfo
        final EncryptInfo encryptInfo = EncryptInfo.newBuilder().
                setEphemeralKey(ByteString.copyFrom(ephemeralPublicKey)).
                setEphemeralKeySignature(ByteString.copyFrom(ephemeralSignature)).
                setInitializationVector(ByteString.copyFrom(ivBytes)).
                build();
  
        //build the message containing encrypted payload information
        return message.setTerraHarvestPayload(ByteString.copyFrom(encrypt)).setEncryptInfo(encryptInfo).build();
        
    }
/**
     * Encrypt the payload information from the message.
     * 
     * @return bytes
     *       Encrypted payload
     * @param message
     *      TerraHarvestMessage before encryption
     * @param payload
     *      TerraHarvestpayload before encryption     
     */
Encrypt the payload information from the message.

@return bytes
Encrypted payload
@param message
TerraHarvestMessage before encryption
@param payload
TerraHarvestpayload before encryption
Encrypt the payload information from the message . @return bytes Encrypted payload @param message TerraHarvestMessage before encryption @param payload TerraHarvestpayload before encryption
@Override
    public TerraHarvestMessage encryptMessage(final TerraHarvestMessage.Builder message,
                                              final TerraHarvestPayload payload)
    {
        if (message.getEncryptType().equals(EncryptType.NONE))
        {
            return message.setTerraHarvestPayload(payload.toByteString()).build();
        }
        final int remoteSystemId = message.getDestId();
        final int localSystemId = message.getSourceId();
        create a ephemeral key pair for the source
        final AsymmetricCipherKeyPair ephemeralKeyPair = EncryptionUtility.createKeyPair();
        final byte[] ephemeralPublicKey = 
                ((ECPublicKeyParameters)ephemeralKeyPair.getPublic()).getQ().getEncoded(false);
        Now sign the ephemeral public key with source private static key.
         To follow the guidance exactly, we should use a separate private key for the signing operation and the
         encryption operation (see the Suite B Implementer's Guide section 8.2 as well as NIST SP 800-57 section 5.2.)
         We don't do this right now for simplicity. We may want to change this later 
        (which would mean we'd need to load two sets of keys for each System.)
        final DSADigestSigner dsaSigner = new DSADigestSigner(new ECDSASigner(), new SHA256Digest()); 
        dsaSigner.init(true, getPrivateStaticKey());
        If we realize it here, we don't use the whole message, instead just use the Ephemeral public key from source
        and sign it using Astatic priv key. This is done because whole message signature would take a long time,
        just signing the ephemeral public key with Source static private key will save time. 
        dsaSigner.update(ephemeralPublicKey, 0, ephemeralPublicKey.length);
        final byte[] ephemeralSignature = dsaSigner.generateSignature();
        generate the shared KDF key
        final byte[] sharedKeyBytesEncrypt = EncryptionUtility.sharedEcdhKeyCreate(
                    (ECPrivateKeyParameters)ephemeralKeyPair.getPrivate(), getRemotePublicKey(remoteSystemId), 
                    localSystemId, remoteSystemId);
        final Key key = new SecretKeySpec(sharedKeyBytesEncrypt, ENCRYPT_ALGORITHM_AES);
        create the initialization vector for length =12
        final SecureRandom rngBC1 = new SecureRandom();
        final byte[] ivBytes = new byte[m_IvLength];
        EncryptionUtility.RANDOM_BC.nextBytes(ivBytes);
        final IvParameterSpec ivBytes_New = new IvParameterSpec(ivBytes);
        final byte[] encrypt;
        try
        {
            m_Input.init(Cipher.ENCRYPT_MODE, key, ivBytes_New);
            encrypt = m_Input.doFinal(payload.toByteArray());
        } 
        catch (final InvalidKeyException e) 
        {
            throw new IllegalArgumentException(" Key returned by KDF does not meet specification", e);
        } 
        catch (final InvalidAlgorithmParameterException e)
        {
            throw new IllegalArgumentException(" Inappropriate Algorithm parameters", e);
        }
        catch (final IllegalBlockSizeException e)
        {
            throw new IllegalArgumentException(" Data and block size are not aligned", e);
        }
        catch (final BadPaddingException e)
        {
            throw new IllegalArgumentException(" Data is not padded appropriately for the padding mechanism", e);
        }
        build EncryptInfo
        final EncryptInfo encryptInfo = EncryptInfo.newBuilder().
                setEphemeralKey(ByteString.copyFrom(ephemeralPublicKey)).
                setEphemeralKeySignature(ByteString.copyFrom(ephemeralSignature)).
                setInitializationVector(ByteString.copyFrom(ivBytes)).
                build();
        build the message containing encrypted payload information
        return message.setTerraHarvestPayload(ByteString.copyFrom(encrypt)).setEncryptInfo(encryptInfo).build();
    }
@ Override public TerraHarvestMessage encryptMessage ( final TerraHarvestMessage . Builder message , final TerraHarvestPayload payload ) { if ( message . getEncryptType ( ) . equals ( EncryptType . NONE ) ) { return message . setTerraHarvestPayload ( payload . toByteString ( ) ) . build ( ) ; } final int remoteSystemId = message . getDestId ( ) ; final int localSystemId = message . getSourceId ( ) ; final AsymmetricCipherKeyPair ephemeralKeyPair = EncryptionUtility . createKeyPair ( ) ; final byte [ ] ephemeralPublicKey = ( ( ECPublicKeyParameters ) ephemeralKeyPair . getPublic ( ) ) . getQ ( ) . getEncoded ( false ) ; final DSADigestSigner dsaSigner = new DSADigestSigner ( new ECDSASigner ( ) , new SHA256Digest ( ) ) ; dsaSigner . init ( true , getPrivateStaticKey ( ) ) ; dsaSigner . update ( ephemeralPublicKey , 0 , ephemeralPublicKey . length ) ; final byte [ ] ephemeralSignature = dsaSigner . generateSignature ( ) ; final byte [ ] sharedKeyBytesEncrypt = EncryptionUtility . sharedEcdhKeyCreate ( ( ECPrivateKeyParameters ) ephemeralKeyPair . getPrivate ( ) , getRemotePublicKey ( remoteSystemId ) , localSystemId , remoteSystemId ) ; final Key key = new SecretKeySpec ( sharedKeyBytesEncrypt , ENCRYPT_ALGORITHM_AES ) ; final byte [ ] ivBytes = new byte [ m_IvLength ] ; EncryptionUtility . RANDOM_BC . nextBytes ( ivBytes ) ; final IvParameterSpec ivBytes_New = new IvParameterSpec ( ivBytes ) ; final byte [ ] encrypt ; try { m_Input . init ( Cipher . ENCRYPT_MODE , key , ivBytes_New ) ; encrypt = m_Input . doFinal ( payload . toByteArray ( ) ) ; } catch ( final InvalidKeyException e ) { throw new IllegalArgumentException ( " Key returned by KDF does not meet specification" , e ) ; } catch ( final InvalidAlgorithmParameterException e ) { throw new IllegalArgumentException ( " Inappropriate Algorithm parameters" , e ) ; } catch ( final IllegalBlockSizeException e ) { throw new IllegalArgumentException ( " Data and block size are not aligned" , e ) ; } catch ( final BadPaddingException e ) { throw new IllegalArgumentException ( " Data is not padded appropriately for the padding mechanism" , e ) ; } final EncryptInfo encryptInfo = EncryptInfo . newBuilder ( ) . setEphemeralKey ( ByteString . copyFrom ( ephemeralPublicKey ) ) . setEphemeralKeySignature ( ByteString . copyFrom ( ephemeralSignature ) ) . setInitializationVector ( ByteString . copyFrom ( ivBytes ) ) . build ( ) ; return message . setTerraHarvestPayload ( ByteString . copyFrom ( encrypt ) ) . setEncryptInfo ( encryptInfo ) . build ( ) ; }
Encrypt the payload information from the message.
Encrypt the payload information from the message .
// One Pass Diffie-Hellman key exchange per "Suite B Implementers' Guide to NIST SP 800-56A" section 3.2 // for store and forward applications. Basically, we generate an ephemeral (temporary) key pair for each // message and then use ECDH with the ephemeral private key and the recipient's static (preloaded) public // key to generate an AES key that is used to encrypt the message. The ephemeral public key is sent along // with the message, and is signed with the sender's static private key to allow the recipient to authenticate // the sender. The receiver uses ECDH with its static private key and the ephemeral public key received with the // message to generate the AES key used to decrypt the message as previously described. This is basically the // technique used for S/MIME email. // //create a ephemeral key pair for the source //Now sign the ephemeral public key with source private static key. // To follow the guidance exactly, we should use a separate private key for the signing operation and the // encryption operation (see the Suite B Implementer's Guide section 8.2 as well as NIST SP 800-57 section 5.2.) // We don't do this right now for simplicity. We may want to change this later  //(which would mean we'd need to load two sets of keys for each System.) //If we realize it here, we don't use the whole message, instead just use the Ephemeral public key from source //and sign it using Astatic priv key. This is done because whole message signature would take a long time, //just signing the ephemeral public key with Source static private key will save time.  //generate the shared KDF key //create the initialization vector for length =12 //final SecureRandom rngBC1 = new SecureRandom(); //build EncryptInfo //build the message containing encrypted payload information