BlogJava-Justin's Java Blog-文章分类-Project Management

最近安装了一个JIRA，顺便研究了一下它的注册机制，属于一个典型的DSA签名算法的实现。按照常理，很自然的想到自己生成一对publickey和privatekey替换掉原来软件带的publickey，就可以生成自己的注册码了。

但是搞定才发现网上有很多的注册机，想不到DSA算法的privatekey也有人能够分析出来？经过验证，事实就摆在面前了，的确从JIRA 2.6.1开始这对密匙就没变过，所以注册机就可以一直沿用到现在了，难道在早期的版本不小心将私匙给泄漏出来了？或者所谓的黑客真的破解了JIRA的密匙？

首先分析一下JIRA的内部机制，与注册相关的对象都放在com.atlassian.license包下面，其中publickey的文件名是bug.class，在com\atlassian\jira\issue下面，其中WEB-INF\classes和atlassian- extras-.7.10.jar中各有一个。利用下面代码就可以读出publickey的内容了：

InputStream keyfis = new FileInputStream(pubfilename);
byte encKey[] = new byte[keyfis.available()];
keyfis.read(encKey);
keyfis.close();
X509EncodedKeySpec pubKeySpec = new X509EncodedKeySpec(encKey);
KeyFactory keyFactory = KeyFactory.getInstance("DSA");
PublicKey pubkey = keyFactory.generatePublic(pubKeySpec);
DSAPublicKeySpec pubkeyspec = (DSAPublicKeySpec) keyFactory.getKeySpec(pubkey, DSAPublicKeySpec.class);
System.out.println("P=" + pubkeyspec.getP());
System.out.println("Q=" + pubkeyspec.getQ());
System.out.println("G=" + pubkeyspec.getG());
System.out.println("Y=" + pubkeyspec.getY());

运行结果如下：

P = 178011905478542266528237562450159990145232156369120674273274450314442865788737020770612695252123463079567156784778466449970650770920727857050009668388144034129745
221171818506047231150039301079959358067395348717066319802262019714966524135060945913707594956514672855690606794135837542707371727429551343320695239
Q = 864205495604807476120572616017955259175325408501
G = 174068207532402095185811980123523436538604490794561350978495831040599953488455823147851597408940950725307797094915759492368300574252438761037084473467180148876118
103083043754985190983472601550494691329488083395492313850000361646482644608492304078721818959999056496097769368017749273708962006689187956744210730
Y = 104878378611578608516131988304241730575226860461304117604293580069983220227094632807881557460560834347944389679413307090500106772833435437017122610074687673247552
012771759005247409187709312922876281831426019398155097541955193653855246734321859930303643524786168850036251099739995507172205951987756012523624501

如果有兴趣可以从这里入手去找寻privatekey的X，难度可想而知，但是在网上可以下载的注册机中就有X，不管你是否相信，真让人怀疑DSA的安全性，值如下：

X = 240907294874328356661328650403099424255880489796

这下就可以很方便的生成注册码了：
明文：licenseTypeCode ^ dateCreated ^ datePurchased ^ organisation
其中，licenseTypeCode = 267就是JIRA Enterprise: Commercial Server
dateCreated = datePurchased =new Date() 就可以了
organisation随便

代码如下：

import com.atlassian.license.LicensePair;

import java.math.BigInteger;
import java.security.KeyFactory;
import java.security.Signature;
import java.security.interfaces.DSAPrivateKey;
import java.security.spec.DSAPrivateKeySpec;
import java.util.Date;

public class JIRAKeyGen
{
    public static void main(String[] args)
    {
        Date dt = new Date();
        long d = dt.getTime();
        BigInteger x = new BigInteger("240907294874328356661328650403099424255880489796");
        BigInteger p = new BigInteger("178011905478542266528237562450159990145232156369120674273274450314442865788737020770612695252123463079567156784778466449970650770920727
8570500096683881440341297452211718185060472311500393010799593580673953487170663198022620197149665241350609459137075949565146728556906067941358375427073717274295513433
20695239");
        BigInteger q = new BigInteger("864205495604807476120572616017955259175325408501");
        BigInteger g = new BigInteger("174068207532402095185811980123523436538604490794561350978495831040599953488455823147851597408940950725307797094915759492368300574252438
761037084473467180148876118103083043754985190983472601550494691329488083395492313850000361646482644608492304078721818959999056496097769368017749273708962006689187956
744210730");
        try
        {
            DSAPrivateKeySpec keyspec = new DSAPrivateKeySpec(x, p, q, g);
            KeyFactory keyFactory = KeyFactory.getInstance("DSA");
            DSAPrivateKey prikey = (DSAPrivateKey) keyFactory.generatePrivate(keyspec);
            String messageString = "267^" + d + "^" + d + "^blogjava";
            // 生成签名hash
            Signature signature = Signature.getInstance("SHA1withDSA");
            signature.initSign(prikey);
            signature.update(messageString.getBytes());
            byte[] lichash = signature.sign();
            // 编码
            LicensePair pair = new LicensePair(messageString.getBytes(), lichash);
            System.out.println(pair.toString());
        }
        catch (Exception ex)
        {
            ex.printStackTrace();
        }
    }
}

当然还有另外一种方法，自己生成DSA算法的key，然后覆盖原来的bug.class,利用与上面相同的办法就可以生成license了。

示例代码如下：

public void genDSAKey()
{
    try
    {
        // 生成DSA key
        KeyPairGenerator gen = KeyPairGenerator.getInstance("DSA");
        KeyPair kp = gen.genKeyPair();
        DSAPublicKey pubkey = (DSAPublicKey) kp.getPublic();
        DSAPrivateKey prikey = (DSAPrivateKey) kp.getPrivate();
        saveEncodedData(pubkey.getEncoded(), "bug.class");
        saveEncodedData(prikey.getEncoded(), "privatekey.key");
        // 签名计算，下次需要直接从文件中读取privatekey.key,初始化prikey
        Signature signature = Signature.getInstance("SHA1withDSA");
        signature.initSign(prikey);
        Date dt=new Date();
        long d = dt.getTime();
        String messageString = "267^" + d + "^" + d + "^blogjava";
        System.out.println(dt.getTime());
        signature.initSign(prikey);
        signature.update(messageString.getBytes());
        byte[] lichash=signature.sign();
        LicensePair pair=new LicensePair(messageString.getBytes(),lichash);
        System.out.println(pair.toString());
    }
    catch (Exception ex)
    {
        ex.printStackTrace();
    }
}

public boolean saveEncodedData(byte[] data, String filename)
{
    boolean res = true;
    try
    {
        FileOutputStream fs = new FileOutputStream(filename);
        fs.write(data);
        fs.close();
    }
    catch (Exception ex)
    {
        res = false;
        ex.printStackTrace();
    }
    return res;
}

注意上面的代码需要调用atlassian-extras-0.7.10,在WEB-INF\lib目录下面可以找到。

转自：http://www.blogjava.net/midea0978/articles/16563.html

Justin 2009-09-09 11:45 发表评论

]]>