Securing your API using Spring Security

  
1
2
3
4
5

  
package nl.acme.carapp.model;

public enum AuthorityName {
    USER, ADMIN
}

  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

  
package nl.acme.carapp.model;

import jakarta.persistence.*;
import lombok.Getter;
import lombok.Setter;
import org.springframework.security.core.GrantedAuthority;

import java.util.List;

@Entity
@Getter
@Setter
public class Authority implements GrantedAuthority {

    @Id
    @GeneratedValue(strategy= GenerationType.IDENTITY)
    private long id;

    @Column(nullable = false)
    @Enumerated(EnumType.STRING)
    private AuthorityName name;

    @ManyToMany(mappedBy = "authorities", fetch = FetchType.LAZY)
    private List<User> users;

    @Override
    public String toString() {
        return "Authority{" +
                "id=" + id +
                ", name=" + name +
                '}';
    }

    @Override
    public String getAuthority() {
        return this.name.name();
    }
}

  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94

  
package nl.acme.carapp.model;

import com.fasterxml.jackson.annotation.JsonIgnore;
import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
import jakarta.persistence.CascadeType;
import jakarta.persistence.Column;
import jakarta.persistence.Entity;
import jakarta.persistence.FetchType;
import jakarta.persistence.GeneratedValue;
import jakarta.persistence.GenerationType;
import jakarta.persistence.Id;
import jakarta.persistence.JoinColumn;
import jakarta.persistence.JoinTable;
import jakarta.persistence.ManyToMany;
import lombok.EqualsAndHashCode;
import lombok.Getter;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;

import java.util.ArrayList;
import java.util.Collection;
import java.util.List;

@Entity
@EqualsAndHashCode(of = {"id"})
public class User implements UserDetails {

    @Getter
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    @Getter
    @Column(nullable = false, unique = true)
    private String username;

    @Column(nullable = false)
    private String password;

    @ManyToMany(cascade = CascadeType.ALL, fetch = FetchType.EAGER)
    @JoinTable(
            name = "USER_AUTHORITY",
            joinColumns = {@JoinColumn(name = "USER_ID", referencedColumnName = "ID")},
            inverseJoinColumns = {@JoinColumn(name = "AUTHORITY_ID", referencedColumnName = "ID")})
    private final List<Authority> authorities = new ArrayList<>();

    public User() {}

    public User(String username, String password, Authority authority) {
        this.username = username;
        this.password = password;
        this.authorities.add(authority);
    }

    @JsonIgnore
    public String getPassword() {
        return password;
    }

    @Override
    public boolean isAccountNonExpired() {
        return true;
    }

    @Override
    public boolean isAccountNonLocked() {
        return true;
    }

    @Override
    public boolean isCredentialsNonExpired() {
        return true;
    }

    @Override
    public boolean isEnabled() {
        return true;
    }

    @JsonIgnoreProperties("users")
    @Override
    public Collection<? extends GrantedAuthority> getAuthorities() {
        return authorities;
    }

    @Override
    public String toString() {
        return "User{" +
                "id=" + id +
                ", username='" + username + '\'' +
                ", authorities=" + authorities +
                '}';
    }
}

  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69

  
package nl.acme.carapp.service;

import jakarta.transaction.Transactional;
import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j;
import nl.acme.carapp.config.InitProperties;
import nl.acme.carapp.dto.SignUpRequest;
import nl.acme.carapp.model.Authority;
import nl.acme.carapp.model.AuthorityName;
import nl.acme.carapp.model.Car;
import nl.acme.carapp.model.User;
import nl.acme.carapp.repository.AuthorityRepository;
import nl.acme.carapp.repository.CarRepository;
import nl.acme.carapp.repository.UserRepository;
import org.springframework.boot.CommandLineRunner;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Service;

import java.util.List;

@Service
@Slf4j
@RequiredArgsConstructor
public class InitService implements CommandLineRunner {

    private final AuthorityRepository authorityRepository;
    private final CarRepository carRepository;
    private final UserRepository userRepository;
    private final PasswordEncoder passwordEncoder;
    private final InitProperties initProperties;

    @Override
    @Transactional
    public void run(String... args) {
        this.userRepository.deleteAll();
        this.authorityRepository.deleteAll();

        initAuthorities();
        initUsers();
        initCars();
    }

    private void initAuthorities() {
        for (AuthorityName authorityName : AuthorityName.values()) {
            Authority authority = new Authority();
            authority.setName(authorityName);
            this.authorityRepository.save(authority);
        }
    }

    public void initUsers() {
        for (SignUpRequest signUpRequest : this.initProperties.getSignUpRequests()) {
            User user = new User(signUpRequest.username(), passwordEncoder.encode(signUpRequest.password()), this.authorityRepository.findByName(signUpRequest.role()));
            this.userRepository.save(user);
        }
    }

    public void initCars() {
        this.carRepository.deleteAll();
        List<String> carNames = this.initProperties.getCars();
        for (int i = 1; i <= 3; i++) {
            Car car = new Car();
            car.setBrand(carNames.get(i - 1));
            car.setMileage(1000 * i);
            car.setLicensePlate("%s9-BB-CC".formatted(i));
            this.carRepository.save(car);
        }
    }
}

  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

  
package nl.acme.carapp.config;

import lombok.Getter;
import lombok.Setter;
import nl.acme.carapp.dto.SignUpRequest;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.stereotype.Component;

import java.util.List;

@Component
@ConfigurationProperties(prefix="realm")
@Getter
@Setter
public class InitProperties {
    private List<SignUpRequest> signUpRequests;
    private List<String> cars;
}

  
1
2
3
4
5
6

  
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>3.2.5</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>

  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85

  
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>nl.acme</groupId>
    <artifactId>carapp</artifactId>
    <version>3.3.0</version>
    <name>carapp</name>
    <description>Scaffolded carapp application by Carpago Software</description>

    <parent>
        <groupId>nl.carpago.acme.security</groupId>
        <artifactId>api-and-ui-security</artifactId>
        <version>3.3.0</version>
    </parent>

    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-jpa</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-rest</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-devtools</artifactId>
            <scope>runtime</scope>
            <optional>true</optional>
        </dependency>
        <dependency>
            <groupId>com.mysql</groupId>
            <artifactId>mysql-connector-j</artifactId>
            <scope>runtime</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <!-- for the JWT token generation -->
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
        </dependency>
        <dependency>
            <!-- Handy for autocompletion in application.yaml -->
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-configuration-processor</artifactId>
            <scope>compile</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-docker-compose</artifactId>
            <scope>runtime</scope>
        </dependency>
    </dependencies>
    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-failsafe-plugin</artifactId>
            </plugin>
        </plugins>
    </build>
</project>

  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

  
package nl.acme.carapp.service;

import lombok.RequiredArgsConstructor;
import nl.acme.carapp.model.User;
import nl.acme.carapp.repository.UserRepository;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

@Service
@RequiredArgsConstructor
public class MyUserDetailsServiceImpl implements UserDetailsService {

    private final UserRepository userRepository;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

        User user = userRepository.findByUsername(username);
        if (user == null) {
            throw new UsernameNotFoundException("No user found with username '%s'.".formatted(username));
        } else {
            return user;
        }
    }
}

  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90

  
package nl.acme.carapp.config;

import com.nimbusds.jose.jwk.JWK;
import com.nimbusds.jose.jwk.JWKSet;
import com.nimbusds.jose.jwk.RSAKey;
import com.nimbusds.jose.jwk.source.ImmutableJWKSet;
import com.nimbusds.jose.jwk.source.JWKSource;
import com.nimbusds.jose.proc.SecurityContext;
import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j;
import nl.acme.carapp.service.MyUserDetailsServiceImpl;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.oauth2.jwt.JwtDecoder;
import org.springframework.security.oauth2.jwt.JwtEncoder;
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
import org.springframework.security.oauth2.jwt.NimbusJwtEncoder;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.util.Assert;

import static org.springframework.security.config.Customizer.withDefaults;

@Configuration
@EnableWebSecurity
@EnableMethodSecurity(securedEnabled = true,
        prePostEnabled = false)
@Slf4j
@RequiredArgsConstructor
public class SecurityConfig {

    private final RsaKeyProperties rsaKeys;

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public JwtDecoder jwtDecoder() {
        return NimbusJwtDecoder.withPublicKey(rsaKeys.publicKey()).build();
    }

    @Bean
    public JwtEncoder jwtEncoder() {
        JWK jwk = new RSAKey.Builder(rsaKeys.publicKey()).privateKey(rsaKeys.privateKey()).build();
        JWKSource<SecurityContext> jwks = new ImmutableJWKSet<>(new JWKSet(jwk));

        return new NimbusJwtEncoder(jwks);
    }

    @Bean
    public AuthenticationProvider authenticationProvider(UserDetailsService userDetailsService, PasswordEncoder passwordEncoder) {
        Assert.isTrue(userDetailsService instanceof MyUserDetailsServiceImpl, "userDetailsService should be of type MyUserDetailsServiceImpl");
        DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
        provider.setUserDetailsService(userDetailsService);
        provider.setPasswordEncoder(passwordEncoder);

        return provider;
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http, @Value("${jwt.route.authentication.path}") String authenticationPath) throws Exception {
        log.info("Authenticationpath is: [{}]", authenticationPath);
        return http.
                httpBasic(withDefaults())
                .oauth2ResourceServer(config -> config.jwt(customizer -> customizer.decoder(this.jwtDecoder())))
                .csrf(AbstractHttpConfigurer::disable) (1)
                .sessionManagement(management -> management.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                .authorizeHttpRequests(auth -> auth
                        .requestMatchers(authenticationPath).permitAll() (2)
                        .requestMatchers(HttpMethod.OPTIONS, "/**").permitAll() (3)
                        .requestMatchers("/images/**", "/js/**", "/webjars/**").permitAll() (4)
                        .requestMatchers(HttpMethod.GET, "/api/**").hasAnyAuthority("SCOPE_USER", "SCOPE_ADMIN") (5)
                        .requestMatchers( "/api/**").hasAuthority("SCOPE_ADMIN") (6)
                        .anyRequest().authenticated()) (7)
                .build();
    }
}

##Steps for creating the certs in src/main/resources/certs

## run this in src/main/resources/certs

#Create a keypair
openssl genrsa -out keypair.pem 2048

#Extract the public key
openssl rsa -in keypair.pem -pubout -out public.pem  

#Since the private key must be encoded in PKCS8 format
openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in keypair.pem -out private.pem

#Delete keypair.pem
delete keypair.pem

###Do not check those files in in git in production

rsa.private-key=classpath:certs/private.pem
rsa.public-key=classpath:certs/public.pem

  
1
2
3
4
5
6
7
8
9

  
package nl.acme.carapp.config;

import org.springframework.boot.context.properties.ConfigurationProperties;

import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.RSAPublicKey;

@ConfigurationProperties(prefix = "rsa")
public record RsaKeyProperties(RSAPublicKey publicKey, RSAPrivateKey privateKey) {}

  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

  
package nl.acme.carapp.service;

import lombok.RequiredArgsConstructor;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.oauth2.jwt.Jwt;
import org.springframework.security.oauth2.jwt.JwtClaimsSet;
import org.springframework.security.oauth2.jwt.JwtEncoder;
import org.springframework.security.oauth2.jwt.JwtEncoderParameters;
import org.springframework.stereotype.Service;

import java.time.Instant;
import java.time.temporal.ChronoUnit;
import java.util.Arrays;
import java.util.stream.Collectors;

@Service
@RequiredArgsConstructor
public class TokenService {

    private final JwtEncoder encoder;
    private @Value("${jwt.expiration}") int expires; // @Value => Not final or else injection fails


    public Jwt generateToken(Authentication authentication) {

        Instant now = Instant.now();
        String roles = authentication.getAuthorities().stream()
                .map(GrantedAuthority::getAuthority)
                .collect(Collectors.joining(" "));

        JwtClaimsSet claims = JwtClaimsSet.builder()
                .issuer("http://localhost:8080/issuer")
                .audience(Arrays.asList("cars"))
                .claim("scope", roles)
                .subject(authentication.getName())
                .issuedAt(now)
                .expiresAt(now.plus(this.expires, ChronoUnit.SECONDS))
                .build();

        JwtEncoderParameters params = JwtEncoderParameters.from(claims);
        final Jwt token = this.encoder.encode(params);

        return token;
    }
}

  
1

  
@EnableConfigurationProperties(RsaKeyProperties.class);

  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

  
package nl.acme.carapp;

import nl.acme.carapp.config.RsaKeyProperties;
import nl.acme.carapp.config.InitProperties;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.context.properties.EnableConfigurationProperties;

@SpringBootApplication
@EnableConfigurationProperties({InitProperties.class, RsaKeyProperties.class})
public class Application {
    public static void main(String[] args) {
                SpringApplication.run(Application.class, args);
    }
}

  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49

  
package nl.acme.carapp.api;

import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j;
import nl.acme.carapp.dto.SignInRequest;
import nl.acme.carapp.dto.SignUpRequest;
import nl.acme.carapp.model.User;
import nl.acme.carapp.service.AuthService;
import nl.acme.carapp.service.TokenService;
import org.springframework.http.ResponseEntity;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.oauth2.jwt.Jwt;
import org.springframework.web.bind.annotation.*;

@RestController
@CrossOrigin
@RequestMapping("api/auth")
@Slf4j
@RequiredArgsConstructor
public class AuthController {

    private final AuthService authService;
    private final TokenService tokenService;

    // Authenticate by posting a username and password in a JSON body
    @PostMapping("signin")
    public ResponseEntity<Jwt> token(@RequestBody SignInRequest signInRequest) {
        var authentication = authService.signin(new UsernamePasswordAuthenticationToken(signInRequest.username(), signInRequest.password()));

        return token(authentication);
    }

    @PostMapping("signup")
    public ResponseEntity<User> createUser(@RequestBody SignUpRequest signUpRequest) {
        return ResponseEntity.ok(this.authService.signUp(signUpRequest));
    }

    // Authenticate by using Basic Authentication
    @GetMapping("signin")
    public ResponseEntity<Jwt> token(Authentication authentication) {
        log.info("Token requested for user [{}]", authentication.getName());
        Jwt jwtAuthenticationToken = this.tokenService.generateToken(authentication);
        log.debug("Token granted: [{}]", jwtAuthenticationToken.getTokenValue());

        return ResponseEntity.ok(jwtAuthenticationToken);
    }

}

  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41

  
server:
  port: '8080'
spring:
  datasource:
    url: 'jdbc:mysql://localhost:3306/carapp?serverTimezone'
    driverClassName: com.mysql.cj.jdbc.Driver
    username: rloman
    password: rloman
  jpa:
    hibernate:
      ddl-auto: update
    show-sql: false
    properties:
      hibernate:
        format_sql: true
  docker:
    compose:
      lifecycle-management: start_only
'# for a week': '604800, for 2 minutes: 120, for 15 minutes: 900'
jwt:
  expiration: '900'
  route:
    authentication:
      path: /api/auth/**
      refresh: refresh
rsa:
  private-key: 'classpath:certs/private.pem'
  public-key: 'classpath:certs/public.pem'

realm:
  signUpRequests:
    - username: johndoe
      password: passwordjohn
      role: ADMIN
    - username: janedoe
      password: passwordjane
      role: USER
  cars:
    - bmw
    - mercedes
    - kia

  
1
2
3
4
5
6
7
8
9
10

  
spring:
  datasource:
    url: 'jdbc:mysql://localhost:3307/carapp?serverTimezone'
  jpa:
    hibernate:
      ddl-auto: create-drop
jwt:
  header: Authorization
  secret: mySecret
  expiration: '604800'

  
1
2
3
4
5
6
7
8
9
10
11
12
13
14

  
package nl.acme.carapp;

import org.junit.jupiter.api.Test;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.test.context.ActiveProfiles;

@SpringBootTest
@ActiveProfiles("integrationtest")
public class CarApplicationIT {

    @Test
    public void contextLoads() {
    }
}

  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77

  
package nl.acme.carapp.rsa;

import java.math.BigInteger;

public class Rsa {

    private BigInteger n;
    private BigInteger publicKey; // When encrypting, the public key. Also used for validating the signature
    private BigInteger privateKey; // When decrypting; the private key. Also used for creating the signature

    private Rsa(RsaBuilder builder) {
        this.n = builder.n;
        this.publicKey = builder.publicKey;
        this.privateKey = builder.privateKey;
    }

    // Use the public key to encrypt the message
    public BigInteger encrypt(BigInteger message) {
        return message.modPow(publicKey, n);
    }

    // Use the private key to descrypt the cypherText to the original
    public BigInteger decrypt(BigInteger cypherText) {
        return cypherText.modPow(this.privateKey, n);
    }

    // Use the PRIVATE(!) key to sign the digest
    public BigInteger createDigitalSignature(BigInteger digest) {
        return this.decrypt(digest);
    }

    public static class RsaBuilder {
        private BigInteger p;
        private BigInteger q;
        private BigInteger n;
        private BigInteger nAccent;

        private BigInteger publicKey;
        private BigInteger privateKey;

        public RsaBuilder() {
            this(java.math.BigInteger.valueOf(1270).nextProbablePrime(), java.math.BigInteger.valueOf(2110).nextProbablePrime());
        }

        public RsaBuilder(BigInteger p, BigInteger q) { // p and q should be primes here
            this.p = p;
            this.q = q;
        }

        public Rsa build() {
            createModulus();
            createModulusAccent();
            createPublicKey();
            createPrivateKey();

            return new Rsa(this);
        }

        public void createModulus() {
            this.n = p.multiply(q);
        }

        public void createModulusAccent() {
            // Subtracting One From The Two Primes And Multiply Them
            this.nAccent = p.subtract(java.math.BigInteger.valueOf(1)).multiply(q.subtract(java.math.BigInteger.valueOf(1)));
        }

        public void createPublicKey() {
            BigInteger startPointForGettingARandomPrime = this.nAccent.divide(java.math.BigInteger.valueOf(2));
            this.publicKey = startPointForGettingARandomPrime.nextProbablePrime();
        }

        public void createPrivateKey() {
            this.privateKey = publicKey.modInverse(this.nAccent);
        }
    }
}

  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

  
package nl.acme.carapp.rsa;

import java.math.BigInteger;

public final class Digest {

    public static BigInteger createDigest(String message) {
        var hashedValue = String.valueOf(message.hashCode());
        hashedValue = hashedValue.substring(hashedValue.length() - 6); // if you remove more the hashedValue is too long

        return BigInteger.valueOf(Integer.parseInt(hashedValue));
    }

    private Digest() {}
}

  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59

  
package nl.acme.carapp.rsa;

import lombok.extern.slf4j.Slf4j;
import org.junit.jupiter.api.Test;

import java.math.BigInteger;

import static org.junit.jupiter.api.Assertions.assertEquals;

@Slf4j
public class RsaTest {

    private Rsa rsa = new Rsa.RsaBuilder().build();

    @Test
    public void testEncryptionAndDecryption() {

        // Arrange
        BigInteger originalMessage = BigInteger.valueOf(10237);
        BigInteger cypherText = rsa.encrypt(originalMessage);
        log.info("Encrypting: [{}] to [{}]",originalMessage, cypherText);

        // Act
        BigInteger message = rsa.decrypt(cypherText);
        log.info("Decrypting: [{}] to [{}]",cypherText, originalMessage);

        // Assert
        assertEquals(originalMessage, message);
    }

    @Test
    public void testDigitalSignature() {
        // Arrange
        // At the sender
        String message = "Hello world!";
        // Create the / a hash
        BigInteger mDigest = Digest.createDigest(message);
        // Create the digital signature
        BigInteger signature = rsa.createDigitalSignature(mDigest); // NB: The other way around as encryption / decryption

        // At the receiver
        // accepts m, the original message. Accepts signature, the signed with private key message
        // first calculate the digest, so

        // Act
        String receivedMessage = new String(message);
        // create the hash
        BigInteger mDigestReceiver = Digest.createDigest(receivedMessage);
        BigInteger mDigestDecrypted = rsa.encrypt(signature); // NB: The other way around as encryption / decryption

        // Assert
        log.info("Message: [{}], Digest: [{}]", message, mDigest);
        log.info("Message: [{}], Digest: [{}]", receivedMessage, mDigestDecrypted);

        assertEquals(message, receivedMessage);
        assertEquals(mDigest, mDigestDecrypted);
        assertEquals(mDigestReceiver, mDigestDecrypted);
    }
}